pgkiln 0.60.0 → 0.62.0

package/SECURITY.md

@@ -113,6 +113,8 @@ first version (MVP). Every finding below has a regression test in
 | Ask and smart filters set facets (sprint 122) | A phrase can only set facets of the faceted search and smart filters regions on the page that the user sees, on their configured columns; values and range bounds become the facets' own URL parameters (bounds checked as numbers or dates) and reach SQL as query parameters, never as text. Values in a phrase are looked up in the report's rows with a query parameter, as the application's role. A facet chip's Remove is checked against the chips the form showed (a tampered key is refused). Sample apps keep their demo accounts with known passwords: install them on development or demo instances only. |
 | Builder texts in the browser (sprint 123) | The builder's JavaScript gets its texts as JSON in an attribute (`<div id="builder-texts" data-texts>`), escaped like any attribute value, so builder pages still have no inline script. The texts are the fixed message files, never data; scripts put them into the page with `textContent` and attributes, not as HTML. |
 | Two-factor sign-in for developers (0.60.0) | TOTP secrets (RFC 6238, 160 bits) are encrypted with `PGKILN_SECRET_KEY` and stored only after a code from the app confirms them; recovery codes (10 × 50 bits) are stored as SHA-256 and used up atomically; a code is accepted once (the last step is updated atomically) and only one 30-second step either side. The password step leaves only a pending sign-in in the session (5 minutes, no session for the developer yet); wrong codes count with wrong passwords for the per-user and per-IP lockout. Removing an app needs the password; another developer's factors can only be reset by an administrator, with a reason, which ends that developer's builder sessions. The require policy can only be turned on, and stays enforceable, with at least two administrators (or every one) holding an app; there is no setting, URL or variable that skips the second step: recovery is `pgkiln admin reset-2fa` / `set-2fa-policy off` on the server with the owner connection. Every enrolment, removal, reset, policy change and used recovery code is in the activity log; resets and policy changes are mailed to the administrators. The factor tables are closed to the runtime role. |
+| Passkeys and trusted browsers (0.61.0) | Passkeys (WebAuthn) are checked in `src/webauthn.ts` without a library: a 32-byte one-time challenge per purpose (registration or sign-in) kept in the session for five minutes and used up on the first answer, the `clientDataJSON` type, challenge and origin (`PUBLIC_URL`'s, else the browser's own), the SHA-256 of the relying party id in the authenticator data, user presence, an ES256, EdDSA or RS256 signature over the authenticator data and the client data hash, and a signature counter that must go up (updated atomically, so a replayed or cloned key is refused). The CBOR reader takes only definite lengths, at most 16 levels and 1,000 entries. Credentials are public keys (no secret to leak, independent of the instance key); attestation is *none*. `PGKILN_RP_ID` is only honoured when it is the host or a parent domain of it. The sign-in options (the developer's credential ids) are only given after the password step, with the CSRF token. Trusted browsers (off by default) are a random 256-bit cookie token (`HttpOnly`, `SameSite=Lax`, `Secure` with `COOKIE_SECURE`, path `/builder`) of which only the SHA-256 is stored; the cookie is only looked at after a correct password, for that developer, and ends with its days, a new password, removing a factor, a reset, *Forget trusted browsers* or turning trust off (which removes every trusted browser at once). |
+| Passkey sign-in without a password, workspace rule (0.62.0) | *Sign in with a passkey* asks the browser for any passkey of this site (empty allow list) with `userVerification: required`, and the server refuses an answer whose authenticator data lacks the user-verified flag, so the passkey alone stands for possession plus a fingerprint, face or PIN. The credential id is looked up for this relying party only; a user handle, when the browser sends one, must be the developer's (a SHA-256-derived handle, not the user name). The same one-time challenge, origin, RP ID hash, signature and counter checks as at the second step apply; failures are logged as `login_failed` with the developer's name when the key is known and count for the per-user and per-IP lockout. Administrators turn it off in Instance settings. A workspace's rule (administrators and its own administrators only, CSRF-checked) can only add a requirement; `pgkiln admin set-2fa-policy off` clears every workspace's rule. While a second factor is required of a developer, a sign-in with the default password leads only to the password change. |
 
 ## Findings of the MVP review and their fixes
 
@@ -235,4 +237,4 @@ A second full review, mainly of what end users and API callers can reach. Regres
 8. With REST data sources: list only the hosts you need in `PGKILN_REST_ALLOWED_HOSTS` (avoid `*`), set a long random `PGKILN_SECRET_KEY` (32+ characters) kept outside the database and its backups, and use `PGKILN_REST_PRIVATE_HOSTS` only for internal services you mean to reach. Narrow it further per workspace under Administration → Network access (sprint 118).
 9. With header authentication: list only your proxy's addresses in `PGKILN_AUTH_HEADER_PROXIES`, make sure users can't reach pgkiln directly, and have the proxy remove any incoming copy of the header.
 10. With database-account authentication: list exact roles or use a dedicated membership role, and limit what those roles may connect to in `pg_hba.conf` (they can reach the database with their password outside pgkiln too).
-11. Turn on two-factor sign-in for the builder (Instance settings → Two-factor sign-in, at least for administrators) once two administrators have an authenticator app, keep `PGKILN_SECRET_KEY` backed up, and keep the recovery commands (`pgkiln admin reset-2fa`) for people with server access only.
+11. Turn on two-factor sign-in for the builder (Instance settings → Two-factor sign-in, at least for administrators) once two administrators have a passkey or an authenticator app; set `PUBLIC_URL` to the address developers use (passkeys belong to its host name), require it per workspace where the instance policy is too broad, keep *Trust a browser* short or at 0 on shared machines, keep `PGKILN_SECRET_KEY` backed up, and keep the recovery commands (`pgkiln admin reset-2fa`) for people with server access only.

package/db/migrations/129_developer_passkeys.sql

@@ -0,0 +1,49 @@
+-- ---------------------------------------------------------------------
+-- 129: passkeys and trusted browsers for developers (sprint 127, SEC-2
+-- part 2; beyond APEX).
+--
+-- meta.developer_factor gets a second kind, 'passkey' (WebAuthn): the
+-- credential id (base64url, unique), its public key as a JWK, the COSE
+-- algorithm, the signature counter, the relying party id it was made for
+-- (the host name; a passkey only works on that domain) and the transports
+-- the browser reported. A passkey keeps working without the instance key
+-- (it is a public key). An authenticator app keeps its encrypted secret.
+--
+-- meta.developer_trusted_browser: "trust this browser" after a second
+-- factor, for meta.setting mfa_trust_days days (0, the default: never).
+-- Only the SHA-256 of the cookie's random token is stored; a reset, a new
+-- password, removing a factor or "Forget trusted browsers" deletes them.
+--
+-- Owner-only, like meta.developer.
+-- ---------------------------------------------------------------------
+alter table meta.developer_factor drop constraint developer_factor_kind_check;
+alter table meta.developer_factor
+  alter column secret_enc drop not null,
+  add column credential_id text unique,
+  add column public_key   jsonb,
+  add column alg          int,
+  add column sign_count   bigint not null default 0,
+  add column rp_id        text,
+  add column transports   text[] not null default '{}',
+  add constraint developer_factor_kind_check check (kind in ('totp', 'passkey')),
+  add constraint developer_factor_kind_fields check (
+    case kind
+      when 'totp' then secret_enc is not null
+      when 'passkey' then credential_id is not null and public_key is not null and alg is not null and rp_id is not null
+    end);
+comment on table meta.developer_factor is
+  'A developer''s second factors: authenticator apps (TOTP, 128; the secret encrypted with the instance key) and passkeys (WebAuthn, 129; a public key).';
+
+create table meta.developer_trusted_browser (
+  token_hash  text primary key,
+  username    text not null references meta.developer on update cascade on delete cascade,
+  created_at  timestamptz not null default now(),
+  expires_at  timestamptz not null,
+  user_agent  text
+);
+create index on meta.developer_trusted_browser (username);
+comment on table meta.developer_trusted_browser is
+  'Browsers a developer trusted after a second factor (129): sha256 of the cookie token, until expires_at.';
+
+insert into meta.setting (name, value) values ('mfa_trust_days', '0')
+on conflict (name) do nothing;

package/db/migrations/130_passkey_signin_workspace_mfa.sql

@@ -0,0 +1,20 @@
+-- ---------------------------------------------------------------------
+-- 130: passkey sign-in and a workspace two-factor rule (sprint 128,
+-- SEC-2 part 3; beyond APEX).
+--
+-- meta.workspace.mfa_required_since: when set, every developer of the
+-- workspace needs a second factor, with the instance's grace period
+-- (mfa_grace_days) counted from this moment; null = the instance policy
+-- alone decides. Administrators of the instance are covered only where they
+-- are members. `pgkiln admin set-2fa-policy off` clears it everywhere.
+--
+-- meta.setting mfa_passkey_signin ('on', the default, or 'off'): a
+-- developer may sign in with a passkey alone, without the password, when
+-- the authenticator verified them (fingerprint, face, PIN). It counts as
+-- both factors.
+-- ---------------------------------------------------------------------
+alter table meta.workspace add column mfa_required_since timestamptz;
+
+comment on column meta.workspace.mfa_required_since is 'Two-factor sign-in required for this workspace''s developers since (null = not by the workspace) (130).';
+
+insert into meta.setting (name, value) values ('mfa_passkey_signin', 'on') on conflict (name) do nothing;

package/docs/apex-feature-parity.md

@@ -138,7 +138,7 @@ the 26.2 comparison.)
 | APEX accounts | ✅ | Instance-wide user directory, bcrypt, session rotation, idle and absolute timeouts |
 | Application Access Control (roles per app, any-user switch) | ✅ | Access control per application |
 | Social sign-in / OpenID Connect | ✅ | Any OIDC provider (Entra ID, Google, Okta, Keycloak, …): PKCE, group → role mapping, account linking, automatic accounts |
-| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprint 126): the builder itself has two-factor sign-in with authenticator apps (TOTP) and recovery codes, a policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)); passkeys and two-factor for application users follow (SEC-2, SEC-3) |
+| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–128): the builder itself has two-factor sign-in with passkeys (WebAuthn, also on their own without a password), authenticator apps (TOTP) and recovery codes, trusted browsers, an instance and per-workspace policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)); two-factor for application users follows (SEC-3) |
 | Change own password | ✅ | A built-in *My account* page (APEX offers the API `CHANGE_CURRENT_USER_PW`) |
 | Password expiry, change on first use, admin reset, complexity | ✅ | Lifetime in days, expire/unexpire, admin reset, length and letters+digits rules, unlock |
 | Lockout after failed sign-ins | ✅ | Per user and per IP, time-based (APEX: until an administrator unlocks) |
@@ -296,8 +296,9 @@ Small but real differences, for teams comparing the two:
 - Responsive layouts verified automatically at four screen sizes.
 - The theme follows the device's light/dark setting automatically, and the choice is saved per user.
 - A built-in *My account* page (own password, theme, language).
-- (sprint 126) **Two-factor sign-in for the builder** without an identity provider: authenticator apps (TOTP),
-  recovery codes, a policy for administrators or all developers with a grace period, and lockout recovery on the
+- (sprints 126–128) **Two-factor sign-in for the builder** without an identity provider: passkeys (WebAuthn; sign-in with a
+  passkey alone), authenticator apps (TOTP), recovery codes, a policy for administrators, all developers or a
+  workspace's developers with a grace period, and lockout recovery on the
   command line ([chapter 3](guide/03-builder.md#two-factor-sign-in)). APEX relies on the identity provider.
 - One RLS policy set protects both the web UI and the REST API.
 - An import can be checked before it commits (`pgkiln import --check`): SQL that names a missing

package/docs/guide/01-installation.md

@@ -141,7 +141,8 @@ which is read at startup; real environment variables take precedence.
 | `RUNTIME_DATABASE_URL` | *(falls back to `DATABASE_URL`)* | Least-privilege connection that runs applications |
 | `PORT` | `3100` | HTTP port |
 | `HOST` | `127.0.0.1` | Interface to listen on; use `0.0.0.0` in a container |
-| `PUBLIC_URL` | `http://127.0.0.1:<PORT>` | The address users reach pgkiln at (e.g. `https://apps.example.com`). Single sign-on redirect URIs are built from it |
+| `PUBLIC_URL` | `http://127.0.0.1:<PORT>` | The address users reach pgkiln at (e.g. `https://apps.example.com`). Single sign-on redirect URIs are built from it, and developers' passkeys belong to its host name |
+| `PGKILN_RP_ID` | the host of `PUBLIC_URL` | (0.61) A parent domain for developers' passkeys (`example.com` when the builder is at `builder.example.com`), so one passkey works on its sub-domains. Ignored unless it is the host or a parent of it |
 | `API_URL` | `http://127.0.0.1:3000` | Where PostgREST serves the REST API ([chapter 13](13-rest-api.md)) |
 | `API_JWT_SECRET` | *(none)* | Signs REST API tokens; at least 32 characters, the same as PostgREST's `jwt-secret`. Without it, tokens can't be issued |
 | `COOKIE_SECURE` | `false` | `true` behind HTTPS: marks cookies `Secure` and sends HSTS |

package/docs/guide/03-builder.md

@@ -40,8 +40,9 @@ joins the workspace you are working in; one made with the command line or SQL jo
 ### Two-factor sign-in
 
 (0.60) Developers can sign in to the builder with a second factor: a 6-digit code from an **authenticator app**
-(Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, any app for TOTP codes per RFC 6238).
-APEX has no built-in second factor for the builder; there it comes from an identity provider.
+(Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, any app for TOTP codes per RFC 6238) or
+(0.61) a **passkey**: the fingerprint reader, face recognition or screen lock of a laptop or phone, or a security key
+(WebAuthn). APEX has no built-in second factor for the builder; there it comes from an identity provider.
 
 **Setting it up.** Your account menu → **Two-factor sign-in** opens **Security** (`/builder/security`):
 
@@ -49,10 +50,30 @@ APEX has no built-in second factor for the builder; there it comes from an ident
 2. Enter the code the app shows, give the app a name (*Phone*) and **Confirm and turn on**.
 3. You get **ten recovery codes**, shown once. Save them away from your phone and tick *I saved these codes*.
 
-From then on, signing in asks for a code after the password. A recovery code works instead of an app code, once;
+**A passkey** instead (or as well): on Security, give it a name (*Laptop*) and click **Add a passkey**; the browser asks
+for your fingerprint, face, screen lock or security key. Add one on each device you use, or one that syncs (iCloud
+Keychain, Google Password Manager, 1Password). The first factor you add, app or passkey, gives you the recovery codes.
+
+From then on, signing in asks for a code, or a passkey with **Use a passkey**, after the password. A recovery code works instead of an app code, once;
 signing in with one opens Security, which shows how many are left and makes new ones (the old ones stop working).
-Removing an app asks for your password. Each code is accepted once, and one 30-second step either side of the
-server's clock.
+Removing an app or a passkey asks for your password. Each code is accepted once, and one 30-second step either side
+of the server's clock.
+
+A passkey belongs to the **address** it was made at. With `PUBLIC_URL` set, that is its host name; otherwise the
+host name in the browser's address bar. Passkeys need a host name: at `http://127.0.0.1:3100` the page asks you to
+use `http://localhost:3100` instead. If the builder moves to another domain, passkeys made for the old one are
+marked *for old.example.com* and stop working there; add new ones (apps and recovery codes keep working). To use
+one passkey on several sub-domains, set `PGKILN_RP_ID` to the parent domain (`example.com` for
+`builder.example.com`; [chapter 1](01-installation.md)). Passkeys are public keys: they keep working when the
+instance key changes. pgkiln accepts any authenticator (attestation *none*), checks the signature, the address and
+the relying party on every sign-in, and refuses a key whose signature counter goes back (a copied key).
+
+**A passkey alone** (0.62): the sign-in page has **Sign in with a passkey** next to the password form. The browser
+offers the passkeys it holds for this site, and you choose one; no user name, no password. It only works when the
+device verified you (fingerprint, face or PIN), so the passkey counts as both factors; a workspace typed in the form
+still applies. Administrators can turn it off in Instance settings → *Two-factor sign-in* (*Developers may sign in
+with a passkey alone*, on by default). A security key without a PIN, or a passkey made before 0.61 that the browser
+doesn't offer, still works at the second step after the password.
 
 The app's secret is stored encrypted with the instance key (`PGKILN_SECRET_KEY`, [chapter 1](01-installation.md));
 without the key the page says so and you can't add an app. Recovery codes are stored as SHA-256 hashes, so they keep
@@ -63,6 +84,21 @@ sign-in*: **Nobody** (optional, the default), **Administrators** or **All develo
 (default 7 days). During the grace period a developer without an app sees a reminder on every page; after it, they
 see only their Security page until they add one. The region lists the developers who have no app yet.
 
+**Per workspace** (0.62): a workspace's page (Workspace utilities → Workspaces → the workspace, *Preferences*) has
+*Require two-factor sign-in of this workspace's developers*, for administrators and the workspace's own
+administrators. It adds to the instance's policy: the workspace's developers get the instance's grace period from the
+moment it was turned on, then only their Security page. The page lists the members who have no factor yet.
+
+**The default password** (0.62): a developer who signs in with the default password (`admin`, or their user name)
+while two-factor sign-in is required of them sees only **Developers**, to change it, before anything else (then the
+grace period or the Security page as above).
+
+**Trusted browsers** (0.61): *Trust a browser (days)* in the same region (0, the default: never) adds *Trust this
+browser for N days* to the second step. A trusted browser skips the second step for that developer until the days
+are over; only a hash of the cookie's random token is stored. The developer's Security page shows how many browsers
+they trust and **Forget trusted browsers**; changing the password, removing a factor or a reset forgets them too, and
+setting the days to 0 stops every trusted browser at once.
+
 **So nobody is locked out:**
 
 - The policy can be turned on only when **at least two administrators** have two-factor sign-in (or every
@@ -79,10 +115,11 @@ see only their Security page until they add one. The region lists the developers
 
 | Situation | What to do |
 |---|---|
-| Lost your phone, still have recovery codes | Sign in with a recovery code, remove the old app on Security and add the new phone |
-| Lost phone and codes | Ask another administrator to reset your two-factor sign-in on Developers |
+| Lost your phone or key, still have recovery codes | Sign in with a recovery code, remove the old app or passkey on Security and add the new one |
+| Lost phone, keys and codes | Ask another administrator to reset your two-factor sign-in on Developers |
+| A passkey no longer works after a move to another domain | Sign in with an app code or a recovery code and add a new passkey ([above](#two-factor-sign-in)) |
 | No administrator can sign in | On the server: `pgkiln admin reset-2fa <developer> --reason "…"` ([chapter 18](18-cli.md)), then sign in with the password |
-| The policy locks everyone out | On the server: `pgkiln admin set-2fa-policy off` |
+| The policy locks everyone out | On the server: `pgkiln admin set-2fa-policy off` (also clears the workspaces' own rules) |
 | Codes are always wrong | Check the time on the phone and on the server (codes allow 30 seconds either way) |
 | The instance key was lost or changed | The apps' secrets can't be read: reset the developers (`pgkiln admin reset-2fa`); recovery codes still work |
 

package/docs/guide/18-cli.md

@@ -53,7 +53,7 @@ any (see [what is not exported](03-builder.md#export-format)).
 | `pgkiln users add <username> [--developer] [--app <alias> --roles a,b] [--name …] [--email …]` | Adds an account (optionally with access to an application) or a builder developer |
 | `pgkiln users password <username> [--developer]` | Sets a password and ends that user's sessions |
 | `pgkiln admin reset-2fa <developer> [--reason <text>]` | (0.60) Removes a developer's authenticator apps and recovery codes and ends their builder sessions: [locked out?](03-builder.md#locked-out) |
-| `pgkiln admin set-2fa-policy off\|admins\|all [--grace <days>]` | (0.60) Sets the builder's [two-factor policy](03-builder.md#two-factor-sign-in); `off` always works, the others need two administrators with an app |
+| `pgkiln admin set-2fa-policy off\|admins\|all [--grace <days>]` | (0.60) Sets the builder's [two-factor policy](03-builder.md#two-factor-sign-in); `off` always works (and, 0.62, clears every workspace's own rule), the others need two administrators with an app |
 
 `users` reads the password from standard input (the first line, e.g. from a secret store:
 `printf '%s\n' "$PW" | pgkiln users add ops --developer`) or asks for it twice on a terminal. It is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/builder.css

@@ -675,6 +675,7 @@ kbd { display: inline-block; padding: 0 0.35em; border: 1px solid var(--border);
 .signin-reveal { flex: none; border: 0; background: none; color: var(--accent); cursor: pointer; font-size: 0.85rem; padding: 0.25rem; }
 .signin-remember { font-size: 0.9rem; }
 .signin-submit { padding: 0.75rem; font-size: 1rem; border-radius: var(--radius); }
+[data-passkey-status]:empty { display: none; }
 .signin-hint { margin: 0; text-align: center; }
 .signin-actions { display: flex; flex-wrap: wrap; justify-content: center; gap: 0.5rem 1.5rem; margin-top: 1rem; padding-top: 1rem; border-top: 1px solid var(--border); }
 .signin-actions a { display: inline-flex; align-items: center; gap: 0.4rem; color: var(--gold); text-decoration: none; }

package/public/builder.js

@@ -1333,3 +1333,66 @@ document.querySelectorAll('input[data-filter-tree]').forEach((el) => {
     });
   }
 })();
+
+// (sprint 127) Passkeys: a [data-passkey] button asks the server (its URL) for WebAuthn options, calls
+// navigator.credentials.create() (Security page) or .get() (the second sign-in step) and posts the answer in
+// its own form, to data-passkey-submit when set, so the server answers with a redirect as for any form.
+// (sprint 128) On the sign-in page the list of allowed passkeys is empty: the browser offers the ones it holds.
+// Without WebAuthn or JavaScript the buttons stay hidden; codes keep working.
+(() => {
+  'use strict';
+  if (!window.PublicKeyCredential || !navigator.credentials) return;
+  const b64 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+  const bytes = (s) => Uint8Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/') + '==='.slice((s.length + 3) % 4)), (c) => c.charCodeAt(0));
+  for (const btn of document.querySelectorAll('[data-passkey]')) {
+    const form = btn.closest('form');
+    if (!form) continue;
+    btn.hidden = false;
+    btn.addEventListener('click', async (e) => {
+      e.preventDefault();
+      const status = form.querySelector('[data-passkey-status]');
+      const set = (name, value) => {
+        const field = form.querySelector(`[name="${name}"]`);
+        if (field) field.value = value;
+      };
+      btn.disabled = true;
+      if (status) status.textContent = '';
+      try {
+        const res = await fetch(btn.dataset.passkey, {
+          method: 'POST', credentials: 'same-origin', headers: { accept: 'application/json' },
+          body: new URLSearchParams({ __csrf: form.querySelector('[name="__csrf"]').value }),
+        });
+        if (!res.ok) throw new Error(String(res.status));
+        const o = await res.json();
+        if (o.mode === 'create') {
+          const c = await navigator.credentials.create({ publicKey: {
+            challenge: bytes(o.challenge), rp: o.rp,
+            user: { id: bytes(o.user.id), name: o.user.name, displayName: o.user.displayName },
+            pubKeyCredParams: o.algs.map((alg) => ({ type: 'public-key', alg })),
+            excludeCredentials: o.exclude.map((id) => ({ type: 'public-key', id: bytes(id) })),
+            authenticatorSelection: { residentKey: 'preferred', userVerification: 'preferred' },
+            attestation: 'none', timeout: 120000,
+          } });
+          set('clientDataJSON', b64(c.response.clientDataJSON));
+          set('attestationObject', b64(c.response.attestationObject));
+          set('transports', (c.response.getTransports ? c.response.getTransports() : []).join(','));
+        } else {
+          const c = await navigator.credentials.get({ publicKey: {
+            challenge: bytes(o.challenge), rpId: o.rpId, userVerification: o.uv || 'preferred', timeout: 120000,
+            allowCredentials: o.allow.map((a) => ({ type: 'public-key', id: bytes(a.id), transports: a.transports })),
+          } });
+          set('credentialId', b64(c.rawId));
+          set('clientDataJSON', b64(c.response.clientDataJSON));
+          set('authenticatorData', b64(c.response.authenticatorData));
+          set('signature', b64(c.response.signature));
+          if (c.response.userHandle) set('userHandle', b64(c.response.userHandle));
+        }
+        if (btn.dataset.passkeySubmit) form.action = btn.dataset.passkeySubmit;
+        form.submit();
+      } catch (err) {
+        btn.disabled = false;
+        if (status) status.textContent = btn.dataset.passkeyError || String(err);
+      }
+    });
+  }
+})();

package/src/builder/i18n/de.ts

@@ -1714,16 +1714,16 @@ export const de: BuilderMessages = {
   // ------------------------------------------------------------ Security: two-factor sign-in (sprint 126)
   'mfa.menu': 'Zwei-Faktor-Anmeldung',
   'mfa.title': 'Sicherheit',
-  'mfa.intro': 'Melden Sie sich nach dem Passwort mit einem Code aus einer Authenticator-App an. Wiederherstellungscodes helfen, wenn Sie das Telefon verlieren.',
-  'mfa.required_you': 'Ihr Administrator verlangt die Zwei-Faktor-Anmeldung: Fügen Sie eine Authenticator-App hinzu.',
+  'mfa.intro': 'Bestätigen Sie nach dem Passwort mit einem Passkey (Fingerabdruck, Gesicht, Sicherheitsschlüssel) oder einem Code aus einer Authenticator-App, dass Sie es sind. Wiederherstellungscodes helfen, wenn Sie diese verlieren.',
+  'mfa.required_you': 'Ihr Administrator verlangt die Zwei-Faktor-Anmeldung: Fügen Sie einen Passkey oder eine Authenticator-App hinzu.',
   'mfa.banner': 'Die Zwei-Faktor-Anmeldung ist erforderlich. Richten Sie sie vor dem {date} ein: {link}',
   'mfa.set_up_now': 'jetzt einrichten',
-  'mfa.apps': 'Authenticator-Apps',
+  'mfa.factors': 'Passkeys und Authenticator-Apps',
   'mfa.app_name': 'Name',
   'mfa.app_default': 'Telefon',
   'mfa.added': 'Hinzugefügt',
   'mfa.last_used': 'Zuletzt verwendet',
-  'mfa.no_apps': 'Noch keine Authenticator-App: Sie melden sich nur mit Ihrem Passwort an.',
+  'mfa.no_apps': 'Noch kein zweiter Faktor: Sie melden sich nur mit Ihrem Passwort an.',
   'mfa.add_app': 'Authenticator-App hinzufügen',
   'mfa.no_key': 'Die Zwei-Faktor-Anmeldung braucht den Instanzschlüssel (PGKILN_SECRET_KEY), um das Geheimnis der App zu speichern.',
   'mfa.scan': 'Scannen Sie den QR-Code mit einer Authenticator-App.',
@@ -1739,28 +1739,28 @@ export const de: BuilderMessages = {
   'mfa.remove_app': 'Diese App entfernen',
   'mfa.your_password': 'Ihr Passwort',
   'mfa.wrong_password': 'Falsches Passwort.',
-  'mfa.cannot_remove_required': 'Die Zwei-Faktor-Anmeldung ist für Sie erforderlich: Fügen Sie eine weitere App hinzu, bevor Sie diese entfernen.',
+  'mfa.cannot_remove_required': 'Die Zwei-Faktor-Anmeldung ist für Sie erforderlich: Fügen Sie einen weiteren Passkey oder eine App hinzu, bevor Sie diesen Faktor entfernen.',
   'mfa.cannot_remove_admin': 'Mindestens zwei Administratoren (oder alle, wenn es weniger sind) müssen die Zwei-Faktor-Anmeldung behalten, solange die Richtlinie gilt.',
   'mfa.keep_admins': 'Jetzt nicht: Die Zwei-Faktor-Richtlinie braucht mindestens zwei Administratoren mit Zwei-Faktor-Anmeldung (oder alle, wenn es weniger sind).',
-  'mfa.removed': 'Authenticator-App entfernt.',
+  'mfa.removed': 'Entfernt.',
   'mfa.codes_title': 'Wiederherstellungscodes',
   'mfa.codes_once': 'Bewahren Sie diese Codes sicher und getrennt vom Telefon auf. Jeder Code ersetzt einmal einen App-Code. Sie werden nur jetzt angezeigt.',
   'mfa.codes_saved': 'Ich habe diese Codes gespeichert',
   'mfa.codes_done': 'Fertig',
   'mfa.codes_kept': 'Wiederherstellungscodes gespeichert.',
   'mfa.codes_left': 'Unbenutzte Wiederherstellungscodes: {n}.',
-  'mfa.codes_after': 'Sie erhalten Wiederherstellungscodes, wenn Sie eine Authenticator-App hinzufügen.',
+  'mfa.codes_after': 'Sie erhalten Wiederherstellungscodes, wenn Sie einen Passkey oder eine Authenticator-App hinzufügen.',
   'mfa.codes_low': 'Nur noch wenige Wiederherstellungscodes: Erstellen Sie neue.',
   'mfa.codes_new': 'Neue Wiederherstellungscodes',
   'mfa.codes_new_confirm': 'Neue Wiederherstellungscodes erstellen? Die alten gelten dann nicht mehr.',
   'mfa.expired': 'Die Anmeldung hat zu lange gedauert: Melden Sie sich erneut an.',
   'mfa.step_title': 'Zwei-Faktor-Anmeldung',
-  'mfa.step_intro': 'Geben Sie den Code aus Ihrer Authenticator-App für {user} ein.',
+  'mfa.step_intro': 'Bestätigen Sie, dass Sie es sind, {user}: mit einem Passkey oder einem Code aus Ihrer Authenticator-App.',
   'mfa.code': 'Code',
   'mfa.code_help': '6 Ziffern aus der App oder einer Ihrer Wiederherstellungscodes.',
   'mfa.verify': 'Bestätigen',
   'mfa.cancel': 'Zurück zur Anmeldung',
-  'mfa.locked_out': 'Telefon und Codes verloren? Bitten Sie einen Administrator, Ihre Zwei-Faktor-Anmeldung zurückzusetzen.',
+  'mfa.locked_out': 'Telefon, Schlüssel und Codes verloren? Bitten Sie einen Administrator, Ihre Zwei-Faktor-Anmeldung zurückzusetzen.',
   'mfa.wrong': 'Dieser Code ist falsch oder wurde schon verwendet.',
   'mfa.column': 'Zwei-Faktor',
   'mfa.on': 'an',
@@ -1784,4 +1784,40 @@ export const de: BuilderMessages = {
   'mfa.policy_needs_admins': 'Zuerst müssen mindestens zwei Administratoren (oder alle, wenn es weniger sind) die Zwei-Faktor-Anmeldung einrichten, damit niemand allein ausgesperrt wird.',
   'mfa.without': 'Ohne Zwei-Faktor-Anmeldung: {list}.',
   'mfa.cli_note': 'Ausgesperrt? Auf dem Server: pgkiln admin reset-2fa <developer> oder pgkiln admin set-2fa-policy off.',
+  // ------------------------------------------------------------ Security: passkeys and trusted browsers (sprint 127)
+  'mfa.kind': 'Art',
+  'mfa.kind_passkey': 'Passkeys',
+  'mfa.kind_app': 'Authenticator-Apps',
+  'mfa.other_domain': 'für {domain}',
+  'mfa.other_domain_help': 'Für {domain} erstellt: Unter dieser Adresse funktioniert er nicht. Fügen Sie hier einen neuen Passkey hinzu.',
+  'mfa.passkey_intro': 'Melden Sie sich mit Fingerabdruck, Gesicht, Bildschirmsperre oder einem Sicherheitsschlüssel an. Ein Passkey funktioniert nur auf dieser Website.',
+  'mfa.passkey_default': 'Passkey',
+  'mfa.add_passkey': 'Passkey hinzufügen',
+  'mfa.passkey_needs_js': 'Zum Hinzufügen eines Passkeys ist JavaScript nötig; eine Authenticator-App funktioniert ohne.',
+  'mfa.passkey_failed': 'Der Passkey hat nicht funktioniert. Versuchen Sie es erneut oder verwenden Sie einen Code.',
+  'mfa.passkey_known': 'Dieser Passkey ist bereits hinzugefügt.',
+  'mfa.passkey_added': 'Passkey hinzugefügt: Ab jetzt können Sie sich damit anmelden.',
+  'mfa.remove_passkey': 'Diesen Passkey entfernen',
+  'mfa.use_passkey': 'Passkey verwenden',
+  'mfa.trust_browser': 'Diesem Browser {days} Tage vertrauen',
+  'mfa.trusted_title': 'Vertrauenswürdige Browser',
+  'mfa.trusted_count': 'Browser, die den zweiten Schritt überspringen: {n} (höchstens {days} Tage).',
+  'mfa.trusted_off': 'Das Vertrauen von Browsern ist ausgeschaltet.',
+  'mfa.forget_browsers': 'Vertrauenswürdige Browser vergessen',
+  'mfa.browsers_forgotten': 'Jeder Browser fragt wieder nach dem zweiten Schritt.',
+  'mfa.trust_days': 'Browser vertrauen (Tage)',
+  'mfa.trust_days_help': 'Nach dem zweiten Schritt darf ein Entwickler ihn in diesem Browser so viele Tage überspringen. 0: nie.',
+  'mfa.passkey_needs_host': 'Passkeys brauchen einen Hostnamen, keine IP-Adresse ({host}): Öffnen Sie den Builder über localhost oder seinen Domainnamen.',
+  'signin.passkey': 'Mit einem Passkey anmelden',
+  'mfa.passkey_signin': 'Entwickler dürfen sich nur mit einem Passkey anmelden (ohne Passwort)',
+  'mfa.passkey_signin_help': 'Nur wenn das Gerät den Entwickler geprüft hat (Fingerabdruck, Gesicht oder PIN): Dann zählt der Passkey als beide Faktoren.',
+  'mfa.weak_required': 'Zwei-Faktor-Anmeldung ist erforderlich: Ändern Sie das Standardpasswort, bevor Sie fortfahren.',
+  'wsp.mfa': 'Zwei-Faktor-Anmeldung',
+  'wsp.mfa_required': 'Zwei-Faktor-Anmeldung für die Entwickler dieses Workspace verlangen',
+  'wsp.mfa_required_help': 'Zusätzlich zur Richtlinie der Instanz. Entwickler ohne Passkey oder Authenticator-App erhalten die Übergangsfrist der Instanz, danach nur ihre Sicherheitsseite.',
+  'wsp.mfa_since': 'Erforderlich seit {date}.',
+  'wsp.mfa_without': 'Noch nicht eingerichtet: {list}.',
+  'wsp.mfa_save': 'Zwei-Faktor-Regel speichern',
+  'wsp.mfa_on': 'Die Entwickler dieses Workspace brauchen die Zwei-Faktor-Anmeldung.',
+  'wsp.mfa_off': 'Der Workspace verlangt keine Zwei-Faktor-Anmeldung mehr (die Richtlinie der Instanz gilt weiter).',
 };

package/src/builder/i18n/en.ts

@@ -1717,16 +1717,16 @@ export const en = {
   // ------------------------------------------------------------ Security: two-factor sign-in (sprint 126)
   'mfa.menu': 'Two-factor sign-in',
   'mfa.title': 'Security',
-  'mfa.intro': 'Sign in with a code from an authenticator app after your password. Recovery codes get you in when you lose the phone.',
-  'mfa.required_you': 'Your administrator requires two-factor sign-in: add an authenticator app.',
+  'mfa.intro': 'After your password, confirm it’s you with a passkey (fingerprint, face, security key) or a code from an authenticator app. Recovery codes get you in when you lose them.',
+  'mfa.required_you': 'Your administrator requires two-factor sign-in: add a passkey or an authenticator app.',
   'mfa.banner': 'Two-factor sign-in is required. Set it up before {date}: {link}',
   'mfa.set_up_now': 'set up now',
-  'mfa.apps': 'Authenticator apps',
+  'mfa.factors': 'Passkeys and authenticator apps',
   'mfa.app_name': 'Name',
   'mfa.app_default': 'Phone',
   'mfa.added': 'Added',
   'mfa.last_used': 'Last used',
-  'mfa.no_apps': 'No authenticator app yet: you sign in with your password only.',
+  'mfa.no_apps': 'No second factor yet: you sign in with your password only.',
   'mfa.add_app': 'Add an authenticator app',
   'mfa.no_key': 'Two-factor sign-in needs the instance key (PGKILN_SECRET_KEY) to store the app’s secret.',
   'mfa.scan': 'Scan the QR code with an authenticator app.',
@@ -1742,28 +1742,28 @@ export const en = {
   'mfa.remove_app': 'Remove this app',
   'mfa.your_password': 'Your password',
   'mfa.wrong_password': 'Wrong password.',
-  'mfa.cannot_remove_required': 'Two-factor sign-in is required for you: add another app before you remove this one.',
+  'mfa.cannot_remove_required': 'Two-factor sign-in is required for you: add another passkey or app before you remove this one.',
   'mfa.cannot_remove_admin': 'At least two administrators (or every administrator, when there are fewer) must keep two-factor sign-in while the policy is on.',
   'mfa.keep_admins': 'Not now: the two-factor policy needs at least two administrators with two-factor sign-in (or every administrator, when there are fewer).',
-  'mfa.removed': 'Authenticator app removed.',
+  'mfa.removed': 'Removed.',
   'mfa.codes_title': 'Recovery codes',
   'mfa.codes_once': 'Save these codes somewhere safe, away from your phone. Each one signs you in once instead of an app code. They are shown only now.',
   'mfa.codes_saved': 'I saved these codes',
   'mfa.codes_done': 'Done',
   'mfa.codes_kept': 'Recovery codes saved.',
   'mfa.codes_left': 'Unused recovery codes: {n}.',
-  'mfa.codes_after': 'You get recovery codes when you add an authenticator app.',
+  'mfa.codes_after': 'You get recovery codes when you add a passkey or an authenticator app.',
   'mfa.codes_low': 'Few recovery codes left: make new ones.',
   'mfa.codes_new': 'New recovery codes',
   'mfa.codes_new_confirm': 'Make new recovery codes? The old ones stop working.',
   'mfa.expired': 'The sign-in took too long: sign in again.',
   'mfa.step_title': 'Two-factor sign-in',
-  'mfa.step_intro': 'Enter the code from your authenticator app for {user}.',
+  'mfa.step_intro': 'Confirm it’s you, {user}: use a passkey or enter a code from your authenticator app.',
   'mfa.code': 'Code',
   'mfa.code_help': '6 digits from the app, or one of your recovery codes.',
   'mfa.verify': 'Verify',
   'mfa.cancel': 'Back to sign-in',
-  'mfa.locked_out': 'Lost your phone and codes? Ask an administrator to reset your two-factor sign-in.',
+  'mfa.locked_out': 'Lost your phone, key and codes? Ask an administrator to reset your two-factor sign-in.',
   'mfa.wrong': 'That code is not right, or was already used.',
   'mfa.column': 'Two-factor',
   'mfa.on': 'on',
@@ -1787,4 +1787,40 @@ export const en = {
   'mfa.policy_needs_admins': 'First, at least two administrators (or every administrator, when there are fewer) set up two-factor sign-in, so nobody is locked out alone.',
   'mfa.without': 'Without two-factor sign-in: {list}.',
   'mfa.cli_note': 'Locked out? On the server: pgkiln admin reset-2fa <developer> or pgkiln admin set-2fa-policy off.',
+  // ------------------------------------------------------------ Security: passkeys and trusted browsers (sprint 127)
+  'mfa.kind': 'Kind',
+  'mfa.kind_passkey': 'Passkeys',
+  'mfa.kind_app': 'Authenticator apps',
+  'mfa.other_domain': 'for {domain}',
+  'mfa.other_domain_help': 'Made for {domain}: it doesn’t work at this address. Add a new passkey here.',
+  'mfa.passkey_intro': 'Sign in with your fingerprint, face or screen lock, or a security key. A passkey only works on this site.',
+  'mfa.passkey_default': 'Passkey',
+  'mfa.add_passkey': 'Add a passkey',
+  'mfa.passkey_needs_js': 'Adding a passkey needs JavaScript; an authenticator app works without it.',
+  'mfa.passkey_failed': 'The passkey didn’t work. Try again, or use a code.',
+  'mfa.passkey_known': 'This passkey is already added.',
+  'mfa.passkey_added': 'Passkey added: from now on you can sign in with it.',
+  'mfa.remove_passkey': 'Remove this passkey',
+  'mfa.use_passkey': 'Use a passkey',
+  'mfa.trust_browser': 'Trust this browser for {days} days',
+  'mfa.trusted_title': 'Trusted browsers',
+  'mfa.trusted_count': 'Browsers that skip the second step: {n} (for up to {days} days).',
+  'mfa.trusted_off': 'Trusting browsers is turned off.',
+  'mfa.forget_browsers': 'Forget trusted browsers',
+  'mfa.browsers_forgotten': 'Every browser asks for the second step again.',
+  'mfa.trust_days': 'Trust a browser (days)',
+  'mfa.trust_days_help': 'After the second step a developer may skip it in that browser for this many days. 0: never.',
+  'mfa.passkey_needs_host': 'Passkeys need a host name, not an IP address ({host}): open the builder at localhost or its domain name.',
+  'signin.passkey': 'Sign in with a passkey',
+  'mfa.passkey_signin': 'Developers may sign in with a passkey alone (no password)',
+  'mfa.passkey_signin_help': 'Only when the device checked the developer (fingerprint, face or PIN): the passkey then counts as both factors.',
+  'mfa.weak_required': 'Two-factor sign-in is required: change the default password before you continue.',
+  'wsp.mfa': 'Two-factor sign-in',
+  'wsp.mfa_required': 'Require two-factor sign-in of this workspace’s developers',
+  'wsp.mfa_required_help': 'On top of the instance’s policy. Developers without a passkey or authenticator app get the instance’s grace period, then only their Security page.',
+  'wsp.mfa_since': 'Required since {date}.',
+  'wsp.mfa_without': 'Not set up yet: {list}.',
+  'wsp.mfa_save': 'Save two-factor rule',
+  'wsp.mfa_on': 'This workspace’s developers need two-factor sign-in.',
+  'wsp.mfa_off': 'The workspace no longer requires two-factor sign-in (the instance’s policy still applies).',
 } as const;

package/src/builder/i18n/es.ts

@@ -1714,16 +1714,16 @@ export const es: BuilderMessages = {
   // ------------------------------------------------------------ Security: two-factor sign-in (sprint 126)
   'mfa.menu': 'Inicio de sesión en dos pasos',
   'mfa.title': 'Seguridad',
-  'mfa.intro': 'Inicie sesión con un código de una aplicación de autenticación después de su contraseña. Los códigos de recuperación le permiten entrar si pierde el teléfono.',
-  'mfa.required_you': 'Su administrador exige el inicio de sesión en dos pasos: añada una aplicación de autenticación.',
+  'mfa.intro': 'Después de su contraseña, confirme que es usted con una llave de acceso (huella, rostro, llave de seguridad) o un código de una aplicación de autenticación. Los códigos de recuperación le permiten entrar si los pierde.',
+  'mfa.required_you': 'Su administrador exige el inicio de sesión en dos pasos: añada una llave de acceso o una aplicación de autenticación.',
   'mfa.banner': 'El inicio de sesión en dos pasos es obligatorio. Configúrelo antes del {date}: {link}',
   'mfa.set_up_now': 'configurar ahora',
-  'mfa.apps': 'Aplicaciones de autenticación',
+  'mfa.factors': 'Llaves de acceso y aplicaciones de autenticación',
   'mfa.app_name': 'Nombre',
   'mfa.app_default': 'Teléfono',
   'mfa.added': 'Añadida',
   'mfa.last_used': 'Último uso',
-  'mfa.no_apps': 'Aún no hay aplicación de autenticación: inicia sesión solo con su contraseña.',
+  'mfa.no_apps': 'Aún no hay segundo factor: inicia sesión solo con su contraseña.',
   'mfa.add_app': 'Añadir una aplicación de autenticación',
   'mfa.no_key': 'El inicio de sesión en dos pasos necesita la clave de la instancia (PGKILN_SECRET_KEY) para guardar el secreto de la aplicación.',
   'mfa.scan': 'Escanee el código QR con una aplicación de autenticación.',
@@ -1739,28 +1739,28 @@ export const es: BuilderMessages = {
   'mfa.remove_app': 'Quitar esta aplicación',
   'mfa.your_password': 'Su contraseña',
   'mfa.wrong_password': 'Contraseña incorrecta.',
-  'mfa.cannot_remove_required': 'El inicio de sesión en dos pasos es obligatorio para usted: añada otra aplicación antes de quitar esta.',
+  'mfa.cannot_remove_required': 'El inicio de sesión en dos pasos es obligatorio para usted: añada otra llave o aplicación antes de quitar esta.',
   'mfa.cannot_remove_admin': 'Al menos dos administradores (o todos, si hay menos) deben mantener el inicio de sesión en dos pasos mientras la política esté activa.',
   'mfa.keep_admins': 'Ahora no: la política de dos pasos necesita al menos dos administradores con inicio de sesión en dos pasos (o todos, si hay menos).',
-  'mfa.removed': 'Aplicación de autenticación quitada.',
+  'mfa.removed': 'Quitado.',
   'mfa.codes_title': 'Códigos de recuperación',
   'mfa.codes_once': 'Guarde estos códigos en un lugar seguro, lejos del teléfono. Cada uno sustituye una vez a un código de la aplicación. Solo se muestran ahora.',
   'mfa.codes_saved': 'He guardado estos códigos',
   'mfa.codes_done': 'Hecho',
   'mfa.codes_kept': 'Códigos de recuperación guardados.',
   'mfa.codes_left': 'Códigos de recuperación sin usar: {n}.',
-  'mfa.codes_after': 'Recibe códigos de recuperación al añadir una aplicación de autenticación.',
+  'mfa.codes_after': 'Recibe códigos de recuperación al añadir una llave de acceso o una aplicación de autenticación.',
   'mfa.codes_low': 'Quedan pocos códigos de recuperación: genere nuevos.',
   'mfa.codes_new': 'Nuevos códigos de recuperación',
   'mfa.codes_new_confirm': '¿Generar nuevos códigos de recuperación? Los antiguos dejan de funcionar.',
   'mfa.expired': 'El inicio de sesión tardó demasiado: inicie sesión de nuevo.',
   'mfa.step_title': 'Inicio de sesión en dos pasos',
-  'mfa.step_intro': 'Introduzca el código de su aplicación de autenticación para {user}.',
+  'mfa.step_intro': 'Confirme que es usted, {user}: use una llave de acceso o introduzca un código de su aplicación de autenticación.',
   'mfa.code': 'Código',
   'mfa.code_help': '6 dígitos de la aplicación o uno de sus códigos de recuperación.',
   'mfa.verify': 'Verificar',
   'mfa.cancel': 'Volver al inicio de sesión',
-  'mfa.locked_out': '¿Perdió el teléfono y los códigos? Pida a un administrador que restablezca su inicio de sesión en dos pasos.',
+  'mfa.locked_out': '¿Perdió el teléfono, la llave y los códigos? Pida a un administrador que restablezca su inicio de sesión en dos pasos.',
   'mfa.wrong': 'Ese código no es correcto o ya se usó.',
   'mfa.column': 'Dos pasos',
   'mfa.on': 'activado',
@@ -1784,4 +1784,40 @@ export const es: BuilderMessages = {
   'mfa.policy_needs_admins': 'Primero, al menos dos administradores (o todos, si hay menos) deben configurar el inicio de sesión en dos pasos, para que nadie quede bloqueado solo.',
   'mfa.without': 'Sin inicio de sesión en dos pasos: {list}.',
   'mfa.cli_note': '¿Bloqueado? En el servidor: pgkiln admin reset-2fa <developer> o pgkiln admin set-2fa-policy off.',
+  // ------------------------------------------------------------ Security: passkeys and trusted browsers (sprint 127)
+  'mfa.kind': 'Tipo',
+  'mfa.kind_passkey': 'Llaves de acceso',
+  'mfa.kind_app': 'Aplicaciones de autenticación',
+  'mfa.other_domain': 'para {domain}',
+  'mfa.other_domain_help': 'Creada para {domain}: no funciona en esta dirección. Añada aquí una nueva llave.',
+  'mfa.passkey_intro': 'Inicie sesión con su huella, su rostro, el bloqueo de pantalla o una llave de seguridad. Una llave de acceso solo funciona en este sitio.',
+  'mfa.passkey_default': 'Llave de acceso',
+  'mfa.add_passkey': 'Añadir una llave de acceso',
+  'mfa.passkey_needs_js': 'Añadir una llave de acceso requiere JavaScript; una aplicación de autenticación funciona sin él.',
+  'mfa.passkey_failed': 'La llave de acceso no funcionó. Inténtelo de nuevo o use un código.',
+  'mfa.passkey_known': 'Esta llave de acceso ya está añadida.',
+  'mfa.passkey_added': 'Llave de acceso añadida: a partir de ahora puede iniciar sesión con ella.',
+  'mfa.remove_passkey': 'Quitar esta llave de acceso',
+  'mfa.use_passkey': 'Usar una llave de acceso',
+  'mfa.trust_browser': 'Confiar en este navegador durante {days} días',
+  'mfa.trusted_title': 'Navegadores de confianza',
+  'mfa.trusted_count': 'Navegadores que omiten el segundo paso: {n} (hasta {days} días).',
+  'mfa.trusted_off': 'La confianza en navegadores está desactivada.',
+  'mfa.forget_browsers': 'Olvidar los navegadores de confianza',
+  'mfa.browsers_forgotten': 'Todos los navegadores vuelven a pedir el segundo paso.',
+  'mfa.trust_days': 'Confiar en un navegador (días)',
+  'mfa.trust_days_help': 'Tras el segundo paso, un desarrollador puede omitirlo en ese navegador durante estos días. 0: nunca.',
+  'mfa.passkey_needs_host': 'Las llaves de acceso necesitan un nombre de host, no una dirección IP ({host}): abra el constructor en localhost o en su nombre de dominio.',
+  'signin.passkey': 'Iniciar sesión con una llave de acceso',
+  'mfa.passkey_signin': 'Los desarrolladores pueden iniciar sesión solo con una llave de acceso (sin contraseña)',
+  'mfa.passkey_signin_help': 'Solo cuando el dispositivo verificó al desarrollador (huella, rostro o PIN): la llave cuenta entonces como ambos factores.',
+  'mfa.weak_required': 'El inicio de sesión en dos pasos es obligatorio: cambie la contraseña predeterminada antes de continuar.',
+  'wsp.mfa': 'Inicio de sesión en dos pasos',
+  'wsp.mfa_required': 'Exigir el inicio de sesión en dos pasos a los desarrolladores de este espacio de trabajo',
+  'wsp.mfa_required_help': 'Además de la política de la instancia. Los desarrolladores sin llave de acceso ni app de autenticación tienen el periodo de gracia de la instancia y después solo su página de seguridad.',
+  'wsp.mfa_since': 'Obligatorio desde {date}.',
+  'wsp.mfa_without': 'Aún sin configurar: {list}.',
+  'wsp.mfa_save': 'Guardar la regla de dos pasos',
+  'wsp.mfa_on': 'Los desarrolladores de este espacio de trabajo necesitan el inicio de sesión en dos pasos.',
+  'wsp.mfa_off': 'El espacio de trabajo ya no exige el inicio de sesión en dos pasos (la política de la instancia sigue vigente).',
 };