@ecmaos/kernel 0.6.4 → 0.6.5

package/dist/{kernel-DtEbpoeV.js → kernel-C_Xvcpox.js}

@@ -25369,39 +25369,101 @@ const _Auth = class _Auth {
       // Create a new credential
       create: /* @__PURE__ */ __name(async (options) => {
         try {
-          return await navigator.credentials.create({ publicKey: options });
+          if (!this.passkey.isSupported()) {
+            throw new Error("WebAuthn is not supported in this browser");
+          }
+          if (!window.isSecureContext) {
+            throw new Error("WebAuthn requires a secure context (HTTPS or localhost)");
+          }
+          const credential = await navigator.credentials.create({ publicKey: options });
+          if (!credential || !(credential instanceof PublicKeyCredential)) {
+            throw new Error("Failed to create credential");
+          }
+          return credential;
         } catch (error) {
-          console.error("Error creating credential:", error);
-          return null;
+          if (error instanceof Error) {
+            if (error.name === "NotAllowedError") {
+              throw new Error("User cancelled or denied the operation");
+            } else if (error.name === "InvalidStateError") {
+              throw new Error("Credential already exists or operation is invalid");
+            } else if (error.name === "NotSupportedError") {
+              throw new Error("The operation is not supported");
+            } else if (error.name === "SecurityError") {
+              throw new Error("Security error: operation not allowed");
+            }
+            throw error;
+          }
+          throw new Error(`Error creating credential: ${String(error)}`);
         }
       }, "create"),
       // Get an existing credential
       get: /* @__PURE__ */ __name(async (options) => {
         try {
-          return await navigator.credentials.get({ publicKey: options });
+          if (!this.passkey.isSupported()) {
+            throw new Error("WebAuthn is not supported in this browser");
+          }
+          if (!window.isSecureContext) {
+            throw new Error("WebAuthn requires a secure context (HTTPS or localhost)");
+          }
+          const credential = await navigator.credentials.get({ publicKey: options });
+          if (!credential || !(credential instanceof PublicKeyCredential)) {
+            return null;
+          }
+          return credential;
         } catch (error) {
-          console.error("Error getting credential:", error);
-          return null;
+          if (error instanceof Error) {
+            if (error.name === "NotAllowedError") {
+              throw new Error("User cancelled or denied the operation");
+            } else if (error.name === "InvalidStateError") {
+              throw new Error("No matching credential found");
+            } else if (error.name === "NotSupportedError") {
+              throw new Error("The operation is not supported");
+            } else if (error.name === "SecurityError") {
+              throw new Error("Security error: operation not allowed");
+            }
+            throw error;
+          }
+          throw new Error(`Error getting credential: ${String(error)}`);
         }
       }, "get"),
       // Check if WebAuthn is supported in the current browser
       isSupported: /* @__PURE__ */ __name(() => {
-        return !!window.PublicKeyCredential;
+        return !!window.PublicKeyCredential && !!navigator.credentials;
       }, "isSupported"),
-      // Register a new credential
-      register: /* @__PURE__ */ __name(async (credential) => {
-        await navigator.credentials.store(credential);
-      }, "register"),
-      // Full test of passkey functionality
-      fullTest: /* @__PURE__ */ __name(async () => {
-        const credential = await this.passkey.create({
-          challenge: new Uint8Array(32),
-          rp: { name: "Example RP" },
-          user: { id: new Uint8Array(16), name: "example@example.com", displayName: "Example User" },
-          pubKeyCredParams: [{ type: "public-key", alg: -7 }]
-        });
-        console.log(credential);
-      }, "fullTest")
+      // Verify a passkey signature
+      verify: /* @__PURE__ */ __name(async (credential, challenge, publicKey) => {
+        try {
+          const response = credential.response;
+          const signature = response.signature;
+          const clientDataJSON = response.clientDataJSON;
+          const authenticatorData = response.authenticatorData;
+          const clientData = JSON.parse(new TextDecoder().decode(clientDataJSON));
+          const receivedChallenge = Uint8Array.from(atob(clientData.challenge), (c) => c.charCodeAt(0));
+          const expectedChallenge = challenge;
+          if (receivedChallenge.length !== expectedChallenge.length) {
+            return false;
+          }
+          for (let i = 0; i < expectedChallenge.length; i++) {
+            if (receivedChallenge[i] !== expectedChallenge[i]) {
+              return false;
+            }
+          }
+          const clientDataHash = await crypto.subtle.digest("SHA-256", clientDataJSON);
+          const signedData = new Uint8Array(authenticatorData.byteLength + clientDataHash.byteLength);
+          signedData.set(new Uint8Array(authenticatorData), 0);
+          signedData.set(new Uint8Array(clientDataHash), authenticatorData.byteLength);
+          const isValid2 = await crypto.subtle.verify(
+            { name: "ECDSA", hash: "SHA-256" },
+            publicKey,
+            signature,
+            signedData
+          );
+          return isValid2;
+        } catch (error) {
+          console.error("Error verifying passkey:", error);
+          return false;
+        }
+      }, "verify")
     });
     __publicField(this, "password", {
       create: /* @__PURE__ */ __name(async (options) => {
@@ -28559,7 +28621,7 @@ const _Dom = class _Dom {
   }
   async topbar(show) {
     if (!this._topbar) return;
-    const { default: topbar } = await import("./topbar.min-BK1fdCNA.js").then((n) => n.t);
+    const { default: topbar } = await import("./topbar.min-D7kPyIYf.js").then((n) => n.t);
     this._topbarShow = show ?? !this._topbarShow;
     if (this._topbarShow) topbar.show();
     else topbar.hide();
@@ -59629,7 +59691,7 @@ const _TerminalCommand = class _TerminalCommand {
 };
 __name(_TerminalCommand, "TerminalCommand");
 let TerminalCommand = _TerminalCommand;
-function createCommand$h(kernel, shell, terminal) {
+function createCommand$i(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "cat",
     description: "Concatenate files and print on the standard output",
@@ -59713,8 +59775,8 @@ function createCommand$h(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$h, "createCommand$h");
-function createCommand$g(kernel, shell, terminal) {
+__name(createCommand$i, "createCommand$i");
+function createCommand$h(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "cd",
     description: "Change the shell working directory",
@@ -59735,8 +59797,8 @@ function createCommand$g(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$g, "createCommand$g");
-function createCommand$f(kernel, shell, terminal) {
+__name(createCommand$h, "createCommand$h");
+function createCommand$g(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "chmod",
     description: "Change file mode bits",
@@ -59762,8 +59824,8 @@ function createCommand$f(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$f, "createCommand$f");
-function createCommand$e(kernel, shell, terminal) {
+__name(createCommand$g, "createCommand$g");
+function createCommand$f(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "cp",
     description: "Copy files",
@@ -59785,8 +59847,8 @@ function createCommand$e(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$e, "createCommand$e");
-function createCommand$d(kernel, shell, terminal) {
+__name(createCommand$f, "createCommand$f");
+function createCommand$e(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "echo",
     description: "Print arguments to the standard output",
@@ -59814,8 +59876,8 @@ function createCommand$d(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$d, "createCommand$d");
-function createCommand$c(kernel, shell, terminal) {
+__name(createCommand$e, "createCommand$e");
+function createCommand$d(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "ln",
     description: "Create links between files",
@@ -59907,7 +59969,7 @@ function createCommand$c(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$c, "createCommand$c");
+__name(createCommand$d, "createCommand$d");
 var humanFormat$2 = { exports: {} };
 var humanFormat$1 = humanFormat$2.exports;
 var hasRequiredHumanFormat;
@@ -60188,7 +60250,7 @@ function requireHumanFormat() {
 __name(requireHumanFormat, "requireHumanFormat");
 var humanFormatExports = requireHumanFormat();
 const humanFormat = /* @__PURE__ */ getDefaultExportFromCjs(humanFormatExports);
-function createCommand$b(kernel, shell, terminal) {
+function createCommand$c(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "ls",
     description: "List directory contents",
@@ -60353,8 +60415,8 @@ function createCommand$b(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$b, "createCommand$b");
-function createCommand$a(kernel, shell, terminal) {
+__name(createCommand$c, "createCommand$c");
+function createCommand$b(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "mkdir",
     description: "Create a directory",
@@ -60373,8 +60435,8 @@ function createCommand$a(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$a, "createCommand$a");
-function createCommand$9(kernel, shell, terminal) {
+__name(createCommand$b, "createCommand$b");
+function createCommand$a(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "mv",
     description: "Move or rename files",
@@ -60413,8 +60475,8 @@ function createCommand$9(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$9, "createCommand$9");
-function createCommand$8(kernel, shell, terminal) {
+__name(createCommand$a, "createCommand$a");
+function createCommand$9(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "pwd",
     description: "Print the shell working directory",
@@ -60430,8 +60492,8 @@ function createCommand$8(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$8, "createCommand$8");
-function createCommand$7(kernel, shell, terminal) {
+__name(createCommand$9, "createCommand$9");
+function createCommand$8(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "rm",
     description: "Remove files or directories",
@@ -60451,8 +60513,8 @@ function createCommand$7(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$7, "createCommand$7");
-function createCommand$6(kernel, shell, terminal) {
+__name(createCommand$8, "createCommand$8");
+function createCommand$7(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "rmdir",
     description: "Remove a directory",
@@ -60471,7 +60533,7 @@ function createCommand$6(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$6, "createCommand$6");
+__name(createCommand$7, "createCommand$7");
 const MAX_32_BITS = 4294967295;
 const MAX_16_BITS = 65535;
 const MAX_8_BITS = 255;
@@ -65266,7 +65328,7 @@ const table = {
   return mimeTypes;
 })();
 t(configure);
-function createCommand$5(kernel, shell, terminal) {
+function createCommand$6(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "stat",
     description: "Display information about a file or directory",
@@ -65296,8 +65358,8 @@ function createCommand$5(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$5, "createCommand$5");
-function createCommand$4(kernel, shell, terminal) {
+__name(createCommand$6, "createCommand$6");
+function createCommand$5(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "touch",
     description: "Create an empty file",
@@ -65316,8 +65378,8 @@ function createCommand$4(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$4, "createCommand$4");
-function createCommand$3(kernel, shell, terminal) {
+__name(createCommand$5, "createCommand$5");
+function createCommand$4(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "hex",
     description: "Display file contents in hexadecimal format",
@@ -65389,7 +65451,7 @@ function createCommand$3(kernel, shell, terminal) {
     }, "run")
   });
 }
-__name(createCommand$3, "createCommand$3");
+__name(createCommand$4, "createCommand$4");
 const csi = "\x1B[";
 const ansi = {};
 ansi.style = {
@@ -65567,7 +65629,7 @@ ansi.erase = {
     return csi + (n || 0) + "K";
   }, "inLine")
 };
-function createCommand$2(kernel, shell, terminal) {
+function createCommand$3(kernel, shell, terminal) {
   return new TerminalCommand({
     command: "less",
     description: "View file contents interactively",
@@ -65730,6 +65792,181 @@ function createCommand$2(kernel, shell, terminal) {
     }, "run")
   });
 }
+__name(createCommand$3, "createCommand$3");
+function createCommand$2(kernel, shell, terminal) {
+  return new TerminalCommand({
+    command: "passkey",
+    description: "Manage passkey credentials for WebAuthn authentication",
+    kernel,
+    shell,
+    terminal,
+    options: [
+      { name: "help", type: Boolean, description: kernel.i18n.t("Display help") },
+      { name: "subcommand", type: String, defaultOption: true, description: "Subcommand: register, list, remove, remove-all" },
+      { name: "name", type: String, description: "Name/description for the passkey (used with register)" },
+      { name: "id", type: String, description: "Passkey ID to remove (used with remove)" }
+    ],
+    run: /* @__PURE__ */ __name(async (argv, process2) => {
+      if (!process2) return 1;
+      const currentUid = shell.credentials.uid;
+      const user2 = kernel.users.get(currentUid);
+      if (!user2) {
+        await writelnStderr(process2, terminal, chalk$1.red("Error: Current user not found"));
+        return 1;
+      }
+      const subcommand = argv.subcommand?.toLowerCase();
+      if (!subcommand || subcommand === "help" || argv.help) {
+        await writelnStdout(process2, terminal, "Usage: passkey <subcommand> [options]");
+        await writelnStdout(process2, terminal, "");
+        await writelnStdout(process2, terminal, "Subcommands:");
+        await writelnStdout(process2, terminal, "  register [--name <name>]    Register a new passkey");
+        await writelnStdout(process2, terminal, "  list                        List all registered passkeys");
+        await writelnStdout(process2, terminal, "  remove --id <id>            Remove a specific passkey");
+        await writelnStdout(process2, terminal, "  remove-all                  Remove all passkeys");
+        return 0;
+      }
+      try {
+        switch (subcommand) {
+          case "register": {
+            if (!kernel.auth.passkey.isSupported()) {
+              await writelnStderr(process2, terminal, chalk$1.red("Error: WebAuthn is not supported in this browser"));
+              return 1;
+            }
+            const name = argv.name || void 0;
+            const username = user2.username;
+            const userId = new TextEncoder().encode(username);
+            const challenge = crypto.getRandomValues(new Uint8Array(32));
+            const rpId = globalThis.location.hostname || "localhost";
+            const createOptions = {
+              challenge,
+              rp: {
+                name: kernel.name || "ecmaOS",
+                id: rpId
+              },
+              user: {
+                id: userId,
+                name: username,
+                displayName: username
+              },
+              pubKeyCredParams: [
+                { type: "public-key", alg: -7 },
+                { type: "public-key", alg: -257 }
+              ],
+              authenticatorSelection: {
+                userVerification: "preferred"
+              },
+              timeout: 6e4
+            };
+            await writelnStdout(process2, terminal, chalk$1.yellow("Please interact with your authenticator to register a passkey..."));
+            const credential = await kernel.auth.passkey.create(createOptions);
+            if (!credential || !(credential instanceof PublicKeyCredential)) {
+              await writelnStderr(process2, terminal, chalk$1.red("Error: Failed to create passkey. Registration cancelled or failed."));
+              return 1;
+            }
+            const publicKeyCredential = credential;
+            const response = publicKeyCredential.response;
+            const credentialId = btoa(String.fromCharCode(...new Uint8Array(publicKeyCredential.rawId)));
+            let publicKeyArray;
+            try {
+              if (typeof response.getPublicKey === "function") {
+                try {
+                  const publicKeyCrypto = response.getPublicKey();
+                  if (publicKeyCrypto && publicKeyCrypto instanceof CryptoKey) {
+                    const publicKeyJwk = await crypto.subtle.exportKey("jwk", publicKeyCrypto);
+                    publicKeyArray = new TextEncoder().encode(JSON.stringify(publicKeyJwk));
+                  } else {
+                    throw new Error("getPublicKey() did not return a valid CryptoKey");
+                  }
+                } catch (exportError) {
+                  await writelnStderr(process2, terminal, chalk$1.yellow(`Warning: Could not extract public key via getPublicKey(): ${exportError instanceof Error ? exportError.message : String(exportError)}. Using attestationObject instead.`));
+                  const attestationObject = response.attestationObject;
+                  publicKeyArray = new Uint8Array(attestationObject);
+                }
+              } else {
+                const attestationObject = response.attestationObject;
+                publicKeyArray = new Uint8Array(attestationObject);
+              }
+            } catch (error) {
+              await writelnStderr(process2, terminal, chalk$1.red(`Error processing credential data: ${error instanceof Error ? error.message : String(error)}`));
+              return 1;
+            }
+            const passkey = {
+              id: crypto.randomUUID(),
+              credentialId,
+              publicKey: publicKeyArray,
+              createdAt: Date.now(),
+              name
+            };
+            await kernel.users.addPasskey(currentUid, passkey);
+            await writelnStdout(process2, terminal, chalk$1.green(`Passkey registered successfully${name ? `: ${name}` : ""}`));
+            await writelnStdout(process2, terminal, `Passkey ID: ${passkey.id}`);
+            return 0;
+          }
+          case "list": {
+            const passkeys = await kernel.users.getPasskeys(currentUid);
+            if (passkeys.length === 0) {
+              await writelnStdout(process2, terminal, "No passkeys registered for this user.");
+              return 0;
+            }
+            await writelnStdout(process2, terminal, `Registered passkeys (${passkeys.length}):`);
+            await writelnStdout(process2, terminal, "");
+            for (const pk of passkeys) {
+              const createdDate = new Date(pk.createdAt).toLocaleString();
+              const lastUsedDate = pk.lastUsed ? new Date(pk.lastUsed).toLocaleString() : "Never";
+              await writelnStdout(process2, terminal, `  ID: ${pk.id}`);
+              if (pk.name) {
+                await writelnStdout(process2, terminal, `    Name: ${pk.name}`);
+              }
+              await writelnStdout(process2, terminal, `    Created: ${createdDate}`);
+              await writelnStdout(process2, terminal, `    Last used: ${lastUsedDate}`);
+              await writelnStdout(process2, terminal, "");
+            }
+            return 0;
+          }
+          case "remove": {
+            const id = argv.id;
+            if (!id) {
+              await writelnStderr(process2, terminal, chalk$1.red("Error: --id is required for remove command"));
+              await writelnStdout(process2, terminal, "Usage: passkey remove --id <id>");
+              return 1;
+            }
+            const passkeys = await kernel.users.getPasskeys(currentUid);
+            const passkey = passkeys.find((pk) => pk.id === id);
+            if (!passkey) {
+              await writelnStderr(process2, terminal, chalk$1.red(`Error: Passkey with ID ${id} not found`));
+              return 1;
+            }
+            await kernel.users.removePasskey(currentUid, id);
+            await writelnStdout(process2, terminal, chalk$1.green(`Passkey removed successfully${passkey.name ? `: ${passkey.name}` : ""}`));
+            return 0;
+          }
+          case "remove-all": {
+            const passkeys = await kernel.users.getPasskeys(currentUid);
+            if (passkeys.length === 0) {
+              await writelnStdout(process2, terminal, "No passkeys to remove.");
+              return 0;
+            }
+            await kernel.users.savePasskeys(currentUid, []);
+            const passkeysPath = `${user2.home}/.passkeys`;
+            try {
+              await kernel.filesystem.fs.unlink(passkeysPath);
+            } catch {
+            }
+            await writelnStdout(process2, terminal, chalk$1.green(`Removed ${passkeys.length} passkey(s)`));
+            return 0;
+          }
+          default:
+            await writelnStderr(process2, terminal, chalk$1.red(`Error: Unknown subcommand: ${subcommand}`));
+            await writelnStdout(process2, terminal, 'Run "passkey help" for usage information');
+            return 1;
+        }
+      } catch (error) {
+        await writelnStderr(process2, terminal, chalk$1.red(`Error: ${error instanceof Error ? error.message : String(error)}`));
+        return 1;
+      }
+    }, "run")
+  });
+}
 __name(createCommand$2, "createCommand$2");
 function parseSedExpression(expr) {
   expr = expr.trim();
@@ -66168,22 +66405,23 @@ function createCommand(kernel, shell, terminal) {
 __name(createCommand, "createCommand");
 function createAllCommands(kernel, shell, terminal) {
   return {
-    cat: createCommand$h(kernel, shell, terminal),
-    cd: createCommand$g(kernel, shell, terminal),
-    chmod: createCommand$f(kernel, shell, terminal),
-    cp: createCommand$e(kernel, shell, terminal),
-    echo: createCommand$d(kernel, shell, terminal),
-    ln: createCommand$c(kernel, shell, terminal),
-    ls: createCommand$b(kernel, shell, terminal),
-    mkdir: createCommand$a(kernel, shell, terminal),
-    mv: createCommand$9(kernel, shell, terminal),
-    pwd: createCommand$8(kernel, shell, terminal),
-    rm: createCommand$7(kernel, shell, terminal),
-    rmdir: createCommand$6(kernel, shell, terminal),
-    stat: createCommand$5(kernel, shell, terminal),
-    touch: createCommand$4(kernel, shell, terminal),
-    hex: createCommand$3(kernel, shell, terminal),
-    less: createCommand$2(kernel, shell, terminal),
+    cat: createCommand$i(kernel, shell, terminal),
+    cd: createCommand$h(kernel, shell, terminal),
+    chmod: createCommand$g(kernel, shell, terminal),
+    cp: createCommand$f(kernel, shell, terminal),
+    echo: createCommand$e(kernel, shell, terminal),
+    ln: createCommand$d(kernel, shell, terminal),
+    ls: createCommand$c(kernel, shell, terminal),
+    mkdir: createCommand$b(kernel, shell, terminal),
+    mv: createCommand$a(kernel, shell, terminal),
+    pwd: createCommand$9(kernel, shell, terminal),
+    rm: createCommand$8(kernel, shell, terminal),
+    rmdir: createCommand$7(kernel, shell, terminal),
+    stat: createCommand$6(kernel, shell, terminal),
+    touch: createCommand$5(kernel, shell, terminal),
+    hex: createCommand$4(kernel, shell, terminal),
+    less: createCommand$3(kernel, shell, terminal),
+    passkey: createCommand$2(kernel, shell, terminal),
     sed: createCommand$1(kernel, shell, terminal),
     tee: createCommand(kernel, shell, terminal)
   };
@@ -66289,7 +66527,7 @@ const TerminalCommands = /* @__PURE__ */ __name((kernel, shell, terminal) => {
         { name: "reinstall", type: Boolean, description: "Reinstall the package if it is already installed" }
       ],
       run: /* @__PURE__ */ __name(async (argv) => {
-        const { default: install } = await import("./install-DIY-HQ9n.js");
+        const { default: install } = await import("./install-CNseKaMB.js");
         return await install({ kernel, shell, terminal, args: [argv.package, argv.registry, argv.reinstall] });
       }, "run")
     }),
@@ -66304,7 +66542,7 @@ const TerminalCommands = /* @__PURE__ */ __name((kernel, shell, terminal) => {
         { name: "package", type: String, typeLabel: "{underline package}", defaultOption: true, description: "The package name and optional version (e.g. package@1.0.0). If no version is specified, all versions will be uninstalled." }
       ],
       run: /* @__PURE__ */ __name(async (argv) => {
-        const { default: uninstall } = await import("./uninstall-BOyXf2bF.js");
+        const { default: uninstall } = await import("./uninstall-CamF7_kP.js");
         return await uninstall({ kernel, shell, terminal, args: [argv.package] });
       }, "run")
     }),
@@ -72157,10 +72395,27 @@ const _Users = class _Users {
   /**
    * Login a user
    */
-  async login(username, password) {
+  async login(username, password, passkeyCredential) {
     const user2 = Array.from(this._users.values()).find((u) => u.username === username);
-    const hashedPassword = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(password.trim()));
-    if (!user2 || user2.password !== Array.from(new Uint8Array(hashedPassword)).map((b) => b.toString(16).padStart(2, "0")).join("")) throw new Error("Invalid username or password");
+    if (!user2) throw new Error("Invalid username or password");
+    if (passkeyCredential) {
+      const passkeys = await this.getPasskeys(user2.uid);
+      const credential = passkeyCredential;
+      const credentialId = btoa(String.fromCharCode(...new Uint8Array(credential.rawId)));
+      const matchingPasskey = passkeys.find((pk) => pk.credentialId === credentialId);
+      if (!matchingPasskey) {
+        throw new Error("Passkey not found for this user");
+      }
+      matchingPasskey.lastUsed = Date.now();
+      await this.savePasskeys(user2.uid, passkeys);
+    } else if (password) {
+      const hashedPassword = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(password.trim()));
+      if (user2.password !== Array.from(new Uint8Array(hashedPassword)).map((b) => b.toString(16).padStart(2, "0")).join("")) {
+        throw new Error("Invalid username or password");
+      }
+    } else {
+      throw new Error("Password or passkey required");
+    }
     const cred = createCredentials({
       uid: user2.uid,
       gid: user2.gid,
@@ -72204,6 +72459,77 @@ const _Users = class _Users {
       throw new Error(`User with UID ${uid} not found`);
     }
   }
+  /**
+   * Get all passkeys for a user
+   */
+  async getPasskeys(uid) {
+    const user2 = this._users.get(uid);
+    if (!user2) return [];
+    const passkeysPath = `${user2.home}/.passkeys`;
+    try {
+      const exists2 = await this._options.kernel.filesystem.fs.exists(passkeysPath);
+      if (!exists2) return [];
+      const content = await this._options.kernel.filesystem.fs.readFile(passkeysPath, "utf-8");
+      const parsed = JSON.parse(content);
+      return parsed.map((pk) => {
+        const publicKeyArray = JSON.parse(pk.publicKey);
+        return {
+          ...pk,
+          publicKey: new Uint8Array(publicKeyArray)
+        };
+      });
+    } catch (error) {
+      this._options.kernel.log.warn(`Failed to read passkeys for user ${uid}: ${error}`);
+      return [];
+    }
+  }
+  /**
+   * Save passkeys for a user
+   */
+  async savePasskeys(uid, passkeys) {
+    const user2 = this._users.get(uid);
+    if (!user2) throw new Error(`User with UID ${uid} not found`);
+    const passkeysPath = `${user2.home}/.passkeys`;
+    const serialized = passkeys.map((pk) => {
+      const publicKeyArray = pk.publicKey instanceof ArrayBuffer ? Array.from(new Uint8Array(pk.publicKey)) : Array.from(pk.publicKey);
+      return {
+        ...pk,
+        publicKey: JSON.stringify(publicKeyArray)
+      };
+    });
+    await this._options.kernel.filesystem.fs.writeFile(
+      passkeysPath,
+      JSON.stringify(serialized, null, 2),
+      { encoding: "utf-8", mode: 384 }
+    );
+    try {
+      await this._options.kernel.filesystem.fs.chown(passkeysPath, uid, user2.gid);
+    } catch {
+    }
+  }
+  /**
+   * Add a passkey to a user's collection
+   */
+  async addPasskey(uid, passkey) {
+    const existing = await this.getPasskeys(uid);
+    existing.push(passkey);
+    await this.savePasskeys(uid, existing);
+  }
+  /**
+   * Remove a passkey by ID
+   */
+  async removePasskey(uid, passkeyId) {
+    const existing = await this.getPasskeys(uid);
+    const filtered = existing.filter((pk) => pk.id !== passkeyId);
+    await this.savePasskeys(uid, filtered);
+  }
+  /**
+   * Check if a user has any registered passkeys
+   */
+  async hasPasskeys(uid) {
+    const passkeys = await this.getPasskeys(uid);
+    return passkeys.length > 0;
+  }
 };
 __name(_Users, "Users");
 let Users = _Users;
@@ -73568,10 +73894,10 @@ const _Workers = class _Workers {
 };
 __name(_Workers, "Workers");
 let Workers = _Workers;
-const __vite_import_meta_env__ = { "AUTHOR": { "name": "Jay Mathis", "email": "code@mathis.network", "url": "https://github.com/mathiscode" }, "BASE_URL": "/", "DESCRIPTION": "ecmaOS: Micro-kernel and framework for web technologies", "DEV": false, "HOMEPAGE": "https://ecmaos.sh", "KNOWN_ISSUES": ["It's best to stick to Chromium-based browsers for the most features", "Keyboard is broken on mobile; ecmaOS is not mobile-friendly at this time", "Don't expect any sort of POSIX compliance at this stage", "Most commands/devices are very basic implementations, not complete reproductions", "stdin/stdout/stderr streams and redirection can be wonky and don't work everywhere, but are coming along", "CTRL-C will return you to a prompt, but doesn't currently interrupt a process", "Lots of unfinished work; watch your step"], "MODE": "production", "NAME": "@ecmaos/kernel", "PROD": true, "REPOSITORY": "https://github.com/ecmaos/ecmaos", "SSR": false, "TIPS": ["If it ever fails to boot, check your logs or try clearing all data", "You can run some devices that offer a CLI - e.g. '/dev/battery --help'", "Use the 'install' command to install packages - e.g. 'install @ecmaos-apps/news'", "You can install any NPM package - e.g. 'install jquery'", "Use the 'news' command to see the latest news about ecmaOS", "Type 'ls /bin' to see all built-in commands", "Type 'ls /usr/bin' to see all installed commands", "You can set your environment variables in ~/.env (try setting PROMPT to a PS1-like format)", "Try 'fetch /xkcd-os.sixel'"], "VERSION": "0.6.4", "VITE_APP_SHOW_DEFAULT_LOGIN": "true", "VITE_AUTOLOGIN_PASSWORD": "root", "VITE_AUTOLOGIN_USERNAME": "root", "VITE_BOOT_DISABLE_ISSUES": "true", "VITE_BOOT_DISABLE_LOGO_CONSOLE": "false", "VITE_BOOT_DISABLE_LOGO_FIGLET": "false", "VITE_BOOT_DISABLE_TIPS": "false", "VITE_INITFS": "/initfs.tar.gz", "VITE_KERNEL_INTERVALS_PROC": "1000", "VITE_KERNEL_MODULES": "@ecmaos-modules/boilerplate@0.1.0", "VITE_METAL_SOCKET": "ws://localhost:30445/socket", "VITE_PORT": "30443", "VITE_RECOMMENDED_APPS": "@ecmaos-apps/code,@ecmaos-apps/edit,@ecmaos-apps/ai,@ecmaos-apps/webamp,@ecmaos-apps/news", "XTERM_VERSION": "5.5.0", "ZENFS_VERSION": "2.4.2" };
+const __vite_import_meta_env__ = { "AUTHOR": { "name": "Jay Mathis", "email": "code@mathis.network", "url": "https://github.com/mathiscode" }, "BASE_URL": "/", "DESCRIPTION": "ecmaOS: Micro-kernel and framework for web technologies", "DEV": false, "HOMEPAGE": "https://ecmaos.sh", "KNOWN_ISSUES": ["It's best to stick to Chromium-based browsers for the most features", "Keyboard is broken on mobile; ecmaOS is not mobile-friendly at this time", "Don't expect any sort of POSIX compliance at this stage", "Most commands/devices are very basic implementations, not complete reproductions", "stdin/stdout/stderr streams and redirection can be wonky and don't work everywhere, but are coming along", "CTRL-C will return you to a prompt, but doesn't currently interrupt a process", "Lots of unfinished work; watch your step"], "MODE": "production", "NAME": "@ecmaos/kernel", "PROD": true, "REPOSITORY": "https://github.com/ecmaos/ecmaos", "SSR": false, "TIPS": ["If it ever fails to boot, check your logs, try clearing all data, try incognito mode, or try another browser", "You can run some devices that offer a CLI - e.g. '/dev/battery --help'", "Use the 'install' command to install packages - e.g. 'install @ecmaos-apps/news'", "You can install any NPM package - e.g. 'install jquery'", "Use the 'news' command to see the latest news about ecmaOS", "Type 'ls /bin' to see all built-in commands", "Type 'ls /usr/bin' to see all installed commands", "You can set your environment variables in ~/.env (try setting PROMPT to a PS1-like format)", "You can register and login with a passkey: 'passkey register' and 'passkey list'", "Try 'fetch /xkcd-os.sixel'"], "VERSION": "0.6.5", "VITE_APP_SHOW_DEFAULT_LOGIN": "true", "VITE_BOOT_DISABLE_ISSUES": "true", "VITE_BOOT_DISABLE_LOGO_CONSOLE": "false", "VITE_BOOT_DISABLE_LOGO_FIGLET": "false", "VITE_BOOT_DISABLE_TIPS": "false", "VITE_INITFS": "/initfs.tar.gz", "VITE_KERNEL_INTERVALS_PROC": "1000", "VITE_KERNEL_MODULES": "@ecmaos-modules/boilerplate@0.1.0", "VITE_METAL_SOCKET": "ws://localhost:30445/socket", "VITE_PORT": "30443", "VITE_RECOMMENDED_APPS": "@ecmaos-apps/code,@ecmaos-apps/edit,@ecmaos-apps/ai,@ecmaos-apps/webamp,@ecmaos-apps/news", "XTERM_VERSION": "5.5.0", "ZENFS_VERSION": "2.4.2" };
 var define_import_meta_env_AUTHOR_default = { name: "Jay Mathis", email: "code@mathis.network", url: "https://github.com/mathiscode" };
 var define_import_meta_env_KNOWN_ISSUES_default = ["It's best to stick to Chromium-based browsers for the most features", "Keyboard is broken on mobile; ecmaOS is not mobile-friendly at this time", "Don't expect any sort of POSIX compliance at this stage", "Most commands/devices are very basic implementations, not complete reproductions", "stdin/stdout/stderr streams and redirection can be wonky and don't work everywhere, but are coming along", "CTRL-C will return you to a prompt, but doesn't currently interrupt a process", "Lots of unfinished work; watch your step"];
-var define_import_meta_env_TIPS_default = ["If it ever fails to boot, check your logs or try clearing all data", "You can run some devices that offer a CLI - e.g. '/dev/battery --help'", "Use the 'install' command to install packages - e.g. 'install @ecmaos-apps/news'", "You can install any NPM package - e.g. 'install jquery'", "Use the 'news' command to see the latest news about ecmaOS", "Type 'ls /bin' to see all built-in commands", "Type 'ls /usr/bin' to see all installed commands", "You can set your environment variables in ~/.env (try setting PROMPT to a PS1-like format)", "Try 'fetch /xkcd-os.sixel'"];
+var define_import_meta_env_TIPS_default = ["If it ever fails to boot, check your logs, try clearing all data, try incognito mode, or try another browser", "You can run some devices that offer a CLI - e.g. '/dev/battery --help'", "Use the 'install' command to install packages - e.g. 'install @ecmaos-apps/news'", "You can install any NPM package - e.g. 'install jquery'", "Use the 'news' command to see the latest news about ecmaOS", "Type 'ls /bin' to see all built-in commands", "Type 'ls /usr/bin' to see all installed commands", "You can set your environment variables in ~/.env (try setting PROMPT to a PS1-like format)", "You can register and login with a passkey: 'passkey register' and 'passkey list'", "Try 'fetch /xkcd-os.sixel'"];
 const DefaultKernelOptions = {
   devices: DefaultDevices,
   dom: DefaultDomOptions,
@@ -73613,7 +73939,7 @@ const _Kernel = class _Kernel {
     /** Name of the kernel */
     __publicField(this, "name", "@ecmaos/kernel");
     /** Version string of the kernel */
-    __publicField(this, "version", "0.6.4");
+    __publicField(this, "version", "0.6.5");
     /** Authentication and authorization service */
     __publicField(this, "auth");
     /** BIOS module providing low-level functionality */
@@ -73771,7 +74097,7 @@ const _Kernel = class _Kernel {
         ];
         this.terminal.writeln(chalk$2.red.bold(`🐉  ${t2("kernel.experimental", "EXPERIMENTAL")} 🐉`));
         this.terminal.writeln(
-          `${this.terminal.createSpecialLink("https://ecmaos.sh", "@ecmaos/kernel")}@${"0.6.4"}` + chalk$2.cyan(` [${dependencyLinks.map((link2) => link2.link).join(", ")}]`)
+          `${this.terminal.createSpecialLink("https://ecmaos.sh", "@ecmaos/kernel")}@${"0.6.5"}` + chalk$2.cyan(` [${dependencyLinks.map((link2) => link2.link).join(", ")}]`)
         );
         this.terminal.writeln(`${t2("kernel.madeBy", "Made with ❤️  by Jay Mathis")} ${this.terminal.createSpecialLink(
           define_import_meta_env_AUTHOR_default?.url || "https://github.com/mathiscode",
@@ -73788,14 +74114,14 @@ const _Kernel = class _Kernel {
         if (logoFiglet && true) {
           console.log(`%c${logoFiglet}`, "color: green");
           console.log(`%c${"https://github.com/ecmaos/ecmaos"}`, "color: blue; text-decoration: underline; font-size: 16px");
-          this.log.info(`${"@ecmaos/kernel"} v${"0.6.4"}`);
+          this.log.info(`${"@ecmaos/kernel"} v${"0.6.5"}`);
         }
         if (Notification?.permission === "default") Notification.requestPermission();
         if (Notification?.permission === "denied") this.log.warn(t2("kernel.permissionNotificationDenied", "Notification permission denied"));
         this.intervals.set("title-blink", () => {
           globalThis.document.title = globalThis.document.title.includes("_") ? "ecmaos# " : "ecmaos# _";
         }, 600);
-        this.toast.success(`${"@ecmaos/kernel"} v${"0.6.4"}`);
+        this.toast.success(`${"@ecmaos/kernel"} v${"0.6.5"}`);
       }
       await this.configure({ devices: this.options.devices || DefaultDevices, filesystem: Filesystem.options() });
       const requiredPaths = [
@@ -73956,20 +74282,62 @@ const _Kernel = class _Kernel {
             const icon = isSecure ? "🔒" : "🔓";
             this.terminal.writeln(`${icon}  ${protocolStr}//${hostname}${port}`);
             const username = await this.terminal.readline(`👤  ${this.i18n.t("Username")}: `);
-            const password = await this.terminal.readline(`🔑  ${this.i18n.t("Password")}: `, true);
-            const { user: user22, cred } = await this.users.login(username, password);
-            this.shell.credentials = cred;
-            this.shell.context = bindContext({ root: "/", pwd: "/", credentials: cred });
+            const user22 = Array.from(this.users.all.values()).find((u) => u.username === username);
+            let loginSuccess = false;
+            let userCred = null;
+            if (user22) {
+              const passkeys = await this.users.getPasskeys(user22.uid);
+              if (passkeys.length > 0 && this.auth.passkey.isSupported()) {
+                try {
+                  const challenge = crypto.getRandomValues(new Uint8Array(32));
+                  const rpId = globalThis.location.hostname || "localhost";
+                  const allowCredentials = passkeys.map((pk) => {
+                    const credentialIdBytes = Uint8Array.from(atob(pk.credentialId), (c) => c.charCodeAt(0));
+                    return {
+                      id: credentialIdBytes.buffer,
+                      type: "public-key",
+                      transports: ["usb", "nfc", "ble", "internal"]
+                    };
+                  });
+                  const requestOptions = {
+                    challenge,
+                    allowCredentials,
+                    rpId,
+                    userVerification: "preferred",
+                    timeout: 6e4
+                  };
+                  this.terminal.writeln(chalk$2.yellow("🔐  Please use your passkey to authenticate..."));
+                  const credential = await this.auth.passkey.get(requestOptions);
+                  if (credential && credential instanceof PublicKeyCredential) {
+                    userCred = await this.users.login(username, void 0, credential);
+                    loginSuccess = true;
+                  } else {
+                    this.terminal.writeln(chalk$2.yellow("Passkey authentication cancelled or failed. Falling back to password..."));
+                  }
+                } catch (err2) {
+                  this.terminal.writeln(chalk$2.yellow(`Passkey authentication error: ${err2.message}. Falling back to password...`));
+                }
+              }
+            }
+            if (!loginSuccess) {
+              const password = await this.terminal.readline(`🔑  ${this.i18n.t("Password")}: `, true);
+              userCred = await this.users.login(username, password);
+            }
+            if (!userCred) {
+              throw new Error("Login failed");
+            }
+            this.shell.credentials = userCred.cred;
+            this.shell.context = bindContext({ root: "/", pwd: "/", credentials: userCred.cred });
             await this.shell.loadEnvFile();
-            this.shell.env.set("UID", user22.uid.toString());
-            this.shell.env.set("GID", user22.gid.toString());
-            this.shell.env.set("SUID", cred.suid.toString());
-            this.shell.env.set("SGID", cred.sgid.toString());
-            this.shell.env.set("EUID", cred.euid.toString());
-            this.shell.env.set("EGID", cred.egid.toString());
-            this.shell.env.set("SHELL", user22.shell || "ecmaos");
-            this.shell.env.set("HOME", user22.home || "/root");
-            this.shell.env.set("USER", user22.username);
+            this.shell.env.set("UID", userCred.user.uid.toString());
+            this.shell.env.set("GID", userCred.user.gid.toString());
+            this.shell.env.set("SUID", userCred.cred.suid.toString());
+            this.shell.env.set("SGID", userCred.cred.sgid.toString());
+            this.shell.env.set("EUID", userCred.cred.euid.toString());
+            this.shell.env.set("EGID", userCred.cred.egid.toString());
+            this.shell.env.set("SHELL", userCred.user.shell || "ecmaos");
+            this.shell.env.set("HOME", userCred.user.home || "/root");
+            this.shell.env.set("USER", userCred.user.username);
             process$1.env = Object.fromEntries(this.shell.env);
             break;
           } catch (err2) {
@@ -74499,7 +74867,7 @@ const _Kernel = class _Kernel {
       memory: "?",
       platform: navigator.userAgentData?.platform || navigator?.platform || navigator.userAgent,
       querystring: location.search,
-      version: `${"@ecmaos/kernel"} ${"0.6.4"}`,
+      version: `${"@ecmaos/kernel"} ${"0.6.5"}`,
       language: navigator.language,
       host: location.host,
       userAgent: navigator.userAgent,
@@ -74676,4 +75044,4 @@ export {
   path$1 as p,
   semver as s
 };
-//# sourceMappingURL=kernel-DtEbpoeV.js.map
+//# sourceMappingURL=kernel-C_Xvcpox.js.map