From 8f547447e88bf118fd7ba37b8f84d1e8b42544b9 Mon Sep 17 00:00:00 2001
From: "Michael B. Jones" <michael_b_jones@hotmail.com>
Date: Sat, 27 Apr 2024 23:54:28 +0000
Subject: [PATCH] Merge pull request #2039 from selfissued/mbj-dependencies

SHA: bc18dcdd5f926ce85e7850b0a8a5b9d829017ea7
Reason: push, by selfissued

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 91 ++++++++++++++++++++++++++----------------------------
 1 file changed, 44 insertions(+), 47 deletions(-)

diff --git a/index.html b/index.html
index 6f71f1b6b..1d1ec4ebd 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version d765c696b, updated Fri Mar 8 15:58:52 2024 -0800" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="3ad0eda0ebc4f54b522518f71461449657c4c43b" name="revision">
+  <meta content="bc18dcdd5f926ce85e7850b0a8a5b9d829017ea7" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -965,7 +965,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-04-03">3 April 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-04-27">27 April 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -1957,9 +1957,6 @@ <h2 class="heading settled" data-level="3" id="sctn-dependencies"><span class="s
     <dt data-md>ECMAScript
     <dd data-md>
      <p><a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor">%ArrayBuffer%</a> is defined in <a data-link-type="biblio" href="#biblio-ecmascript" title="ECMAScript Language Specification">[ECMAScript]</a>.</p>
-    <dt data-md>HTML
-    <dd data-md>
-     <p>The concepts of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin②">origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple" id="ref-for-concept-origin-tuple">tuple origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site">same site</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to">is a registrable domain suffix of or is equal to</a> are defined in <a data-link-type="biblio" href="#biblio-html" title="HTML Standard">[HTML]</a>.</p>
     <dt data-md>URL
     <dd data-md>
      <p>The concepts of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host">host</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port">port</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme">scheme</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain">valid domain</a> and <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string">valid domain string</a> are defined in <a data-link-type="biblio" href="#biblio-url" title="URL Standard">[URL]</a>.</p>
@@ -1973,8 +1970,9 @@ <h2 class="heading settled" data-level="3" id="sctn-dependencies"><span class="s
      <p>The algorithms for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application" id="ref-for-determining-the-facetid-of-a-calling-application">determining the FacetID of a calling application</a> and <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid">determining if a caller’s FacetID is authorized for an AppID</a> (used only in
 the <a data-link-type="dfn" href="#appid" id="ref-for-appid">AppID extension</a>) are defined by <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>.</p>
    </dl>
-   <p>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and
-"OPTIONAL" in this document are to be interpreted as described in <a data-link-type="biblio" href="#biblio-rfc2119" title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</a>.</p>
+   <p>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",
+"NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in
+BCP 14 <a data-link-type="biblio" href="#biblio-rfc2119" title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</a> <a data-link-type="biblio" href="#biblio-rfc8174" title="Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words">[RFC8174]</a> when, and only when, they appear in all capitals, as shown here.</p>
    <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="secno">4. </span><span class="content">Terminology</span><a class="self-link" href="#sctn-terminology"></a></h2>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation">Attestation</dfn>
@@ -2330,13 +2328,13 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
      <p>In the context of the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑧">WebAuthn API</a>, a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier①">relying party identifier</a> is a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string①">valid domain string</a> identifying the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑧">WebAuthn Relying Party</a> on whose behalf a given <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑤">registration</a> or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑧">authentication ceremony</a> is being performed. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑥">public key credential</a> can only be used for <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑨">authentication</a> with the same entity (as identified by <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③">RP ID</a>) it was registered with.</p>
      <p>By default, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④">RP ID</a> for a
 WebAuthn operation is set to the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain">effective domain</a>. This default MAY be
-overridden by the caller, as long as the caller-specified <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤">RP ID</a> value <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to①">is a registrable domain suffix of or is equal
+overridden by the caller, as long as the caller-specified <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤">RP ID</a> value <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to">is a registrable domain suffix of or is equal
 to</a> the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①">effective domain</a>. See also <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> and <a href="#sctn-getAssertion">§ 5.1.4 Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>.</p>
      <div class="note" id="note-pkcredscope" role="note">
-      <a class="self-link" href="#note-pkcredscope"></a> Note: An <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥">RP ID</a> is based on a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host" id="ref-for-concept-origin-host">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain①">domain</a> name. It does not itself include a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme" id="ref-for-concept-origin-scheme">scheme</a> or <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port①">port</a>, as an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin③">origin</a> does. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑦">RP ID</a> of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑦">public key credential</a> determines its <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="scope">scope</dfn>. I.e., it <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</dfn>, as follows: 
+      <a class="self-link" href="#note-pkcredscope"></a> Note: An <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥">RP ID</a> is based on a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host" id="ref-for-concept-origin-host">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain①">domain</a> name. It does not itself include a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme" id="ref-for-concept-origin-scheme">scheme</a> or <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port①">port</a>, as an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin②">origin</a> does. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑦">RP ID</a> of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑦">public key credential</a> determines its <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="scope">scope</dfn>. I.e., it <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</dfn>, as follows: 
       <ul>
        <li data-md>
-        <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑧">RP ID</a> must be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to②">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain③">effective domain</a>.</p>
+        <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑧">RP ID</a> must be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to①">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain③">effective domain</a>.</p>
        <li data-md>
         <p>One of the following must be true:</p>
         <ul>
@@ -2456,16 +2454,16 @@ <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5.
 deletion are considered to be the responsibility of such a user interface and are deliberately omitted from the API exposed to
 scripts.</p>
    <p>The security properties of this API are provided by the client and the authenticator working together. The authenticator, which
-holds and <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①⓪">manages</a> credentials, ensures that all operations are <a data-link-type="dfn" href="#scope" id="ref-for-scope⑦">scoped</a> to a particular <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin④">origin</a>, and cannot be replayed against
-a different <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑤">origin</a>, by incorporating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑥">origin</a> in its responses. Specifically, as defined in <a href="#sctn-authenticator-ops">§ 6.3 Authenticator Operations</a>,
-the full <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑦">origin</a> of the requester is included, and signed over, in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object③">attestation object</a> produced when a new credential
+holds and <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①⓪">manages</a> credentials, ensures that all operations are <a data-link-type="dfn" href="#scope" id="ref-for-scope⑦">scoped</a> to a particular <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin③">origin</a>, and cannot be replayed against
+a different <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin④">origin</a>, by incorporating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑤">origin</a> in its responses. Specifically, as defined in <a href="#sctn-authenticator-ops">§ 6.3 Authenticator Operations</a>,
+the full <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑥">origin</a> of the requester is included, and signed over, in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object③">attestation object</a> produced when a new credential
 is created as well as in all assertions produced by WebAuthn credentials.</p>
    <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
 credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
 Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥②">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a> can only be used in operations
-requested by the same <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①④">RP ID</a>. Separating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origin</a> from the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑤">RP ID</a> in this way allows the API to be used in cases
-where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origins</a>.</p>
-   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a> for
+requested by the same <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①④">RP ID</a>. Separating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑦">origin</a> from the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑤">RP ID</a> in this way allows the API to be used in cases
+where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origins</a>.</p>
+   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a> for
 each operation. Since this is an integral part of the WebAuthn security model, user agents only expose this API to callers in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context">secure contexts</a>.
 For web contexts in particular,
 this only includes those accessed via a secure transport (e.g., TLS) established without errors.</p>
@@ -2630,7 +2628,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin"><code>origin</code></dfn>
      <dd data-md>
-      <p>This argument is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object①">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin②">origin</a>, as determined by the
+      <p>This argument is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin②">origin</a>, as determined by the
 calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑨">create()</a></code> implementation.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-create-origin-options-sameoriginwithancestors-options"><code>options</code></dfn>
      <dd data-md>
@@ -2661,7 +2659,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
        <li data-md>
         <p><a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation" id="ref-for-consume-user-activation">Consume user activation</a> of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global" id="ref-for-concept-relevant-global①">relevant global object</a>.</p>
       </ol>
-      <p class="note" role="note"><span class="marker">NOTE:</span> The <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a> SHOULD make it clear to the user in the case where the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> that is creating a credential is different from the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin">top-level origin</a> of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global" id="ref-for-concept-relevant-global②">relevant global object</a> (i.e., is a
+      <p class="note" role="note"><span class="marker">NOTE:</span> The <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a> SHOULD make it clear to the user in the case where the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> that is creating a credential is different from the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin">top-level origin</a> of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global" id="ref-for-concept-relevant-global②">relevant global object</a> (i.e., is a
       different origin than the user can see in the address bar).</p>
      <li data-md>
       <p>Let <var>pkOptions</var> be the value of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey③">publicKey</a></code></code>.</p>
@@ -2674,7 +2672,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
      <li data-md>
       <p>If the length of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user①">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①">id</a></code></code> is not between 1 and 64 bytes (inclusive) then throw a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror">TypeError</a></code>.</p>
      <li data-md>
-      <p>Let <var>callerOrigin</var> be <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin" id="ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin">origin</a></code>. If <var>callerOrigin</var> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②">DOMException</a></code>.</p>
+      <p>Let <var>callerOrigin</var> be <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin" id="ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin">origin</a></code>. If <var>callerOrigin</var> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain④">effective domain</a>.
 If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑤">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain①">valid domain</a>, then throw a
@@ -2690,7 +2688,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
       <dl class="switch">
        <dt data-md>is present
        <dd data-md>
-        <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp②">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id②">id</a></code></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to③">is not a
+        <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp②">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id②">id</a></code></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to②">is not a
 registrable domain suffix of and is not equal to</a> <var>effectiveDomain</var>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException④">DOMException</a></code>.</p>
        <dt data-md>Is not present
        <dd data-md>
@@ -3065,7 +3063,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"><code>origin</code></dfn>
      <dd data-md>
-      <p>This argument is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object②">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin④">origin</a>, as determined by the
+      <p>This argument is the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object①">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin④">origin</a>, as determined by the
 calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑥">get()</a></code> implementation, i.e., <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer①">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential">Request a <code>Credential</code></a> abstract operation.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options"><code>options</code></dfn>
      <dd data-md>
@@ -3113,7 +3111,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
       </ol>
      <li data-md>
       <p>Let <var>callerOrigin</var> be <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin">origin</a></code>. If <var>callerOrigin</var> is
-an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque②">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror④">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑨">DOMException</a></code>.</p>
+an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror④">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑨">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑧">effective domain</a>.
 If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain②">valid domain</a>, then throw a
@@ -3128,7 +3126,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
       <p>Otherwise:</p>
       <ol>
        <li data-md>
-        <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid①">rpId</a></code></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to④">is not a registrable domain suffix of and is not
+        <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid①">rpId</a></code></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to③">is not a registrable domain suffix of and is not
 equal to</a> <var>effectiveDomain</var>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror③">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①①">DOMException</a></code>.</p>
        <li data-md>
         <p>Set <var>rpId</var> to <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid②">rpId</a></code></code>.</p>
@@ -3512,7 +3510,7 @@ <h4 class="heading settled" data-level="5.1.6" id="sctn-isUserVerifyingPlatformA
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑤"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isUserVerifyingPlatformAuthenticatorAvailable()" id="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></dfn>();
 };
 </pre>
-    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①①">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①①">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
    <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><span class="secno">5.1.7. </span><span class="content">Availability of <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> capabilities - PublicKeyCredential’s <code>getClientCapabilities()</code> Method</span><a class="self-link" href="#sctn-getClientCapabilities"></a></h4>
    <div data-link-for-hint="WebAuthentication/getClientCapabilities">
@@ -3533,7 +3531,7 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><
 When a capability does not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">exist</a> as a key, the availability of the client feature is not known.</p>
     <p>The set of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys②">keys</a> SHOULD also contain a key for each <a href="#sctn-extensions">extension</a> implemented by the client, where the key is formed by prefixing the string <code>extension:</code> to the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifier</a>. The associated value for each implemented extension SHOULD be <code>true</code>. If <code>getClientCapabilities()</code> is supported by a client, but an extension is not mapped to the value <code>true</code>, then a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a> MAY assume that client processing steps for that extension will not be carried out by this client and that the extension MAY not be forwarded to the authenticator.</p>
     <p class="note" role="note"><span class="marker">Note:</span> Even if an extension is mapped to <code>true</code>, the authenticator used for any given operation may not support that extension, so <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Parties</a> MUST NOT assume that the authenticator processing steps for that extension will be performed on that basis.</p>
-    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context②">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
    <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8. </span><span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span><a class="self-link" href="#sctn-parseCreationOptionsFromJSON"></a></h4>
    <div data-link-for-hint="WebAuthentication/parseCreationOptionsFromJSON">
@@ -3761,7 +3759,7 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
 details.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑦">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a> the credential
-should be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⓪">scoped</a> to. If omitted, its value will be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object③">relevant
+should be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⓪">scoped</a> to. If omitted, its value will be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object②">relevant
 settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①②">effective domain</a>. See <a href="#dictionary-rp-credential-params">§ 5.4.2 Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> for further details.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-user"><code>user</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity①">PublicKeyCredentialUserEntity</a></span>
      <dd data-md>
@@ -4087,11 +4085,11 @@ <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①">USVString</a></span>
     <dd data-md>
      <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
 The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> MUST verify
 that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a>.</p>
      <p>If not specified, its value will
-be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object④">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a>.</p>
+be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object③">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-allowcredentials"><code>allowCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑧">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
      <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a>.
@@ -4213,7 +4211,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
       <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑨">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origin</a> of the requester, as provided to the authenticator by the client, in
+      <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> of the requester, as provided to the authenticator by the client, in
 the syntax defined by <a data-link-type="biblio" href="#biblio-rfc6454" title="The Web Origin Concept">[RFC6454]</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-toporigin"><code>topOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⓪">DOMString</a></span>
      <dd data-md>
@@ -5750,7 +5748,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑥">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
-    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a>.
+    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code></code> is present:</p>
@@ -5759,7 +5757,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
        <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> expects that this credential would have been created within an iframe that is
 not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
       <li data-md>
-       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
+       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> of a page
 that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
@@ -5925,7 +5923,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑦">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
-    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a>.
+    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
@@ -5933,7 +5931,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
       <li data-md>
        <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
       <li data-md>
-       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
+       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> of a page
 that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
@@ -6865,7 +6863,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
     <dd data-md>
      <ol>
       <li data-md>
-       <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑧">origin</a> to the
+       <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> to the
 FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application" id="ref-for-determining-the-facetid-of-a-calling-application①">determining the FacetID of a calling application</a>.</p>
       <li data-md>
        <p>Let <var>appId</var> be the extension input.</p>
@@ -6887,7 +6885,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> In practice, several implementations do not implement steps four and onward of the
 algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid②">determining if a caller’s FacetID is authorized for an AppID</a>.
-Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site①">same site</a>.</p>
+Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site">same site</a>.</p>
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
@@ -6931,7 +6929,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
        <p>Just after <a href="#CreateCred-DetermineRpId">establishing the RP ID</a> perform these steps:</p>
        <ol>
         <li data-md>
-         <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑨">origin</a> to the FIDO algorithm
+         <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑧">origin</a> to the FIDO algorithm
 for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application" id="ref-for-determining-the-facetid-of-a-calling-application②">determining the FacetID of a calling application</a>.</p>
         <li data-md>
          <p>Let <var>appId</var> be the value of the extension input <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appidexclude" id="ref-for-dom-authenticationextensionsclientinputs-appidexclude">appidExclude</a></code>.</p>
@@ -6939,7 +6937,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
          <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">determining if a caller’s
 FacetID is authorized for an AppID</a>. If the latter algorithm rejects <var>appId</var> then
 return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site②">same site</a>.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site①">same site</a>.</p>
         <li data-md>
          <p>Otherwise, continue with normal processing.</p>
        </ol>
@@ -9913,7 +9911,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="fc736137">textarea</span>
      <li><span class="dfn-paneled" id="c63519ed">top-level origin</span>
      <li><span class="dfn-paneled" id="47fe679e">transient activation</span>
-     <li><span class="dfn-paneled" id="57b5eb7f">tuple origin</span>
     </ul>
    <li>
     <a data-link-type="biblio">[I18N-GLOSSARY]</a> defines the following terms:
@@ -10157,6 +10154,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd>M. Jones; J. Bradley; N. Sakimura. <a href="https://www.rfc-editor.org/rfc/rfc7515"><cite>JSON Web Signature (JWS)</cite></a>. May 2015. Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc7515">https://www.rfc-editor.org/rfc/rfc7515</a>
    <dt id="biblio-rfc8152">[RFC8152]
    <dd>J. Schaad. <a href="https://www.rfc-editor.org/rfc/rfc8152"><cite>CBOR Object Signing and Encryption (COSE)</cite></a>. July 2017. Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc8152">https://www.rfc-editor.org/rfc/rfc8152</a>
+   <dt id="biblio-rfc8174">[RFC8174]
+   <dd>B. Leiba. <a href="https://www.rfc-editor.org/rfc/rfc8174"><cite>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</cite></a>. May 2017. Best Current Practice. URL: <a href="https://www.rfc-editor.org/rfc/rfc8174">https://www.rfc-editor.org/rfc/rfc8174</a>
    <dt id="biblio-rfc8230">[RFC8230]
    <dd>M. Jones. <a href="https://www.rfc-editor.org/rfc/rfc8230"><cite>Using RSA Algorithms with CBOR Object Signing and Encryption (COSE) Messages</cite></a>. September 2017. Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc8230">https://www.rfc-editor.org/rfc/rfc8230</a>
    <dt id="biblio-rfc8264">[RFC8264]
@@ -11135,14 +11134,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "45209803": {"dfnID":"45209803","dfnText":"for each (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-iterate"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-iterate\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-iterate\u2461"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-map-iterate\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-map-iterate\u2463"},{"id":"ref-for-map-iterate\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-map-iterate\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-map-iterate\u2466"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://infra.spec.whatwg.org/#map-iterate"},
 "47fe679e": {"dfnID":"47fe679e","dfnText":"transient activation","external":true,"refSections":[{"refs":[{"id":"ref-for-transient-activation"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
 "48c6127a": {"dfnID":"48c6127a","dfnText":"ConstraintError","external":true,"refSections":[{"refs":[{"id":"ref-for-constrainterror"},{"id":"ref-for-constrainterror\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"https://webidl.spec.whatwg.org/#constrainterror"},
-"4a044e45": {"dfnID":"4a044e45","dfnText":"is not a registrable domain suffix of and is not equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
+"4a044e45": {"dfnID":"4a044e45","dfnText":"is not a registrable domain suffix of and is not equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
 "4be6272b": {"dfnID":"4be6272b","dfnText":"success","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-success"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-success\u2460"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-success\u2461"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-success\u2462"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-success\u2463"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-success\u2464"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-success\u2465"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-success\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-success"},
 "53275e46": {"dfnID":"53275e46","dfnText":"append (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-append"},{"id":"ref-for-list-append\u2460"},{"id":"ref-for-list-append\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-append\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#list-append"},
 "535dd335": {"dfnID":"535dd335","dfnText":"aborted","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal-aborted"},{"id":"ref-for-abortsignal-aborted\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortsignal-aborted\u2461"},{"id":"ref-for-abortsignal-aborted\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortsignal-aborted\u2463"},{"id":"ref-for-abortsignal-aborted\u2464"},{"id":"ref-for-abortsignal-aborted\u2465"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortsignal-aborted"},
 "5372cca8": {"dfnID":"5372cca8","dfnText":"boolean","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-boolean"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-boolean\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-boolean\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-boolean\u2462"},{"id":"ref-for-idl-boolean\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-boolean\u2464"},{"id":"ref-for-idl-boolean\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-boolean\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-boolean\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-boolean\u2468"},{"id":"ref-for-idl-boolean\u2460\u24ea"},{"id":"ref-for-idl-boolean\u2460\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-boolean\u2460\u2461"},{"id":"ref-for-idl-boolean\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-boolean\u2460\u2463"},{"id":"ref-for-idl-boolean\u2460\u2464"},{"id":"ref-for-idl-boolean\u2460\u2465"},{"id":"ref-for-idl-boolean\u2460\u2466"},{"id":"ref-for-idl-boolean\u2460\u2467"},{"id":"ref-for-idl-boolean\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-idl-boolean\u2461\u24ea"}],"title":"10.2.1. User Verification Method Extension (uvm)"}],"url":"https://webidl.spec.whatwg.org/#idl-boolean"},
 "546b09a7": {"dfnID":"546b09a7","dfnText":"mediation","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation\u2461"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2462"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2463"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2464"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation"},
 "57435598": {"dfnID":"57435598","dfnText":"allow","external":true,"refSections":[{"refs":[{"id":"ref-for-attr-iframe-allow"},{"id":"ref-for-attr-iframe-allow\u2460"}],"title":"5.10. Using Web Authentication within iframe elements"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow"},
-"57b5eb7f": {"dfnID":"57b5eb7f","dfnText":"tuple origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-tuple"}],"title":"3. Dependencies"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple"},
 "588dbb2c": {"dfnID":"588dbb2c","dfnText":"Create a Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-create-a-credential"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential"},
 "59825b02": {"dfnID":"59825b02","dfnText":"CredentialsContainer","external":true,"refSections":[{"refs":[{"id":"ref-for-credentialscontainer"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credentialscontainer\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-credentialscontainer\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-credentialscontainer\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credentialscontainer\u2463"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#credentialscontainer"},
 "5a63c8f7": {"dfnID":"5a63c8f7","dfnText":"ctap2 canonical cbor encoding form","external":true,"refSections":[{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form"},{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2460"}],"title":"2.4. All Conformance Classes"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2461"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2463"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2464"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form"},
@@ -11199,7 +11197,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "99c988d6": {"dfnID":"99c988d6","dfnText":"remove","external":true,"refSections":[{"refs":[{"id":"ref-for-list-remove"},{"id":"ref-for-list-remove\u2460"},{"id":"ref-for-list-remove\u2461"},{"id":"ref-for-list-remove\u2462"},{"id":"ref-for-list-remove\u2463"},{"id":"ref-for-list-remove\u2464"},{"id":"ref-for-list-remove\u2465"},{"id":"ref-for-list-remove\u2466"},{"id":"ref-for-list-remove\u2467"},{"id":"ref-for-list-remove\u2468"},{"id":"ref-for-list-remove\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-remove\u2460\u2460"},{"id":"ref-for-list-remove\u2460\u2461"},{"id":"ref-for-list-remove\u2460\u2462"},{"id":"ref-for-list-remove\u2460\u2463"},{"id":"ref-for-list-remove\u2460\u2464"},{"id":"ref-for-list-remove\u2460\u2465"},{"id":"ref-for-list-remove\u2460\u2466"},{"id":"ref-for-list-remove\u2460\u2467"},{"id":"ref-for-list-remove\u2460\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-remove\u2461\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://infra.spec.whatwg.org/#list-remove"},
 "9aeb0a82": {"dfnID":"9aeb0a82","dfnText":"long long","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-long-long"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://webidl.spec.whatwg.org/#idl-long-long"},
 "9befea0b": {"dfnID":"9befea0b","dfnText":"EncodingError","external":true,"refSections":[{"refs":[{"id":"ref-for-encodingerror"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-encodingerror\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#encodingerror"},
-"9c4c1e66": {"dfnID":"9c4c1e66","dfnText":"relevant settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-relevant-settings-object"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-relevant-settings-object\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relevant-settings-object\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object"},
+"9c4c1e66": {"dfnID":"9c4c1e66","dfnText":"relevant settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-relevant-settings-object"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relevant-settings-object\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object"},
 "9c6c84a4": {"dfnID":"9c6c84a4","dfnText":"application parameter","external":true,"refSections":[{"refs":[{"id":"ref-for-authentication-request-message---u2f_authenticate"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate"},
 "9cce47fd": {"dfnID":"9cce47fd","dfnText":"sequence","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-sequence"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-sequence\u2460"},{"id":"ref-for-idl-sequence\u2461"},{"id":"ref-for-idl-sequence\u2462"},{"id":"ref-for-idl-sequence\u2463"},{"id":"ref-for-idl-sequence\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-sequence\u2465"},{"id":"ref-for-idl-sequence\u2466"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-sequence\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-sequence\u2468"},{"id":"ref-for-idl-sequence\u2460\u24ea"},{"id":"ref-for-idl-sequence\u2460\u2460"},{"id":"ref-for-idl-sequence\u2460\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2462"},{"id":"ref-for-idl-sequence\u2460\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2465"},{"id":"ref-for-idl-sequence\u2460\u2466"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2467"},{"id":"ref-for-idl-sequence\u2460\u2468"},{"id":"ref-for-idl-sequence\u2461\u24ea"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://webidl.spec.whatwg.org/#idl-sequence"},
 "9cec8893": {"dfnID":"9cec8893","dfnText":"[[Create]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-create-slot"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot"},
@@ -11214,9 +11212,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "a41102eb": {"dfnID":"a41102eb","dfnText":"permissions policy","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document-permissions-policy"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2463"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy"},
 "a5c91173": {"dfnID":"a5c91173","dfnText":"SameObject","external":true,"refSections":[{"refs":[{"id":"ref-for-SameObject"},{"id":"ref-for-SameObject\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-SameObject\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-SameObject\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-SameObject\u2463"},{"id":"ref-for-SameObject\u2464"},{"id":"ref-for-SameObject\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#SameObject"},
 "a72449dd": {"dfnID":"a72449dd","dfnText":"in parallel","external":true,"refSections":[{"refs":[{"id":"ref-for-in-parallel"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
-"a76569bf": {"dfnID":"a76569bf","dfnText":"is a registrable domain suffix of or is equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
+"a76569bf": {"dfnID":"a76569bf","dfnText":"is a registrable domain suffix of or is equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
 "a869e769": {"dfnID":"a869e769","dfnText":"unsupported operation","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-unsupported-operation"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://w3c.github.io/webdriver/#dfn-unsupported-operation"},
-"a944ac4c": {"dfnID":"a944ac4c","dfnText":"origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-concept-origin\u2460"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-concept-origin\u2461"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-origin\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin\u2463"},{"id":"ref-for-concept-origin\u2464"},{"id":"ref-for-concept-origin\u2465"},{"id":"ref-for-concept-origin\u2466"},{"id":"ref-for-concept-origin\u2467"},{"id":"ref-for-concept-origin\u2468"},{"id":"ref-for-concept-origin\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2463"},{"id":"ref-for-concept-origin\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2465"},{"id":"ref-for-concept-origin\u2460\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
+"a944ac4c": {"dfnID":"a944ac4c","dfnText":"origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-concept-origin\u2460"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-concept-origin\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin\u2462"},{"id":"ref-for-concept-origin\u2463"},{"id":"ref-for-concept-origin\u2464"},{"id":"ref-for-concept-origin\u2465"},{"id":"ref-for-concept-origin\u2466"},{"id":"ref-for-concept-origin\u2467"},{"id":"ref-for-concept-origin\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-concept-origin\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2462"},{"id":"ref-for-concept-origin\u2460\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2464"},{"id":"ref-for-concept-origin\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
 "a973e0fe": {"dfnID":"a973e0fe","dfnText":"document","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-document\u2460"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#concept-document"},
 "aa6633ff": {"dfnID":"aa6633ff","dfnText":"multi-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
 "aaf09faf": {"dfnID":"aaf09faf","dfnText":"salted","external":true,"refSections":[{"refs":[{"id":"ref-for-page-258"},{"id":"ref-for-page-258\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"https://tools.ietf.org/html/rfc4949#page-258"},
@@ -11646,7 +11644,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-userverificationrequirement-discouraged": {"dfnID":"dom-userverificationrequirement-discouraged","dfnText":"discouraged","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-discouraged"},
 "dom-userverificationrequirement-preferred": {"dfnID":"dom-userverificationrequirement-preferred","dfnText":"preferred","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-preferred"},
 "dom-userverificationrequirement-required": {"dfnID":"dom-userverificationrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-required"},{"id":"ref-for-dom-userverificationrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2461"},{"id":"ref-for-dom-userverificationrequirement-required\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2464"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-userverificationrequirement-required"},
-"e0660c76": {"dfnID":"e0660c76","dfnText":"opaque origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-opaque"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-origin-opaque\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-opaque\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
+"e0660c76": {"dfnID":"e0660c76","dfnText":"opaque origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-opaque"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-opaque\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
 "e1812e4c": {"dfnID":"e1812e4c","dfnText":"token binding id","external":true,"refSections":[{"refs":[{"id":"ref-for-section-3.2"},{"id":"ref-for-section-3.2\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://tools.ietf.org/html/rfc8471#section-3.2"},
 "e3db52cd": {"dfnID":"e3db52cd","dfnText":"signal (for CredentialCreationOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-signal"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2460"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2461"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal"},
 "e5ea84f2": {"dfnID":"e5ea84f2","dfnText":"intersection","external":true,"refSections":[{"refs":[{"id":"ref-for-set-intersection"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://infra.spec.whatwg.org/#set-intersection"},
@@ -11680,10 +11678,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "f8de33a3": {"dfnID":"f8de33a3","dfnText":"long","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-long"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}],"url":"https://webidl.spec.whatwg.org/#idl-long"},
 "f937b7b6": {"dfnID":"f937b7b6","dfnText":"continue","external":true,"refSections":[{"refs":[{"id":"ref-for-iteration-continue"},{"id":"ref-for-iteration-continue\u2460"},{"id":"ref-for-iteration-continue\u2461"},{"id":"ref-for-iteration-continue\u2462"},{"id":"ref-for-iteration-continue\u2463"},{"id":"ref-for-iteration-continue\u2464"},{"id":"ref-for-iteration-continue\u2465"},{"id":"ref-for-iteration-continue\u2466"},{"id":"ref-for-iteration-continue\u2467"},{"id":"ref-for-iteration-continue\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u24ea"},{"id":"ref-for-iteration-continue\u2460\u2460"},{"id":"ref-for-iteration-continue\u2460\u2461"},{"id":"ref-for-iteration-continue\u2460\u2462"},{"id":"ref-for-iteration-continue\u2460\u2463"},{"id":"ref-for-iteration-continue\u2460\u2464"},{"id":"ref-for-iteration-continue\u2460\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u2466"},{"id":"ref-for-iteration-continue\u2460\u2467"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://infra.spec.whatwg.org/#iteration-continue"},
 "f9c635f5": {"dfnID":"f9c635f5","dfnText":"conditional","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2462"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2463"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2465"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2466"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2467"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2468"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u24ea"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2460"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2464"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2465"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional"},
-"faf954d6": {"dfnID":"faf954d6","dfnText":"browsing context","external":true,"refSections":[{"refs":[{"id":"ref-for-browsing-context"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-browsing-context\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-browsing-context\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context"},
+"faf954d6": {"dfnID":"faf954d6","dfnText":"browsing context","external":true,"refSections":[{"refs":[{"id":"ref-for-browsing-context"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-browsing-context\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context"},
 "fbc75291": {"dfnID":"fbc75291","dfnText":"token binding","external":true,"refSections":[{"refs":[{"id":"ref-for-section-1"},{"id":"ref-for-section-1\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://tools.ietf.org/html/rfc8471#section-1"},
 "fc736137": {"dfnID":"fc736137","dfnText":"textarea","external":true,"refSections":[{"refs":[{"id":"ref-for-the-textarea-element"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element"},
-"feac4ab3": {"dfnID":"feac4ab3","dfnText":"same site","external":true,"refSections":[{"refs":[{"id":"ref-for-same-site"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-same-site\u2460"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-same-site\u2461"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#same-site"},
+"feac4ab3": {"dfnID":"feac4ab3","dfnText":"same site","external":true,"refSections":[{"refs":[{"id":"ref-for-same-site"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-same-site\u2460"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#same-site"},
 "first-factor-roaming-authenticator": {"dfnID":"first-factor-roaming-authenticator","dfnText":"First-factor roaming authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-first-factor-roaming-authenticator"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-first-factor-roaming-authenticator\u2460"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#first-factor-roaming-authenticator"},
 "generating-authenticator": {"dfnID":"generating-authenticator","dfnText":"Generating Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-generating-authenticator"},{"id":"ref-for-generating-authenticator\u2460"},{"id":"ref-for-generating-authenticator\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-generating-authenticator\u2462"}],"title":"6.1.3. Credential Backup State"}],"url":"#generating-authenticator"},
 "get-credentials": {"dfnID":"get-credentials","dfnText":"Get Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-get-credentials"}],"title":"11.6. Get Credentials"}],"url":"#get-credentials"},
@@ -12685,7 +12683,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "https://html.spec.whatwg.org/multipage/nav-history-apis.html#window": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"Window","type":"interface","url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window"},
 "https://html.spec.whatwg.org/multipage/origin.html#concept-origin": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
 "https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"opaque origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
-"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"tuple origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple"},
 "https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"document.domain","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain"},
 "https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin": {"export":true,"for_":["environment"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"top-level origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin"},
 "https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"relevant global object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global"},