@stacksjs/defaults 0.75.181 → 0.75.183

package/ai/skills/stacks-auth/SKILL.md

@@ -337,18 +337,43 @@ const result = await actions.resetPassword(token, newPassword)
 - `logout(): Promise<void>`
 - `refresh(): Promise<void>`
 
-## Passkey/WebAuthn (passkey.ts)
-
-- `getUserPasskeys(userId): Promise<PasskeyAttribute[]>`
-- `getUserPasskey(userId, passkeyId): Promise<PasskeyAttribute | undefined>`
-- `setCurrentRegistrationOptions(user, verified): Promise<void>`
-
-### Re-exported from @stacksjs/ts-auth
-- `generateRegistrationOptions`, `generateAuthenticationOptions`
-- `verifyRegistrationResponse`, `verifyAuthenticationResponse`
-- `startRegistration`, `startAuthentication` (browser)
-- `browserSupportsWebAuthn`, `browserSupportsWebAuthnAutofill`
-- `platformAuthenticatorIsAvailable`
+## Passkey/WebAuthn
+
+Opt in with `config.auth.passkeys: { enabled: true, origin?: string, name?: string }`.
+The canonical origin defaults to `config.app.url`; production requires HTTPS.
+`buddy migrate` / `buddy auth:setup` create `passkey_ceremonies` and `passkeys`.
+
+- `beginPasskeyRegistration({ id, email?, name? }, { origin, name })` returns
+  `{ ceremony, options }` as JSON. Call only for the authenticated account.
+- `finishPasskeyRegistration(userId, ceremony, credentialJSON, party)` consumes
+  the account-bound challenge and saves only verified resident credentials.
+- `beginPasskeyAuthentication(party)` returns discoverable options without an
+  email lookup, usable with conditional mediation and `autocomplete="username webauthn"`.
+- `finishPasskeyAuthentication(ceremony, credentialJSON, party)` returns the
+  verified user ID; the application then issues its usual session.
+- `listPasskeys(userId)` returns display-safe metadata, never public-key material.
+- `removePasskey(userId, id, hasAlternativeSignIn?)` serializes removals and
+  refuses to remove the last key without another login method. Supply a callback
+  when password hashes may be unusable placeholders or other factors exist.
+
+Default routes under `/auth/passkeys` expose registration/options, registration,
+authentication/options, authentication (POST), listing (GET) and deletion (DELETE
+`/{id}`). Public authentication endpoints require the canonical Origin header;
+enrollment/removal also require auth and CSRF protection. Deleting the last key
+requires proving the fallback password in the request. All responses are no-store.
+
+Browser code imports **`@stacksjs/auth/passkeys-browser`**, never the server barrel.
+It exports `startRegistration`, `startAuthentication(options, { signal?, mediation? })`,
+`browserSupportsWebAuthn`, `browserSupportsWebAuthnAutofill`, the JSON option/credential
+codecs and types. Abort a pending conditional request before explicit sign-in or
+password submission, and on unmount. Serialize results using
+`registrationCredentialToJSON` / `authenticationCredentialToJSON` before POSTing.
+Native JS contexts require a platform passkey bridge; web support alone does not
+provide one. Keep existing native sign-in available until that bridge exists.
+
+Legacy helpers (`getUserPasskeys`, `getUserPasskey`, `storeWebAuthnChallenge`,
+`consumeWebAuthnChallenge`) remain for existing integrations. New flows should
+use the ceremony API, which supports concurrent anonymous browser attempts.
 
 ## Auth Middleware (middleware.ts)
 

package/ai/skills/stacks-mobile/SKILL.md

@@ -452,7 +452,14 @@ option the original metres heuristic remains for unlabelled inputs.
 - `<NativeSheet v-model:open="editing" title="…">` raises a bottom sheet for a
   task that belongs to the screen: dragged down from its grabber or header to
   dismiss, the page behind inert. `detents="medium large"` makes it full
-  height with detents, the page pressed into a card at large.
+  height with detents, the page pressed into a card at large. An open sheet is
+  a layer on stx's overlay stack (`window.stx.overlays`) with Dialog, Drawer,
+  stxConfirm and the HTML alerts: the stack locks the page, makes it inert,
+  gives Escape and Tab to the top layer and returns focus, so a confirm opened
+  from a sheet closes alone. `lockBackground` and `trapFocus` no longer exist;
+  an app's own overlay uses `openOverlay` / `closeOverlay` from
+  `@stacksjs/components/overlays` (in `<script client>`), passing `root` for
+  an element lifted into `<body>` and `zIndex` to stack by opening order.
 - `<NativeContextMenu :items="[...]" @select="…">` opens a menu on a
   half-second press: UIMenu in the shell, an HTML menu elsewhere.
 - `<NativeActionSheet v-model:open="choosing" :actions="[...]" @select="…">`

package/ai/skills/stacks-native/CATALOG.md

@@ -18,7 +18,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 7 |
 | `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 6 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 2 |
-| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 112 |
+| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 113 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
 | `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 7 |
 | `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 145 |
@@ -183,9 +183,9 @@ Guidance: [`stacks-auth`](../stacks-auth/SKILL.md). Source: [storage/framework/c
 
 Declared runtime exports: `DEFAULT_ROLE_PACKS`, `createBqbRbacStore`, `generateTOTP`, `generateTOTPSecret`, `seedDefaultRoles`, `totpKeyUri`, `verifyTOTP`.
 
-Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
+Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/passkeys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkeys.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
 
-Evidence directory: [112 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [113 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/browser
 

package/app/Actions/Auth/PasskeyAuthenticationAction.ts

@@ -0,0 +1,23 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { finishPasskeyAuthentication, Auth, resolveBrowserSessionPolicy, authCookieForBrowserSession } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyAuthentication',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    if (request.headers.get('origin') !== new URL(party.origin).origin) return new Response(null, { status: 403 })
+    try {
+      const body = request.all()
+      const id = await finishPasskeyAuthentication(body.ceremony, body.credential, party)
+      const policy = resolveBrowserSessionPolicy(body.remember)
+      const session = await Auth.loginUsingId(id, { expiresInMinutes: policy.expiresInMinutes, withRefreshToken: policy.withRefreshToken })
+      if (!session) return new Response(null, { status: 401 })
+      return Response.json({ token: session.token, user: { id: session.user?.id, email: session.user?.email, name: session.user?.name }, expires_in: session.expiresIn, remembered: policy.remembered },
+        { headers: { 'Cache-Control': 'no-store', 'Set-Cookie': authCookieForBrowserSession(session.token, session.expiresIn) } })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyAuthenticationOptionsAction.ts

@@ -0,0 +1,17 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { beginPasskeyAuthentication } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyAuthenticationOptions',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    if (request.headers.get('origin') !== new URL(party.origin).origin) return new Response(null, { status: 403 })
+    try {
+      return passkeyJSON(await beginPasskeyAuthentication(party))
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyDestroyAction.ts

@@ -0,0 +1,24 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { verifyHash } from '@stacksjs/security'
+import { removePasskey } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyDestroy',
+  method: 'DELETE',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      const id = request.getParam('id')
+      if (typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,1366}$/.test(id)) return new Response(null, { status: 422 })
+      return await removePasskey(Number(user.id), id, async row => {
+        const password = request.get('password')
+        return typeof password === 'string' && !!password && typeof row.password === 'string' && await verifyHash(password, row.password)
+      }) ? passkeyJSON({ ok: true }) : new Response(null, { status: 404 })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyIndexAction.ts

@@ -0,0 +1,18 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { listPasskeys } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyIndex',
+  method: 'GET',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      return passkeyJSON({ passkeys: await listPasskeys(Number(user.id)) })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyRegistrationAction.ts

@@ -0,0 +1,20 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { finishPasskeyRegistration } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyRegistration',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      const body = request.all()
+      await finishPasskeyRegistration(Number(user.id), body.ceremony, body.credential, party)
+      return passkeyJSON({ ok: true })
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/PasskeyRegistrationOptionsAction.ts

@@ -0,0 +1,18 @@
+import { Action } from '@stacksjs/actions/runtime'
+import { beginPasskeyRegistration } from '@stacksjs/auth'
+import { passkeyParty, passkeyFailure, passkeyJSON } from './passkey-config'
+
+export default new Action({
+  name: 'PasskeyRegistrationOptions',
+  method: 'POST',
+  async handle(request) {
+    const party = passkeyParty()
+    if (!party) return new Response(null, { status: 404 })
+    try {
+      const user = await request.user()
+      if (!user) return new Response(null, { status: 401 })
+      return passkeyJSON(await beginPasskeyRegistration({ id: Number(user.id), email: user.email, name: user.name }, party))
+    }
+    catch (error) { return passkeyFailure(error) }
+  },
+})

package/app/Actions/Auth/passkey-config.ts

@@ -0,0 +1,13 @@
+import { config } from '@stacksjs/config'
+import { PasskeyError } from '@stacksjs/auth'
+export function passkeyParty() {
+  const options = config.auth.passkeys
+  return options?.enabled ? { origin: options.origin || config.app.url || 'http://localhost:3333', name: options.name || config.app.name || 'Stacks' } : null
+}
+export function passkeyFailure(error: unknown): Response {
+  if (!(error instanceof PasskeyError)) throw error
+  return Response.json({ error: error.message }, { status: 400, headers: { 'Cache-Control': 'no-store' } })
+}
+export function passkeyJSON(value: unknown): Response {
+  return Response.json(value, { headers: { 'Cache-Control': 'no-store' } })
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.181",
+  "version": "0.75.183",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.181",
+  "version": "0.75.183",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.181",
+    "@stacksjs/mobile": "0.75.183",
     "@stacksjs/sanitizer": "^0.2.483",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",

package/resources/components/NativeComponents.test.ts

@@ -118,10 +118,15 @@ describe('Native components', () => {
     expect(bar).toContain("useReactiveProp<boolean>('titleOnScroll', false)")
   })
 
-  it('lifts an open sheet out of the router\'s stacking context', () => {
+  it('lifts a sheet into the body when it mounts, out of the router\'s stacking context', () => {
     const sheet = read('NativeSheet')
-    expect(sheet).toContain('main:has(.native-sheet.is-open) { view-transition-name: none; }')
     expect(sheet).toContain("useModel('open'")
+    // Lifted before it can open, so it never draws inside <main>, which the
+    // router makes a stacking context; <main> no longer has to give up its
+    // view-transition name while a sheet is up.
+    const mounted = sheet.slice(sheet.indexOf('onMount(() => {'))
+    expect(mounted.indexOf('putBack ??= liftToBody(element)')).toBeLessThan(mounted.indexOf('if (open()) present()'))
+    expect(sheet).not.toContain('main:has(')
   })
 
   it('hides the native tab bar under a shell that has none, like a sign-in screen', () => {
@@ -272,12 +277,32 @@ describe('Native components feel native', () => {
     expect(html).toContain('data-stx-ref="nativeSheetHeader"')
   })
 
-  it('opens a sheet without a haptic, holds the page behind it, and keeps focus inside', () => {
+  it('opens a sheet without a haptic, as a layer on the stx overlay stack', () => {
     const sheet = read('NativeSheet')
     expect(sheet).not.toContain('haptics')
-    expect(sheet).toContain('releaseBackground = lockBackground(element)')
-    expect(sheet).toContain('trapFocus(panel.current as HTMLElement, event)')
     expect(sheet).toContain('putBack ??= liftToBody(element)')
+    // The stack holds the page, traps Tab, answers Escape for the top layer
+    // and hands focus back, shared with Dialog, Drawer and stxConfirm. The
+    // sheet's own Escape listener, Tab trap, background lock and focus
+    // restore each fought the stack when one overlay opened over another.
+    expect(sheet).toContain("import { closeOverlay, openOverlay } from '@stacksjs/components/overlays'")
+    expect(sheet).toContain('openOverlay(overlayId, {')
+    expect(sheet).toContain('root: element,')
+    expect(sheet).toContain('zIndex: SHEET_LAYER,')
+    expect(sheet).toContain('onEscape: close,')
+    expect(sheet).toContain('initialFocus: sheetPanel,')
+    for (const gone of ['lockBackground', 'trapFocus', 'previousFocus', "useEventListener('keydown'", 'releaseBackground'])
+      expect(sheet).not.toContain(gone)
+  })
+
+  it('leaves the overlay stack when it closes, and when it is removed while up', () => {
+    const sheet = read('NativeSheet')
+    const dismissed = sheet.slice(sheet.indexOf('function dismissed(): void {'), sheet.indexOf('let wasOpen = false'))
+    expect(dismissed).toContain('closeOverlay(overlayId)')
+    const destroyed = sheet.slice(sheet.indexOf('onDestroy(() => {'), sheet.indexOf("useEventListener('stx:navigate'"))
+    expect(destroyed).toContain('closeOverlay(overlayId)')
+    // Each sheet gives back only its own hold on the card.
+    expect(destroyed).toContain('presentPageAsCard(element.ownerDocument, false)')
   })
 
   it('slides a sheet up from where it was lifted to, rather than appearing up', () => {
@@ -285,8 +310,8 @@ describe('Native components feel native', () => {
     // is-open follows `shown`, which present() sets only after the lifted
     // sheet's closed style is worked out in the body.
     expect(sheet).toContain("const sheetClass = derived(() => `${shown() ? 'is-open' : ''}")
-    expect(sheet).toContain('sheetPanel.getBoundingClientRect()')
-    expect(sheet.indexOf('sheetPanel.getBoundingClientRect()')).toBeLessThan(sheet.indexOf('shown.set(true)'))
+    expect(sheet).toContain('sheetPanel()?.getBoundingClientRect()')
+    expect(sheet.indexOf('sheetPanel()?.getBoundingClientRect()')).toBeLessThan(sheet.indexOf('shown.set(true)'))
     expect(sheet.indexOf('putBack ??= liftToBody(element)')).toBeLessThan(sheet.indexOf('shown.set(true)'))
   })
 

package/resources/components/NativeSheet.stx

@@ -1,6 +1,7 @@
 <script client>
 import type { SheetDetent } from '@stacksjs/mobile'
-import { coverTabBar, liftToBody, lockBackground, observeSheetDrag, presentPageAsCard, trapFocus } from '@stacksjs/mobile'
+import { closeOverlay, openOverlay } from '@stacksjs/components/overlays'
+import { coverTabBar, liftToBody, observeSheetDrag, presentPageAsCard } from '@stacksjs/mobile'
 
 /**
  * A bottom sheet: a task that belongs to this screen, raised over it.
@@ -19,6 +20,15 @@ import { coverTabBar, liftToBody, lockBackground, observeSheetDrag, presentPageA
  * it is up. It belongs to the screen it was opened on, so leaving that screen
  * (a link from outside, a tab switch) closes it rather than carrying it over
  * the next one.
+ *
+ * An open sheet is a layer on the page's overlay stack (stx's
+ * `window.stx.overlays`), shared with Dialog, Drawer, stxConfirm, the web
+ * stand-ins for native alerts and the app's own overlays. The stack holds the
+ * page still from the first layer to the last, makes the rest of the page
+ * inert, gives Escape and Tab to whichever layer is on top, and hands focus
+ * back to whatever opened each one. A confirmation opened from a sheet, or a
+ * sheet opened over a drawer, closes with one Escape and leaves the layer
+ * under it up, locked and in charge of the keyboard.
  */
 const emit = defineEmits()
 const open = useModel('open', { default: false })
@@ -44,9 +54,15 @@ const panel = useRef('nativeSheetPanel')
 const grabber = useRef('nativeSheetGrabber')
 const header = useRef('nativeSheetHeader')
 
-let releaseBackground: (() => void) | null = null
+// This sheet's id on the overlay stack.
+const overlayId = useId('native-sheet')
+// Sheets stack above the page at 70 (the stylesheet's z-index); the stack
+// adds each open sheet's place to it, so a sheet opened over another draws
+// above it wherever the two were lifted into the body.
+const SHEET_LAYER = 70
+
+let presented = false
 let putBack: (() => void) | null = null
-let previousFocus: HTMLElement | null = null
 let carded = false
 let stopDrag: (() => void) | null = null
 let openedOn = ''
@@ -59,35 +75,47 @@ function root(): HTMLElement | null {
   return sheetRoot.current as HTMLElement | null
 }
 
+function sheetPanel(): HTMLElement | null {
+  return panel.current as HTMLElement | null
+}
+
 function present(): void {
   const element = root()
-  if (!element || releaseBackground) return
+  if (!element || presented) return
+  presented = true
   detent.set(detents()[0] ?? 'large')
-  previousFocus = element.ownerDocument.activeElement as HTMLElement | null
   // Out of the page's stacking contexts and transforms (the card below
-  // scales the page), and everything else made inert behind it.
+  // scales the page). A child of the body, it is what the overlay stack keeps
+  // usable while everything else goes inert.
   putBack ??= liftToBody(element)
-  releaseBackground = lockBackground(element)
   openedOn = currentPath()
   coverTabBar(element, true)
   // A node moved in the document starts over with no style to transition
   // from, so a sheet lifted and marked open in one go appears already up.
   // Work its closed style out where it now is, then open it: the panel
   // slides from there.
-  const sheetPanel = panel.current as HTMLElement | null
-  if (sheetPanel) void sheetPanel.getBoundingClientRect()
+  void sheetPanel()?.getBoundingClientRect()
   shown.set(true)
-  void nextTick(() => (panel.current as HTMLElement | null)?.focus())
+  // Focus goes to the panel itself, not its first control: on a phone a
+  // focused field raises the keyboard over the sheet before it is up.
+  openOverlay(overlayId, {
+    panel: sheetPanel,
+    root: element,
+    zIndex: SHEET_LAYER,
+    initialFocus: sheetPanel,
+    onEscape: close,
+  })
 }
 
 function dismissed(): void {
+  if (!presented) return
+  presented = false
   shown.set(false)
   const element = root()
   if (element) coverTabBar(element, false)
-  releaseBackground?.()
-  releaseBackground = null
-  previousFocus?.focus?.()
-  previousFocus = null
+  // Off the stack: the layer underneath (or the page) gets the keyboard back,
+  // and focus returns to whatever opened the sheet.
+  closeOverlay(overlayId)
 }
 
 let wasOpen = false
@@ -98,9 +126,9 @@ effect(() => {
   wasOpen = isOpen
 })
 
-// The page behind becomes a card while a full-height sheet is at large. Only
-// this sheet's own change is applied, so a closed sheet never undoes an open
-// one's card.
+// The page behind becomes a card while a full-height sheet is at large. Each
+// sheet hands back only its own hold, so a sheet closing over another never
+// undoes the card the other still wants.
 effect(() => {
   const element = root()
   const want = open() && hasDetents() && detent() === 'large'
@@ -117,13 +145,15 @@ function close(): void {
 onMount(() => {
   // Give the sheet its permanent presentation parent before its slot loads
   // media. Reparenting an already loading iframe or video interrupts playback.
+  // A closed sheet waits in the body like this, so one nested in another's
+  // content can open over it without leaving the document mid-transition.
   const element = root()
   if (element) putBack ??= liftToBody(element)
-  const sheetPanel = panel.current as HTMLElement | null
-  if (!sheetPanel) return
+  const dragPanel = sheetPanel()
+  if (!dragPanel) return
   const handles = [grabber.current, header.current].filter(Boolean) as HTMLElement[]
   stopDrag = observeSheetDrag({
-    panel: sheetPanel,
+    panel: dragPanel,
     handles,
     detents: () => detents(),
     detent: () => detent(),
@@ -137,10 +167,16 @@ onMount(() => {
 
 onDestroy(() => {
   stopDrag?.()
-  releaseBackground?.()
   const element = root()
-  if (element && open()) coverTabBar(element, false)
-  if (carded && element) presentPageAsCard(element.ownerDocument, false)
+  if (element && presented) coverTabBar(element, false)
+  // Removed while up: off the stack, so the page is not left locked under a
+  // sheet that is gone.
+  presented = false
+  closeOverlay(overlayId)
+  if (carded && element) {
+    carded = false
+    presentPageAsCard(element.ownerDocument, false)
+  }
   putBack?.()
 })
 
@@ -153,12 +189,6 @@ useEventListener('stx:navigate', (event: Event) => {
   if (to !== openedOn) close()
 })
 
-useEventListener('keydown', (event: KeyboardEvent) => {
-  if (!open()) return
-  if (event.key === 'Escape') close()
-  else if (panel.current) trapFocus(panel.current as HTMLElement, event)
-})
-
 const sheetClass = derived(() => `${shown() ? 'is-open' : ''}${hasDetents() ? ' has-detents' : ''}${detent() === 'medium' ? ' is-medium' : ''}`.trim())
 </script>
 
@@ -308,9 +338,4 @@ const sheetClass = derived(() => `${shown() ? 'is-open' : ''}${hasDetents() ? '
   :root[data-native-reduce-motion] .native-sheet-panel { transition: none; }
   :root[data-native-reduce-motion][data-native-sheet-card] .native-app-content { transform: none; border-radius: 0; }
 
-  /* The router names the page's <main> for view transitions, which makes it a
-     stacking context: a sheet inside it stacked under the tab bar whatever its
-     z-index. While a sheet is open <main> gives the name up. Nothing navigates
-     with a sheet open, so no transition is lost. */
-  main:has(.native-sheet.is-open) { view-transition-name: none; }
 </style>

package/routes/auth.ts

@@ -121,3 +121,12 @@ route.group({ prefix: '/password' }, () => {
   route.post('/reset', 'Actions/Password/PasswordResetAction').rateLimit(5, 'minute')
   route.post('/verify-token', 'Actions/Password/VerifyResetTokenAction').rateLimit(10, 'minute')
 })
+
+// Discoverable passkeys: canonical JSON ceremonies, independent concurrent browser attempts.
+// Public flows carry a one-use ceremony capability; enrollment and removal also require auth/CSRF.
+route.post('/auth/passkeys/authentication/options', 'Actions/Auth/PasskeyAuthenticationOptionsAction').skipCsrf().rateLimit(10, 'minute')
+route.post('/auth/passkeys/authentication', 'Actions/Auth/PasskeyAuthenticationAction').skipCsrf().rateLimit(10, 'minute')
+route.post('/auth/passkeys/registration/options', 'Actions/Auth/PasskeyRegistrationOptionsAction').middleware('auth').rateLimit(5, 'minute')
+route.post('/auth/passkeys/registration', 'Actions/Auth/PasskeyRegistrationAction').middleware('auth').rateLimit(5, 'minute')
+route.get('/auth/passkeys', 'Actions/Auth/PasskeyIndexAction').middleware('auth')
+route.delete('/auth/passkeys/{id}', 'Actions/Auth/PasskeyDestroyAction').middleware('auth').rateLimit(10, 'minute')