server.passkeys

Passkey JS bridge injection — the vendoredwindow.chirp.passkeysruntime.

Mirrors the Alpine/htmx/islands injection path (src/chirp/server/{alpine,htmx,islands}.py). When AppConfig(passkeys=True) Chirp injects this inline<script> before </body>via HTMLInject, marked data-chirp="passkeys" and carrying the live per-request CSP nonce.

Unlike Alpine/htmx, nothing external is loaded — the bridge is a pure base64url + navigator.credentialsshim, so there is no CDN footgun (AGENTS.mdjsDelivr rule) to get wrong and no npm/Node toolchain. It absorbs the part of WebAuthn every DIY integration fumbles: base64url↔ArrayBuffer marshalling of the challenge / user handle / credential ids / signatures, and mappingDOMExceptionnames to clean states.

Browser API exposed (SimpleWebAuthn-parity — one call, options in, POSTable JSON out; the app does thefetchso it controls the URL and includes the CSRF token, since the JS POST is not a template<form> the csrf_formrule can validate)::

const opts = await (await fetch('/auth/passkey/login/begin', {method:'POST'})).json();
const credential = await chirp.passkeys.authenticate(opts);   // throws on cancel/misconfig
await fetch('/auth/passkey/login/finish', {
  method: 'POST',
  headers: {'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken},
  body: JSON.stringify(credential),
});

Errors thrown carry a.passkeyReason of cancelled(user dismissed / timeout),duplicate (authenticator already registered), misconfigured (bad rp_id/origin — also logged as a developer console error, the browser twin of thepasskeys startup contract), unsupported, or failed.