diff --git a/apps/api/src/lib/target-app.ts b/apps/api/src/lib/target-app.ts
index 27d70b7..5bcddc1 100644
--- a/apps/api/src/lib/target-app.ts
+++ b/apps/api/src/lib/target-app.ts
@@ -5,17 +5,15 @@ export function targetAppFromReturnTo(
   returnTo: string | undefined | null,
 ): AuditSourceApp {
   if (!returnTo) return 'portal'
-  let host = ''
-  let path = ''
-  let search = ''
+  let u: URL
   try {
-    const u = new URL(returnTo)
-    host = u.hostname.toLowerCase()
-    path = u.pathname.toLowerCase()
-    search = u.search
+    u = new URL(returnTo)
   } catch {
     return 'portal'
   }
+  const host = u.hostname.toLowerCase()
+  const path = u.pathname.toLowerCase()
+  const search = u.search
 
   // Portal OIDC authorize as return_to → map via client's redirect_uri
   if (path === '/oauth/authorize' || path.endsWith('/oauth/authorize')) {
diff --git a/apps/api/src/lib/webauthn.ts b/apps/api/src/lib/webauthn.ts
index 757fe09..9d1eb18 100644
--- a/apps/api/src/lib/webauthn.ts
+++ b/apps/api/src/lib/webauthn.ts
@@ -14,16 +14,17 @@ export function webauthnRelyingParty(app: FastifyInstance): {
   }
 }
 
-export function userIdToBytes(userId: string): Uint8Array {
-  return isoUint8Array.fromUTF8String(userId)
+export function userIdToBytes(userId: string): Uint8Array<ArrayBuffer> {
+  // Копия через конструктор даёт Uint8Array<ArrayBuffer>, которого требует SimpleWebAuthn v13.
+  return new Uint8Array(isoUint8Array.fromUTF8String(userId))
 }
 
-export function encodePublicKey(publicKey: Uint8Array): string {
+export function encodePublicKey(publicKey: Uint8Array<ArrayBuffer>): string {
   return isoBase64URL.fromBuffer(publicKey)
 }
 
-export function decodePublicKey(stored: string): Uint8Array {
-  return isoBase64URL.toBuffer(stored)
+export function decodePublicKey(stored: string): Uint8Array<ArrayBuffer> {
+  return new Uint8Array(isoBase64URL.toBuffer(stored))
 }
 
 export function asTransports(
diff --git a/packages/shared/src/contracts/audit.ts b/packages/shared/src/contracts/audit.ts
index 6727d0f..cce5e20 100644
--- a/packages/shared/src/contracts/audit.ts
+++ b/packages/shared/src/contracts/audit.ts
@@ -23,6 +23,7 @@ export const AUDIT_TARGET_TYPES = [
   'session',
   'system',
   'app_resource',
+  'credential',
 ] as const
 export type AuditTargetType = (typeof AUDIT_TARGET_TYPES)[number]
 export const auditTargetTypeSchema = z.enum(AUDIT_TARGET_TYPES)