release-2.9.0 (#1532)

* fix(macos): skip single-instance lock in Mac App Store builds (#1454) fix(macos): skip single-instance lock in Mac App Store builds * Fix/backend optional sharp (#1455) Fix/backend optional sharp * feat: issue #1218 (#1218) https://github.com/Termix-SSH/Support/issues/1218 * feat: Add option to use saved global custom theme under Connection Defaults (#1209) https://github.com/Termix-SSH/Support/issues/1209 * feat: Add Fleet Sharing functionality to the UI (#1228) https://github.com/Termix-SSH/Support/issues/1228 * feat: Add a list view to the Docker management page (#1237) https://github.com/Termix-SSH/Support/issues/1237 * feat: issue #1264 (#1264) https://github.com/Termix-SSH/Support/issues/1264 * feat: 2FA With FortiToken (#1288) https://github.com/Termix-SSH/Support/issues/1288 * feat: Allow to disable showing paths to folders (#1274) https://github.com/Termix-SSH/Support/issues/1274 * feat: Sync Network Graph between Desktop and Remote Server (#1245) https://github.com/Termix-SSH/Support/issues/1245 * feat: Version Number on offline servers (#1291) https://github.com/Termix-SSH/Support/issues/1291 * feat: Support OrbStack Docker socket path on macOS / Fix "Docker is not installed" on mac... (#1302) https://github.com/Termix-SSH/Support/issues/1302 * feat: Sidebar host click should focus existing tab instead of opening a new connection (#1289) https://github.com/Termix-SSH/Support/issues/1289 * fix: Search in side bar shows overlapping hosts when grouped by tags (#1303) https://github.com/Termix-SSH/Support/issues/1303 * fix: I can't send a file on its own. (#1304) https://github.com/Termix-SSH/Support/issues/1304 * fix: sudo password not autofilling (#1248) https://github.com/Termix-SSH/Support/issues/1248 * fix: node-MainThread (#1300) https://github.com/Termix-SSH/Support/issues/1300 * fix: Tunnel authentication with shared credentials (#1295) https://github.com/Termix-SSH/Support/issues/1295 * fix: host key updates not syncing, metrics 404 race on first connect Host key writes never bumped updatedAt so sync never picked them up. Also retry the first metrics fetch briefly instead of failing right away. * chore: increment ver * feat: add category and icon fields to plugin manifest schema * ci(deps): bump the github-actions group with 2 updates (#1458) Bumps the github-actions group with 2 updates: [crowdin/github-action](https://github.com/crowdin/github-action) and [actions/github-script](https://github.com/actions/github-script). Updates `crowdin/github-action` from 2 to 3 - [Release notes](https://github.com/crowdin/github-action/releases) - [Commits](https://github.com/crowdin/github-action/compare/v2...v3) Updates `actions/github-script` from 7 to 9 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7...v9) --- updated-dependencies: - dependency-name: crowdin/github-action dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 13 updates (#1459) Bumps the dev-patch-updates group with 13 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/commands](https://github.com/codemirror/commands) | `6.11.0` | `6.11.1` | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.1` | `6.7.2` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.9` | `6.43.12` | | [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` | | [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.5` | `14.6.7` | | [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2) | `1.15.5` | `1.15.6` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` | | [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.1` | `3.34.3` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.7` | | [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.2` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` | | [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.14` | Updates `@codemirror/commands` from 6.11.0 to 6.11.1 - [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/commands/commits) Updates `@codemirror/search` from 6.7.1 to 6.7.2 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.9 to 6.43.12 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@testing-library/dom` from 10.4.1 to 10.4.2 - [Release notes](https://github.com/testing-library/dom-testing-library/releases) - [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/dom-testing-library/compare/v10.4.1...v10.4.2) Updates `@testing-library/react` from 16.3.2 to 16.3.3 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3) Updates `@testing-library/user-event` from 14.6.5 to 14.6.7 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/user-event/compare/v14.6.5...v14.6.7) Updates `@types/ssh2` from 1.15.5 to 1.15.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2) Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react) Updates `cytoscape` from 3.34.1 to 3.34.3 - [Release notes](https://github.com/cytoscape/cytoscape.js/releases) - [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.1...v3.34.3) Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.7 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.4...v0.5.7) Updates `i18next` from 26.4.0 to 26.4.2 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.4.0...v26.4.2) Updates `prettier` from 3.9.6 to 3.9.8 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.9.6...3.9.8) Updates `react-i18next` from 17.0.12 to 17.0.14 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/react-i18next/compare/v17.0.12...v17.0.14) --- updated-dependencies: - dependency-name: "@codemirror/commands" dependency-version: 6.11.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/search" dependency-version: 6.7.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/dom" dependency-version: 10.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/react" dependency-version: 16.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@testing-library/user-event" dependency-version: 14.6.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@types/ssh2" dependency-version: 1.15.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: cytoscape dependency-version: 3.34.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: i18next dependency-version: 26.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: react-i18next dependency-version: 17.0.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the prod-patch-updates group with 6 updates (#1461) Bumps the prod-patch-updates group with 6 updates: | Package | From | To | | --- | --- | --- | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.13` | | [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` | | [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` | | [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` | | [socks](https://github.com/JoshGlazebrook/socks) | `2.8.9` | `2.8.10` | | [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` | Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.13 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.13/packages/react-virtual) Updates `compression` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2) Updates `jose` from 6.2.9 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](https://github.com/panva/jose/compare/v6.2.9...v6.2.12) Updates `jszip` from 3.10.1 to 3.10.2 - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](https://github.com/Stuk/jszip/compare/v3.10.1...v3.10.2) Updates `socks` from 2.8.9 to 2.8.10 - [Release notes](https://github.com/JoshGlazebrook/socks/releases) - [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.9...2.8.10) Updates `undici` from 8.10.0 to 8.10.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2) --- updated-dependencies: - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: compression dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: jose dependency-version: 6.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: jszip dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: socks dependency-version: 2.8.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates - dependency-name: undici dependency-version: 8.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add plugin worker protocol, bootstrap and plugin_storage table Worker-side ctx proxy plus the message envelope it talks over, and the per-plugin key/value table behind ctx.storage with migrations for all three dialects. Rows cascade with the plugin so uninstalling leaves nothing behind. * feat: add allowlisted host view for plugins An allowlist rather than a list of fields to strip. A blocklist rots: the moment a new secret-bearing column lands on SSHHost it starts leaking silently. With an allowlist a new field stays invisible to plugins until someone adds it here on purpose. * feat: add plugin loader with manifest validation and crash restart Validates an unpacked plugin, spawns a worker_threads worker and manages activate/deactivate/crash-restart with backoff, disabling after three tries. The crash counter clears only after a plugin stays up past a stability window, not on activation. Clearing it on activation let a plugin that activates cleanly and then dies restart forever, because every attempt looked like the first. loader.ts documents what the worker boundary does and does not buy you. Node's permission model is process-wide, not per-worker, so it cannot be enabled for plugin workers alone and is not claimed here. * feat: route internal events through a shared plugin event bus Formalises three ad-hoc publish paths that already existed: automation-events.ts, metrics/automation-bridge.ts and the hostSessionStatus singleton, now the host.session.status topic. Both invariants the old code relied on are preserved. Publishing stays fire-and-forget, so a failing subscriber cannot disturb a metrics poll or a host delete. The automations engine subscribes to the bus at scheduler start instead of being imported ad hoc, which keeps the edge one-directional: automations may import repositories, hosts modules must not import automations. * feat: add plugin ctx broker with permission gate and audit Every ctx call a plugin makes is checked against its granted capabilities, performed by the main thread, then audited. A capability must be both declared in the manifest and granted in the database, so widening a plugin's reach always needs a new manifest the user can see, never just a database row. Audit attribution is set by the broker, not the plugin. The plugin supplies only the details, so it cannot forge the actor. fix: stop plugin workers seeing plaintext credentials in error messages A failing ctx.ssh.connect handed the worker the raw error from deep in the SSH stack, which embeds the connect config. The worker received, in full: Authentication failed for root using password <SECRET> where <SECRET> was the host's real plaintext password. Any plugin with ssh.exec could read it by catching the error, defeating the whole point of the handle-based ssh API. Errors crossing the boundary are now sanitised. Only PluginFacingError and PluginPermissionError, both authored here, reach a plugin verbatim; anything else becomes a generic message and the real one goes to the log. This uses a marker class rather than matching on message text, because matching would start leaking again the moment an upstream error happened to contain a familiar phrase. Covered by credential-isolation.test.ts, which plants a sentinel in every secret-bearing field and asserts it appears in no message the worker ever receives. * feat: dispatch plugin HTTP routes and wire the runtime into startup ctx.http.route now registers a real router on the /plugin-api/:pluginId dispatcher, replacing its stub 404. A plugin never touches the Express req/res: it gets a plain summary and returns a plain object, so sockets and session cookies stay on this side of the boundary. Authorization and cookie headers are not forwarded. Plugins load last in the start-up sequence, after the server is fully wired, and are terminated before the database on shutdown so none can outlive it. A plugin that fails to load cannot stop the backend. fix: correct the nginx plugin-api location regex The pattern was ^/plugin-api/(/.*)?$, which needs a double slash and so never matched /plugin-api/<id>/<route>. Every other block in the file uses ^/prefix(/.*)?$. Left alone, plugin routes would work in dev and 404 only behind Docker. * fix: update stale SFTP transfer test for single file destination paths The test still asserted transferToHost was called with the destination directory "/srv". Commit 7727fa09 (#1304) deliberately changed a single file transfer to send the full destination path including the filename, so the correct expectation is "/srv/remote-1.txt". The code was right and the test was left behind. * feat: ship the ssh terminal as a first-party in-process plugin Adds a hardcoded process:transport-owner tier so the terminal can own its WebSocket server and ssh2 clients, which cannot cross the worker boundary. * feat: ship docker as a first-party in-process plugin Moves docker backend and frontend into plugins/docker/, alongside ssh-terminal. Adds a host editor tab seam, a dashboard card registry, and a build step to compile plugin backends into dist. * feat: ship host metrics as a first-party in-process plugin * fix: harden plugin auth and add per-request identity for ctx calls Require auth on /plugin-api, gate plugin enable/grant/revoke routes behind admin.plugins.manage, and thread the calling user through worker ctx.hosts/ctx.ssh calls instead of always using the install owner. Also adds the plugin permissions grant/revoke UI. * feat: ship the AI assistant as a first-party in-process plugin Moves src/backend/ai and its routes into plugins/ai, mounted through a small /ai dispatcher instead of its own port. Moves the ai-enabled and ai-private-endpoints settings routes out of user-settings-routes.ts into the plugin too, so it has no leftover core dependents. * fix: remove compiled plugin JS left behind in plugins/ after build copy-bundled-plugins.cjs compiled and rewrote plugin backend TS in place, copied it to dist/plugins, but never deleted the .js it had just emitted next to the .ts sources. Those files shadowed the real source for vitest/tsx and had import paths rewritten for the dist layout, so tests failed with "Cannot find module" once a local build had run. Affects docker, host-metrics and ai, not just this one. * feat: add a permission-gated backend service registry for plugins * feat: add a permission-gated UI action registry and action slots for plugins Moves the terminal toolbar's hardwired AI button into a slot the ssh-terminal plugin offers and the ai plugin fills, gated on ai.services.use. * feat: add cross-plugin secret references gated by the provider's RBAC permission * feat: move proxmox discovery/import/sync into a first-party plugin * feat: move remote desktop (RDP/VNC/Telnet) into a first-party plugin Relocates guacamole backend/frontend source and tests into plugins/remote-desktop, following the ssh-terminal/docker pattern. * feat: wire remote-desktop plugin into core and rename i18n keys Repoints core consumers (dispatcher, collab, session-sharing, tab utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/ telnet, widens hostCapability to accept an array, and renames the guacamole i18n namespace to remoteDesktop. * feat: move fleets into a first-party plugin * feat: move automations into a first-party plugin * feat: remove legacy alert rules, superseded by automations Alert rules already auto-migrate into automations on boot and the old engine stands down after. Deletes the rule/firing tables, routes, UI, and AI tools; keeps notification channels since automations still use them. Also fixes automations' notify step, which still called the deleted repository. * feat: move network topology into a first-party plugin * feat: move tailscale device discovery and settings into a plugin Adds plugins/tailscale/ with a devices sidebar tab, admin settings section, and re-auth dialog. Host Metrics tailscale manager card and SSH re-auth banner parsing stay in core. * feat: move workspaces into a first-party plugin * feat: move web endpoint into a first-party plugin * feat: collapse plugin runtime to one tier behind a plugin SDK * feat: make each plugin an npm workspace built by a termix-plugin CLI * feat: give plugins their own tables, migrations and sync entities * feat: serve plugin http and websockets from one mount instead of ports * feat: namespace plugin permissions and keep them valid when a plugin is off * feat: give plugins their own settings and one settings screen * feat: load plugin frontends at runtime and remove plugin ids from the shell * fix: mock the ai status fetch in its activate test * feat: add auth extension points and one ssh connect pipeline * feat: rebuild workspaces as the reference plugin * fix: gate second factors after SSO/LDAP behind an admin setting * feat: convert network-topology to a full plugin (B1) * feat: move snippets backend and tables into a plugin (B2) * feat: point core frontend snippets pickers at the plugin (B2) * feat: add the snippets plugin (B2) * feat: wire ai, automations, fleets and ssh-terminal to snippets (B2) * feat: finish the tailscale plugin, including SSH auth (B3) * feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4) * chore: update proxmox and host-metrics locale files for B5 * chore: regenerate drizzle migration journals for B5 * feat: add ctx.hosts create/update to the SDK, host-metrics drops proxmox * feat: move proxmox node stats and collectors into the proxmox plugin * feat: drop proxmox host columns, use plugin settings instead * feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4) * feat: convert file manager into a plugin * feat: convert ssh tunnels into a plugin * feat: finish the web-endpoint plugin, add ctx.desktop (B8) * feat: move the terminal fully into the ssh-terminal plugin (B9) * feat: convert tmux monitoring into a plugin (B10) * feat: convert serial console into the serial plugin * feat: move session sharing and collab rooms into a plugin (B12) * feat: turn session recording into a plugin (B13) * feat: finish the remote-desktop plugin (B14) * feat: finish the host-metrics plugin, move host status into core (B16) * feat: finish the docker plugin (B15) * feat: finish the automations plugin (B17) * feat: finish the ai plugin (B18) * feat: finish the homepage plugin, move service links and canvas out of core (B19) * feat: convert wake-on-lan into a plugin (B20) * feat: convert secret-sources into a plugin (B20) * feat: move totp and passkeys into plugins (C1) * feat: move sso and ldap logins into plugins (C2) * feat: move opkssh and warpgate into plugins (C3) * feat: move step-ca into a plugin (C4) * feat: move vault ssh signing into a plugin (C5) * feat: move termix identity into a plugin (C6) * feat: move acme certificate automation into a plugin (C7) * fix: finish 2.9.0 plugin moves and get every check green * chore: lock the plugin boundary and remove 2.9.0 leftovers * fix: harden the plugin runtime after the 2.9.0 security review * feat: add plugin packing, signing, pinned trust and tmxplug bundling * test: prove 2.8 to 2.9.0 upgrade is lossless and fix what it caught * fix: give bundled plugin backends a real require for CJS deps * feat: improve UI loading time and jitter * feat: show credential sharing inline in the sidebar like host sharing * feat: tailscale add host and copy ip, fix outbound fetch hang and plugin ESM warning * feat: unify alerts into one plugin, channels, rules and inbox * feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling * fix: set blacksmith builder cache-key to stop broken gha cache fallback * fix: link plugin-sdk workspace before npm ci in docker deps stage * fix: link every plugin workspace before npm ci in docker deps stage * fix(host-metrics): exclude image and firmware filesystems (#1469) * fix(host-metrics): exclude image and firmware filesystems * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(hosts): normalize imported jump host references (#1470) * fix(hosts): normalize imported jump host references * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(ci): build plugin SDK and repair MySQL settings migration (#1471) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): keep inline rename consistent (#1476) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): keep inline rename consistent * fix(dashboard): reuse translated host status labels (#1475) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(dashboard): reuse translated host status labels * docs(api): clarify local and remote version fields (#1474) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * docs(api): clarify local and remote version fields * fix(file-manager): preserve selected backgrounds on hover (#1473) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): preserve selection feedback on hover * test(ui): await dialog focus cleanup before teardown * fix(file-manager): restore Ctrl/Cmd+F file search (#1472) * fix(ci): build plugin SDK before dependent checks * fix(mysql): keep plugin settings scope indexes within limits * test(mysql): refresh reviewed plugin upgrade SQL * fix(file-manager): focus file search with Ctrl or Cmd F * fix: keep rounded-full circular in production builds * fix(file-manager): cancel uploads and stop remote writes (#1477) * fix(file-manager): cancel uploads and stop remote writes * test(css): exercise the configured PostCSS plugin chain * fix(file-manager): apply compact density to directory tree (#1478) * fix(file-manager): apply compact density to directory tree * test(css): exercise the configured PostCSS plugin chain * fix(file-manager): preserve font sizes in compact mode (#1480) * fix(file-manager): preserve font sizes in compact mode * test(css): exercise the configured PostCSS plugin chain * fix(file-manager): prioritize file names in narrow lists (#1483) * fix(file-manager): prioritize file names in narrow lists * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * test(remote-desktop): always mutate ciphertext in tamper test * fix(remote-desktop): probe the saved host guacd endpoint (#1481) * fix(remote-desktop): probe the saved host guacd endpoint * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * fix(homepage): check allowlisted private service reachability (#1479) * fix(homepage): check allowlisted private service reachability * test(css): exercise the configured PostCSS plugin chain * fix(remote-desktop): stop unsolicited clipboard read prompts (#1482) * fix(remote-desktop): read clipboard only on explicit paste * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * test(remote-desktop): always mutate ciphertext in tamper test * chore: simplify plugin readmes, changelogs and manifest descriptions * fix: keep plugins loaded after signing in from the login screen * fix(file-manager): accept OS file drops over existing rows (#1484) * fix(file-manager): accept OS file drops over existing rows * test(file-manager): target the file label in drop tests * test(css): exercise the configured PostCSS plugin chain * test(identity): preserve full Ed25519 public keys in fixtures * test(remote-desktop): always mutate ciphertext in tamper test * fix(file-manager): pipeline SFTP download reads (#1485) * feat: add plugin sdk build to beta release * fix: make link-store secret check immune to random base64 matches * fix(ldap): preserve the directory-provided bind DN (#1486) * fix: compute beta changes across dev branches and move the beta tag * chore: untrack plugin sdk ARCHITECTURE.md * chore: remove references to plugin sdk ARCHITECTURE.md * feat: merge host editor terminal tabs into one owned by ssh-terminal * feat: add descriptions to plugin host enable toggles * fix(file-manager): show download progress in file viewers (#1487) * fix(electron): signal backend readiness over IPC (#1488) * fix(split-screen): allow layout creation without randomUUID (#1490) * fix(split-screen): allow layout creation without randomUUID * test(credentials): avoid flaky Ed25519 key generation * fix(sidebar): remeasure visible rows after density changes (#1489) * fix(sidebar): remeasure visible rows after density changes * test(credentials): avoid flaky Ed25519 key generation * feat(split-screen): redesign split screen with free-form panes and pane picker * feat(sidebar): add host click behavior setting, default to always opening a new tab * feat(snippets): redesign panel to match the host list * fix(session-recording): stop session logs panel from refetching in a loop * feat(snippets): bring back sharing, target hosts and drag reorder * feat(ssh-terminal): add toolbar position, start state, display and fade host settings * feat(ssh-terminal): add host setting to turn off password prompt auto-fill * fix(ai): stop streams getting cut off and keep tool steps across messages * feat: improve quick connect system using plugin api * fix: proxmox guest sync, startup snippet sync, drop dead cloudflare ssh transport * feat: move terminal settings, look and ssh tools into ssh-terminal plugin * feat: move snippets, keybinding actions and macros out of core into plugins * feat: store rdp, vnc and telnet logins in a generic per-protocol table * feat: type the plugin host record, move plugin strings out of core and add lint checks * feat: replace core homepage widget registry with generic extension points * feat: plugins only see their own host settings in the browser * feat: harden plugin api for separate repos, signed updates and generic external login * fix: keep plugin css below core utilities and version plugin assets by their css * fix: load and save plugin host settings in the editor and tighten settings row spacing * feat: redesign user host defaults system * fix(remote-desktop): release held keys on focus loss (#1498) * fix(session-sharing): replace local presentation after takeover (#1500) * fix(file-manager): refresh disk usage with directory listing (#1503) * fix(ssh-terminal): preserve input order during local echo reconciliation (#1505) * feat(remote-desktop): expose display zoom controls for RDP (#1514) * fix(file-manager): restore text selection and copying in Markdown previews (#1518) * fix(sidebar): keep compact host addresses visible (#1524) * fix(hosts): preserve plugin settings when reopening the editor (#1499) * fix(ssh-terminal): close owner sockets when presentations unmount (#1501) * fix(session-sharing): synchronize shared SSH terminal dimensions (#1502) * fix(session-sharing): show participant presence in member terminals (#1504) * fix(ai): sync provider configuration and keys across linked devices (#1506) * feat(ssh-terminal): add a duplicate tab action (#1510) * feat(file-manager): allow disabling move-to-trash confirmation (#1511) * feat(file-manager): default to the remote login directory (#1512) * feat(homepage): synchronize canvas layouts across devices (#1515) * fix(shortcuts): prevent accidental double-Shift palette activation (#1519) * feat(tmux-monitor): add a unified multi-host view (#1520) * fix(electron): allow explicit quit with active connections (#1522) * feat: reconnect all disconnected terminal tabs (#1523) * fix(hosts): preserve recording and sharing settings in the dev editor (#1509) * fix(database): preserve RDP domain during startup backfill (#1497) * feat(sidebar): add keyboard type-ahead search for hosts (#1516) * feat(automations): add per-host maintenance mode and recurring schedules (#1521) * feat(tmux): add a per-host mouse toggle and preserve remote configuration (#1513) * fix(session-sharing): use the linked server for desktop meetings and links (#1507) * fix(tunnels): support TOTP for client tunnels and jump hosts (#1508) * fix: type errors and lint failures from merged plugin prs * feat(installer): make the Windows desktop shortcut optional (#1517) * fix: ship the plugin sdk and serialport in desktop builds * fix: prefer ipv4 when resolving ssh host names (#1365) * fix: readable terminal selection with the light theme (#1319) * fix: build desktop session share links on the linked server (#1350) * fix: show meeting guests to members and hide the roster from guests (#1353) * fix: reliable file manager saves with sudo prompt and no base64 guessing (#1335) * fix: show disk usage for the mount being browsed (#1347) * fix: load the linux tray icon reliably and log tray failures (#1332) * fix: cover the gnome close path in the desktop quit test (#1332) * fix: prompt for jump host TOTP in terminal, file manager and metrics (#1312) * feat: optional auto reconnect for dropped ssh sessions (#1321) * feat: tighter compact host rows with inline tags (#1325) * feat: bring back the alert feed homepage widget * feat: pick target terminals for snippets again * feat: share button on connection tabs again * feat: recent servers list when linking the desktop app * feat: list the fixed app shortcuts in keyboard shortcuts * fix: translate hardcoded toasts and drop em dashes from ui text * fix: translate leftover hardcoded ui text * fix: toolbar files button opens at the shell directory again * fix: show the remote desktop note under connection origin again * chore: openapi docs for host metrics manager routes * chore: openapi docs for undocumented routes and fix two broken doc blocks * fix: declare terminal.listSessions use for snippet targets * revert: drop the alert feed widget, the notification center replaces it * feat: restore the alert feed homepage widget * fix: quick connect fills the host address from plugin auth editors like tailscale * fix: docker container logs use the base background color * chore: fix dependabot alerts and apply safe npm upgrades * fix: proxmox stats tab reads its switch from plugin host settings * fix: count plugin ssh logins toward host status and stop showing reachable as a warning * fix: hide the built-in source pill in the host editor * fix: host status shows online when the port answers and only warns on a failed login * fix: drop the top border on the split layout menu * fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default * fix: remote desktop auth method labels and notes for vnc and telnet * fix: add description to the web endpoint enable switch * fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release * feat: move telemetry out of core into a usage statistics plugin * fix: recent activity card no longer cuts off host names early * fix: remove duplicate top border on split screen menu * fix: redesign session log player controls, fix tooltip overlap and drop dot separators * fix: file manager and sftp text showing raw i18n keys * fix: onboarding rerunning for existing users after upgrading * fix: fleet detail buttons overflowing the sidebar * fix: session log player scrolling off screen horizontally * fix: network graph lag when adding hosts and on every render * fix: maintenance index name, shared host read only view and badge polling * fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag * chore: update release notes * fix: remote desktop tabs reconnecting on every tab switch * fix: build plugin sdk before linting in release workflow * chore: lint, format, and bump version to 2.9.0 * chore: skip crowdin pre-translate in release for now * chore: sync Crowdin translations for 2.9.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Koi <38512047+datlt4@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
2026-10-30 15:15:24 +00:00 · 2026-10-01 16:20:16 -05:00
1 parent 49fa488093
commit 3643e7af97
@@ -0,0 +1,7 @@
+# Changelog
+
+## 1.0.0
+
+First release, bundled with Termix 2.9.0.
+
+Lets users sign in with a passkey or security key instead of a password. A passkey that checks your PIN or fingerprint also counts as a second factor.
@@ -0,0 +1,17 @@
+# Passkeys
+
+Sign in with a passkey or security key instead of a password. A passkey that checks your PIN or fingerprint also counts as a second factor.
+
+## Features
+
+- Sign in with a passkey or security key instead of a password.
+- A passkey that checks your PIN or fingerprint also counts as a second factor.
+- Add more than one passkey, including synced ones.
+
+## Development
+
+```bash
+npm run build      # build into dist/
+npm run test       # run this plugin's tests
+npm run typecheck  # type-check this plugin
+```
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Wagwoorde",
+  "signIn": "Teken aan met wagwoord",
+  "loginFailed": "Wagwoord-aanmelding het misluk",
+  "description": "Gebruik WebAuthn/FIDO2-bewyse om aan te meld sonder 'n wagwoord",
+  "namePlaceholder": "Wagwoordnaam",
+  "defaultName": "Wagwoord",
+  "uv": {
+    "preferred": "Verkies",
+    "required": "Vereis",
+    "discouraged": "Ontmoedig"
+  },
+  "add": "Voeg wagwoord by",
+  "none": "Geen wagwoorde geregistreer nie.",
+  "added": "Wagwoord bygevoeg",
+  "addFailed": "Kon nie wagwoord byvoeg nie",
+  "delete": "Vee wagwoord uit",
+  "deleted": "Wagwoord verwyder",
+  "deleteFailed": "Kon nie wagwoord verwyder nie",
+  "unknownDevice": "onbekend",
+  "synced": "gesinkroniseer"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "مفاتيح المرور",
+  "signIn": "تسجيل الدخول باستخدام مفتاح المرور",
+  "loginFailed": "فشل تسجيل الدخول بمفتاح المرور",
+  "description": "استخدم بيانات اعتماد WebAuthn/FIDO2 لتسجيل الدخول بدون كلمة مرور",
+  "namePlaceholder": "اسم مفتاح المرور",
+  "defaultName": "مفتاح المرور",
+  "uv": {
+    "preferred": "مفضل",
+    "required": "مطلوب",
+    "discouraged": "غير مشجع"
+  },
+  "add": "إضافة مفتاح مرور",
+  "none": "لا توجد مفاتيح مرور مسجلة.",
+  "added": "تمت إضافة مفتاح المرور",
+  "addFailed": "فشل إضافة مفتاح المرور",
+  "delete": "حذف مفتاح المرور",
+  "deleted": "تم حذف مفتاح المرور",
+  "deleteFailed": "فشل حذف مفتاح المرور",
+  "unknownDevice": "غير معروف",
+  "synced": "متزامن"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Пароли",
+  "signIn": "Влезте с парола",
+  "loginFailed": "Влизането с парола не бе успешно",
+  "description": "Използвайте WebAuthn/FIDO2 идентификационни данни за влизане без парола",
+  "namePlaceholder": "Име на паролата",
+  "defaultName": "Ключ за достъп",
+  "uv": {
+    "preferred": "Предпочитан",
+    "required": "Задължително",
+    "discouraged": "Обезкуражен"
+  },
+  "add": "Добавяне на парола",
+  "none": "Няма регистрирани пароли.",
+  "added": "Добавен е ключ за достъп",
+  "addFailed": "Добавянето на ключ за достъп не бе успешно",
+  "delete": "Изтриване на парола",
+  "deleted": "Ключът за достъп е изтрит",
+  "deleteFailed": "Изтриването на ключа за достъп не бе успешно",
+  "unknownDevice": "неизвестен",
+  "synced": "синхронизирано"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Claus d'accés",
+  "signIn": "Inicia la sessió amb la clau d'accés",
+  "loginFailed": "Error d'inici de sessió amb contrasenya",
+  "description": "Utilitzeu les credencials de WebAuthn/FIDO2 per iniciar la sessió sense contrasenya",
+  "namePlaceholder": "Nom de la clau d'accés",
+  "defaultName": "Clau d'accés",
+  "uv": {
+    "preferred": "Preferit",
+    "required": "Obligatori",
+    "discouraged": "Desanimat"
+  },
+  "add": "Afegeix una contrasenya",
+  "none": "No hi ha cap clau d'accés registrada.",
+  "added": "Clau d'accés afegida",
+  "addFailed": "No s'ha pogut afegir la contrasenya",
+  "delete": "Suprimeix la clau d'accés",
+  "deleted": "Clau d'accés suprimida",
+  "deleteFailed": "No s'ha pogut suprimir la clau d'accés",
+  "unknownDevice": "desconegut",
+  "synced": "sincronitzat"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Přístupové klíče",
+  "signIn": "Přihlásit se pomocí hesla",
+  "loginFailed": "Přihlášení k heslu se nezdařilo",
+  "description": "Pro přihlášení bez hesla použijte přihlašovací údaje WebAuthn/FIDO2",
+  "namePlaceholder": "Název přístupového klíče",
+  "defaultName": "Přístupový klíč",
+  "uv": {
+    "preferred": "Preferované",
+    "required": "Požadovaný",
+    "discouraged": "Odradit"
+  },
+  "add": "Přidat přístupový klíč",
+  "none": "Nejsou registrovány žádné přístupové klíče.",
+  "added": "Přístupový klíč byl přidán",
+  "addFailed": "Nepodařilo se přidat přístupový klíč",
+  "delete": "Smazat přístupový klíč",
+  "deleted": "Přístupový klíč smazán",
+  "deleteFailed": "Nepodařilo se smazat přístupový klíč",
+  "unknownDevice": "neznámý",
+  "synced": "synchronizováno"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Adgangsnøgler",
+  "signIn": "Log ind med adgangsnøgle",
+  "loginFailed": "Login med adgangsnøgle mislykkedes",
+  "description": "Brug WebAuthn/FIDO2-legitimationsoplysninger til at logge ind uden en adgangskode",
+  "namePlaceholder": "Adgangsnøglenavn",
+  "defaultName": "Adgangsnøgle",
+  "uv": {
+    "preferred": "Foretrukket",
+    "required": "Påkrævet",
+    "discouraged": "Modløs"
+  },
+  "add": "Tilføj adgangsnøgle",
+  "none": "Ingen adgangsnøgler registreret.",
+  "added": "Adgangsnøgle tilføjet",
+  "addFailed": "Kunne ikke tilføje adgangsnøgle",
+  "delete": "Slet adgangsnøgle",
+  "deleted": "Adgangsnøgle slettet",
+  "deleteFailed": "Kunne ikke slette adgangsnøglen",
+  "unknownDevice": "ukendt",
+  "synced": "synkroniseret"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Mit Passkey anmelden",
+  "loginFailed": "Passkey-Anmeldung fehlgeschlagen",
+  "description": "WebAuthn/FIDO2-Anmeldedaten für eine Anmeldung ohne Passwort verwenden",
+  "namePlaceholder": "Passkey-Name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Bevorzugt",
+    "required": "Erforderlich",
+    "discouraged": "Nicht empfohlen"
+  },
+  "add": "Passkey hinzufügen",
+  "none": "Keine Passkeys registriert.",
+  "added": "Passkey hinzugefügt",
+  "addFailed": "Fehler beim Hinzufügen des Passkeys",
+  "delete": "Passwort löschen",
+  "deleted": "Passkey gelöscht",
+  "deleteFailed": "Löschen des Passkeys fehlgeschlagen",
+  "unknownDevice": "unbekannt",
+  "synced": "synchronisiert"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Κλειδιά πρόσβασης",
+  "signIn": "Σύνδεση με κλειδί πρόσβασης",
+  "loginFailed": "Η σύνδεση με κωδικό πρόσβασης απέτυχε",
+  "description": "Χρησιμοποιήστε διαπιστευτήρια WebAuthn/FIDO2 για να συνδεθείτε χωρίς κωδικό πρόσβασης",
+  "namePlaceholder": "Όνομα κλειδιού πρόσβασης",
+  "defaultName": "Αντικλείδι",
+  "uv": {
+    "preferred": "Προνομιούχος",
+    "required": "Υποχρεούμαι",
+    "discouraged": "Αποθαρρυμένος"
+  },
+  "add": "Προσθήκη κλειδιού πρόσβασης",
+  "none": "Δεν έχουν καταχωρηθεί κλειδιά πρόσβασης.",
+  "added": "Προστέθηκε κλειδί πρόσβασης",
+  "addFailed": "Αποτυχία προσθήκης κλειδιού πρόσβασης",
+  "delete": "Διαγραφή κλειδιού πρόσβασης",
+  "deleted": "Ο κωδικός πρόσβασης διαγράφηκε",
+  "deleteFailed": "Η διαγραφή του κλειδιού πρόσβασης απέτυχε",
+  "unknownDevice": "άγνωστος",
+  "synced": "συγχρονισμένο"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Iniciar sesión con clave de acceso",
+  "loginFailed": "Error al iniciar sesión con clave de acceso",
+  "description": "Usa credenciales WebAuthn/FIDO2 para iniciar sesión sin contraseña",
+  "namePlaceholder": "Nombre de la passkey",
+  "defaultName": "Llave maestra",
+  "uv": {
+    "preferred": "Preferida",
+    "required": "Requerida",
+    "discouraged": "Desaconsejada"
+  },
+  "add": "Añadir passkey",
+  "none": "No hay passkeys registradas.",
+  "added": "Passkey añadida",
+  "addFailed": "No se pudo añadir la passkey",
+  "delete": "Eliminar clave de acceso",
+  "deleted": "Passkey eliminada",
+  "deleteFailed": "Error al eliminar la clave de acceso",
+  "unknownDevice": "desconocido",
+  "synced": "sincronizado"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Salasanat",
+  "signIn": "Kirjaudu sisään salasanalla",
+  "loginFailed": "Salasanan kirjautuminen epäonnistui",
+  "description": "Kirjaudu sisään ilman salasanaa WebAuthn/FIDO2-tunnuksilla",
+  "namePlaceholder": "Salasanan nimi",
+  "defaultName": "Salasana",
+  "uv": {
+    "preferred": "Ensisijainen",
+    "required": "Pakollinen",
+    "discouraged": "Lannistunut"
+  },
+  "add": "Lisää salasana",
+  "none": "Ei rekisteröityjä salasanoja.",
+  "added": "Salasana lisätty",
+  "addFailed": "Salasanan lisääminen epäonnistui",
+  "delete": "Poista salasana",
+  "deleted": "Salasana poistettu",
+  "deleteFailed": "Salasanan poistaminen epäonnistui",
+  "unknownDevice": "tuntematon",
+  "synced": "synkronoitu"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Clés d’accès",
+  "signIn": "Se connecter avec une clé d'accès",
+  "loginFailed": "Échec de la connexion par clé d'accès",
+  "description": "Utilisez des identifiants WebAuthn/FIDO2 pour vous connecter sans mot de passe",
+  "namePlaceholder": "Nom de la clé d’accès",
+  "defaultName": "Clé d'accès",
+  "uv": {
+    "preferred": "Préféré",
+    "required": "Requis",
+    "discouraged": "Déconseillé"
+  },
+  "add": "Ajouter une clé d’accès",
+  "none": "Aucune clé d’accès enregistrée.",
+  "added": "Clé d’accès ajoutée",
+  "addFailed": "Échec de l’ajout de la clé d’accès",
+  "delete": "Supprimer le code d'accès",
+  "deleted": "Clé d’accès supprimée",
+  "deleteFailed": "Échec de la suppression de la clé d'accès",
+  "unknownDevice": "inconnu",
+  "synced": "synchronisé"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "מפתחות סיסמה",
+  "signIn": "כניסה עם סיסמה",
+  "loginFailed": "כניסה עם סיסמה נכשלה",
+  "description": "השתמש בפרטי הכניסה של WebAuthn/FIDO2 ללא סיסמה",
+  "namePlaceholder": "שם סיסמה",
+  "defaultName": "סיסמה",
+  "uv": {
+    "preferred": "מועדף",
+    "required": "דָרוּשׁ",
+    "discouraged": "מיואש"
+  },
+  "add": "הוסף סיסמה",
+  "none": "אין סיסמות רשומות.",
+  "added": "סיסמה נוספת",
+  "addFailed": "נכשלה הוספת סיסמה",
+  "delete": "מחיקת סיסמה",
+  "deleted": "סיסמת הגישה נמחקה",
+  "deleteFailed": "מחיקת המפתח נכשלה",
+  "unknownDevice": "לֹא יְדוּעַ",
+  "synced": "מסונכרן"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "पासकीज़",
+  "signIn": "पासकी से साइन इन करें",
+  "loginFailed": "पासकी लॉगिन विफल",
+  "description": "बिना पासवर्ड साइन इन करने के लिए WebAuthn/FIDO2 क्रेडेंशियल का उपयोग करें",
+  "namePlaceholder": "पासकी नाम",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "पसंदीदा",
+    "required": "आवश्यक",
+    "discouraged": "हतोत्साहित"
+  },
+  "add": "पासकी जोड़ें",
+  "none": "कोई पासकी पंजीकृत नहीं है।",
+  "added": "पासकी जोड़ी गई",
+  "addFailed": "पासकी जोड़ने में विफल",
+  "delete": "Delete passkey",
+  "deleted": "पासकी हटाई गई",
+  "deleteFailed": "पासकी हटाने में विफल",
+  "unknownDevice": "अज्ञात",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Jelszavak",
+  "signIn": "Bejelentkezés jelszóval",
+  "loginFailed": "Jelszóval történő bejelentkezés sikertelen",
+  "description": "Jelszó nélküli bejelentkezéshez használja a WebAuthn/FIDO2 hitelesítő adatokat",
+  "namePlaceholder": "Jelszó neve",
+  "defaultName": "Jelszó",
+  "uv": {
+    "preferred": "Előnyben részesített",
+    "required": "Kívánt",
+    "discouraged": "Elbátortalanodva"
+  },
+  "add": "Jelszó hozzáadása",
+  "none": "Nincsenek regisztrált jelszók.",
+  "added": "Hozzáadott jelszó",
+  "addFailed": "Nem sikerült hozzáadni a jelszót",
+  "delete": "Jelszó törlése",
+  "deleted": "Jelszó törölve",
+  "deleteFailed": "Nem sikerült törölni a jelszót",
+  "unknownDevice": "ismeretlen",
+  "synced": "szinkronizálva"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Accedi con passkey",
+  "loginFailed": "Accesso con passkey non riuscito",
+  "description": "Utilizza credenziali WebAuthn/FIDO2 per accedere senza password",
+  "namePlaceholder": "Nome passkey",
+  "defaultName": "Chiave di sicurezza",
+  "uv": {
+    "preferred": "Preferita",
+    "required": "Obbligatoria",
+    "discouraged": "Sconsigliata"
+  },
+  "add": "Aggiungi passkey",
+  "none": "Nessuna passkey registrata.",
+  "added": "Passkey aggiunta",
+  "addFailed": "Impossibile aggiungere la passkey",
+  "delete": "Elimina la password",
+  "deleted": "Passkey eliminata",
+  "deleteFailed": "Impossibile eliminare la passkey",
+  "unknownDevice": "sconosciuto",
+  "synced": "sincronizzato"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "パスキー",
+  "signIn": "パスキーでサインイン",
+  "loginFailed": "パスキーログインに失敗しました",
+  "description": "WebAuthn/FIDO2認証情報を使用してパスワードなしでサインインできます",
+  "namePlaceholder": "パスキー名",
+  "defaultName": "パスキー",
+  "uv": {
+    "preferred": "優先",
+    "required": "必須",
+    "discouraged": "非推奨"
+  },
+  "add": "パスキーを追加",
+  "none": "登録されたパスキーはありません。",
+  "added": "パスキーが追加されました",
+  "addFailed": "パスキーの追加に失敗しました",
+  "delete": "パスキーを削除",
+  "deleted": "パスキーが削除されました",
+  "deleteFailed": "パスキーの削除に失敗しました",
+  "unknownDevice": "不明",
+  "synced": "同期済み"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "패스키",
+  "signIn": "Passkey로 로그인",
+  "loginFailed": "패스키 로그인 실패",
+  "description": "WebAuthn/FIDO2 자격 증명을 사용하여 비밀번호 없이 로그인하세요.",
+  "namePlaceholder": "패스키 이름",
+  "defaultName": "곁쇠",
+  "uv": {
+    "preferred": "선호",
+    "required": "필수",
+    "discouraged": "권장 안 함"
+  },
+  "add": "패스키 추가",
+  "none": "등록된 패스키가 없습니다.",
+  "added": "패스키가 추가되었습니다.",
+  "addFailed": "패스키 추가 실패",
+  "delete": "암호 삭제",
+  "deleted": "패스키가 삭제되었습니다.",
+  "deleteFailed": "패스키 삭제 실패",
+  "unknownDevice": "알 수 없음",
+  "synced": "동기화됨"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Påkrevd",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "ukjent",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Klucze dostępu",
+  "signIn": "Zaloguj się za pomocą klucza dostępu",
+  "loginFailed": "Nie udało się zalogować za pomocą klucza dostępu",
+  "description": "Używaj poświadczeń WebAuthn/FIDO2, aby logować się bez hasła",
+  "namePlaceholder": "Nazwa klucza dostępu",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferowane",
+    "required": "Wymagane",
+    "discouraged": "Odradzane"
+  },
+  "add": "Dodaj klucz dostępu",
+  "none": "Nie zarejestrowano żadnych kluczy dostępu.",
+  "added": "Dodano klucz dostępu",
+  "addFailed": "Nie udało się dodać klucza dostępu",
+  "delete": "Delete passkey",
+  "deleted": "Usunięto klucz dostępu",
+  "deleteFailed": "Nie udało się usunąć klucza dostępu",
+  "unknownDevice": "nieznany",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Obrigatório",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Iniciar sessão com passkey",
+  "loginFailed": "Falha no início de sessão com passkey",
+  "description": "Utilize credenciais WebAuthn/FIDO2 para iniciar sessão sem palavra-passe",
+  "namePlaceholder": "Nome da passkey",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferencial",
+    "required": "Obrigatório",
+    "discouraged": "Desaconselhado"
+  },
+  "add": "Adicionar Passkey",
+  "none": "Nenhuma passkey registada.",
+  "added": "Passkey adicionada",
+  "addFailed": "Falha ao adicionar passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey eliminada",
+  "deleteFailed": "Falha ao eliminar chave de acesso",
+  "unknownDevice": "desconhecido",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Chei de acces",
+  "signIn": "Conectați-vă cu cheia de acces",
+  "loginFailed": "Conectarea cu parola a eșuat",
+  "description": "Folosește acreditările WebAuthn/FIDO2 pentru a te conecta fără parolă",
+  "namePlaceholder": "Numele cheii de acces",
+  "defaultName": "Cheie de acces",
+  "uv": {
+    "preferred": "Preferat",
+    "required": "Necesar",
+    "discouraged": "Descurajat"
+  },
+  "add": "Adăugați o cheie de acces",
+  "none": "Nicio cheie de acces înregistrată.",
+  "added": "Cheie de acces adăugată",
+  "addFailed": "Nu s-a putut adăuga parola",
+  "delete": "Ștergeți parola",
+  "deleted": "Cheia de acces a fost ștearsă",
+  "deleteFailed": "Nu s-a putut șterge parola",
+  "unknownDevice": "necunoscut",
+  "synced": "sincronizat"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Ключи доступа",
+  "signIn": "Войти с ключом доступа",
+  "loginFailed": "Вход по ключу не удался",
+  "description": "Используйте учётные данные WebAuthn/FIDO2 для входа без пароля",
+  "namePlaceholder": "Название ключа доступа",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Предпочтительно",
+    "required": "Обязательно",
+    "discouraged": "Не рекомендуется"
+  },
+  "add": "Добавить ключ доступа",
+  "none": "Нет зарегистрированных ключей доступа.",
+  "added": "Ключ доступа добавлен",
+  "addFailed": "Не удалось добавить ключ доступа",
+  "delete": "Delete passkey",
+  "deleted": "Ключ доступа удалён",
+  "deleteFailed": "Ошибка удаления ключа доступа",
+  "unknownDevice": "неизвестно",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Geçiş Anahtarları",
+  "signIn": "passkey ile oturum aç",
+  "loginFailed": "Passkey girişi başarısız oldu",
+  "description": "Parola olmadan oturum açmak için WebAuthn/FIDO2 kimlik bilgilerini kullanın",
+  "namePlaceholder": "Geçiş anahtarı adı",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Tercih edilen",
+    "required": "Gerekli",
+    "discouraged": "Önerilmeyen"
+  },
+  "add": "Geçiş Anahtarı Ekle",
+  "none": "Kayıtlı geçiş anahtarı yok.",
+  "added": "Geçiş anahtarı eklendi",
+  "addFailed": "Geçiş anahtarı eklenemedi",
+  "delete": "Delete passkey",
+  "deleted": "Geçiş anahtarı silindi",
+  "deleteFailed": "Geçiş anahtarı silinemedi",
+  "unknownDevice": "bilinmiyor",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Sign in with passkey",
+  "loginFailed": "Passkey login failed",
+  "description": "Use WebAuthn/FIDO2 credentials to sign in without a password",
+  "namePlaceholder": "Passkey name",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Preferred",
+    "required": "Required",
+    "discouraged": "Discouraged"
+  },
+  "add": "Add Passkey",
+  "none": "No passkeys registered.",
+  "added": "Passkey added",
+  "addFailed": "Failed to add passkey",
+  "delete": "Delete passkey",
+  "deleted": "Passkey deleted",
+  "deleteFailed": "Failed to delete passkey",
+  "unknownDevice": "unknown",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "Passkeys",
+  "signIn": "Đăng nhập bằng khóa truy cập",
+  "loginFailed": "Đăng nhập bằng passkey thất bại",
+  "description": "Sử dụng thông tin đăng nhập WebAuthn/FIDO2 để đăng nhập không cần mật khẩu",
+  "namePlaceholder": "Tên passkey",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "Ưu tiên",
+    "required": "Bắt buộc",
+    "discouraged": "Không khuyến khích"
+  },
+  "add": "Thêm Passkey",
+  "none": "Chưa đăng ký passkey nào.",
+  "added": "Đã thêm Passkey",
+  "addFailed": "Không thêm được Passkey",
+  "delete": "Delete passkey",
+  "deleted": "Đã xóa Passkey",
+  "deleteFailed": "Xóa passkey thất bại",
+  "unknownDevice": "không xác định",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "通行密钥",
+  "signIn": "使用通行密钥登录",
+  "loginFailed": "通行密钥登录失败",
+  "description": "使用 WebAuthn/FIDO2 凭据进行无密码登录",
+  "namePlaceholder": "通行密钥名称",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "首选",
+    "required": "必需",
+    "discouraged": "不鼓励"
+  },
+  "add": "添加通行密钥",
+  "none": "未注册通行密钥。",
+  "added": "通行密钥已添加",
+  "addFailed": "添加通行密钥失败",
+  "delete": "Delete passkey",
+  "deleted": "通行密钥已删除",
+  "deleteFailed": "删除通行密钥失败",
+  "unknownDevice": "未知",
+  "synced": "synced"
+}
@@ -0,0 +1,22 @@
+{
+  "title": "通行金鑰",
+  "signIn": "使用通行密鑰登入",
+  "loginFailed": "Passkey 登入失敗",
+  "description": "使用 WebAuthn/FIDO2 憑證無需密碼即可登入",
+  "namePlaceholder": "通行金鑰名稱",
+  "defaultName": "Passkey",
+  "uv": {
+    "preferred": "偏好",
+    "required": "需要",
+    "discouraged": "不鼓勵"
+  },
+  "add": "新增通行金鑰",
+  "none": "尚未註冊通行金鑰。",
+  "added": "通行金鑰已新增",
+  "addFailed": "無法新增通行金鑰",
+  "delete": "Delete passkey",
+  "deleted": "通行金鑰已刪除",
+  "deleteFailed": "刪除通行密鑰失敗",
+  "unknownDevice": "未知",
+  "synced": "synced"
+}
@@ -0,0 +1,33 @@
+{
+  "id": "webauthn",
+  "name": "Passkeys",
+  "version": "1.0.0",
+  "description": "Sign in with a passkey or security key instead of a password. A passkey that checks your PIN or fingerprint also counts as a second factor.",
+  "author": {
+    "name": "Termix"
+  },
+  "license": "MIT",
+  "repository": "https://github.com/Termix-SSH/Termix",
+  "category": "Access & Security",
+  "icon": "Fingerprint",
+  "engine": {
+    "termix": ">=2.9.0",
+    "api": "1"
+  },
+  "capabilities": [
+    "db:own",
+    "network:serve",
+    "auth:provide",
+    "settings:read-core",
+    "ui:surface",
+    "db:core-refs"
+  ],
+  "contributes": {
+    "auth": {
+      "loginMethods": ["passkey"]
+    }
+  },
+  "locales": "locales",
+  "platforms": ["linux", "win32", "darwin"],
+  "desktop": "server"
+}
@@ -0,0 +1,19 @@
+-- webauthn 0001: adopt_webauthn_credentials
+-- Generated by termix-plugin migrations. Review before committing.
+
+CREATE TABLE IF NOT EXISTS `webauthn_credentials` (
+  `id` varchar(255) PRIMARY KEY NOT NULL,
+  `user_id` varchar(255) NOT NULL,
+  `name` text NOT NULL,
+  `credential_id` varchar(255) NOT NULL UNIQUE,
+  `public_key` text NOT NULL,
+  `counter` int NOT NULL DEFAULT 0,
+  `device_type` text,
+  `backed_up` boolean NOT NULL DEFAULT false,
+  `transports` text,
+  `user_verification` text NOT NULL DEFAULT ('preferred'),
+  `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+  `last_used_at` text,
+  FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
+);
+RENAME TABLE `webauthn_credentials` TO `p_webauthn_credentials`;
@@ -0,0 +1,19 @@
+-- webauthn 0001: adopt_webauthn_credentials
+-- Generated by termix-plugin migrations. Review before committing.
+
+CREATE TABLE IF NOT EXISTS "webauthn_credentials" (
+  "id" varchar(255) PRIMARY KEY NOT NULL,
+  "user_id" varchar(255) NOT NULL,
+  "name" text NOT NULL,
+  "credential_id" varchar(255) NOT NULL UNIQUE,
+  "public_key" text NOT NULL,
+  "counter" integer NOT NULL DEFAULT 0,
+  "device_type" text,
+  "backed_up" boolean NOT NULL DEFAULT false,
+  "transports" text,
+  "user_verification" text NOT NULL DEFAULT 'preferred',
+  "created_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "last_used_at" text,
+  FOREIGN KEY ("user_id") REFERENCES "users" ("id") ON DELETE CASCADE
+);
+ALTER TABLE "webauthn_credentials" RENAME TO "p_webauthn_credentials";
@@ -0,0 +1,65 @@
+{
+  "version": 1,
+  "tables": {
+    "credentials": {
+      "columns": {
+        "id": {
+          "type": "varchar",
+          "length": 255,
+          "primaryKey": true,
+          "notNull": true
+        },
+        "userId": {
+          "type": "refUser",
+          "length": 255,
+          "notNull": true
+        },
+        "name": {
+          "type": "text",
+          "notNull": true
+        },
+        "credentialId": {
+          "type": "varchar",
+          "length": 255,
+          "notNull": true,
+          "unique": true
+        },
+        "publicKey": {
+          "type": "text",
+          "notNull": true
+        },
+        "counter": {
+          "type": "integer",
+          "notNull": true,
+          "defaultValue": 0
+        },
+        "deviceType": {
+          "type": "text"
+        },
+        "backedUp": {
+          "type": "boolean",
+          "notNull": true,
+          "defaultValue": false
+        },
+        "transports": {
+          "type": "text"
+        },
+        "userVerification": {
+          "type": "text",
+          "notNull": true,
+          "defaultValue": "preferred"
+        },
+        "createdAt": {
+          "type": "timestamp",
+          "notNull": true,
+          "defaultNow": true
+        },
+        "lastUsedAt": {
+          "type": "timestamp"
+        }
+      },
+      "indexes": [],
+      "adopts": "webauthn_credentials"
+    }
+  }
+}
@@ -0,0 +1,19 @@
+-- webauthn 0001: adopt_webauthn_credentials
+-- Generated by termix-plugin migrations. Review before committing.
+
+CREATE TABLE IF NOT EXISTS "webauthn_credentials" (
+  "id" text PRIMARY KEY NOT NULL,
+  "user_id" text NOT NULL,
+  "name" text NOT NULL,
+  "credential_id" text NOT NULL UNIQUE,
+  "public_key" text NOT NULL,
+  "counter" integer NOT NULL DEFAULT 0,
+  "device_type" text,
+  "backed_up" integer NOT NULL DEFAULT 0,
+  "transports" text,
+  "user_verification" text NOT NULL DEFAULT 'preferred',
+  "created_at" text NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "last_used_at" text,
+  FOREIGN KEY ("user_id") REFERENCES "users" ("id") ON DELETE CASCADE
+);
+ALTER TABLE "webauthn_credentials" RENAME TO "p_webauthn_credentials";
@@ -0,0 +1,35 @@
+{
+  "name": "@termix-plugin/webauthn",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "build": "termix-plugin build",
+    "test": "termix-plugin test",
+    "typecheck": "tsc -p .",
+    "validate": "termix-plugin validate"
+  },
+  "dependencies": {
+    "@simplewebauthn/browser": "^13.3.0",
+    "@simplewebauthn/server": "^13.3.2",
+    "lucide-react": "^1.33.0"
+  },
+  "devDependencies": {
+    "@termix/plugin-sdk": "^1.0.0",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^26.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "better-sqlite3": "^13.0.3",
+    "jsdom": "^30.0.1",
+    "vitest": "^4.1.11"
+  },
+  "peerDependencies": {
+    "@termix/plugin-sdk": "^1.0.0",
+    "drizzle-orm": "^0.45.2",
+    "express": "^5.2.1",
+    "react": "^19.2.8",
+    "sonner": "^2.0.8"
+  }
+}
@@ -0,0 +1,33 @@
+import type { Router } from "express";
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+import { credentials } from "./tables.js";
+import { createCredentialRepository } from "./repository.js";
+import { createPasskeyService } from "./passkeys.js";
+import { PUBLIC_PATHS, registerPasskeyRoutes } from "./routes.js";
+
+export async function activate(ctx: PluginContext) {
+  const table = await ctx.db.define(credentials);
+  const repository = createCredentialRepository(ctx.db, table);
+  const passkeys = createPasskeyService(ctx, repository);
+
+  // No describe: a passkey only helps a user who already registered one, so
+  // it never counts for the password lockout guard.
+  ctx.auth.registerLoginMethod({
+    id: "passkey",
+    labelKey: "signIn",
+    icon: "fingerprint",
+    kind: "form",
+    verify: (request) => passkeys.verifyLogin(request.body ?? {}),
+  });
+
+  registerPasskeyRoutes(
+    ctx.http.router<Router>({ public: PUBLIC_PATHS }),
+    ctx,
+    repository,
+    passkeys,
+  );
+}
+
+export async function deactivate() {
+  // Everything above was registered through ctx and is disposed by core.
+}
@@ -0,0 +1,298 @@
+import { randomUUID } from "node:crypto";
+import type {
+  AuthenticationResponseJSON,
+  AuthenticatorTransportFuture,
+  Base64URLString,
+  RegistrationResponseJSON,
+  WebAuthnCredential,
+} from "@simplewebauthn/server";
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse,
+} from "@simplewebauthn/server";
+import {
+  LoginMethodError,
+  type PluginContext,
+  type PluginVerifiedIdentity,
+} from "@termix/plugin-sdk/backend";
+import type { CredentialRecord, CredentialRepository } from "./repository.js";
+
+export type UserVerification = "discouraged" | "preferred" | "required";
+
+interface ChallengeRecord {
+  challenge: string;
+  userId?: string;
+  rpID: string;
+  origin: string;
+  userVerification: UserVerification;
+  createdAt: number;
+}
+
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+
+export function normalizeUserVerification(value: unknown): UserVerification {
+  return value === "discouraged" || value === "required" ? value : "preferred";
+}
+
+function header(
+  headers: Record<string, unknown>,
+  name: string,
+): string | undefined {
+  const value = headers[name];
+  if (Array.isArray(value)) return value[0];
+  return typeof value === "string" ? value : undefined;
+}
+
+/** The browser's origin, or the one a proxy reports. */
+export function requestOrigin(headers: Record<string, unknown>): string {
+  const origin = header(headers, "origin");
+  if (origin) return origin;
+  const proto = header(headers, "x-forwarded-proto") || "http";
+  const host =
+    header(headers, "x-forwarded-host") ||
+    header(headers, "host") ||
+    "localhost";
+  return `${proto.split(",")[0]}://${host.split(",")[0]}`;
+}
+
+export function parseTransports(
+  value: string | null,
+): AuthenticatorTransportFuture[] {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+function toCredential(record: CredentialRecord): WebAuthnCredential {
+  return {
+    id: record.credentialId as Base64URLString,
+    publicKey: Uint8Array.from(
+      Buffer.from(record.publicKey, "base64url"),
+    ) as WebAuthnCredential["publicKey"],
+    counter: record.counter,
+    transports: parseTransports(record.transports),
+  };
+}
+
+export type PasskeyService = ReturnType<typeof createPasskeyService>;
+
+/**
+ * Registration and sign-in ceremonies. Challenges live in memory for five
+ * minutes and are made in activate, so a disabled plugin forgets them.
+ */
+export function createPasskeyService(
+  ctx: PluginContext,
+  repository: CredentialRepository,
+) {
+  const registrations = new Map<string, ChallengeRecord>();
+  const authentications = new Map<string, ChallengeRecord>();
+
+  const prune = (map: Map<string, ChallengeRecord>) => {
+    const now = Date.now();
+    for (const [id, record] of map) {
+      if (now - record.createdAt > CHALLENGE_TTL_MS) map.delete(id);
+    }
+  };
+  const put = (
+    map: Map<string, ChallengeRecord>,
+    record: Omit<ChallengeRecord, "createdAt">,
+  ) => {
+    prune(map);
+    const id = randomUUID();
+    map.set(id, { ...record, createdAt: Date.now() });
+    return id;
+  };
+  const take = (map: Map<string, ChallengeRecord>, id: unknown) => {
+    if (typeof id !== "string") return null;
+    prune(map);
+    const record = map.get(id) ?? null;
+    map.delete(id);
+    return record;
+  };
+
+  async function rpName(): Promise<string> {
+    try {
+      return (await ctx.settings.readCore("app_name")) || "Termix";
+    } catch {
+      return "Termix";
+    }
+  }
+
+  return {
+    async registrationOptions(input: {
+      userId: string;
+      username: string;
+      origin: string;
+      userVerification: UserVerification;
+    }) {
+      const rpID = new URL(input.origin).hostname;
+      const existing = await repository.listByUserId(input.userId);
+      const options = await generateRegistrationOptions({
+        rpName: await rpName(),
+        rpID,
+        userID: Buffer.from(input.userId, "utf8"),
+        userName: input.username,
+        userDisplayName: input.username,
+        attestationType: "none",
+        excludeCredentials: existing.map((credential) => ({
+          id: credential.credentialId as Base64URLString,
+          transports: parseTransports(credential.transports),
+        })),
+        authenticatorSelection: {
+          residentKey: "required",
+          userVerification: input.userVerification,
+        },
+      });
+      const challengeId = put(registrations, {
+        challenge: options.challenge,
+        userId: input.userId,
+        rpID,
+        origin: input.origin,
+        userVerification: input.userVerification,
+      });
+      return { options, challengeId };
+    },
+
+    /** Stores the passkey. False when the challenge or response is bad. */
+    async register(input: {
+      userId: string;
+      challengeId: unknown;
+      response: RegistrationResponseJSON | undefined;
+      name: unknown;
+    }): Promise<boolean | "expired"> {
+      const challenge = take(registrations, input.challengeId);
+      if (!challenge || challenge.userId !== input.userId) return "expired";
+      if (!input.response) return false;
+
+      const verification = await verifyRegistrationResponse({
+        response: input.response,
+        expectedChallenge: challenge.challenge,
+        expectedOrigin: challenge.origin,
+        expectedRPID: challenge.rpID,
+        requireUserVerification: challenge.userVerification === "required",
+      });
+      if (!verification.verified) return false;
+
+      const { credential, credentialDeviceType, credentialBackedUp } =
+        verification.registrationInfo;
+      const name =
+        typeof input.name === "string" && input.name.trim()
+          ? input.name.trim().slice(0, 80)
+          : "Passkey";
+      await repository.create({
+        id: randomUUID(),
+        userId: input.userId,
+        name,
+        credentialId: credential.id,
+        publicKey: Buffer.from(credential.publicKey).toString("base64url"),
+        counter: credential.counter,
+        deviceType: credentialDeviceType,
+        backedUp: credentialBackedUp,
+        transports: JSON.stringify(input.response.response?.transports ?? []),
+        userVerification: challenge.userVerification,
+      });
+      return true;
+    },
+
+    async authenticationOptions(input: {
+      userId?: string;
+      origin: string;
+      userVerification: UserVerification;
+    }) {
+      const rpID = new URL(input.origin).hostname;
+      let allowCredentials:
+        | { id: Base64URLString; transports?: AuthenticatorTransportFuture[] }[]
+        | undefined;
+      if (input.userId) {
+        const credentials = await repository.listByUserId(input.userId);
+        if (credentials.length === 0) return null;
+        allowCredentials = credentials.map((credential) => ({
+          id: credential.credentialId as Base64URLString,
+          transports: parseTransports(credential.transports),
+        }));
+      }
+      const options = await generateAuthenticationOptions({
+        rpID,
+        allowCredentials,
+        userVerification: input.userVerification,
+      });
+      const challengeId = put(authentications, {
+        challenge: options.challenge,
+        userId: input.userId,
+        rpID,
+        origin: input.origin,
+        userVerification: input.userVerification,
+      });
+      return { options, challengeId };
+    },
+
+    /**
+     * Checks an assertion and says who signed in. A passkey that verified
+     * the user (PIN or biometric) counts as the second factor too.
+     */
+    async verifyLogin(
+      body: Record<string, unknown>,
+    ): Promise<PluginVerifiedIdentity> {
+      const challenge = take(authentications, body.challengeId);
+      if (!challenge) {
+        throw new LoginMethodError("Authentication challenge expired", 400);
+      }
+      const response = body.response as AuthenticationResponseJSON | undefined;
+      if (!response?.id) {
+        throw new LoginMethodError("Invalid passkey response", 400);
+      }
+      const credential = await repository.findByCredentialId(response.id);
+      if (
+        !credential ||
+        (challenge.userId && challenge.userId !== credential.userId)
+      ) {
+        throw new LoginMethodError("Passkey not recognized", 401);
+      }
+
+      let verification: Awaited<
+        ReturnType<typeof verifyAuthenticationResponse>
+      >;
+      try {
+        verification = await verifyAuthenticationResponse({
+          response,
+          expectedChallenge: challenge.challenge,
+          expectedOrigin: challenge.origin,
+          expectedRPID: challenge.rpID,
+          credential: toCredential(credential),
+          requireUserVerification: challenge.userVerification === "required",
+          advancedFIDOConfig: { userVerification: challenge.userVerification },
+        });
+      } catch (error) {
+        ctx.log.warn(
+          `Passkey authentication failed for ${credential.userId}: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+        throw new LoginMethodError("Passkey authentication failed", 401);
+      }
+      if (!verification.verified) {
+        throw new LoginMethodError("Passkey authentication failed", 401);
+      }
+
+      await repository.updateAuthState(credential.id, {
+        counter: verification.authenticationInfo.newCounter,
+        backedUp: verification.authenticationInfo.credentialBackedUp,
+        deviceType: verification.authenticationInfo.credentialDeviceType,
+        lastUsedAt: new Date().toISOString(),
+      });
+
+      return {
+        kind: "user",
+        userId: credential.userId,
+        mfaSatisfied: verification.authenticationInfo.userVerified === true,
+        rememberMe: !!body.rememberMe,
+      };
+    },
+  };
+}
@@ -0,0 +1,83 @@
+import { and, eq } from "drizzle-orm";
+import type { PluginDatabase } from "@termix/plugin-sdk/backend";
+
+export interface CredentialRecord {
+  id: string;
+  userId: string;
+  name: string;
+  credentialId: string;
+  publicKey: string;
+  counter: number;
+  deviceType: string | null;
+  backedUp: boolean;
+  transports: string | null;
+  userVerification: string;
+  createdAt: string;
+  lastUsedAt: string | null;
+}
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// ctx.db.define hands the table back untyped and the drizzle handle is the
+// server's own, so both are typed at this module's edge.
+type Table = any;
+type Drizzle = any;
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+export type CredentialRepository = ReturnType<
+  typeof createCredentialRepository
+>;
+
+export function createCredentialRepository(db: PluginDatabase, table: Table) {
+  const client = () => db.client<Drizzle>();
+
+  return {
+    async listByUserId(userId: string): Promise<CredentialRecord[]> {
+      const drizzle = await client();
+      return drizzle.select().from(table).where(eq(table.userId, userId));
+    },
+
+    async findByCredentialId(
+      credentialId: string,
+    ): Promise<CredentialRecord | null> {
+      const drizzle = await client();
+      const rows = await drizzle
+        .select()
+        .from(table)
+        .where(eq(table.credentialId, credentialId))
+        .limit(1);
+      return (rows[0] as CredentialRecord) ?? null;
+    },
+
+    async create(
+      input: Omit<CredentialRecord, "lastUsedAt" | "createdAt">,
+    ): Promise<void> {
+      const drizzle = await client();
+      await drizzle
+        .insert(table)
+        .values({ ...input, createdAt: new Date().toISOString() });
+      await db.persist();
+    },
+
+    async updateAuthState(
+      id: string,
+      state: {
+        counter: number;
+        backedUp: boolean;
+        deviceType: string;
+        lastUsedAt: string;
+      },
+    ): Promise<void> {
+      const drizzle = await client();
+      await drizzle.update(table).set(state).where(eq(table.id, id));
+      await db.persist();
+    },
+
+    async deleteForUser(userId: string, id: string): Promise<void> {
+      const drizzle = await client();
+      await drizzle
+        .delete(table)
+        .where(and(eq(table.id, id), eq(table.userId, userId)));
+      await db.persist();
+    },
+  };
+}
@@ -0,0 +1,193 @@
+import type { Request, Response, Router } from "express";
+import { eq } from "drizzle-orm";
+import type { RegistrationResponseJSON } from "@simplewebauthn/server";
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+import {
+  normalizeUserVerification,
+  parseTransports,
+  requestOrigin,
+  type PasskeyService,
+} from "./passkeys.js";
+import type { CredentialRepository } from "./repository.js";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+type Table = any;
+type Drizzle = any;
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+export const PUBLIC_PATHS = ["/authenticate/options"];
+
+export function registerPasskeyRoutes(
+  router: Router,
+  ctx: PluginContext,
+  repository: CredentialRepository,
+  passkeys: PasskeyService,
+): void {
+  async function findUser(
+    column: "id" | "username",
+    value: string,
+  ): Promise<{ id: string; username: string } | null> {
+    const { users } = await ctx.db.refs<{ users: Table }>();
+    const drizzle = await ctx.db.client<Drizzle>();
+    const rows = await drizzle
+      .select({ id: users.id, username: users.username })
+      .from(users)
+      .where(eq(users[column], value))
+      .limit(1);
+    return rows[0] ?? null;
+  }
+
+  /**
+   * @openapi
+   * /plugin-api/webauthn/credentials:
+   *   get:
+   *     summary: List passkeys
+   *     description: Lists the caller's registered passkeys.
+   *     tags:
+   *       - Passkeys
+   *     responses:
+   *       200:
+   *         description: List of passkeys.
+   */
+  router.get("/credentials", async (_req: Request, res: Response) => {
+    const credentials = await repository.listByUserId(ctx.currentActor()!);
+    res.json({
+      credentials: credentials.map((credential) => ({
+        id: credential.id,
+        name: credential.name,
+        deviceType: credential.deviceType,
+        backedUp: !!credential.backedUp,
+        transports: parseTransports(credential.transports),
+        userVerification: credential.userVerification,
+        createdAt: credential.createdAt,
+        lastUsedAt: credential.lastUsedAt,
+      })),
+    });
+  });
+
+  /**
+   * @openapi
+   * /plugin-api/webauthn/register/options:
+   *   post:
+   *     summary: Start passkey registration
+   *     tags:
+   *       - Passkeys
+   *     responses:
+   *       200:
+   *         description: Registration options and challenge id.
+   *       404:
+   *         description: User not found.
+   */
+  router.post("/register/options", async (req: Request, res: Response) => {
+    const user = await findUser("id", ctx.currentActor()!);
+    if (!user) return res.status(404).json({ error: "User not found" });
+    res.json(
+      await passkeys.registrationOptions({
+        userId: user.id,
+        username: user.username,
+        origin: requestOrigin(req.headers),
+        userVerification: normalizeUserVerification(req.body?.userVerification),
+      }),
+    );
+  });
+
+  /**
+   * @openapi
+   * /plugin-api/webauthn/register/verify:
+   *   post:
+   *     summary: Finish passkey registration
+   *     tags:
+   *       - Passkeys
+   *     responses:
+   *       200:
+   *         description: Passkey registered.
+   *       400:
+   *         description: Registration failed or challenge expired.
+   */
+  router.post("/register/verify", async (req: Request, res: Response) => {
+    const userId = ctx.currentActor()!;
+    try {
+      const result = await passkeys.register({
+        userId,
+        challengeId: req.body?.challengeId,
+        response: req.body?.response as RegistrationResponseJSON | undefined,
+        name: req.body?.name,
+      });
+      if (result === "expired") {
+        return res
+          .status(400)
+          .json({ error: "Registration challenge expired" });
+      }
+      if (!result) {
+        return res.status(400).json({ error: "Passkey registration failed" });
+      }
+      res.json({ success: true });
+    } catch (error) {
+      ctx.log.warn(
+        `Passkey registration failed for ${userId}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      res.status(400).json({ error: "Passkey registration failed" });
+    }
+  });
+
+  /**
+   * @openapi
+   * /plugin-api/webauthn/authenticate/options:
+   *   post:
+   *     summary: Start passkey login
+   *     description: Public. Authentication options, optionally scoped to a username. The assertion is then sent to /users/auth/passkey/verify.
+   *     tags:
+   *       - Passkeys
+   *     responses:
+   *       200:
+   *         description: Authentication options and challenge id.
+   *       404:
+   *         description: No passkeys found for the user.
+   */
+  router.post("/authenticate/options", async (req: Request, res: Response) => {
+    const username =
+      typeof req.body?.username === "string" ? req.body.username.trim() : "";
+    let userId: string | undefined;
+    if (username) {
+      const user = await findUser("username", username);
+      if (!user) return res.status(404).json({ error: "No passkeys found" });
+      userId = user.id;
+    }
+    const result = await passkeys.authenticationOptions({
+      userId,
+      origin: requestOrigin(req.headers),
+      userVerification: normalizeUserVerification(req.body?.userVerification),
+    });
+    if (!result) return res.status(404).json({ error: "No passkeys found" });
+    res.json(result);
+  });
+
+  /**
+   * @openapi
+   * /plugin-api/webauthn/credentials/{credentialId}:
+   *   delete:
+   *     summary: Delete a passkey
+   *     tags:
+   *       - Passkeys
+   *     parameters:
+   *       - in: path
+   *         name: credentialId
+   *         required: true
+   *         schema: { type: string }
+   *     responses:
+   *       200:
+   *         description: Passkey deleted.
+   */
+  router.delete(
+    "/credentials/:credentialId",
+    async (req: Request, res: Response) => {
+      await repository.deleteForUser(
+        ctx.currentActor()!,
+        String(req.params.credentialId),
+      );
+      res.json({ success: true });
+    },
+  );
+}
@@ -0,0 +1,34 @@
+import {
+  adoptLegacyTable,
+  boolean,
+  defineTable,
+  integer,
+  refUser,
+  text,
+  timestamp,
+  varchar,
+} from "@termix/plugin-sdk/db";
+
+/**
+ * Adopted from core's webauthn_credentials, so the column names are the
+ * legacy ones and the rename carries every passkey across.
+ */
+export const credentials = adoptLegacyTable(
+  "webauthn_credentials",
+  defineTable("credentials", {
+    id: varchar().primaryKey(),
+    userId: refUser(),
+    name: text().notNull(),
+    credentialId: varchar().notNull().unique(),
+    publicKey: text().notNull(),
+    counter: integer().notNull().default(0),
+    deviceType: text(),
+    backedUp: boolean().notNull().default(false),
+    transports: text(),
+    userVerification: text().notNull().default("preferred"),
+    createdAt: timestamp().notNull().defaultNow(),
+    lastUsedAt: timestamp(),
+  }),
+);
+
+export const tables = [credentials];
@@ -0,0 +1,137 @@
+import { useEffect, useMemo, useState } from "react";
+import { KeyRound, Trash2 } from "lucide-react";
+import { toast } from "sonner";
+import { Button, Input, Select2 } from "@termix/plugin-sdk/ui";
+import { usePluginApi, useTranslation } from "@termix/plugin-sdk/frontend";
+import {
+  createWebAuthnApi,
+  type WebAuthnCredentialSummary,
+  type WebAuthnUserVerification,
+} from "./webauthn-api";
+
+function apiErrorMessage(error: unknown, fallback: string): string {
+  const data = (error as { response?: { data?: { error?: unknown } } })
+    ?.response?.data;
+  return typeof data?.error === "string" && data.error ? data.error : fallback;
+}
+
+/** Settings > Security: register and remove passkeys. */
+export function PasskeyEnrollment() {
+  const { t } = useTranslation();
+  const pluginApi = usePluginApi();
+  const api = useMemo(() => createWebAuthnApi(pluginApi), [pluginApi]);
+  const [passkeys, setPasskeys] = useState<WebAuthnCredentialSummary[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [name, setName] = useState("");
+  const [userVerification, setUserVerification] =
+    useState<WebAuthnUserVerification>("preferred");
+
+  useEffect(() => {
+    api
+      .list()
+      .then(setPasskeys)
+      .catch(() => {});
+  }, [api]);
+
+  async function add() {
+    setLoading(true);
+    try {
+      await api.register(name || t("defaultName"), userVerification);
+      setPasskeys(await api.list());
+      setName("");
+      toast.success(t("added"));
+    } catch (e) {
+      toast.error(apiErrorMessage(e, t("addFailed")));
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  async function remove(id: string) {
+    setLoading(true);
+    try {
+      await api.remove(id);
+      setPasskeys((prev) => prev.filter((item) => item.id !== id));
+      toast.success(t("deleted"));
+    } catch (e) {
+      toast.error(apiErrorMessage(e, t("deleteFailed")));
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  return (
+    <div className="flex flex-col gap-3">
+      <span className="text-[10px] text-muted-foreground">
+        {t("description")}
+      </span>
+
+      <div className="grid grid-cols-[1fr_auto] gap-2">
+        <Input
+          placeholder={t("namePlaceholder")}
+          value={name}
+          onChange={(e) => setName(e.target.value)}
+          className="h-8 text-xs"
+          disabled={loading}
+        />
+        <Select2
+          value={userVerification}
+          onChange={(e) =>
+            setUserVerification(e.target.value as WebAuthnUserVerification)
+          }
+          className="h-8 w-28 text-xs border border-border bg-background px-2 outline-none focus:ring-1 focus:ring-ring"
+          disabled={loading}
+        >
+          <option value="preferred">{t("uv.preferred")}</option>
+          <option value="required">{t("uv.required")}</option>
+          <option value="discouraged">{t("uv.discouraged")}</option>
+        </Select2>
+      </div>
+      <Button
+        variant="outline"
+        size="sm"
+        className="h-7 text-[10px] border-accent-brand/40 text-accent-brand hover:bg-accent-brand/10 hover:text-accent-brand"
+        onClick={add}
+        disabled={loading}
+      >
+        <KeyRound className="size-3" />
+        {t("add")}
+      </Button>
+
+      <div className="flex flex-col divide-y divide-border border border-border">
+        {passkeys.length === 0 ? (
+          <div className="py-4 text-center text-[10px] text-muted-foreground">
+            {t("none")}
+          </div>
+        ) : (
+          passkeys.map((passkey) => (
+            <div
+              key={passkey.id}
+              className="flex items-center justify-between gap-2 px-2 py-2"
+            >
+              <div className="min-w-0 flex flex-col">
+                <span className="text-xs font-medium truncate">
+                  {passkey.name}
+                </span>
+                <span className="text-[10px] text-muted-foreground truncate">
+                  {passkey.deviceType || t("unknownDevice")}
+                  {passkey.backedUp ? ` / ${t("synced")}` : ""}
+                </span>
+              </div>
+              <Button
+                variant="ghost"
+                size="icon"
+                className="size-6 text-muted-foreground hover:text-destructive"
+                onClick={() => remove(passkey.id)}
+                disabled={loading}
+                aria-label={t("delete")}
+              >
+                <Trash2 className="size-3" />
+              </Button>
+            </div>
+          ))
+        )}
+      </div>
+    </div>
+  );
+}
@@ -0,0 +1,59 @@
+import { useMemo, useState } from "react";
+import { Fingerprint } from "lucide-react";
+import { toast } from "sonner";
+import { Button } from "@termix/plugin-sdk/ui";
+import {
+  usePluginApi,
+  useTranslation,
+  type LoginMethodUIProps,
+} from "@termix/plugin-sdk/frontend";
+import { createWebAuthnApi, isPasskeySupported } from "./webauthn-api";
+
+export function PasskeyLoginButton({
+  disabled,
+  submit,
+  username,
+}: LoginMethodUIProps) {
+  const { t } = useTranslation();
+  const pluginApi = usePluginApi();
+  const api = useMemo(() => createWebAuthnApi(pluginApi), [pluginApi]);
+  const [loading, setLoading] = useState(false);
+  const [supported] = useState(isPasskeySupported);
+  if (!supported) return null;
+
+  return (
+    <Button
+      type="button"
+      variant="outline"
+      onClick={async () => {
+        setLoading(true);
+        try {
+          await submit(
+            await api.passkeyAssertion(username?.trim() || undefined),
+          );
+        } catch (err: unknown) {
+          const error = err as {
+            name?: string;
+            message?: string;
+            response?: { data?: { error?: string } };
+          };
+          // Closing the browser prompt is not a failure worth a toast.
+          if (error?.name === "NotAllowedError" || error?.name === "AbortError")
+            return;
+          toast.error(
+            error?.response?.data?.error || error?.message || t("loginFailed"),
+          );
+        } finally {
+          setLoading(false);
+        }
+      }}
+      disabled={disabled || loading}
+      className="w-full h-10 font-bold"
+    >
+      <span className="flex items-center gap-2">
+        <Fingerprint className="size-4" />
+        {t("signIn")}
+      </span>
+    </Button>
+  );
+}
@@ -0,0 +1,13 @@
+import type { TermixApp } from "@termix/plugin-sdk/frontend";
+import { PasskeyLoginButton } from "./PasskeyLoginButton";
+import { PasskeyEnrollment } from "./PasskeyEnrollment";
+
+export function activate(app: TermixApp): void {
+  app.registerLoginMethod({
+    id: "passkey",
+    titleKey: "title",
+    placement: "inline",
+    component: PasskeyLoginButton,
+    enrollment: PasskeyEnrollment,
+  });
+}
@@ -0,0 +1,82 @@
+import type {
+  AuthenticationResponseJSON,
+  PublicKeyCredentialCreationOptionsJSON,
+  PublicKeyCredentialRequestOptionsJSON,
+  RegistrationResponseJSON,
+} from "@simplewebauthn/browser";
+import {
+  browserSupportsWebAuthn,
+  startAuthentication,
+  startRegistration,
+} from "@simplewebauthn/browser";
+import type { PluginApiClient } from "@termix/plugin-sdk/frontend";
+
+export type WebAuthnUserVerification = "discouraged" | "preferred" | "required";
+
+export type WebAuthnCredentialSummary = {
+  id: string;
+  name: string;
+  deviceType?: string | null;
+  backedUp: boolean;
+  transports: string[];
+  userVerification: WebAuthnUserVerification;
+  createdAt: string;
+  lastUsedAt?: string | null;
+};
+
+type OptionsResponse<T> = { options: T; challengeId: string };
+
+export function isPasskeySupported(): boolean {
+  try {
+    return browserSupportsWebAuthn();
+  } catch {
+    return false;
+  }
+}
+
+export function createWebAuthnApi(api: PluginApiClient) {
+  return {
+    /**
+     * Runs the browser ceremony and returns the body for the login method's
+     * verify step. Without a username, discoverable passkeys still work.
+     */
+    async passkeyAssertion(username?: string) {
+      const { data } = await api.post<
+        OptionsResponse<PublicKeyCredentialRequestOptionsJSON>
+      >("authenticate/options", username ? { username } : {});
+      const response = await startAuthentication({
+        optionsJSON: data.options,
+      });
+      return {
+        challengeId: data.challengeId,
+        response: response as AuthenticationResponseJSON,
+      };
+    },
+
+    async list(): Promise<WebAuthnCredentialSummary[]> {
+      const { data } = await api.get<{
+        credentials?: WebAuthnCredentialSummary[];
+      }>("credentials");
+      return data.credentials ?? [];
+    },
+
+    async register(
+      name: string,
+      userVerification: WebAuthnUserVerification,
+    ): Promise<void> {
+      const { data } = await api.post<
+        OptionsResponse<PublicKeyCredentialCreationOptionsJSON>
+      >("register/options", { userVerification });
+      const response = await startRegistration({ optionsJSON: data.options });
+      await api.post("register/verify", {
+        challengeId: data.challengeId,
+        name,
+        response: response as RegistrationResponseJSON,
+      });
+    },
+
+    async remove(id: string): Promise<void> {
+      await api.delete(`credentials/${encodeURIComponent(id)}`);
+    },
+  };
+}
@@ -0,0 +1,96 @@
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+import { fileURLToPath } from "node:url";
+import express, { type Router } from "express";
+import {
+  createMockCtx,
+  createTestDb,
+  type MockPluginContext,
+  type TestDb,
+} from "@termix/plugin-sdk/testing";
+import type { PluginManifest } from "@termix/plugin-sdk/manifest";
+import manifestJson from "../../manifest.json";
+
+export const pluginDir = fileURLToPath(new URL("../..", import.meta.url));
+export const manifest = manifestJson as unknown as PluginManifest;
+
+export interface TestServer {
+  db: TestDb;
+  mock: MockPluginContext;
+  request: (
+    method: string,
+    path: string,
+    options?: { user?: string; body?: unknown },
+    // Route bodies vary per test; asserting on them is the point.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ) => Promise<{ status: number; body: any }>;
+  close: () => Promise<void>;
+}
+
+/**
+ * The plugin activated against a real in-memory database, its router mounted
+ * on an express app the way core mounts it: JSON parsed, the acting user set
+ * from the request, everything else left to the plugin.
+ */
+export async function startServer(
+  options: {
+    users?: string[];
+    capabilities?: string[];
+    before?: (sqlite: TestDb["sqlite"]) => void;
+  } = {},
+): Promise<TestServer> {
+  const db = await createTestDb(pluginDir, { before: options.before });
+  for (const user of options.users ?? ["user-1", "user-2"]) {
+    db.sqlite
+      .prepare("INSERT INTO users (id, username) VALUES (?, ?)")
+      .run(user, user);
+  }
+
+  let router: Router | null = null;
+  const mock = createMockCtx({
+    pluginId: manifest.id,
+    manifest,
+    capabilities: options.capabilities ?? manifest.capabilities,
+    db: db.database,
+    router: () => (router = express.Router()),
+    coreSettings: { app_name: "Termix Test" },
+  });
+
+  const { activate } = await import("../../src/backend/index.js");
+  await activate(mock.ctx);
+
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    mock.setActor(req.header("x-test-user") || undefined);
+    next();
+  });
+  app.use((req, res, next) => router!(req, res, next));
+
+  const server = http.createServer(app);
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  const { port } = server.address() as AddressInfo;
+
+  return {
+    db,
+    mock,
+    async request(method, path, { user = "user-1", body: given } = {}) {
+      const body = method === "GET" ? undefined : given;
+      const response = await fetch(`http://127.0.0.1:${port}${path}`, {
+        method,
+        headers: {
+          "x-test-user": user,
+          origin: "https://termix.test",
+          ...(body !== undefined ? { "content-type": "application/json" } : {}),
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+      });
+      const text = await response.text();
+      return { status: response.status, body: text ? JSON.parse(text) : null };
+    },
+    async close() {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+      db.close();
+    },
+  };
+}
@@ -0,0 +1,371 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const webauthn = vi.hoisted(() => ({
+  verifyRegistration: vi.fn(),
+  verifyAuthentication: vi.fn(),
+  registrationOptions: vi.fn(),
+  authenticationOptions: vi.fn(),
+}));
+
+vi.mock("@simplewebauthn/server", () => ({
+  generateRegistrationOptions: webauthn.registrationOptions,
+  generateAuthenticationOptions: webauthn.authenticationOptions,
+  verifyRegistrationResponse: webauthn.verifyRegistration,
+  verifyAuthenticationResponse: webauthn.verifyAuthentication,
+}));
+
+import { startServer, type TestServer } from "./helpers";
+import { requestOrigin } from "../../src/backend/passkeys.js";
+
+let server: TestServer | null = null;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  webauthn.registrationOptions.mockImplementation(async (input) => ({
+    challenge: "reg-challenge",
+    rp: { name: input.rpName, id: input.rpID },
+  }));
+  webauthn.authenticationOptions.mockImplementation(async (input) => ({
+    challenge: "auth-challenge",
+    allowCredentials: input.allowCredentials,
+  }));
+  webauthn.verifyRegistration.mockResolvedValue({
+    verified: true,
+    registrationInfo: {
+      credential: {
+        id: "cred-1",
+        publicKey: new Uint8Array([1, 2, 3]),
+        counter: 0,
+      },
+      credentialDeviceType: "multiDevice",
+      credentialBackedUp: true,
+    },
+  });
+  webauthn.verifyAuthentication.mockResolvedValue({
+    verified: true,
+    authenticationInfo: {
+      newCounter: 5,
+      userVerified: true,
+      credentialBackedUp: true,
+      credentialDeviceType: "multiDevice",
+    },
+  });
+});
+
+afterEach(async () => {
+  await server?.close();
+  server = null;
+});
+
+function passkeyMethod(target: TestServer) {
+  const method = target.mock.auth.loginMethods.find(
+    (entry) => entry.id === "passkey",
+  );
+  if (!method?.verify) throw new Error("passkey method not registered");
+  return method;
+}
+
+async function registerPasskey(target: TestServer, user = "user-1") {
+  const options = await target.request("POST", "/register/options", {
+    user,
+    body: { userVerification: "required" },
+  });
+  expect(options.status).toBe(200);
+  const verify = await target.request("POST", "/register/verify", {
+    user,
+    body: {
+      challengeId: options.body.challengeId,
+      name: "Laptop",
+      response: { id: "cred-1", response: { transports: ["internal"] } },
+    },
+  });
+  expect(verify.status).toBe(200);
+}
+
+async function loginWith(
+  target: TestServer,
+  body: Record<string, unknown> = {},
+) {
+  const options = await target.request("POST", "/authenticate/options", {
+    user: "",
+    body,
+  });
+  expect(options.status).toBe(200);
+  return passkeyMethod(target).verify!(
+    {
+      body: {
+        challengeId: options.body.challengeId,
+        response: { id: "cred-1" },
+      },
+      query: {},
+      headers: {},
+    },
+    null,
+  );
+}
+
+describe("registration", () => {
+  it("registers a passkey for the caller and lists it", async () => {
+    server = await startServer();
+    await registerPasskey(server);
+
+    expect(webauthn.registrationOptions).toHaveBeenCalledWith(
+      expect.objectContaining({
+        rpName: "Termix Test",
+        rpID: "termix.test",
+        userName: "user-1",
+      }),
+    );
+    const list = await server.request("GET", "/credentials");
+    expect(list.body.credentials).toEqual([
+      expect.objectContaining({
+        name: "Laptop",
+        deviceType: "multiDevice",
+        backedUp: true,
+        transports: ["internal"],
+        userVerification: "required",
+      }),
+    ]);
+    expect(
+      (await server.request("GET", "/credentials", { user: "user-2" })).body
+        .credentials,
+    ).toEqual([]);
+  });
+
+  it("refuses a challenge issued to someone else", async () => {
+    server = await startServer();
+    const options = await server.request("POST", "/register/options", {
+      body: {},
+    });
+    const verify = await server.request("POST", "/register/verify", {
+      user: "user-2",
+      body: { challengeId: options.body.challengeId, response: { id: "x" } },
+    });
+    expect(verify.status).toBe(400);
+  });
+
+  it("refuses a failed attestation", async () => {
+    server = await startServer();
+    webauthn.verifyRegistration.mockResolvedValue({ verified: false });
+    const options = await server.request("POST", "/register/options", {
+      body: {},
+    });
+    const verify = await server.request("POST", "/register/verify", {
+      body: { challengeId: options.body.challengeId, response: { id: "x" } },
+    });
+    expect(verify.status).toBe(400);
+  });
+
+  it("deletes only the caller's own passkey", async () => {
+    server = await startServer();
+    await registerPasskey(server);
+    const [{ id }] = (await server.request("GET", "/credentials")).body
+      .credentials;
+    await server.request("DELETE", `/credentials/${id}`, { user: "user-2" });
+    expect(
+      (await server.request("GET", "/credentials")).body.credentials,
+    ).toHaveLength(1);
+    await server.request("DELETE", `/credentials/${id}`);
+    expect(
+      (await server.request("GET", "/credentials")).body.credentials,
+    ).toHaveLength(0);
+  });
+});
+
+describe("login", () => {
+  it("says who signed in and counts a verified user as the second factor", async () => {
+    server = await startServer();
+    await registerPasskey(server);
+    const identity = await loginWith(server);
+    expect(identity).toMatchObject({
+      kind: "user",
+      userId: "user-1",
+      mfaSatisfied: true,
+    });
+    const row = server.db.sqlite
+      .prepare("SELECT counter, last_used_at FROM p_webauthn_credentials")
+      .get() as { counter: number; last_used_at: string | null };
+    expect(row.counter).toBe(5);
+    expect(row.last_used_at).toBeTruthy();
+  });
+
+  it("leaves the second factor to core when the user was not verified", async () => {
+    server = await startServer();
+    await registerPasskey(server);
+    webauthn.verifyAuthentication.mockResolvedValue({
+      verified: true,
+      authenticationInfo: {
+        newCounter: 1,
+        userVerified: false,
+        credentialBackedUp: false,
+        credentialDeviceType: "singleDevice",
+      },
+    });
+    expect(await loginWith(server)).toMatchObject({ mfaSatisfied: false });
+  });
+
+  it("scopes the options to a username and 404s without passkeys", async () => {
+    server = await startServer();
+    await registerPasskey(server);
+    const options = await server.request("POST", "/authenticate/options", {
+      user: "",
+      body: { username: "user-1" },
+    });
+    expect(options.body.options.allowCredentials).toEqual([
+      { id: "cred-1", transports: ["internal"] },
+    ]);
+    expect(
+      (
+        await server.request("POST", "/authenticate/options", {
+          user: "",
+          body: { username: "user-2" },
+        })
+      ).status,
+    ).toBe(404);
+  });
+
+  it("refuses a passkey that belongs to another user than asked for", async () => {
+    server = await startServer();
+    await registerPasskey(server);
+    const options = await server.request("POST", "/authenticate/options", {
+      user: "",
+      body: { username: "user-1" },
+    });
+    server.db.sqlite.exec(
+      "UPDATE p_webauthn_credentials SET user_id = 'user-2'",
+    );
+    await expect(
+      passkeyMethod(server).verify!(
+        {
+          body: {
+            challengeId: options.body.challengeId,
+            response: { id: "cred-1" },
+          },
+          query: {},
+          headers: {},
+        },
+        null,
+      ),
+    ).rejects.toMatchObject({ status: 401 });
+  });
+
+  it("refuses an unknown passkey and a failed assertion", async () => {
+    server = await startServer();
+    await expect(loginWith(server)).rejects.toMatchObject({ status: 401 });
+    await registerPasskey(server);
+    webauthn.verifyAuthentication.mockRejectedValue(new Error("bad sig"));
+    await expect(loginWith(server)).rejects.toMatchObject({ status: 401 });
+  });
+
+  it("uses a challenge only once", async () => {
+    server = await startServer();
+    await registerPasskey(server);
+    const options = await server.request("POST", "/authenticate/options", {
+      user: "",
+      body: {},
+    });
+    const request = {
+      body: {
+        challengeId: options.body.challengeId,
+        response: { id: "cred-1" },
+      },
+      query: {},
+      headers: {},
+    };
+    await passkeyMethod(server).verify!(request, null);
+    await expect(
+      passkeyMethod(server).verify!(request, null),
+    ).rejects.toMatchObject({ status: 400 });
+  });
+});
+
+describe("adoption", () => {
+  const LEGACY = `
+    CREATE TABLE webauthn_credentials (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      credential_id TEXT NOT NULL UNIQUE,
+      public_key TEXT NOT NULL,
+      counter INTEGER NOT NULL DEFAULT 0,
+      device_type TEXT,
+      backed_up INTEGER NOT NULL DEFAULT 0,
+      transports TEXT,
+      user_verification TEXT NOT NULL DEFAULT 'preferred',
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      last_used_at TEXT,
+      FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+    );`;
+
+  it("keeps existing passkeys, which still sign in", async () => {
+    server = await startServer({
+      before: (sqlite) => {
+        sqlite
+          .prepare("INSERT INTO users (id, username) VALUES (?, ?)")
+          .run("old-user", "old-user");
+        sqlite.exec(LEGACY);
+        sqlite.exec(`INSERT INTO webauthn_credentials
+          (id, user_id, name, credential_id, public_key, counter, transports)
+          VALUES ('p1', 'old-user', 'Old key', 'cred-1', 'AQID', 3, '[]')`);
+      },
+    });
+    const tables = server.db.sqlite
+      .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+      .all()
+      .map((row) => (row as { name: string }).name);
+    expect(tables).toContain("p_webauthn_credentials");
+    expect(tables).not.toContain("webauthn_credentials");
+    expect(await loginWith(server)).toMatchObject({ userId: "old-user" });
+  });
+
+  it("creates the table on a fresh install", async () => {
+    server = await startServer();
+    expect(
+      server.db.sqlite
+        .prepare("SELECT COUNT(*) AS n FROM p_webauthn_credentials")
+        .get(),
+    ).toEqual({ n: 0 });
+  });
+});
+
+describe("capabilities", () => {
+  it("fails closed without auth:provide", async () => {
+    await expect(
+      startServer({
+        capabilities: [
+          "db:own",
+          "network:serve",
+          "settings:read-core",
+          "ui:surface",
+        ],
+      }),
+    ).rejects.toThrow(/auth:provide/);
+  });
+
+  it("fails closed without network:serve", async () => {
+    await expect(
+      startServer({
+        capabilities: [
+          "db:own",
+          "auth:provide",
+          "settings:read-core",
+          "ui:surface",
+        ],
+      }),
+    ).rejects.toThrow(/network:serve/);
+  });
+});
+
+describe("requestOrigin", () => {
+  it("prefers Origin, then forwarded host and proto", () => {
+    expect(requestOrigin({ origin: "https://a.test" })).toBe("https://a.test");
+    expect(
+      requestOrigin({
+        "x-forwarded-proto": "https, http",
+        "x-forwarded-host": "b.test",
+        host: "internal",
+      }),
+    ).toBe("https://b.test");
+    expect(requestOrigin({ host: "c.test:8080" })).toBe("http://c.test:8080");
+  });
+});
@@ -0,0 +1,129 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import {
+  renderWithApp,
+  type RenderedPluginApp,
+} from "@termix/plugin-sdk/testing";
+import type { PluginManifest } from "@termix/plugin-sdk/manifest";
+
+const browser = vi.hoisted(() => ({
+  startAuthentication: vi.fn(async () => ({ id: "cred-1" })),
+  startRegistration: vi.fn(async () => ({ id: "cred-1" })),
+  browserSupportsWebAuthn: vi.fn(() => true),
+}));
+vi.mock("@simplewebauthn/browser", () => browser);
+
+import * as plugin from "../../src/frontend/index";
+import { createWebAuthnApi } from "../../src/frontend/webauthn-api";
+import manifestJson from "../../manifest.json";
+import locales from "../../locales/en.json";
+
+const manifest = manifestJson as unknown as PluginManifest;
+
+let rendered: RenderedPluginApp | null = null;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  browser.browserSupportsWebAuthn.mockReturnValue(true);
+});
+
+afterEach(async () => {
+  await rendered?.deactivate();
+  rendered = null;
+});
+
+describe(`${manifest.id} activate`, () => {
+  it("registers the passkey login method", async () => {
+    rendered = await renderWithApp(plugin, { manifest, locales });
+    expect(rendered.registered.loginMethods()).toEqual(["passkey"]);
+  });
+
+  it("runs the ceremony and submits the assertion", async () => {
+    const post = vi.fn(async () => ({
+      data: { options: { challenge: "abc" }, challengeId: "chal-1" },
+    }));
+    rendered = await renderWithApp(plugin, {
+      manifest,
+      locales,
+      api: { post } as never,
+    });
+    const submit = vi.fn(async () => {});
+    rendered.renderLoginMethod("passkey", { submit, username: " luke " });
+    fireEvent.click(screen.getByText(locales.signIn));
+    await waitFor(() =>
+      expect(submit).toHaveBeenCalledWith({
+        challengeId: "chal-1",
+        response: { id: "cred-1" },
+      }),
+    );
+    expect(post).toHaveBeenCalledWith("authenticate/options", {
+      username: "luke",
+    });
+  });
+
+  it("draws nothing where the browser has no WebAuthn", async () => {
+    browser.browserSupportsWebAuthn.mockReturnValue(false);
+    rendered = await renderWithApp(plugin, { manifest, locales });
+    rendered.renderLoginMethod("passkey");
+    expect(screen.queryByText(locales.signIn)).toBeNull();
+  });
+
+  it("lists passkeys in the enrolment section", async () => {
+    rendered = await renderWithApp(plugin, {
+      manifest,
+      locales,
+      api: {
+        get: vi.fn(async () => ({
+          data: {
+            credentials: [
+              {
+                id: "p1",
+                name: "Laptop",
+                backedUp: true,
+                transports: [],
+                userVerification: "preferred",
+                createdAt: "",
+              },
+            ],
+          },
+        })),
+      } as never,
+    });
+    rendered.renderEnrollment("passkey");
+    expect(await screen.findByText("Laptop")).toBeTruthy();
+  });
+
+  it("removes the method on deactivate", async () => {
+    const app = await renderWithApp(plugin, { manifest, locales });
+    await app.deactivate();
+    expect(app.registered.loginMethods()).toEqual([]);
+  });
+});
+
+describe("webauthn api", () => {
+  it("omits the username so discoverable passkeys work", async () => {
+    const post = vi.fn(async () => ({
+      data: { options: { challenge: "abc" }, challengeId: "chal-2" },
+    }));
+    await createWebAuthnApi({ post } as never).passkeyAssertion();
+    expect(post).toHaveBeenCalledWith("authenticate/options", {});
+  });
+
+  it("registers through options then verify", async () => {
+    const post = vi
+      .fn()
+      .mockResolvedValueOnce({
+        data: { options: { challenge: "r" }, challengeId: "reg-1" },
+      })
+      .mockResolvedValueOnce({ data: { success: true } });
+    await createWebAuthnApi({ post } as never).register("Key", "required");
+    expect(post).toHaveBeenNthCalledWith(1, "register/options", {
+      userVerification: "required",
+    });
+    expect(post).toHaveBeenNthCalledWith(2, "register/verify", {
+      challengeId: "reg-1",
+      name: "Key",
+      response: { id: "cred-1" },
+    });
+  });
+});
@@ -0,0 +1,4 @@
+{
+  "extends": "@termix/plugin-sdk/tsconfig.plugin.json",
+  "include": ["src/**/*.ts", "src/**/*.tsx", "tests/**/*.ts", "tests/**/*.tsx"]
+}
@@ -0,0 +1,3 @@
+import { pluginVitestConfig } from "@termix/plugin-sdk/vitest-preset";
+
+export default pluginVitestConfig(import.meta.url);