What a sign-in call left to do: nothing (tokens), or one challenge.
WebAuthn PublicKeyCredentialRequestOptionsJSON, as a JSON string.
PublicKeyCredentialRequestOptionsJSON
The first factors this user can use, e.g. no WEB_AUTHN without a passkey.
WEB_AUTHN
What a sign-in call left to do: nothing (tokens), or one challenge.