An app can ask the passkey for a secret of its own, derived from the
same credential but separate from the signing key: pass
`appSecret: { label }` and read it with `withAppSecret(callback)`.

- Every PRF ceremony (connect, unlock) also evaluates `eval.second`
  with `@txnlab/use-wallet-passkey:app-secret:v1:<label>` while the
  option is set. The label is 1-128 characters, no `:`.
- The secret is held only while the session is unlocked and zeroed on
  lock, release, a failed connect and a key mismatch. `withAppSecret`
  hands the callback a copy it zeroes afterwards; while locked it runs
  a PRF ceremony (confirmed per `confirm`).
- A provider that returns no second output gives `PasskeyError` code
  `app-secret-unavailable`.
- `PasskeySigningRequest` gains `{ type: 'app-secret' }`.
- `APP_SECRET_PREFIX`, `appSecretInput` and `PasskeyAppSecretOptions`
  are exported; the prefix is frozen.

hay.app uses it to derive a separate ZeroSignal payer account from a
passkey Haystack Login, as it already does from a legacy login's key.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

## [2026.44.0](https://github.com/michaeltchuang/a-day-in-my-bobalife/compare/v2026.43.0...v2026.44.0) (2026-11-09)

### Updates & Maintenance

* bump com.pierfrancescosoffritti.androidyoutubeplayer:core from 13.0.0 to 13.1.0 in /DisneyScenicRides ([#384](https://github.com/michaeltchuang/a-day-in-my-bobalife/issues/384)) ([1708a12](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/1708a12e33dc1385a4a45d59d445e730dd03ab41))
* bump gradle-wrapper from 9.8.2 to 9.9.0 in /DisneyScenicRides ([#385](https://github.com/michaeltchuang/a-day-in-my-bobalife/issues/385)) ([7d5ed76](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/7d5ed76234287c867182480247214cfba76a50f1))
* bump gradle-wrapper from 9.8.2 to 9.9.0 in /HaveAMagicalDay ([#386](https://github.com/michaeltchuang/a-day-in-my-bobalife/issues/386)) ([c8f1745](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/c8f174588d7f5ebd712de82061ab56dbe728bc74))
* log greeting (2026-11-03) ([b0d53c9](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/b0d53c9cc723b9ab30b0ec134b1f676d7d82b680))
* log greeting (2026-11-04) ([0be0270](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/0be0270fbd37c59137c6a1e6b52cfcf1a12eada9))
* log greeting (2026-11-05) ([9ea187e](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/9ea187eb008eb0af36e92b9f88a2f9de080c0e52))
* log greeting (2026-11-06) ([7b10adf](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/7b10adfbb30b08466b10cc6c82b5710eb520cb1f))
* log greeting (2026-11-07) ([21a36a1](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/21a36a10585e9c6870e27f5ba41481e5aa477ad4))
* log greeting (2026-11-08) ([ee948e3](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/ee948e315899ee01c34d53219a003c21c6119f62))
* log greeting (2026-11-09) ([08d0ff2](https://github.com/michaeltchuang/a-day-in-my-bobalife/commit/08d0ff2a8f7c7a539b8ea4cf469761b9c1e717f4))

README:
- Default network is testnet; add a table of the integrations that are
  tied to specific networks (NFD, Pera, Tinyman, Haystack, Alpha, x402,
  Bazaar).
- List all 8 environment variables the server reads.
- Drop the wallet resources, AP2 and Zod-validation claims; describe the
  13 knowledge resources, document keys and the '~' file names.
- Describe the wallet migration, archiving and persistence as the code
  does them, and x402 in V2 terms (PAYMENT-REQUIRED, PAYMENT-SIGNATURE,
  PAYMENT-RESPONSE, amount), with V1 names as fallbacks.
- Pagination applies only to api_* and alpha_* tools.
- Fix the Claude Code, Codex CLI and OpenCode setup instructions.
- Update the project tree, test tables and counts, E2E notes (the
  wallet suite writes to ~/.algorand-mcp/wallet.db; run with a scratch
  HOME), and the dependency list: correct repository links, pinned
  Alpha SDK, base64-js, the vendored Tinyman SDK, and removed packages.

api_indexer_search_for_assets: the indexer dispatch overwrote the
caller's `name` argument with the tool name, so every search, by name,
unit or creator, also filtered for an asset named after the tool and
returned nothing. The caller's value now reaches the indexer, with a
unit test that fails on the old code.

The knowledge E2E test requested the key "ARCs", which is not a
document, and passed either way. It now reads arcs:specs:arc-0090.md
and checks that an unknown key is rejected.

- Ship the compiled @tinymanorg/tinyman-js-sdk 5.1.5 (MIT, unmodified,
  with its license) in vendor/ instead of depending on the npm package,
  whose deprecated uuid@10 dependency made Socket block installs. The
  bundle already contains the uuid v4 code it uses and loads only
  algosdk, base64-js and crypto, so base64-js becomes a direct
  dependency. uuid and multiformats are no longer installed.
- Pin @alpha-arcade/sdk to 0.5.2 (was "latest").
- Raise zod to ^4.6.7 for CVE-2023-54404 (GHSA-mrhx-c7xc-m3w5).
  src/types.ts uses the two-argument z.record() that zod 4 requires.
- Remove dependencies that nothing imports: @cf-wasm/photon,
  @juit/qrcode, algo-msgpack-with-bigint, hi-base32, just-pick, qrcode
  and @types/qrcode, together with the commented-out local QR code.
- Rename the 804 knowledge files from ':' to '~' as the separator,
  because ':' is invalid in Windows file names. Document keys do not
  change; get_knowledge_doc maps keys to files.
- Remove three index entries that returned no content:
  algo-models:README.md has no file, and two keys pointed to empty
  files. Tests now check that every listed key opens with content and
  that every file name is valid on Windows.
- generate_algorand_qrcode: emit the canonical address form, accept
  amount and asset as decimal strings up to the uint64 maximum, and
  omit the expiry line when QRClaw reports none. Add ARC-82 to the
  knowledge base.
- package.json: add repository, homepage and bugs fields, ship vendor/,
  version 4.4.4.