@byline/admin 6.7.1 → 6.8.0

package/dist/modules/auth/passkey-rate-limiter.js

@@ -0,0 +1,60 @@
+import { createHmac } from "node:crypto";
+import { signInNetwork } from "./sign-in-rate-limiter.js";
+function createPasskeyRequestLimiter(store, secret, now = Date.now) {
+    const bytes = 'string' == typeof secret ? new TextEncoder().encode(secret) : secret;
+    if (bytes.byteLength < 32) throw new Error('Passkey HMAC secret must contain at least 32 bytes');
+    const key = createHmac('sha256', bytes).update('byline:passkey-requests:v1').digest();
+    let active = 0;
+    const cleanupTask = {
+        name: 'auth.sign-in-counters.cleanup',
+        intervalMs: 60000,
+        leaseMs: 60000,
+        async run (context) {
+            const started = performance.now();
+            for(let n = 0; n < 32 && performance.now() - started < 30000; n++){
+                context.signal.throwIfAborted();
+                await context.heartbeat();
+                if (await store.purgeExpired(new Date(now() - 300000)) < 100) return {
+                    workRemaining: false
+                };
+            }
+            return {
+                workRemaining: true
+            };
+        }
+    };
+    return {
+        requiredCleanupTask: cleanupTask.name,
+        cleanupTask,
+        async acquire () {
+            if (active >= 4) return null;
+            active++;
+            const started = performance.now();
+            let released = false;
+            return ()=>{
+                if (released) return;
+                released = true;
+                setTimeout(()=>{
+                    active--;
+                }, Math.max(0, 100 - (performance.now() - started))).unref();
+            };
+        },
+        async consume ({ ip }) {
+            const network = signInNetwork(ip);
+            const time = now();
+            const end = (Math.floor(time / 60000) + 1) * 60000;
+            const digest = createHmac('sha256', key).update(JSON.stringify([
+                'network',
+                network,
+                end
+            ])).digest('hex');
+            await store.purgeExpired(new Date(time - 300000));
+            const allowed = await store.consume(digest, 60, new Date(end));
+            return {
+                allowed,
+                retryAfterSeconds: allowed ? 0 : Math.max(1, Math.ceil((end - time) / 1000))
+            };
+        }
+    };
+}
+export { createPasskeyRequestLimiter };

package/dist/modules/auth/passkey-rate-limiter.test.node.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};

package/dist/modules/auth/passkey-storage-validation.d.ts

@@ -0,0 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { PasskeyAttemptRow, PasskeyClaimInput } from './passkeys-repository.js';
+/** Canonical encoding makes string identity exactly equivalent to WebAuthn byte identity. */
+export declare function assertPasskeyBytes(value: string, maxBytes: number, exactBytes?: number): void;
+export declare function assertPasskeyTokenHash(value: string): void;
+export declare function assertPasskeyAttempt(input: Omit<PasskeyAttemptRow, 'consumed_at'>): void;
+/** Runtime callers must obey the same purpose/action boundary as typed callers. */
+export declare function assertPasskeyClaim(input: PasskeyClaimInput): void;

package/dist/modules/auth/passkey-storage-validation.js

@@ -0,0 +1,59 @@
+function assertPasskeyBytes(value, maxBytes, exactBytes) {
+    if ('string' != typeof value || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error('Invalid passkey byte encoding');
+    const bytes = Buffer.from(value, 'base64url');
+    if (bytes.length > maxBytes || void 0 !== exactBytes && bytes.length !== exactBytes || bytes.toString('base64url') !== value) throw new Error('Invalid passkey byte encoding');
+}
+function assertPasskeyTokenHash(value) {
+    if (!/^[a-f0-9]{64}$/.test(value)) throw new Error('Invalid passkey token hash');
+}
+function assertPasskeyAttempt(input) {
+    assertPasskeyTokenHash(input.token_hash);
+    const lifetime = input.expires_at.getTime() - input.created_at.getTime();
+    if (!Number.isFinite(lifetime) || lifetime <= 0 || lifetime > 300000) throw new Error('Invalid passkey attempt lifetime');
+    if (![
+        'sign-in',
+        'fresh-authentication',
+        'enrollment',
+        'grant'
+    ].includes(input.purpose)) throw new Error('Invalid passkey attempt purpose');
+    if ('grant' === input.purpose) {
+        if (null !== input.challenge) throw new Error('Grants cannot contain challenges');
+    } else assertPasskeyBytes(input.challenge ?? '', 32, 32);
+    if ('sign-in' === input.purpose) {
+        if ([
+            input.actor_user_id,
+            input.actor_login_id,
+            input.actor_generation,
+            input.action,
+            input.target_user_id,
+            input.credential_record_id,
+            input.proof_credential_id
+        ].some((value)=>null !== value)) throw new Error('Sign-in attempts cannot carry management authority');
+    } else {
+        if (!input.actor_user_id || !input.actor_login_id || !Number.isSafeInteger(input.actor_generation) || (input.actor_generation ?? -1) < 0) throw new Error('Management attempts require an acting login and generation');
+        if ('enroll' === input.action) {
+            if (input.target_user_id !== input.actor_user_id || null !== input.credential_record_id) throw new Error('Enrollment must target the actor');
+        } else if ('remove' === input.action) {
+            if (!input.target_user_id || !input.credential_record_id || 'enrollment' === input.purpose) throw new Error('Removal must bind its target account and credential');
+        } else throw new Error('Management attempts require an action');
+    }
+}
+function assertPasskeyClaim(input) {
+    assertPasskeyTokenHash(input.tokenHash);
+    if ('sign-in' === input.purpose) {
+        if (void 0 !== input.action || [
+            input.binding.actor_user_id,
+            input.binding.actor_login_id,
+            input.binding.actor_generation
+        ].some((value)=>null !== value)) throw new Error('Sign-in claims require anonymous binding and no action');
+    } else {
+        if (![
+            'fresh-authentication',
+            'enrollment',
+            'grant'
+        ].includes(input.purpose)) throw new Error('Invalid passkey claim purpose');
+        if ('enroll' !== input.action && 'remove' !== input.action) throw new Error('Authenticated claims require an action');
+        if (!input.binding.actor_user_id || !input.binding.actor_login_id || !Number.isSafeInteger(input.binding.actor_generation) || input.binding.actor_generation < 0) throw new Error('Authenticated claims require an acting login binding');
+    }
+}
+export { assertPasskeyAttempt, assertPasskeyBytes, assertPasskeyClaim, assertPasskeyTokenHash };

package/dist/modules/auth/passkeys-repository.d.ts

@@ -0,0 +1,96 @@
+/**
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Internal persistence records. Never return these through account/editor DTOs. */
+export interface PasskeyCredentialRow {
+    id: string;
+    /** Null after account deletion; the credential identity remains reserved. */
+    admin_user_id: string | null;
+    /** Canonical unpadded base64url; byte-exact uniqueness includes revoked records. */
+    credential_id: string;
+    public_key: string;
+    counter: number;
+    transports: string[];
+    backup_eligible: boolean;
+    backed_up: boolean;
+    name: string;
+    created_at: Date;
+    last_used_at: Date | null;
+    revoked_at: Date | null;
+}
+export interface PasskeyAttemptRow {
+    /** SHA-256 hex of the independent bearer identifier; never the identifier itself. */
+    token_hash: string;
+    purpose: 'sign-in' | 'fresh-authentication' | 'enrollment' | 'grant';
+    challenge: string | null;
+    actor_user_id: string | null;
+    actor_login_id: string | null;
+    actor_generation: number | null;
+    action: 'enroll' | 'remove' | null;
+    target_user_id: string | null;
+    credential_record_id: string | null;
+    /** Credential used for fresh proof, if any; revalidated at grant use. */
+    proof_credential_id: string | null;
+    created_at: Date;
+    expires_at: Date;
+    consumed_at: Date | null;
+}
+export type PasskeyClaimInput = {
+    tokenHash: string;
+    now: Date;
+} & ({
+    purpose: 'sign-in';
+    binding: {
+        actor_user_id: null;
+        actor_login_id: null;
+        actor_generation: null;
+    };
+    action?: never;
+} | {
+    purpose: 'fresh-authentication' | 'enrollment' | 'grant';
+    binding: {
+        actor_user_id: string;
+        actor_login_id: string;
+        actor_generation: number;
+    };
+    action: 'enroll' | 'remove';
+});
+export interface PasskeysRepository {
+    /** Target lock required; generation and native-login revocation commit together. */
+    invalidateAccountLogins(adminUserId: string, at: Date): Promise<void>;
+    /** Success requires both account locks; denial/failure records may be written separately. */
+    appendRemovalAudit(input: {
+        actorId: string;
+        targetId: string;
+        credentialId: string;
+        outcome: 'success' | 'denied' | 'failed';
+    }): Promise<void>;
+    getUserHandle(adminUserId: string): Promise<string | null>;
+    /** Requires the owning account lock. Allocates once; never resets on credential removal. */
+    ensureUserHandle(adminUserId: string, candidate: string): Promise<string>;
+    /** Includes tombstones: authentication must reject revoked or ownerless records. */
+    findCredential(id: string): Promise<PasskeyCredentialRow | null>;
+    /** Includes tombstones: authentication must reject revoked or ownerless records. */
+    findCredentialByCredentialId(credentialId: string): Promise<PasskeyCredentialRow | null>;
+    listCredentials(adminUserId: string): Promise<PasskeyCredentialRow[]>;
+    /** All credential writes require the owning account lock and share its transaction. */
+    createCredential(input: Omit<PasskeyCredentialRow, 'admin_user_id' | 'revoked_at'> & {
+        admin_user_id: string;
+    }): Promise<void>;
+    updateCredential(id: string, patch: Partial<Pick<PasskeyCredentialRow, 'counter' | 'backed_up' | 'name' | 'last_used_at'>>): Promise<void>;
+    revokeCredential(id: string, at: Date): Promise<void>;
+    /** Authenticated attempts require the actor lock; sign-in has no account yet. */
+    createAttempt(input: Omit<PasskeyAttemptRow, 'consumed_at'>): Promise<void>;
+    findAttempt(tokenHash: string): Promise<PasskeyAttemptRow | null>;
+    countPendingForLogin(loginId: string, now: Date): Promise<number>;
+    /**
+     * Root store only: commits consumption in its own short transaction BEFORE returning.
+     * Calling through an account-transaction store must throw, never create a savepoint.
+     * Exact purpose/binding, unconsumed state and expiry gate the sole winning claim.
+     * No automatic retries, even if commit acknowledgement is uncertain.
+     */
+    claimAttempt(input: PasskeyClaimInput): Promise<PasskeyAttemptRow | null>;
+}

package/dist/modules/auth/passkeys-repository.js

@@ -0,0 +1 @@
+export { };

package/dist/modules/auth/refresh-tokens-repository.d.ts

@@ -62,7 +62,7 @@ export interface RefreshTokensRepository {
     revokeChain(startId: string, at?: Date): Promise<number>;
     /** Revoke every non-revoked token for a user. Used on password change / sign-out everywhere. */
     revokeAllForUser(adminUserId: string, at?: Date): Promise<number>;
-    /** Remove rows whose `expires_at` is in the past. Housekeeping. */
+    /** Legacy housekeeping: at most 100 null-sid rows expired for 30 days. Native login members are retained. */
     purgeExpired(now?: Date): Promise<number>;
     /** All non-revoked tokens for a user. Primarily for tests. */
     listActiveForUser(adminUserId: string): Promise<RefreshTokenRow[]>;

package/dist/modules/auth/sign-in-rate-limiter.d.ts

@@ -38,6 +38,8 @@ export interface SignInLimiterOptions {
     /** Also bounds counter creation when the provider or a denial completes very quickly. */
     minimumSlotMs?: number;
 }
+/** IPv4 uses one address; IPv6 uses its /64. Mapped IPv4 shares its native IPv4 bucket. */
+export declare function signInNetwork(ip: string): string;
 /**
  * Instantiate once per process. Acquire before consume and release in finally after verification.
  * Network admission precedes account-plus-network admission. There is no account-wide lockout.

package/dist/modules/auth/sign-in-rate-limiter.js

@@ -226,4 +226,4 @@ function createPasswordSignInLimiter(store, secret, policy = DEFAULT_POLICY, now
         }
     };
 }
-export { createPasswordSignInLimiter };
+export { createPasswordSignInLimiter, signInNetwork };

package/dist/services/admin-services-context.d.ts

@@ -7,7 +7,7 @@
  */
 import { type ReactNode } from 'react';
 import type { BylineAdminServices } from './admin-services-types.js';
-export type { AdminServiceCall, BylineAdminServices, ChangeAccountPasswordInput, CreateAdminRoleInput, CreateAdminUserInput, SetAdminUserPasswordInput, SetRoleAbilitiesInput, SetUserRolesInput, SignInInput, SignInResult, UpdateAccountInput, UpdateAdminRoleInput, UpdateAdminUserInput, WhoHasAbilityInput, } from './admin-services-types.js';
+export type { AdminServiceCall, BylineAdminServices, ChangeAccountPasswordInput, CreateAdminRoleInput, CreateAdminUserInput, PasskeyAdminServices, PasskeyPageBinding, SetAdminUserPasswordInput, SetRoleAbilitiesInput, SetUserRolesInput, SignInInput, SignInResult, UpdateAccountInput, UpdateAdminRoleInput, UpdateAdminUserInput, WhoHasAbilityInput, } from './admin-services-types.js';
 interface BylineAdminServicesProviderProps {
     services: BylineAdminServices;
     children: ReactNode;

package/dist/services/admin-services-types.d.ts

@@ -23,6 +23,7 @@
  * server fns directly today and move into `@byline/host-tanstack-start`
  * in Phase 3 along with the route factories.
  */
+import type { PasskeyAuthenticationOptions, PasskeyCeremony, PasskeyCredentialSummary, PasskeyManagementAction, PasskeyManagementGrant, PasskeyRegistrationOptions } from '@byline/auth';
 import type { AccountResponse, ChangeAccountPasswordRequest, UpdateAccountRequest } from '../modules/admin-account/index.js';
 import type { SetRoleAbilitiesResponse, WhoHasAbilityResponse } from '../modules/admin-permissions/index.js';
 import type { AdminRoleResponse, UserRolesResponse } from '../modules/admin-roles/index.js';
@@ -46,6 +47,63 @@ export interface SignInInput {
  * supply whatever envelope it produces without forcing a public type.
  */
 export type SignInResult = unknown;
+/** Captured before any prompt; the host checks it again before submission. */
+export interface PasskeyPageBinding {
+    expectedSessionId: string | null;
+    assertCurrent(): void;
+}
+interface PasskeyBoundInput {
+    expectedSessionId: string;
+}
+export interface PasskeyAdminServices {
+    capability(): Promise<{
+        enabled: boolean;
+    }>;
+    captureLogin(signIn?: boolean): PasskeyPageBinding;
+    managementContext(binding: PasskeyPageBinding): Promise<{
+        id: string;
+        isSuperAdmin: boolean;
+        canManagePasskeys: boolean;
+    }>;
+    signInOptions: AdminServiceCall<Record<string, never>, PasskeyCeremony<PasskeyAuthenticationOptions>>;
+    signIn(args: {
+        data: {
+            ceremonyId: string;
+            response: unknown;
+        };
+    }, binding: PasskeyPageBinding): Promise<unknown>;
+    passwordProof: AdminServiceCall<PasskeyBoundInput & {
+        password: string;
+        action: PasskeyManagementAction;
+    }, PasskeyManagementGrant>;
+    proofOptions: AdminServiceCall<PasskeyBoundInput & {
+        action: PasskeyManagementAction;
+    }, PasskeyCeremony<PasskeyAuthenticationOptions>>;
+    proof: AdminServiceCall<PasskeyBoundInput & {
+        ceremonyId: string;
+        response: unknown;
+    }, PasskeyManagementGrant>;
+    enrollmentOptions: AdminServiceCall<PasskeyBoundInput & {
+        grantId: string;
+    }, PasskeyCeremony<PasskeyRegistrationOptions>>;
+    enrollment: AdminServiceCall<PasskeyBoundInput & {
+        ceremonyId: string;
+        response: unknown;
+        name: string;
+    }, PasskeyCredentialSummary>;
+    list: AdminServiceCall<PasskeyBoundInput & {
+        targetUserId?: string;
+    }, PasskeyCredentialSummary[]>;
+    rename: AdminServiceCall<PasskeyBoundInput & {
+        credentialRecordId: string;
+        name: string;
+    }, PasskeyCredentialSummary>;
+    remove: AdminServiceCall<PasskeyBoundInput & {
+        grantId: string;
+    }, {
+        signedOut: boolean;
+    }>;
+}
 /** Same shape as `UpdateAccountRequest` from `@byline/admin/admin-account`. */
 export type UpdateAccountInput = UpdateAccountRequest;
 /** Same shape as `ChangeAccountPasswordRequest` from `@byline/admin/admin-account`. */
@@ -119,6 +177,7 @@ export interface WhoHasAbilityInput {
 }
 export interface BylineAdminServices {
     adminSignIn: AdminServiceCall<SignInInput, SignInResult>;
+    passkeys?: PasskeyAdminServices;
     updateAccount: AdminServiceCall<UpdateAccountInput, AccountResponse>;
     changeAccountPassword: AdminServiceCall<ChangeAccountPasswordInput, AccountResponse>;
     setAdminLocale: AdminServiceCall<SetAdminLocaleInput, SetAdminLocaleResult>;
@@ -143,3 +202,4 @@ export interface BylineAdminServices {
      */
     getCollectionDocumentVersion: (collection: string, documentId: string, versionId: string, locale: string | undefined) => Promise<Record<string, unknown>>;
 }
+export {};

package/dist/store.d.ts

@@ -9,7 +9,9 @@ import type { AdminPermissionsRepository } from './modules/admin-permissions/rep
 import type { AdminPreferencesRepository } from './modules/admin-preferences/repository.js';
 import type { AdminRolesRepository } from './modules/admin-roles/repository.js';
 import type { AdminUsersRepository, AdminUserWithPasswordRow } from './modules/admin-users/repository.js';
+import type { AuthMaintenanceRepository } from './modules/auth/auth-maintenance-repository.js';
 import type { LoginSessionsRepository } from './modules/auth/login-sessions-repository.js';
+import type { PasskeysRepository } from './modules/auth/passkeys-repository.js';
 import type { RefreshTokensRepository } from './modules/auth/refresh-tokens-repository.js';
 import type { SignInRateLimitStore } from './modules/auth/sign-in-rate-limiter.js';
 /**
@@ -35,6 +37,8 @@ export interface AdminStore {
     withSessionLock<T>(adminUserId: string, work: (store: AdminStore, user: AdminUserWithPasswordRow | null) => Promise<T>): Promise<T>;
     /** Lock distinct account IDs in sorted order in one transaction for account-switch sign-in. */
     withSessionLocks<T>(adminUserIds: string[], work: (store: AdminStore) => Promise<T>): Promise<T>;
+    authMaintenance: AuthMaintenanceRepository;
+    passkeys: PasskeysRepository;
     loginSessions: LoginSessionsRepository;
     signInRateLimits: SignInRateLimitStore;
     adminUsers: AdminUsersRepository;

package/package.json

@@ -2,9 +2,9 @@
   "name": "@byline/admin",
   "private": false,
   "license": "MPL-2.0",
-  "version": "6.7.1",
+  "version": "6.8.0",
   "engines": {
-    "node": ">=20.9.0"
+    "node": ">=22.22.2"
   },
   "description": "Byline CMS admin subsystem — admin users, roles, permissions, account self-service, and the built-in JWT session provider",
   "keywords": [
@@ -157,13 +157,24 @@
       "import": "./dist/modules/auth/components/sign-in-form.js",
       "require": "./dist/modules/auth/components/sign-in-form.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./auth/components/passkey-manager": {
+      "types": "./dist/modules/auth/components/passkey-manager.d.ts",
+      "import": "./dist/modules/auth/components/passkey-manager.js",
+      "require": "./dist/modules/auth/components/passkey-manager.js"
+    }
   },
   "files": [
     "dist/",
     "src/"
   ],
   "dependencies": {
+    "@byline/analytics": "6.8.0",
+    "@byline/analytics-agent": "6.8.0",
+    "@byline/auth": "6.8.0",
+    "@byline/core": "6.8.0",
+    "@byline/i18n": "6.8.0",
+    "@byline/ui": "6.8.0",
     "@codemirror/commands": "^6.11.1",
     "@codemirror/lang-css": "^6.3.1",
     "@codemirror/lang-html": "^6.4.12",
@@ -173,41 +184,37 @@
     "@codemirror/lang-python": "^6.2.1",
     "@codemirror/lang-sql": "^6.10.0",
     "@codemirror/lang-yaml": "^6.1.3",
-    "@codemirror/language": "^6.12.4",
-    "@codemirror/state": "^6.7.5",
-    "@codemirror/view": "^6.43.12",
-    "@lezer/highlight": "^1.2.3",
+    "@codemirror/language": "^6.13.1",
+    "@codemirror/state": "^6.7.6",
+    "@codemirror/view": "^6.43.14",
+    "@lezer/highlight": "^1.2.5",
+    "@simplewebauthn/browser": "^14.0.0",
+    "@simplewebauthn/server": "^14.0.3",
     "@tanstack/react-form-start": "^1.33.5",
     "clsx": "^2.1.1",
     "jose": "^6.2.12",
     "react-diff-viewer-continued": "^4.4.0",
-    "uuid": "^14.0.2",
-    "zod": "^4.6.5",
-    "@byline/analytics": "6.7.1",
-    "@byline/auth": "6.7.1",
-    "@byline/core": "6.7.1",
-    "@byline/analytics-agent": "6.7.1",
-    "@byline/i18n": "6.7.1",
-    "@byline/ui": "6.7.1"
+    "uuid": "^14.0.3",
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.14",
-    "@rsbuild/plugin-react": "^2.1.0",
-    "@rslib/core": "^1.0.1",
-    "@types/node": "^26.6.2",
+    "@biomejs/biome": "2.5.15",
+    "@rsbuild/plugin-react": "^2.1.1",
+    "@rslib/core": "^1.0.3",
+    "@types/node": "^26.6.5",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
-    "jsdom": "^30.1.0",
-    "react": "^19.3.0",
-    "react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.2",
+    "jsdom": "^30.1.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "typescript": "^7.0.2",
     "typescript-plugin-css-modules": "^5.2.0",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.4"
   },
   "publishConfig": {
     "access": "public",

package/src/modules/admin-account/components/change-password.tsx

@@ -215,7 +215,7 @@ export function ChangeAccountPassword({ account, onClose, onSuccess }: ChangePas
         <div className={cx('byline-account-change-password-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-account-change-password-action', styles.action)}

package/src/modules/admin-account/components/container.module.css

@@ -13,6 +13,7 @@
  *   .byline-account-status-on
  *   .byline-account-status-off
  *   .byline-account-status-help   — italic helper line on Account Status card
+ *   .byline-account-preferences-theme — colour theme block inside Preferences
  *   .byline-account-drawer        — drawer responsive width override
  *   .byline-account-drawer-body   — drawer content container
  *   .byline-account-drawer-scroll — drawer scrollable inner viewport
@@ -92,6 +93,14 @@
   font-size: var(--font-size-xs);
 }
 
+.preferences-theme,
+:global(.byline-account-preferences-theme) {
+  display: flex;
+  flex-direction: column;
+  gap: var(--spacing-8);
+  margin-top: var(--spacing-20);
+}
+
 /*
  * Italic helper for "Not set" placeholders. Replaces the Tailwind
  * `italic` utility we used pre-lift; with the component now in a

package/src/modules/admin-account/components/container.tsx

@@ -32,6 +32,7 @@ import { useTranslation } from '@byline/i18n/react'
 import { CloseIcon, Drawer, EditIcon, IconButton } from '@byline/ui/react'
 import cx from 'clsx'
 
+import { PasskeyManager } from '../../auth/components/passkey-manager.js'
 import { ChangeAccountPassword } from './change-password.js'
 import styles from './container.module.css'
 import { Preferences } from './preferences.js'
@@ -180,6 +181,12 @@ export function AccountSelfContainer({ account }: AccountSelfContainerProps) {
             <p className={cx('muted', 'byline-account-status-help', styles['status-help'])}>
               {t('account.preferences.help')}
             </p>
+            <div className={cx('byline-account-preferences-theme', styles['preferences-theme'])}>
+              <p className={cx('byline-account-line', styles.line)}>
+                <span className="muted">{t('account.appearance.colorTheme')}</span>
+              </p>
+              <ThemeSwitch />
+            </div>
           </ContainerSection>
         </div>
 
@@ -192,9 +199,11 @@ export function AccountSelfContainer({ account }: AccountSelfContainerProps) {
             <p className={cx('byline-account-line', styles.line)}>{t('account.password.intro')}</p>
           </ContainerSection>
 
-          <ContainerSection title={t('account.sections.appearance')}>
-            <ThemeSwitch />
-          </ContainerSection>
+          <PasskeyManager
+            targetUserId={currentAccount.id}
+            targetIsSuperAdmin={currentAccount.is_super_admin}
+            section={ContainerSection}
+          />
 
           <ContainerSection title={t('account.sections.status')}>
             <p className={cx('byline-account-line', styles.line)}>

package/src/modules/admin-account/components/preferences.tsx

@@ -172,7 +172,7 @@ export function Preferences({ account, onClose, onSuccess }: PreferencesProps) {
         <div className={cx('byline-account-preferences-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-account-preferences-action', styles.action)}

package/src/modules/admin-account/components/update.tsx

@@ -240,7 +240,7 @@ export function UpdateAccount({ account, onClose, onSuccess }: UpdateAccountProp
         <div className={cx('byline-account-update-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-account-update-action', styles.action)}

package/src/modules/admin-roles/components/create.tsx

@@ -192,7 +192,7 @@ export function CreateAdminRole({ onClose, onSuccess }: CreateAdminRoleProps) {
         <div className={cx('byline-role-create-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-role-create-action', styles.action)}

package/src/modules/admin-roles/components/permissions.tsx

@@ -288,7 +288,7 @@ export function RolePermissions({
           <div className={cx('byline-role-permissions-actions', styles.actions)}>
             <Button
               type="button"
-              intent="secondary"
+              intent="noeffect"
               size="xs"
               onClick={handleCancel}
               disabled={saving}

package/src/modules/admin-roles/components/update.tsx

@@ -188,7 +188,7 @@ export function UpdateRole({ role, onClose, onSuccess }: UpdateRoleProps) {
         <div className={cx('byline-role-update-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-role-update-action', styles.action)}

package/src/modules/admin-users/abilities.ts

@@ -32,6 +32,7 @@ export const ADMIN_USERS_ABILITIES = {
   update: 'admin.users.update',
   delete: 'admin.users.delete',
   changePassword: 'admin.users.changePassword',
+  managePasskeys: 'admin.users.managePasskeys',
 } as const
 
 export type AdminUsersAbilityKey =
@@ -43,6 +44,12 @@ export type AdminUsersAbilityKey =
  * the webapp wires into `initBylineCore()`.
  */
 export function registerAdminUsersAbilities(registry: AbilityRegistry): void {
+  registry.register({
+    key: ADMIN_USERS_ABILITIES.managePasskeys,
+    label: 'Manage admin user passkeys',
+    group: 'admin.users',
+    source: 'admin',
+  })
   registry.register({
     key: ADMIN_USERS_ABILITIES.read,
     label: 'Read admin users',

package/src/modules/admin-users/components/create.tsx

@@ -299,7 +299,7 @@ export function CreateAdminUser({ onClose, onSuccess }: CreateAdminUserProps) {
         <div className={cx('byline-user-create-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-user-create-action', styles.action)}

package/src/modules/admin-users/components/roles.tsx

@@ -143,7 +143,7 @@ export function UserRoles({ user, allRoles, initialRoleIds, onClose, onSaved }:
       <div className={cx('byline-user-roles-actions', styles.actions)}>
         <Button
           type="button"
-          intent="secondary"
+          intent="noeffect"
           size="xs"
           onClick={onClose}
           disabled={saving}