@stacksjs/defaults 0.75.180 → 0.75.182

package/ai/skills/stacks-auth/SKILL.md

@@ -337,18 +337,43 @@ const result = await actions.resetPassword(token, newPassword)
 - `logout(): Promise<void>`
 - `refresh(): Promise<void>`
 
-## Passkey/WebAuthn (passkey.ts)
-
-- `getUserPasskeys(userId): Promise<PasskeyAttribute[]>`
-- `getUserPasskey(userId, passkeyId): Promise<PasskeyAttribute | undefined>`
-- `setCurrentRegistrationOptions(user, verified): Promise<void>`
-
-### Re-exported from @stacksjs/ts-auth
-- `generateRegistrationOptions`, `generateAuthenticationOptions`
-- `verifyRegistrationResponse`, `verifyAuthenticationResponse`
-- `startRegistration`, `startAuthentication` (browser)
-- `browserSupportsWebAuthn`, `browserSupportsWebAuthnAutofill`
-- `platformAuthenticatorIsAvailable`
+## Passkey/WebAuthn
+
+Opt in with `config.auth.passkeys: { enabled: true, origin?: string, name?: string }`.
+The canonical origin defaults to `config.app.url`; production requires HTTPS.
+`buddy migrate` / `buddy auth:setup` create `passkey_ceremonies` and `passkeys`.
+
+- `beginPasskeyRegistration({ id, email?, name? }, { origin, name })` returns
+  `{ ceremony, options }` as JSON. Call only for the authenticated account.
+- `finishPasskeyRegistration(userId, ceremony, credentialJSON, party)` consumes
+  the account-bound challenge and saves only verified resident credentials.
+- `beginPasskeyAuthentication(party)` returns discoverable options without an
+  email lookup, usable with conditional mediation and `autocomplete="username webauthn"`.
+- `finishPasskeyAuthentication(ceremony, credentialJSON, party)` returns the
+  verified user ID; the application then issues its usual session.
+- `listPasskeys(userId)` returns display-safe metadata, never public-key material.
+- `removePasskey(userId, id, hasAlternativeSignIn?)` serializes removals and
+  refuses to remove the last key without another login method. Supply a callback
+  when password hashes may be unusable placeholders or other factors exist.
+
+Default routes under `/auth/passkeys` expose registration/options, registration,
+authentication/options, authentication (POST), listing (GET) and deletion (DELETE
+`/{id}`). Public authentication endpoints require the canonical Origin header;
+enrollment/removal also require auth and CSRF protection. Deleting the last key
+requires proving the fallback password in the request. All responses are no-store.
+
+Browser code imports **`@stacksjs/auth/passkeys-browser`**, never the server barrel.
+It exports `startRegistration`, `startAuthentication(options, { signal?, mediation? })`,
+`browserSupportsWebAuthn`, `browserSupportsWebAuthnAutofill`, the JSON option/credential
+codecs and types. Abort a pending conditional request before explicit sign-in or
+password submission, and on unmount. Serialize results using
+`registrationCredentialToJSON` / `authenticationCredentialToJSON` before POSTing.
+Native JS contexts require a platform passkey bridge; web support alone does not
+provide one. Keep existing native sign-in available until that bridge exists.
+
+Legacy helpers (`getUserPasskeys`, `getUserPasskey`, `storeWebAuthnChallenge`,
+`consumeWebAuthnChallenge`) remain for existing integrations. New flows should
+use the ceremony API, which supports concurrent anonymous browser attempts.
 
 ## Auth Middleware (middleware.ts)
 

package/ai/skills/stacks-dashboard/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stacks-dashboard
-description: Use when building or customizing the Stacks admin dashboard, including dashboard pages, model management views, analytics widgets, commerce dashboards, content management, settings panels, deployment monitoring, job/queue management, or the 414 built-in dashboard components. Covers the dashboard system at storage/framework/defaults/.
+description: Use when building or customizing the Stacks admin dashboard, including dashboard pages, model management views, analytics widgets, commerce dashboards, content management, settings panels, deployment monitoring, job/queue management, or the 413 built-in dashboard components. Covers the dashboard system at storage/framework/defaults/.
 license: MIT
 compatibility: Bun >= 1.3.0, TypeScript
 allowed-tools: Read Edit Write Bash Grep Glob
@@ -8,7 +8,7 @@ allowed-tools: Read Edit Write Bash Grep Glob
 
 # Stacks Dashboard
 
-The Stacks admin dashboard provides a full-featured admin panel with 100+ route views, 414 components, and a multi-section layout.
+The Stacks admin dashboard provides a full-featured admin panel with 100+ route views, 413 components, and a multi-section layout.
 
 ## Key Paths
 - Dashboard components: `storage/framework/defaults/resources/components/Dashboard/`

package/ai/skills/stacks-mobile/SKILL.md

@@ -466,10 +466,12 @@ option the original metres heuristic remains for unlabelled inputs.
 - A screen that is a task of its own (a workout player, a composer) marks an
   element `data-native-hide-tab-bar`, and the tab bar steps away while it is
   shown, its reserved space with it.
-- `<Video :src="current.url">` is the framework's player (ts-video-player):
-  YouTube, Vimeo, HLS, DASH or a file. `src` is reactive, so one player in a
-  sheet can show whichever video is chosen; clearing it pauses the player.
-  Craft lets an https iframe load inside the app, so embeds play inline.
+- `<Video :src="current.url" autoplay>` is the player from
+  `@stacksjs/components` (ts-video-player): YouTube, Vimeo, HLS, DASH or a
+  file, with controls in the page's language. `src`, `poster`, `aspectRatio`
+  and `label` are reactive, so one player in a sheet can show whichever video
+  is chosen, `autoplay` starts each one, and clearing `src` pauses it. Craft
+  lets an https iframe load inside the app, so embeds play inline.
 
 `<NativeTabItem match="/m/workout">` keeps a tab lit on the detail screens
 opened from it. A tab bar is a `<nav>`, where a link is otherwise current only

package/ai/skills/stacks-native/CATALOG.md

@@ -18,7 +18,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 7 |
 | `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 6 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 2 |
-| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 112 |
+| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 113 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
 | `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 7 |
 | `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 145 |
@@ -183,9 +183,9 @@ Guidance: [`stacks-auth`](../stacks-auth/SKILL.md). Source: [storage/framework/c
 
 Declared runtime exports: `DEFAULT_ROLE_PACKS`, `createBqbRbacStore`, `generateTOTP`, `generateTOTPSecret`, `seedDefaultRoles`, `totpKeyUri`, `verifyTOTP`.
 
-Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
+Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/passkeys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkeys.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
 
-Evidence directory: [112 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [113 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/browser
 

package/app/Actions/Auth/PasskeyAuthenticationAction.ts

@@ -0,0 +1,23 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { finishPasskeyAuthentication, Auth, resolveBrowserSessionPolicy, authCookieForBrowserSession } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyAuthentication',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    if (request.headers.get('origin') !== new URL(party.origin).origin) return new Response(null, { status: 403 })
+    try {
+      const body = request.all()
+      const id = await finishPasskeyAuthentication(body.ceremony, body.credential, party)
+      const policy = resolveBrowserSessionPolicy(body.remember)
+      const session = await Auth.loginUsingId(id, { expiresInMinutes: policy.expiresInMinutes, withRefreshToken: policy.withRefreshToken })
+      if (!session) return new Response(null, { status: 401 })
+      return Response.json({ token: session.token, user: { id: session.user?.id, email: session.user?.email, name: session.user?.name }, expires_in: session.expiresIn, remembered: policy.remembered },
+        { headers: { 'Cache-Control': 'no-store', 'Set-Cookie': authCookieForBrowserSession(session.token, session.expiresIn) } })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyAuthenticationOptionsAction.ts

@@ -0,0 +1,17 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { beginPasskeyAuthentication } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyAuthenticationOptions',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    if (request.headers.get('origin') !== new URL(party.origin).origin) return new Response(null, { status: 403 })
+    try {
+      return passkeyJSON(await beginPasskeyAuthentication(party))
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyDestroyAction.ts

@@ -0,0 +1,24 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { verifyHash } from '@stacksjs/security'
+import { removePasskey } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyDestroy',
+  method: 'DELETE',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      const id = request.getParam('id')
+      if (typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,1366}$/.test(id)) return new Response(null, { status: 422 })
+      return await removePasskey(Number(user.id), id, async row => {
+        const password = request.get('password')
+        return typeof password === 'string' && !!password && typeof row.password === 'string' && await verifyHash(password, row.password)
+      }) ? passkeyJSON({ ok: true }) : new Response(null, { status: 404 })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyIndexAction.ts

@@ -0,0 +1,18 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { listPasskeys } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyIndex',
+  method: 'GET',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      return passkeyJSON({ passkeys: await listPasskeys(Number(user.id)) })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyRegistrationAction.ts

@@ -0,0 +1,20 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { finishPasskeyRegistration } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyRegistration',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      const body = request.all()
+      await finishPasskeyRegistration(Number(user.id), body.ceremony, body.credential, party)
+      return passkeyJSON({ ok: true })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyRegistrationOptionsAction.ts

@@ -0,0 +1,18 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { beginPasskeyRegistration } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyRegistrationOptions',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      return passkeyJSON(await beginPasskeyRegistration({ id: Number(user.id), email: user.email, name: user.name }, party))
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/passkey-config.ts

@@ -0,0 +1,13 @@
+import { config } from '@stacksjs/config'
+import { PasskeyError } from '@stacksjs/auth'
+export function passkeyParty() {
+  const options = config.auth.passkeys
+  return options?.enabled ? { origin: options.origin || config.app.url || 'http://localhost:3333', name: options.name || config.app.name || 'Stacks' } : null
+}
+export function passkeyFailure(error: unknown): Response {
+  if (!(error instanceof PasskeyError)) throw error
+  return Response.json({ error: error.message }, { status: 400, headers: { 'Cache-Control': 'no-store' } })
+}
+export function passkeyJSON(value: unknown): Response {
+  return Response.json(value, { headers: { 'Cache-Control': 'no-store' } })
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.180",
+  "version": "0.75.182",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.180",
+  "version": "0.75.182",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.180",
+    "@stacksjs/mobile": "0.75.182",
     "@stacksjs/sanitizer": "^0.2.483",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",

package/resources/components/index.ts

@@ -27,4 +27,3 @@ export { default as NativeSheet } from './NativeSheet.stx'
 export { default as NativeSymbol } from './NativeSymbol.stx'
 export { default as NativeTabBar } from './NativeTabBar.stx'
 export { default as NativeTabItem } from './NativeTabItem.stx'
-export { default as Video } from './Video.stx'

package/routes/auth.ts

@@ -121,3 +121,12 @@ route.group({ prefix: '/password' }, () => {
   route.post('/reset', 'Actions/Password/PasswordResetAction').rateLimit(5, 'minute')
   route.post('/verify-token', 'Actions/Password/VerifyResetTokenAction').rateLimit(10, 'minute')
 })
+
+// Discoverable passkeys: canonical JSON ceremonies, independent concurrent browser attempts.
+// Public flows carry a one-use ceremony capability; enrollment and removal also require auth/CSRF.
+route.post('/auth/passkeys/authentication/options', 'Actions/Auth/PasskeyAuthenticationOptionsAction').skipCsrf().rateLimit(10, 'minute')
+route.post('/auth/passkeys/authentication', 'Actions/Auth/PasskeyAuthenticationAction').skipCsrf().rateLimit(10, 'minute')
+route.post('/auth/passkeys/registration/options', 'Actions/Auth/PasskeyRegistrationOptionsAction').middleware('auth').rateLimit(5, 'minute')
+route.post('/auth/passkeys/registration', 'Actions/Auth/PasskeyRegistrationAction').middleware('auth').rateLimit(5, 'minute')
+route.get('/auth/passkeys', 'Actions/Auth/PasskeyIndexAction').middleware('auth')
+route.delete('/auth/passkeys/{id}', 'Actions/Auth/PasskeyDestroyAction').middleware('auth').rateLimit(10, 'minute')

package/resources/components/Video.stx

@@ -1,132 +0,0 @@
-<script server>
-interface VideoSource { src: string, type?: string }
-interface VideoDrm {
-  widevine?: { url: string, headers?: Record<string, string> }
-  playready?: { url: string, headers?: Record<string, string> }
-  fairplay?: { url: string, certificateUrl: string, headers?: Record<string, string> }
-}
-interface VideoTrack { src: string, kind: 'subtitles' | 'captions' | 'descriptions' | 'chapters' | 'metadata', srclang?: string, label?: string, default?: boolean }
-interface VideoProps {
-  src: string
-  sources?: VideoSource[]
-  drm?: VideoDrm
-  tracks?: VideoTrack[]
-  poster?: string
-  title?: string
-  width?: number
-  height?: number
-  aspectRatio?: string
-  controls?: boolean
-  autoplay?: boolean
-  loop?: boolean
-  muted?: boolean
-  playsinline?: boolean
-  preload?: 'none' | 'metadata' | 'auto'
-  crossorigin?: 'anonymous' | 'use-credentials'
-  controlslist?: string
-  disablePictureInPicture?: boolean
-  class?: string
-}
-const props = defineProps<VideoProps>()
-const src = props.src || ''
-const sources = props.sources || []
-const tracks = props.tracks || []
-const title = props.title || 'Video player'
-const poster = props.poster || ''
-const width = props.width || ''
-const height = props.height || ''
-const ratio = props.aspectRatio || (width && height ? `${width} / ${height}` : '16 / 9')
-const controls = props.controls !== false
-const inline = props.playsinline !== false
-const preload = props.preload || 'metadata'
-const crossorigin = props.crossorigin || ''
-const controlslist = props.controlslist || 'nodownload'
-const className = props.class || ''
-const playerSources = (sources.length ? sources : src ? [{ src }] : []).map(source => props.drm && (source.type === 'application/dash+xml' || source.src.split(/[?#]/, 1)[0].toLowerCase().endsWith('.mpd')) ? { ...source, type: 'application/dash+xml', drm: props.drm } : source)
-const playerTracks = tracks.map(track => ({ ...track, language: track.srclang }))
-// A YouTube or Vimeo link is a web page, not a media file: the native <video>
-// fallback cannot play it, so without the player it offers the link instead.
-const isEmbed = /^https?:\/\/(?:[\w-]+\.)*(?:youtube\.com|youtube-nocookie\.com|youtu\.be|vimeo\.com)\//i.test(src)
-const playerConfig = JSON.stringify({ sources: playerSources, tracks: playerTracks, ...(props.drm ? { drm: props.drm } : {}) }).replaceAll('<', '\\u003c').replaceAll('>', '\\u003e').replaceAll('&', '\\u0026')
-</script>
-
-<script client>
-import { registerElements } from 'ts-video-player/elements'
-registerElements()
-
-// `src` and `poster` follow the parent, so one player can show whichever
-// video is chosen: `<Video :src="current.url" />` in a sheet. An empty `src`
-// pauses it, which is what closing that sheet should do.
-const liveSrc = useReactiveProp<string>('src', '')
-const livePoster = useReactiveProp<string>('poster', '')
-const element = useRef('player')
-
-effect(() => {
-  if (!liveSrc())
-    (element.current as { player?: { pause: () => void } } | null)?.player?.pause()
-})
-</script>
-
-{{-- No src attribute until there is a video: an empty one resolves to the
-     page's own URL, which the browser then downloads as the video. --}}
-<figure class="m-0 {{ className }}">
-  <video-player
-    ref="player"
-    @if(src) src="{{ src }}" @endif
-    :src="liveSrc() || null"
-    :poster="livePoster() || null"
-    data-media-config="{{ playerConfig }}"
-    @if(poster) poster="{{ poster }}" @endif
-    @if(controls) controls @endif
-    @if(props.autoplay) autoplay @endif
-    @if(props.loop) loop @endif
-    @if(props.muted) muted @endif
-    @if(inline) playsinline @endif
-    preload="{{ preload }}"
-    @if(crossorigin) crossorigin="{{ crossorigin }}" @endif
-    controlslist="{{ controlslist }}"
-    @if(props.disablePictureInPicture) disable-picture-in-picture @endif
-    keep-alive
-    aria-label="{{ title }}"
-    class="block overflow-hidden relative w-full bg-black ring-1 ring-black/10 rounded-2xl dark:ring-white/10 focus-within:ring-2 focus-within:ring-sky-500 shadow-sm group"
-    style="aspect-ratio: {{ ratio }};"
-  >
-    <media-error-display></media-error-display>
-    @if(isEmbed)
-      <a data-native-fallback href="{{ src }}" target="_blank" rel="noopener" class="flex items-center justify-center h-full w-full text-sm text-white underline">Watch {{ title }}</a>
-    @else
-    <video data-native-fallback @if(src) src="{{ src }}" @endif @if(poster) poster="{{ poster }}" @endif @if(width) width="{{ width }}" @endif @if(height) height="{{ height }}" @endif @if(controls) controls @endif @if(props.autoplay) autoplay @endif @if(props.loop) loop @endif @if(props.muted) muted @endif @if(inline) playsinline @endif preload="{{ preload }}" @if(crossorigin) crossorigin="{{ crossorigin }}" @endif controlslist="{{ controlslist }}" @if(props.disablePictureInPicture) disablepictureinpicture @endif aria-label="{{ title }}" class="object-contain h-full w-full">
-      @foreach (sources as source)
-        <source src="{{ source.src }}" @if(source.type) type="{{ source.type }}" @endif>
-      @endforeach
-      @foreach (tracks as track)
-        <track src="{{ track.src }}" kind="{{ track.kind }}" @if(track.srclang) srclang="{{ track.srclang }}" @endif @if(track.label) label="{{ track.label }}" @endif @if(track.default) default @endif>
-      @endforeach
-      Your browser does not support video playback.
-    </video>
-    @endif
-    <video-skin>
-      <media-seek-button slot="left" seconds="-10" aria-label="Back 10 seconds"></media-seek-button>
-      <media-play-button slot="left" aria-label="Play or pause"></media-play-button>
-      <media-seek-button slot="left" seconds="10" aria-label="Forward 10 seconds"></media-seek-button>
-      <media-live-button slot="left" aria-label="Go to live edge"></media-live-button>
-      <media-time-group slot="center" class="font-mono tabular-nums text-xs"></media-time-group>
-      <media-progress-bar slot="center" previews="metadata" aria-label="Video progress"></media-progress-bar>
-      <media-mute-button slot="right" aria-label="Mute or unmute"></media-mute-button>
-      <media-volume-slider slot="right" aria-label="Volume"></media-volume-slider>
-      <media-playback-rate-button slot="right" rates="0.5,0.75,1,1.25,1.5,2" aria-label="Playback speed"></media-playback-rate-button>
-      <media-settings-menu slot="right" aria-label="Video settings"></media-settings-menu>
-      <media-airplay-button slot="right" aria-label="Play on AirPlay"></media-airplay-button>
-      <media-remote-playback-button slot="right" aria-label="Play on another device"></media-remote-playback-button>
-      <media-pip-button slot="right" aria-label="Picture in Picture"></media-pip-button>
-      <media-fullscreen-button slot="right" aria-label="Fullscreen"></media-fullscreen-button>
-    </video-skin>
-  </video-player>
-  <figcaption class="sr-only">{{ title }}</figcaption>
-</figure>
-
-<style>
-video-player:not(:defined) video-skin { display: none; }
-video-player:defined > [data-native-fallback] { display: none; }
-@media (prefers-reduced-motion: reduce) { video-player, video-player * { transition-duration: 0.01ms !important; } }
-</style>

package/resources/components/Video.test.ts

@@ -1,36 +0,0 @@
-import { describe, expect, it } from 'bun:test'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
-
-const video = readFileSync(join(import.meta.dir, 'Video.stx'), 'utf8')
-
-describe('Video', () => {
-  it('follows a reactive src and poster, so one player can show whichever video is chosen', () => {
-    expect(video).toContain(`useReactiveProp<string>('src', '')`)
-    expect(video).toContain(`:src="liveSrc() || null"`)
-    expect(video).toContain(`:poster="livePoster() || null"`)
-  })
-
-  it('renders no src attribute without a video, which would fetch the page itself', () => {
-    // An empty src resolves to the document's URL: the browser downloads the
-    // whole page as the video and fails, every time a player with nothing
-    // chosen yet renders.
-    expect(video).not.toMatch(/(?<!@if\(src\) )src="\{\{ src \}\}"/)
-    expect(video.match(/@if\(src\) src="\{\{ src \}\}" @endif/g)?.length).toBe(2)
-  })
-
-  it('pauses when its src is cleared, as closing a sheet does', () => {
-    expect(video).toContain(`useRef('player')`)
-    expect(video).toContain('ref="player"')
-    expect(video).toMatch(/if \(!liveSrc\(\)\)[\s\S]*?\.pause\(\)/)
-  })
-
-  it('never hands a YouTube or Vimeo page to the native <video> fallback', () => {
-    const isEmbed = new RegExp(video.match(/const isEmbed = \/(.+)\/i\.test/)![1]!, 'i')
-    for (const url of ['https://www.youtube.com/watch?v=aclHkVaku9U', 'https://youtu.be/aclHkVaku9U', 'https://m.youtube.com/shorts/aclHkVaku9U', 'https://vimeo.com/76979871'])
-      expect(isEmbed.test(url)).toBe(true)
-    for (const url of ['https://cdn.example.com/clip.mp4', '/media/demo/manifest.mpd', 'https://example.com/youtube.com/fake.mp4'])
-      expect(isEmbed.test(url)).toBe(false)
-    expect(video).toContain('@if(isEmbed)')
-  })
-})