Jeff Emmett 1471d1d578 fix(passkey): derive WebAuthn user.id deterministically to stop duplicates ... Retries of /api/register/start previously generated a fresh random user.id each time, so the authenticator (iCloud Keychain, Windows Hello, 1Password, etc.) stored a brand-new passkey per attempt. Users who hit the failing registration flow ended up with three or four orphan passkeys in their password manager for every successful one. WebAuthn spec: a create() ceremony with the same (rpId, user.id) overwrites the existing passkey. Deriving user.id as SHA-256(salt + username) means repeated start calls for the same username produce the same user.id and the authenticator overwrites in place. Salt chain: USER_ID_SALT → JWT_SECRET → fallback constant. No new env var needed in prod — JWT_SECRET is already set.		2026-04-17 10:27:55 -04:00
..
encryptid	fix(passkey): derive WebAuthn user.id deterministically to stop duplicates	2026-04-17 10:27:55 -04:00
lib	feat: add JSON WebSocket mode, demo seed data, and useDemoSync hook	2026-02-15 09:38:59 -07:00