@stacksjs/defaults 0.75.181 → 0.75.182

package/ai/skills/stacks-auth/SKILL.md

@@ -337,18 +337,43 @@ const result = await actions.resetPassword(token, newPassword)
 - `logout(): Promise<void>`
 - `refresh(): Promise<void>`
 
-## Passkey/WebAuthn (passkey.ts)
-
-- `getUserPasskeys(userId): Promise<PasskeyAttribute[]>`
-- `getUserPasskey(userId, passkeyId): Promise<PasskeyAttribute | undefined>`
-- `setCurrentRegistrationOptions(user, verified): Promise<void>`
-
-### Re-exported from @stacksjs/ts-auth
-- `generateRegistrationOptions`, `generateAuthenticationOptions`
-- `verifyRegistrationResponse`, `verifyAuthenticationResponse`
-- `startRegistration`, `startAuthentication` (browser)
-- `browserSupportsWebAuthn`, `browserSupportsWebAuthnAutofill`
-- `platformAuthenticatorIsAvailable`
+## Passkey/WebAuthn
+
+Opt in with `config.auth.passkeys: { enabled: true, origin?: string, name?: string }`.
+The canonical origin defaults to `config.app.url`; production requires HTTPS.
+`buddy migrate` / `buddy auth:setup` create `passkey_ceremonies` and `passkeys`.
+
+- `beginPasskeyRegistration({ id, email?, name? }, { origin, name })` returns
+  `{ ceremony, options }` as JSON. Call only for the authenticated account.
+- `finishPasskeyRegistration(userId, ceremony, credentialJSON, party)` consumes
+  the account-bound challenge and saves only verified resident credentials.
+- `beginPasskeyAuthentication(party)` returns discoverable options without an
+  email lookup, usable with conditional mediation and `autocomplete="username webauthn"`.
+- `finishPasskeyAuthentication(ceremony, credentialJSON, party)` returns the
+  verified user ID; the application then issues its usual session.
+- `listPasskeys(userId)` returns display-safe metadata, never public-key material.
+- `removePasskey(userId, id, hasAlternativeSignIn?)` serializes removals and
+  refuses to remove the last key without another login method. Supply a callback
+  when password hashes may be unusable placeholders or other factors exist.
+
+Default routes under `/auth/passkeys` expose registration/options, registration,
+authentication/options, authentication (POST), listing (GET) and deletion (DELETE
+`/{id}`). Public authentication endpoints require the canonical Origin header;
+enrollment/removal also require auth and CSRF protection. Deleting the last key
+requires proving the fallback password in the request. All responses are no-store.
+
+Browser code imports **`@stacksjs/auth/passkeys-browser`**, never the server barrel.
+It exports `startRegistration`, `startAuthentication(options, { signal?, mediation? })`,
+`browserSupportsWebAuthn`, `browserSupportsWebAuthnAutofill`, the JSON option/credential
+codecs and types. Abort a pending conditional request before explicit sign-in or
+password submission, and on unmount. Serialize results using
+`registrationCredentialToJSON` / `authenticationCredentialToJSON` before POSTing.
+Native JS contexts require a platform passkey bridge; web support alone does not
+provide one. Keep existing native sign-in available until that bridge exists.
+
+Legacy helpers (`getUserPasskeys`, `getUserPasskey`, `storeWebAuthnChallenge`,
+`consumeWebAuthnChallenge`) remain for existing integrations. New flows should
+use the ceremony API, which supports concurrent anonymous browser attempts.
 
 ## Auth Middleware (middleware.ts)
 

package/ai/skills/stacks-native/CATALOG.md

@@ -18,7 +18,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 7 |
 | `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 6 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 2 |
-| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 112 |
+| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 113 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
 | `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 7 |
 | `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 145 |
@@ -183,9 +183,9 @@ Guidance: [`stacks-auth`](../stacks-auth/SKILL.md). Source: [storage/framework/c
 
 Declared runtime exports: `DEFAULT_ROLE_PACKS`, `createBqbRbacStore`, `generateTOTP`, `generateTOTPSecret`, `seedDefaultRoles`, `totpKeyUri`, `verifyTOTP`.
 
-Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
+Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/passkeys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkeys.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
 
-Evidence directory: [112 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [113 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/browser
 

package/app/Actions/Auth/PasskeyAuthenticationAction.ts

@@ -0,0 +1,23 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { finishPasskeyAuthentication, Auth, resolveBrowserSessionPolicy, authCookieForBrowserSession } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyAuthentication',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    if (request.headers.get('origin') !== new URL(party.origin).origin) return new Response(null, { status: 403 })
+    try {
+      const body = request.all()
+      const id = await finishPasskeyAuthentication(body.ceremony, body.credential, party)
+      const policy = resolveBrowserSessionPolicy(body.remember)
+      const session = await Auth.loginUsingId(id, { expiresInMinutes: policy.expiresInMinutes, withRefreshToken: policy.withRefreshToken })
+      if (!session) return new Response(null, { status: 401 })
+      return Response.json({ token: session.token, user: { id: session.user?.id, email: session.user?.email, name: session.user?.name }, expires_in: session.expiresIn, remembered: policy.remembered },
+        { headers: { 'Cache-Control': 'no-store', 'Set-Cookie': authCookieForBrowserSession(session.token, session.expiresIn) } })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyAuthenticationOptionsAction.ts

@@ -0,0 +1,17 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { beginPasskeyAuthentication } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyAuthenticationOptions',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    if (request.headers.get('origin') !== new URL(party.origin).origin) return new Response(null, { status: 403 })
+    try {
+      return passkeyJSON(await beginPasskeyAuthentication(party))
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyDestroyAction.ts

@@ -0,0 +1,24 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { verifyHash } from '@stacksjs/security'
+import { removePasskey } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyDestroy',
+  method: 'DELETE',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      const id = request.getParam('id')
+      if (typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,1366}$/.test(id)) return new Response(null, { status: 422 })
+      return await removePasskey(Number(user.id), id, async row => {
+        const password = request.get('password')
+        return typeof password === 'string' && !!password && typeof row.password === 'string' && await verifyHash(password, row.password)
+      }) ? passkeyJSON({ ok: true }) : new Response(null, { status: 404 })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyIndexAction.ts

@@ -0,0 +1,18 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { listPasskeys } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyIndex',
+  method: 'GET',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      return passkeyJSON({ passkeys: await listPasskeys(Number(user.id)) })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyRegistrationAction.ts

@@ -0,0 +1,20 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { finishPasskeyRegistration } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyRegistration',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      const body = request.all()
+      await finishPasskeyRegistration(Number(user.id), body.ceremony, body.credential, party)
+      return passkeyJSON({ ok: true })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyRegistrationOptionsAction.ts

@@ -0,0 +1,18 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { beginPasskeyRegistration } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyRegistrationOptions',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      return passkeyJSON(await beginPasskeyRegistration({ id: Number(user.id), email: user.email, name: user.name }, party))
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/passkey-config.ts

@@ -0,0 +1,13 @@
+import { config } from '@stacksjs/config'
+import { PasskeyError } from '@stacksjs/auth'
+export function passkeyParty() {
+  const options = config.auth.passkeys
+  return options?.enabled ? { origin: options.origin || config.app.url || 'http://localhost:3333', name: options.name || config.app.name || 'Stacks' } : null
+}
+export function passkeyFailure(error: unknown): Response {
+  if (!(error instanceof PasskeyError)) throw error
+  return Response.json({ error: error.message }, { status: 400, headers: { 'Cache-Control': 'no-store' } })
+}
+export function passkeyJSON(value: unknown): Response {
+  return Response.json(value, { headers: { 'Cache-Control': 'no-store' } })
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.181",
+  "version": "0.75.182",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.181",
+  "version": "0.75.182",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.181",
+    "@stacksjs/mobile": "0.75.182",
     "@stacksjs/sanitizer": "^0.2.483",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",

package/routes/auth.ts

@@ -121,3 +121,12 @@ route.group({ prefix: '/password' }, () => {
   route.post('/reset', 'Actions/Password/PasswordResetAction').rateLimit(5, 'minute')
   route.post('/verify-token', 'Actions/Password/VerifyResetTokenAction').rateLimit(10, 'minute')
 })
+
+// Discoverable passkeys: canonical JSON ceremonies, independent concurrent browser attempts.
+// Public flows carry a one-use ceremony capability; enrollment and removal also require auth/CSRF.
+route.post('/auth/passkeys/authentication/options', 'Actions/Auth/PasskeyAuthenticationOptionsAction').skipCsrf().rateLimit(10, 'minute')
+route.post('/auth/passkeys/authentication', 'Actions/Auth/PasskeyAuthenticationAction').skipCsrf().rateLimit(10, 'minute')
+route.post('/auth/passkeys/registration/options', 'Actions/Auth/PasskeyRegistrationOptionsAction').middleware('auth').rateLimit(5, 'minute')
+route.post('/auth/passkeys/registration', 'Actions/Auth/PasskeyRegistrationAction').middleware('auth').rateLimit(5, 'minute')
+route.get('/auth/passkeys', 'Actions/Auth/PasskeyIndexAction').middleware('auth')
+route.delete('/auth/passkeys/{id}', 'Actions/Auth/PasskeyDestroyAction').middleware('auth').rateLimit(10, 'minute')