From 217f9a0de030c38991626e78a8f18ab9af22ea0f Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Mon, 9 Mar 2026 15:39:41 +0100
Subject: [PATCH 001/107] Remove colored container around card in perma

---
 app/assets/stylesheets/native.css | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/app/assets/stylesheets/native.css b/app/assets/stylesheets/native.css
index 591ce8890..064db7527 100644
--- a/app/assets/stylesheets/native.css
+++ b/app/assets/stylesheets/native.css
@@ -59,16 +59,26 @@
     /* ------------------------------------------------------------------------ */
 
     .card-perma {
-      margin-block-start: 0;
+      margin-block-start: var(--block-space-half);
 
       &:not(:has(.card-perma__notch-new-card-buttons)) .card-perma__bg {
-        padding-block: clamp(0.25rem, 2vw, var(--padding-block));
+        padding-block-end: clamp(0.25rem, 2vw, var(--padding-block));
+      }
+
+      .card {
+        background: linear-gradient(to bottom, var(--color-canvas), var(--card-bg-color));
+        box-shadow: unset;
+      }
+
+      .card__board {
+        border-radius: 0 var(--border-radius) var(--border-radius) 0;
       }
     }
 
     .card-perma__bg {
-      border-start-start-radius: calc(0.2em + clamp(0.25rem, 2vw, var(--padding-block)));
-      border-start-end-radius: calc(0.2em + clamp(0.25rem, 2vw, var(--padding-block)));
+      padding-inline: 0;
+      padding-block-start: 0;
+      background-color: unset;
     }
 
     .card-perma__closure-message {
@@ -77,21 +87,10 @@
     }
 
     .card-perma--draft {
-      .card-perma__bg {
-        padding-inline: 0;
-        padding-block-start: 0;
-        background-color: unset;
-      }
-
       .card {
-        background: linear-gradient(to bottom, var(--color-canvas), var(--card-bg-color));
         box-shadow: 0 101vh 0 100vh var(--card-bg-color);
       }
 
-      .card__board {
-        border-radius: 0 var(--border-radius) var(--border-radius) 0;
-      }
-
       .card-perma__notch--bottom {
         z-index: 1;
       }

From a892d52ee09f955562fd0390b7673964adb4d0ba Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Mon, 9 Mar 2026 15:40:30 +0100
Subject: [PATCH 002/107] Move stamp back in the footer by default

(narrow viewport)
---
 app/assets/stylesheets/card-perma.css | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/app/assets/stylesheets/card-perma.css b/app/assets/stylesheets/card-perma.css
index 3dc16d5a2..755dd8f9a 100644
--- a/app/assets/stylesheets/card-perma.css
+++ b/app/assets/stylesheets/card-perma.css
@@ -34,16 +34,6 @@
       }
     }
 
-    @media (max-width: 639px) {
-      &:has(.card__closed) {
-        padding-block-start: 4.5rem;
-
-        .card-perma__bg {
-          box-shadow: 0 -2rem 0 0 var(--color-container);
-        }
-      }
-    }
-
     @media (max-width: 799px) {
       --half-btn-height: 1.25rem;
       --padding-inline: 1.5ch;
@@ -225,8 +215,7 @@
 
     .card__closed {
       @media (max-width: 639px) {
-        inset: auto 0 100% auto;
-        translate: 0 30%;
+        inset: auto 0 3rem auto;
         scale: 75%;
       }
     }

From 078597f132b0648235d106b055b21f3706e12b13 Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Mon, 9 Mar 2026 15:40:45 +0100
Subject: [PATCH 003/107] Add bridge component

---
 .../controllers/bridge/stamp_controller.js    | 20 +++++++++++++++++++
 .../initializers/bridge/bridge_element.js     | 16 +++++++++++++++
 .../cards/display/common/_stamp.html.erb      | 18 +++++++++++++----
 3 files changed, 50 insertions(+), 4 deletions(-)
 create mode 100644 app/javascript/controllers/bridge/stamp_controller.js

diff --git a/app/javascript/controllers/bridge/stamp_controller.js b/app/javascript/controllers/bridge/stamp_controller.js
new file mode 100644
index 000000000..42810d49a
--- /dev/null
+++ b/app/javascript/controllers/bridge/stamp_controller.js
@@ -0,0 +1,20 @@
+import { BridgeComponent } from "@hotwired/hotwire-native-bridge"
+
+export default class extends BridgeComponent {
+  static component = "stamp"
+
+  connect() {
+    super.connect()
+    this.notifyBridgeOfConnect()
+  }
+
+  disconnect() {
+    super.disconnect()
+    this.send("disconnect")
+  }
+
+  notifyBridgeOfConnect() {
+    console.log(this.bridgeElement.getStamp())
+    this.send("connect", this.bridgeElement.getStamp())
+  }
+}
diff --git a/app/javascript/initializers/bridge/bridge_element.js b/app/javascript/initializers/bridge/bridge_element.js
index 438cf22e1..954a8f652 100644
--- a/app/javascript/initializers/bridge/bridge_element.js
+++ b/app/javascript/initializers/bridge/bridge_element.js
@@ -9,6 +9,14 @@ BridgeElement.prototype.getButton = function() {
   }
 }
 
+BridgeElement.prototype.getStamp = function() {
+  return {
+    title: this.title,
+    date: this.getDate(),
+    by: this.getBy()
+  }
+}
+
 BridgeElement.prototype.getIcon = function() {
   const url = this.bridgeAttribute(`icon-url`)
 
@@ -19,6 +27,14 @@ BridgeElement.prototype.getIcon = function() {
   return null
 }
 
+BridgeElement.prototype.getDate = function() {
+  return this.bridgeAttribute(`date`) ?? null
+}
+
+BridgeElement.prototype.getBy = function() {
+  return this.bridgeAttribute(`by`) ?? null
+}
+
 BridgeElement.prototype.getDisplayTitle = function() {
   return !!this.bridgeAttribute(`display-title`)
 }
diff --git a/app/views/cards/display/common/_stamp.html.erb b/app/views/cards/display/common/_stamp.html.erb
index 629e4cf24..e8f7e6148 100644
--- a/app/views/cards/display/common/_stamp.html.erb
+++ b/app/views/cards/display/common/_stamp.html.erb
@@ -1,15 +1,25 @@
 <% if card.postponed? %>
-  <div class="card__closed <%= "card__closed--system" if card.postponed_by&.system? %>">
+  <%= tag.div class: token_list("card__closed", "card__closed--system": card.postponed_by&.system?), data: {
+    controller: "bridge--stamp",
+    bridge_title: "Not Now",
+    bridge_date: card.postponed_at.strftime("%b %d, %Y"),
+    bridge_by: card.postponed_by&.familiar_name
+  } do %>
     <span class="card__closed-title" data-text="Not Now">Not Now</span>
     <strong class="card__closed-date"><%= card.postponed_at.strftime("%b %d, %Y") %></strong>
     <span class="card__closed-by-line">by <span class="card__closed-by"><%= card.postponed_by&.familiar_name %></span></span>
-  </div>
+  <% end %>
 <% end %>
 
 <% if card.closed? %>
-  <div class="card__closed">
+  <%= tag.div class: "card__closed", data: {
+    controller: "bridge--stamp",
+    bridge_title: "Done",
+    bridge_date: card.closed_at.strftime("%b %d, %Y"),
+    bridge_by: card.closed_by.familiar_name
+  } do %>
     <span class="card__closed-title" data-text="Done">Done</span>
     <strong class="card__closed-date"><%= card.closed_at.strftime("%b %d, %Y") %></strong>
     <span class="card__closed-by-line">by <span class="card__closed-by"><%= card.closed_by.familiar_name %></span></span>
-  </div>
+  <% end %>
 <% end %>

From 38ecacc2b037b46cd8b3eb94186c12fbe939ade3 Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Mon, 9 Mar 2026 15:43:05 +0100
Subject: [PATCH 004/107] Hide web stamp

---
 app/assets/stylesheets/native.css | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/assets/stylesheets/native.css b/app/assets/stylesheets/native.css
index 064db7527..e636eae14 100644
--- a/app/assets/stylesheets/native.css
+++ b/app/assets/stylesheets/native.css
@@ -130,3 +130,9 @@
     display: none;
   }
 }
+
+[data-bridge-components~=stamp] {
+  [data-controller~=bridge--stamp] {
+    display: none;
+  }
+}

From d746b86e700c4f41e39533e9f890f32ae99f83fd Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Mon, 9 Mar 2026 15:43:58 +0100
Subject: [PATCH 005/107] Remove debug line

---
 app/javascript/controllers/bridge/stamp_controller.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/javascript/controllers/bridge/stamp_controller.js b/app/javascript/controllers/bridge/stamp_controller.js
index 42810d49a..6c04d3140 100644
--- a/app/javascript/controllers/bridge/stamp_controller.js
+++ b/app/javascript/controllers/bridge/stamp_controller.js
@@ -14,7 +14,6 @@ export default class extends BridgeComponent {
   }
 
   notifyBridgeOfConnect() {
-    console.log(this.bridgeElement.getStamp())
     this.send("connect", this.bridgeElement.getStamp())
   }
 }

From 5a9fd6b975d953f93b6f78c14739258689c52daf Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Mon, 9 Mar 2026 16:38:22 +0100
Subject: [PATCH 006/107] Coding style

---
 app/javascript/initializers/bridge/bridge_element.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/javascript/initializers/bridge/bridge_element.js b/app/javascript/initializers/bridge/bridge_element.js
index 954a8f652..6692a8a22 100644
--- a/app/javascript/initializers/bridge/bridge_element.js
+++ b/app/javascript/initializers/bridge/bridge_element.js
@@ -18,7 +18,7 @@ BridgeElement.prototype.getStamp = function() {
 }
 
 BridgeElement.prototype.getIcon = function() {
-  const url = this.bridgeAttribute(`icon-url`)
+  const url = this.bridgeAttribute("icon-url")
 
   if (url) {
     return { url }
@@ -28,17 +28,17 @@ BridgeElement.prototype.getIcon = function() {
 }
 
 BridgeElement.prototype.getDate = function() {
-  return this.bridgeAttribute(`date`) ?? null
+  return this.bridgeAttribute("date") ?? null
 }
 
 BridgeElement.prototype.getBy = function() {
-  return this.bridgeAttribute(`by`) ?? null
+  return this.bridgeAttribute("by") ?? null
 }
 
 BridgeElement.prototype.getDisplayTitle = function() {
-  return !!this.bridgeAttribute(`display-title`)
+  return !!this.bridgeAttribute("display-title")
 }
 
 BridgeElement.prototype.getDisplayAsPrimaryAction = function() {
-  return !!this.bridgeAttribute(`display-as-primary-action`)
+  return !!this.bridgeAttribute("display-as-primary-action")
 }

From 7974629e20e0f4721bb3dae11ac66ca90228505f Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Mon, 9 Mar 2026 16:42:59 +0100
Subject: [PATCH 007/107] Rename attribute

---
 app/javascript/initializers/bridge/bridge_element.js | 6 +++---
 app/views/cards/display/common/_stamp.html.erb       | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/javascript/initializers/bridge/bridge_element.js b/app/javascript/initializers/bridge/bridge_element.js
index 6692a8a22..b118c9265 100644
--- a/app/javascript/initializers/bridge/bridge_element.js
+++ b/app/javascript/initializers/bridge/bridge_element.js
@@ -13,7 +13,7 @@ BridgeElement.prototype.getStamp = function() {
   return {
     title: this.title,
     date: this.getDate(),
-    by: this.getBy()
+    closedBy: this.getClosedBy()
   }
 }
 
@@ -31,8 +31,8 @@ BridgeElement.prototype.getDate = function() {
   return this.bridgeAttribute("date") ?? null
 }
 
-BridgeElement.prototype.getBy = function() {
-  return this.bridgeAttribute("by") ?? null
+BridgeElement.prototype.getClosedBy = function() {
+  return this.bridgeAttribute("closed-by") ?? null
 }
 
 BridgeElement.prototype.getDisplayTitle = function() {
diff --git a/app/views/cards/display/common/_stamp.html.erb b/app/views/cards/display/common/_stamp.html.erb
index e8f7e6148..75c11ad4a 100644
--- a/app/views/cards/display/common/_stamp.html.erb
+++ b/app/views/cards/display/common/_stamp.html.erb
@@ -3,7 +3,7 @@
     controller: "bridge--stamp",
     bridge_title: "Not Now",
     bridge_date: card.postponed_at.strftime("%b %d, %Y"),
-    bridge_by: card.postponed_by&.familiar_name
+    bridge_closed_by: card.postponed_by&.familiar_name
   } do %>
     <span class="card__closed-title" data-text="Not Now">Not Now</span>
     <strong class="card__closed-date"><%= card.postponed_at.strftime("%b %d, %Y") %></strong>
@@ -16,7 +16,7 @@
     controller: "bridge--stamp",
     bridge_title: "Done",
     bridge_date: card.closed_at.strftime("%b %d, %Y"),
-    bridge_by: card.closed_by.familiar_name
+    bridge_closed_by: card.closed_by.familiar_name
   } do %>
     <span class="card__closed-title" data-text="Done">Done</span>
     <strong class="card__closed-date"><%= card.closed_at.strftime("%b %d, %Y") %></strong>

From 17112fa0eed19eeec5bf7eeff1ff308168173235 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Mar 2026 08:58:36 -0700
Subject: [PATCH 008/107] Bump brakeman from 8.0.2 to 8.0.4 in the
 development-dependencies group (#2669)

* Bump brakeman from 8.0.2 to 8.0.4 in the development-dependencies group

Bumps the development-dependencies group with 1 update: [brakeman](https://github.com/presidentbeef/brakeman).


Updates `brakeman` from 8.0.2 to 8.0.4
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](https://github.com/presidentbeef/brakeman/compare/v8.0.2...v8.0.4)

---
updated-dependencies:
- dependency-name: brakeman
  dependency-version: 8.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* Sync Gemfile.saas.lock

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 Gemfile.lock      | 2 +-
 Gemfile.saas.lock | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 4e3653aeb..3f8461b39 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -158,7 +158,7 @@ GEM
     bindex (0.8.1)
     bootsnap (1.23.0)
       msgpack (~> 1.2)
-    brakeman (8.0.2)
+    brakeman (8.0.4)
       racc
     builder (3.3.0)
     bundler-audit (0.9.3)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 0e35effac..152d1889c 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -248,7 +248,7 @@ GEM
     bindex (0.8.1)
     bootsnap (1.23.0)
       msgpack (~> 1.2)
-    brakeman (8.0.2)
+    brakeman (8.0.4)
       racc
     builder (3.3.0)
     bundler-audit (0.9.3)

From 9585d13f5f04080b0e2875c8d223e823758919ca Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Mar 2026 08:58:45 -0700
Subject: [PATCH 009/107] Bump actions/attest-build-provenance from 3.2.0 to
 4.1.0 (#2668)

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 3.2.0 to 4.1.0.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/v3.2.0...v4.1.0)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/publish-image.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 953f09b72..9d80d143d 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -101,7 +101,7 @@ jobs:
 
       - name: Attest image provenance (per-arch)
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v3.2.0
+        uses: actions/attest-build-provenance@v4.1.0
         with:
           subject-name: ${{ steps.vars.outputs.canonical }}
           subject-digest: ${{ steps.build.outputs.digest }}

From a896b0a9e6bfe264c3ba5621038f0a13d327cff9 Mon Sep 17 00:00:00 2001
From: Rob Zolkos <rob@zolkos.com>
Date: Mon, 9 Mar 2026 13:59:57 -0400
Subject: [PATCH 010/107] Touch board when publication is created or destroyed
 (#2674)

Publishing or unpublishing a board didn't bust the `json.cache! board`
fragment cache because `Board::Publication` didn't touch its parent
board. The board's `updated_at` stayed stale, so subsequent GET requests
continued serving cached JSON without `public_url`.
---
 app/models/board/publication.rb       |  2 +-
 test/models/board/publishable_test.rb | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/app/models/board/publication.rb b/app/models/board/publication.rb
index bd480eecc..20dcc40da 100644
--- a/app/models/board/publication.rb
+++ b/app/models/board/publication.rb
@@ -1,6 +1,6 @@
 class Board::Publication < ApplicationRecord
   belongs_to :account, default: -> { board.account }
-  belongs_to :board
+  belongs_to :board, touch: true
 
   has_secure_token :key
 end
diff --git a/test/models/board/publishable_test.rb b/test/models/board/publishable_test.rb
index e05f19bd2..8feadfd73 100644
--- a/test/models/board/publishable_test.rb
+++ b/test/models/board/publishable_test.rb
@@ -42,6 +42,20 @@ class Board::PublishableTest < ActiveSupport::TestCase
     end
   end
 
+  test "touch board when publication is created" do
+    assert_changes -> { boards(:writebook).reload.updated_at } do
+      boards(:writebook).publish
+    end
+  end
+
+  test "touch board when publication is destroyed" do
+    boards(:writebook).publish
+
+    assert_changes -> { boards(:writebook).reload.updated_at } do
+      boards(:writebook).unpublish
+    end
+  end
+
   test "publish doesn't create duplicate publications" do
     boards(:writebook).publish
     original_publication = boards(:writebook).publication

From 723c8180b4295f387aa170db22582e5f4826cbcf Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Mon, 9 Mar 2026 11:39:49 -0700
Subject: [PATCH 011/107] Add JSON response format for full SDK/CLI coverage
 (#2675)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add JSON response format to void-response controller actions

Add respond_to blocks with JSON format to 14 controllers that
previously only rendered HTML or Turbo Stream responses. JSON
callers get head :no_content (or :created/:ok for push
subscriptions, distinguishing new vs existing).

Covers: board involvements, board/account entropies, column
reordering, card readings, card publishing, user roles, user
avatars, account settings, notification settings, join codes
(with 422 error branch), and push subscriptions.

* Add steps index endpoint with JSON view

Add index action to Cards::StepsController so SDK/CLI callers
can list all steps for a card. Reuses the existing _step.json
partial.

* Add JSON views for paginated card list endpoints

Add show.json.jbuilder for stream, not-now, and closed column
endpoints. No controller changes needed — set_page_and_extract_
portion_from and fresh_when already work format-agnostically.

* Add JSON search endpoint with distinct-card pagination

JSON search paginates distinct Card records (via the existing
Card.mentioning scope with .distinct) rather than Search::Record
objects. This ensures page boundaries, Link headers, and counts
reflect unique cards — no short pages from post-pagination dedup.

ID-match searches return a uniform single-element Card[] array
through the same pagination path.

* Add JSON views for settings and configuration endpoints

Add show.json.jbuilder for account settings (name), join codes
(code, usage_count, usage_limit, url, active), and notification
settings (bundle_email_frequency). Tests for show and update
were added in the void-response commit.

* Add JSON response format to data exports

Create returns 201 with export id, status, and created_at so
callers can poll. Show returns any-status exports for JSON (not
just completed) with a download_url when ready, or 404 for
missing/other-user exports.

* Extend access token JSON API

Add index.json and _access_token.json partial for listing tokens.
Add JSON format to destroy. Include id and created_at in the
create response alongside the existing token/description/permission
fields.

* Fix ambiguous precedence warning in export JSON view

* Assert X-Total-Count pagination header in streams JSON test

* Address review feedback

- Guard steps index against HTML requests (redirect to card)
- Normalize created_at to UTC in access token and export JSON
- Add deterministic ordering (.latest) to search JSON pagination

* Return 406 for HTML requests to steps index instead of redirect

* Add wrap_parameters for flat SDK JSON payload compatibility

Five controllers infer the wrong wrapper key from their class
name, so flat JSON bodies like {"role":"admin"} fail with 400.
Add explicit wrap_parameters declarations:

- Users::RolesController → :user
- Notifications::SettingsController → :user_settings
- Account::JoinCodesController → :account_join_code
- Account::SettingsController → :account
- Boards::EntropiesController → :board

Add integration tests that send flat (unwrapped) JSON payloads
for all seven param-bearing endpoints to prove SDK compatibility.

* Address PR review feedback

- Use 201 Created (not 204) for all create actions: publishes, readings,
  left/right positions, push subscriptions
- Simplify push subscription to always return :created (no 200/201 variance)
- Remove superfluous respond_to block from steps#index
- Merge exports#show into single respond_to block
- Move export download_url conditional out of inline args
- Ensure join code active is explicitly boolean
- Remove extra parens from search controller assignment
- Add blank lines between format blocks for readability

* Return JSON bodies on create actions

Create actions for boards, cards, columns, comments, and steps now
render the resource as JSON (via their show views) instead of returning
empty 201 responses with only a Location header. SDKs expect a JSON
body they can deserialize into the created resource.

* Return JSON bodies on reaction create actions

Card and comment reaction creates now render the reaction as JSON
instead of returning empty 201 responses, consistent with the other
resource-creating endpoints.

* Allow access tokens API without account scope

Access tokens are identity-level (not account-scoped), so the
controller needs to work with bearer token auth and no account slug
in the URL. Skip require_account so the bearer token auth path
can proceed.

Also fix involvement test to send params in JSON body (not query
string) to match real SDK usage.
---
 .../account/entropies_controller.rb           |  6 +-
 app/controllers/account/exports_controller.rb | 16 ++++-
 .../account/join_codes_controller.rb          | 18 ++++-
 .../account/settings_controller.rb            |  8 ++-
 app/controllers/boards/columns_controller.rb  |  2 +-
 .../boards/entropies_controller.rb            |  7 ++
 .../boards/involvements_controller.rb         |  6 ++
 app/controllers/boards_controller.rb          |  2 +-
 .../cards/comments/reactions_controller.rb    |  2 +-
 app/controllers/cards/comments_controller.rb  |  2 +-
 app/controllers/cards/publishes_controller.rb | 16 +++--
 app/controllers/cards/reactions_controller.rb |  2 +-
 app/controllers/cards/readings_controller.rb  | 10 +++
 app/controllers/cards/steps_controller.rb     |  6 +-
 app/controllers/cards_controller.rb           |  4 +-
 .../columns/left_positions_controller.rb      |  5 ++
 .../columns/right_positions_controller.rb     |  5 ++
 .../my/access_tokens_controller.rb            | 11 ++-
 .../notifications/settings_controller.rb      |  8 ++-
 app/controllers/searches_controller.rb        | 18 ++++-
 app/controllers/users/avatars_controller.rb   |  6 +-
 .../users/push_subscriptions_controller.rb    | 13 +++-
 app/controllers/users/roles_controller.rb     |  8 ++-
 app/views/account/exports/show.json.jbuilder  |  6 ++
 .../account/join_codes/show.json.jbuilder     |  3 +
 app/views/account/settings/show.json.jbuilder |  1 +
 .../boards/columns/closeds/show.json.jbuilder |  1 +
 .../columns/not_nows/show.json.jbuilder       |  1 +
 .../boards/columns/streams/show.json.jbuilder |  1 +
 app/views/cards/steps/index.json.jbuilder     |  1 +
 .../access_tokens/_access_token.json.jbuilder |  2 +
 .../my/access_tokens/index.json.jbuilder      |  1 +
 .../notifications/settings/show.json.jbuilder |  1 +
 app/views/reactions/show.json.jbuilder        |  1 +
 app/views/searches/show.json.jbuilder         |  1 +
 .../accounts/entropies_controller_test.rb     |  7 ++
 .../accounts/exports_controller_test.rb       | 43 +++++++++++
 .../accounts/join_codes_controller_test.rb    | 35 +++++++++
 .../accounts/settings_controller_test.rb      | 14 ++++
 test/controllers/api/flat_json_params_test.rb | 71 +++++++++++++++++++
 .../boards/columns/closeds_controller_test.rb |  7 ++
 .../columns/not_nows_controller_test.rb       |  7 ++
 .../boards/columns/streams_controller_test.rb |  8 +++
 .../boards/columns_controller_test.rb         |  1 +
 .../boards/entropies_controller_test.rb       |  7 ++
 .../boards/involvements_controller_test.rb    | 11 +++
 test/controllers/boards_controller_test.rb    |  1 +
 .../comments/reactions_controller_test.rb     |  1 +
 .../cards/comments_controller_test.rb         |  1 +
 .../cards/publishes_controller_test.rb        | 11 +++
 .../cards/reactions_controller_test.rb        |  1 +
 .../cards/readings_controller_test.rb         | 12 ++++
 .../cards/steps_controller_test.rb            | 14 ++++
 test/controllers/cards_controller_test.rb     |  1 +
 .../columns/left_positions_controller_test.rb | 16 +++++
 .../right_positions_controller_test.rb        | 16 +++++
 .../my/access_tokens_controller_test.rb       | 32 +++++++++
 .../notifications/settings_controller_test.rb | 15 ++++
 test/controllers/searches_controller_test.rb  | 30 ++++++++
 .../users/avatars_controller_test.rb          |  5 ++
 .../push_subscriptions_controller_test.rb     | 36 ++++++++++
 .../users/roles_controller_test.rb            |  7 ++
 62 files changed, 580 insertions(+), 31 deletions(-)
 create mode 100644 app/views/account/exports/show.json.jbuilder
 create mode 100644 app/views/account/join_codes/show.json.jbuilder
 create mode 100644 app/views/account/settings/show.json.jbuilder
 create mode 100644 app/views/boards/columns/closeds/show.json.jbuilder
 create mode 100644 app/views/boards/columns/not_nows/show.json.jbuilder
 create mode 100644 app/views/boards/columns/streams/show.json.jbuilder
 create mode 100644 app/views/cards/steps/index.json.jbuilder
 create mode 100644 app/views/my/access_tokens/_access_token.json.jbuilder
 create mode 100644 app/views/my/access_tokens/index.json.jbuilder
 create mode 100644 app/views/notifications/settings/show.json.jbuilder
 create mode 100644 app/views/reactions/show.json.jbuilder
 create mode 100644 app/views/searches/show.json.jbuilder
 create mode 100644 test/controllers/api/flat_json_params_test.rb

diff --git a/app/controllers/account/entropies_controller.rb b/app/controllers/account/entropies_controller.rb
index 9876e99d8..7290c1e4e 100644
--- a/app/controllers/account/entropies_controller.rb
+++ b/app/controllers/account/entropies_controller.rb
@@ -3,7 +3,11 @@ class Account::EntropiesController < ApplicationController
 
   def update
     Current.account.entropy.update!(entropy_params)
-    redirect_to account_settings_path, notice: "Account updated"
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path, notice: "Account updated" }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/account/exports_controller.rb b/app/controllers/account/exports_controller.rb
index dbe0a11c1..32fb5bd42 100644
--- a/app/controllers/account/exports_controller.rb
+++ b/app/controllers/account/exports_controller.rb
@@ -6,11 +6,20 @@ class Account::ExportsController < ApplicationController
   CURRENT_EXPORT_LIMIT = 10
 
   def show
+    respond_to do |format|
+      format.html
+      format.json { @export ? render(:show) : head(:not_found) }
+    end
   end
 
   def create
-    Current.account.exports.create!(user: Current.user).build_later
-    redirect_to account_settings_path, notice: "Export started. You'll receive an email when it's ready."
+    @export = Current.account.exports.create!(user: Current.user)
+    @export.build_later
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path, notice: "Export started. You'll receive an email when it's ready." }
+      format.json { render :show, status: :created }
+    end
   end
 
   private
@@ -23,6 +32,7 @@ class Account::ExportsController < ApplicationController
     end
 
     def set_export
-      @export = Current.account.exports.completed.find_by(id: params[:id], user: Current.user)
+      scope = request.format.json? ? Current.account.exports : Current.account.exports.completed
+      @export = scope.find_by(id: params[:id], user: Current.user)
     end
 end
diff --git a/app/controllers/account/join_codes_controller.rb b/app/controllers/account/join_codes_controller.rb
index 217ee603c..3df9552db 100644
--- a/app/controllers/account/join_codes_controller.rb
+++ b/app/controllers/account/join_codes_controller.rb
@@ -1,4 +1,6 @@
 class Account::JoinCodesController < ApplicationController
+  wrap_parameters :account_join_code
+
   before_action :set_join_code
   before_action :ensure_admin, only: %i[ update destroy ]
 
@@ -10,15 +12,25 @@ class Account::JoinCodesController < ApplicationController
 
   def update
     if @join_code.update(join_code_params)
-      redirect_to account_join_code_path
+      respond_to do |format|
+        format.html { redirect_to account_join_code_path }
+        format.json { head :no_content }
+      end
     else
-      render :edit, status: :unprocessable_entity
+      respond_to do |format|
+        format.html { render :edit, status: :unprocessable_entity }
+        format.json { render json: @join_code.errors, status: :unprocessable_entity }
+      end
     end
   end
 
   def destroy
     @join_code.reset
-    redirect_to account_join_code_path
+
+    respond_to do |format|
+      format.html { redirect_to account_join_code_path }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/account/settings_controller.rb b/app/controllers/account/settings_controller.rb
index 27f47ab99..6201ca656 100644
--- a/app/controllers/account/settings_controller.rb
+++ b/app/controllers/account/settings_controller.rb
@@ -1,4 +1,6 @@
 class Account::SettingsController < ApplicationController
+  wrap_parameters :account
+
   before_action :ensure_admin, only: :update
   before_action :set_account
 
@@ -8,7 +10,11 @@ class Account::SettingsController < ApplicationController
 
   def update
     @account.update!(account_params)
-    redirect_to account_settings_path
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/boards/columns_controller.rb b/app/controllers/boards/columns_controller.rb
index 4b71e7f3e..a3cf867ea 100644
--- a/app/controllers/boards/columns_controller.rb
+++ b/app/controllers/boards/columns_controller.rb
@@ -18,7 +18,7 @@ class Boards::ColumnsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream
-      format.json { head :created, location: board_column_path(@board, @column, format: :json) }
+      format.json { render :show, status: :created, location: board_column_path(@board, @column, format: :json) }
     end
   end
 
diff --git a/app/controllers/boards/entropies_controller.rb b/app/controllers/boards/entropies_controller.rb
index e42631eaf..557adb2d9 100644
--- a/app/controllers/boards/entropies_controller.rb
+++ b/app/controllers/boards/entropies_controller.rb
@@ -1,10 +1,17 @@
 class Boards::EntropiesController < ApplicationController
+  wrap_parameters :board
+
   include BoardScoped
 
   before_action :ensure_permission_to_admin_board
 
   def update
     @board.update!(entropy_params)
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/boards/involvements_controller.rb b/app/controllers/boards/involvements_controller.rb
index a904f2989..271b50262 100644
--- a/app/controllers/boards/involvements_controller.rb
+++ b/app/controllers/boards/involvements_controller.rb
@@ -3,5 +3,11 @@ class Boards::InvolvementsController < ApplicationController
 
   def update
     @board.access_for(Current.user).update!(involvement: params[:involvement])
+
+    respond_to do |format|
+      format.html
+      format.turbo_stream
+      format.json { head :no_content }
+    end
   end
 end
diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb
index 604938deb..1e93a5758 100644
--- a/app/controllers/boards_controller.rb
+++ b/app/controllers/boards_controller.rb
@@ -26,7 +26,7 @@ class BoardsController < ApplicationController
 
     respond_to do |format|
       format.html { redirect_to board_path(@board) }
-      format.json { head :created, location: board_path(@board, format: :json) }
+      format.json { render :show, status: :created, location: board_path(@board, format: :json) }
     end
   end
 
diff --git a/app/controllers/cards/comments/reactions_controller.rb b/app/controllers/cards/comments/reactions_controller.rb
index 0c822360e..32ca9f2f8 100644
--- a/app/controllers/cards/comments/reactions_controller.rb
+++ b/app/controllers/cards/comments/reactions_controller.rb
@@ -22,7 +22,7 @@ class Cards::Comments::ReactionsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream { render "reactions/create" }
-      format.json { head :created }
+      format.json { render "reactions/show", status: :created }
     end
   end
 
diff --git a/app/controllers/cards/comments_controller.rb b/app/controllers/cards/comments_controller.rb
index f2b318813..6a377bc2c 100644
--- a/app/controllers/cards/comments_controller.rb
+++ b/app/controllers/cards/comments_controller.rb
@@ -14,7 +14,7 @@ class Cards::CommentsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream
-      format.json { head :created, location: card_comment_path(@card, @comment, format: :json) }
+      format.json { render :show, status: :created, location: card_comment_path(@card, @comment, format: :json) }
     end
   end
 
diff --git a/app/controllers/cards/publishes_controller.rb b/app/controllers/cards/publishes_controller.rb
index a0378eec3..a544e6979 100644
--- a/app/controllers/cards/publishes_controller.rb
+++ b/app/controllers/cards/publishes_controller.rb
@@ -4,11 +4,17 @@ class Cards::PublishesController < ApplicationController
   def create
     @card.publish
 
-    if add_another_param?
-      card = @board.cards.create!(status: :drafted)
-      redirect_to card_draft_path(card), notice: "Card added"
-    else
-      redirect_to @card.board
+    respond_to do |format|
+      format.html do
+        if add_another_param?
+          card = @board.cards.create!(status: :drafted)
+          redirect_to card_draft_path(card), notice: "Card added"
+        else
+          redirect_to @card.board
+        end
+      end
+
+      format.json { head :created }
     end
   end
 
diff --git a/app/controllers/cards/reactions_controller.rb b/app/controllers/cards/reactions_controller.rb
index 4105a4121..4f19a1c64 100644
--- a/app/controllers/cards/reactions_controller.rb
+++ b/app/controllers/cards/reactions_controller.rb
@@ -21,7 +21,7 @@ class Cards::ReactionsController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream { render "reactions/create" }
-      format.json { head :created }
+      format.json { render "reactions/show", status: :created }
     end
   end
 
diff --git a/app/controllers/cards/readings_controller.rb b/app/controllers/cards/readings_controller.rb
index 75fdbac19..4b71272f8 100644
--- a/app/controllers/cards/readings_controller.rb
+++ b/app/controllers/cards/readings_controller.rb
@@ -4,11 +4,21 @@ class Cards::ReadingsController < ApplicationController
   def create
     @notification = @card.read_by(Current.user)
     record_board_access
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :created }
+    end
   end
 
   def destroy
     @notification = @card.unread_by(Current.user)
     record_board_access
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/cards/steps_controller.rb b/app/controllers/cards/steps_controller.rb
index 0b788fe36..387dd8e23 100644
--- a/app/controllers/cards/steps_controller.rb
+++ b/app/controllers/cards/steps_controller.rb
@@ -3,12 +3,16 @@ class Cards::StepsController < ApplicationController
 
   before_action :set_step, only: %i[ show edit update destroy ]
 
+  def index
+    fresh_when etag: @card.steps
+  end
+
   def create
     @step = @card.steps.create!(step_params)
 
     respond_to do |format|
       format.turbo_stream
-      format.json { head :created, location: card_step_path(@card, @step, format: :json) }
+      format.json { render :show, status: :created, location: card_step_path(@card, @step, format: :json) }
     end
   end
 
diff --git a/app/controllers/cards_controller.rb b/app/controllers/cards_controller.rb
index e007527b8..482d2ff78 100644
--- a/app/controllers/cards_controller.rb
+++ b/app/controllers/cards_controller.rb
@@ -18,8 +18,8 @@ class CardsController < ApplicationController
       end
 
       format.json do
-        card = @board.cards.create! card_params.merge(creator: Current.user, status: "published")
-        head :created, location: card_path(card, format: :json)
+        @card = @board.cards.create! card_params.merge(creator: Current.user, status: "published")
+        render :show, status: :created, location: card_path(@card, format: :json)
       end
     end
   end
diff --git a/app/controllers/columns/left_positions_controller.rb b/app/controllers/columns/left_positions_controller.rb
index 7161c093f..78e0c0c80 100644
--- a/app/controllers/columns/left_positions_controller.rb
+++ b/app/controllers/columns/left_positions_controller.rb
@@ -4,5 +4,10 @@ class Columns::LeftPositionsController < ApplicationController
   def create
     @left_column = @column.left_column
     @column.move_left
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :created }
+    end
   end
 end
diff --git a/app/controllers/columns/right_positions_controller.rb b/app/controllers/columns/right_positions_controller.rb
index d43beb662..5d9cc37f9 100644
--- a/app/controllers/columns/right_positions_controller.rb
+++ b/app/controllers/columns/right_positions_controller.rb
@@ -4,5 +4,10 @@ class Columns::RightPositionsController < ApplicationController
   def create
     @right_column = @column.right_column
     @column.move_right
+
+    respond_to do |format|
+      format.turbo_stream
+      format.json { head :created }
+    end
   end
 end
diff --git a/app/controllers/my/access_tokens_controller.rb b/app/controllers/my/access_tokens_controller.rb
index 82cd93842..c9fcf38c3 100644
--- a/app/controllers/my/access_tokens_controller.rb
+++ b/app/controllers/my/access_tokens_controller.rb
@@ -1,4 +1,6 @@
 class My::AccessTokensController < ApplicationController
+  skip_before_action :require_account
+
   def index
     @access_tokens = my_access_tokens.order(created_at: :desc)
   end
@@ -24,14 +26,19 @@ class My::AccessTokensController < ApplicationController
 
       format.json do
         render status: :created, json: \
-          { token: access_token.token, description: access_token.description, permission: access_token.permission }
+          { id: access_token.id, token: access_token.token, description: access_token.description,
+            permission: access_token.permission, created_at: access_token.created_at.utc }
       end
     end
   end
 
   def destroy
     my_access_tokens.find(params[:id]).destroy!
-    redirect_to my_access_tokens_path
+
+    respond_to do |format|
+      format.html { redirect_to my_access_tokens_path }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/notifications/settings_controller.rb b/app/controllers/notifications/settings_controller.rb
index c4aab7f69..252abec2e 100644
--- a/app/controllers/notifications/settings_controller.rb
+++ b/app/controllers/notifications/settings_controller.rb
@@ -1,4 +1,6 @@
 class Notifications::SettingsController < ApplicationController
+  wrap_parameters :user_settings
+
   before_action :set_settings
 
   def show
@@ -7,7 +9,11 @@ class Notifications::SettingsController < ApplicationController
 
   def update
     @settings.update!(settings_params)
-    redirect_to notifications_settings_path, notice: "Settings updated"
+
+    respond_to do |format|
+      format.html { redirect_to notifications_settings_path, notice: "Settings updated" }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/searches_controller.rb b/app/controllers/searches_controller.rb
index b1ec5a0d2..70dfa4d4d 100644
--- a/app/controllers/searches_controller.rb
+++ b/app/controllers/searches_controller.rb
@@ -5,10 +5,22 @@ class SearchesController < ApplicationController
     @query = params[:q].blank? ? nil : params[:q]
 
     if card = Current.user.accessible_cards.find_by_id(@query)
-      @card = card
+      respond_to do |format|
+        format.html { @card = card }
+        format.json { set_page_and_extract_portion_from Current.user.accessible_cards.where(id: card.id) }
+      end
     else
-      set_page_and_extract_portion_from Current.user.search(@query)
-      @recent_search_queries = Current.user.search_queries.order(updated_at: :desc).limit(10)
+      respond_to do |format|
+        format.html do
+          set_page_and_extract_portion_from Current.user.search(@query)
+          @recent_search_queries = Current.user.search_queries.order(updated_at: :desc).limit(10)
+        end
+
+        format.json do
+          set_page_and_extract_portion_from \
+            Current.user.accessible_cards.mentioning(@query, user: Current.user).distinct.latest.preloaded
+        end
+      end
     end
   end
 end
diff --git a/app/controllers/users/avatars_controller.rb b/app/controllers/users/avatars_controller.rb
index 55d8f06dd..544398331 100644
--- a/app/controllers/users/avatars_controller.rb
+++ b/app/controllers/users/avatars_controller.rb
@@ -16,7 +16,11 @@ class Users::AvatarsController < ApplicationController
 
   def destroy
     @user.avatar.destroy
-    redirect_to @user
+
+    respond_to do |format|
+      format.html { redirect_to @user }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/users/push_subscriptions_controller.rb b/app/controllers/users/push_subscriptions_controller.rb
index b511a6b19..91b47264c 100644
--- a/app/controllers/users/push_subscriptions_controller.rb
+++ b/app/controllers/users/push_subscriptions_controller.rb
@@ -5,12 +5,21 @@ class Users::PushSubscriptionsController < ApplicationController
   end
 
   def create
-    @push_subscriptions.create_with(user_agent: request.user_agent).create_or_find_by!(push_subscription_params)
+    subscription = @push_subscriptions.create_with(user_agent: request.user_agent).create_or_find_by!(push_subscription_params)
+
+    respond_to do |format|
+      format.html { head :no_content }
+      format.json { head :created }
+    end
   end
 
   def destroy
     @push_subscriptions.destroy_by(id: params[:id])
-    redirect_to user_push_subscriptions_url
+
+    respond_to do |format|
+      format.html { redirect_to user_push_subscriptions_url }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/controllers/users/roles_controller.rb b/app/controllers/users/roles_controller.rb
index 711308d13..fb11d4e08 100644
--- a/app/controllers/users/roles_controller.rb
+++ b/app/controllers/users/roles_controller.rb
@@ -1,10 +1,16 @@
 class Users::RolesController < ApplicationController
+  wrap_parameters :user
+
   before_action :set_user
   before_action :ensure_permission_to_administer_user
 
   def update
     @user.update!(role_params)
-    redirect_to account_settings_path
+
+    respond_to do |format|
+      format.html { redirect_to account_settings_path }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/views/account/exports/show.json.jbuilder b/app/views/account/exports/show.json.jbuilder
new file mode 100644
index 000000000..2bd9e3d60
--- /dev/null
+++ b/app/views/account/exports/show.json.jbuilder
@@ -0,0 +1,6 @@
+json.(@export, :id, :status)
+json.created_at @export.created_at.utc
+
+if @export.completed? && @export.file.attached?
+  json.download_url rails_blob_url(@export.file, disposition: "attachment")
+end
diff --git a/app/views/account/join_codes/show.json.jbuilder b/app/views/account/join_codes/show.json.jbuilder
new file mode 100644
index 000000000..559e7b6c2
--- /dev/null
+++ b/app/views/account/join_codes/show.json.jbuilder
@@ -0,0 +1,3 @@
+json.(@join_code, :code, :usage_count, :usage_limit)
+json.url join_url(code: @join_code.code, script_name: Current.account.slug)
+json.active !!@join_code.active?
diff --git a/app/views/account/settings/show.json.jbuilder b/app/views/account/settings/show.json.jbuilder
new file mode 100644
index 000000000..9a62dabc6
--- /dev/null
+++ b/app/views/account/settings/show.json.jbuilder
@@ -0,0 +1 @@
+json.(Current.account, :name)
diff --git a/app/views/boards/columns/closeds/show.json.jbuilder b/app/views/boards/columns/closeds/show.json.jbuilder
new file mode 100644
index 000000000..c1dc1dff1
--- /dev/null
+++ b/app/views/boards/columns/closeds/show.json.jbuilder
@@ -0,0 +1 @@
+json.array! @page.records, partial: "cards/card", as: :card
diff --git a/app/views/boards/columns/not_nows/show.json.jbuilder b/app/views/boards/columns/not_nows/show.json.jbuilder
new file mode 100644
index 000000000..c1dc1dff1
--- /dev/null
+++ b/app/views/boards/columns/not_nows/show.json.jbuilder
@@ -0,0 +1 @@
+json.array! @page.records, partial: "cards/card", as: :card
diff --git a/app/views/boards/columns/streams/show.json.jbuilder b/app/views/boards/columns/streams/show.json.jbuilder
new file mode 100644
index 000000000..c1dc1dff1
--- /dev/null
+++ b/app/views/boards/columns/streams/show.json.jbuilder
@@ -0,0 +1 @@
+json.array! @page.records, partial: "cards/card", as: :card
diff --git a/app/views/cards/steps/index.json.jbuilder b/app/views/cards/steps/index.json.jbuilder
new file mode 100644
index 000000000..087790175
--- /dev/null
+++ b/app/views/cards/steps/index.json.jbuilder
@@ -0,0 +1 @@
+json.array! @card.steps, partial: "cards/steps/step", as: :step
diff --git a/app/views/my/access_tokens/_access_token.json.jbuilder b/app/views/my/access_tokens/_access_token.json.jbuilder
new file mode 100644
index 000000000..3e0a08084
--- /dev/null
+++ b/app/views/my/access_tokens/_access_token.json.jbuilder
@@ -0,0 +1,2 @@
+json.(access_token, :id, :description, :permission)
+json.created_at access_token.created_at.utc
diff --git a/app/views/my/access_tokens/index.json.jbuilder b/app/views/my/access_tokens/index.json.jbuilder
new file mode 100644
index 000000000..4abdba5f7
--- /dev/null
+++ b/app/views/my/access_tokens/index.json.jbuilder
@@ -0,0 +1 @@
+json.array! @access_tokens, partial: "my/access_tokens/access_token", as: :access_token
diff --git a/app/views/notifications/settings/show.json.jbuilder b/app/views/notifications/settings/show.json.jbuilder
new file mode 100644
index 000000000..6eaea0893
--- /dev/null
+++ b/app/views/notifications/settings/show.json.jbuilder
@@ -0,0 +1 @@
+json.bundle_email_frequency Current.user.settings.bundle_email_frequency
diff --git a/app/views/reactions/show.json.jbuilder b/app/views/reactions/show.json.jbuilder
new file mode 100644
index 000000000..a61ed5902
--- /dev/null
+++ b/app/views/reactions/show.json.jbuilder
@@ -0,0 +1 @@
+json.partial! "reactions/reaction", reaction: @reaction
diff --git a/app/views/searches/show.json.jbuilder b/app/views/searches/show.json.jbuilder
new file mode 100644
index 000000000..c1dc1dff1
--- /dev/null
+++ b/app/views/searches/show.json.jbuilder
@@ -0,0 +1 @@
+json.array! @page.records, partial: "cards/card", as: :card
diff --git a/test/controllers/accounts/entropies_controller_test.rb b/test/controllers/accounts/entropies_controller_test.rb
index ef23851de..5903ed7d0 100644
--- a/test/controllers/accounts/entropies_controller_test.rb
+++ b/test/controllers/accounts/entropies_controller_test.rb
@@ -13,6 +13,13 @@ class Account::EntropiesControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to account_settings_path
   end
 
+  test "update as JSON" do
+    put account_entropy_path, params: { entropy: { auto_postpone_period: 2.days } }, as: :json
+
+    assert_response :no_content
+    assert_equal 2.days, entropies("37s_account").reload.auto_postpone_period
+  end
+
   test "update requires admin" do
     logout_and_sign_in_as :david
 
diff --git a/test/controllers/accounts/exports_controller_test.rb b/test/controllers/accounts/exports_controller_test.rb
index ebcf26117..fd950f989 100644
--- a/test/controllers/accounts/exports_controller_test.rb
+++ b/test/controllers/accounts/exports_controller_test.rb
@@ -76,6 +76,49 @@ class Account::ExportsControllerTest < ActionDispatch::IntegrationTest
     assert_select "h2", "Download Expired"
   end
 
+  test "create as JSON" do
+    assert_difference -> { Account::Export.count }, 1 do
+      assert_enqueued_with(job: DataExportJob) do
+        post account_exports_path, as: :json
+      end
+    end
+
+    assert_response :created
+    body = @response.parsed_body
+    assert body["id"].present?
+    assert_equal "pending", body["status"]
+    assert_nil body["download_url"]
+  end
+
+  test "show as JSON with completed export" do
+    export = Account::Export.create!(account: Current.account, user: users(:jason))
+    export.build
+
+    get account_export_path(export), as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert_equal export.id, body["id"]
+    assert_equal "completed", body["status"]
+    assert body["download_url"].present?
+  end
+
+  test "show as JSON with pending export" do
+    export = Account::Export.create!(account: Current.account, user: users(:jason))
+
+    get account_export_path(export), as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert_equal "pending", body["status"]
+    assert_nil body["download_url"]
+  end
+
+  test "show as JSON with missing export" do
+    get account_export_path("nonexistent"), as: :json
+    assert_response :not_found
+  end
+
   test "create is forbidden for non-admin members" do
     logout_and_sign_in_as :david
 
diff --git a/test/controllers/accounts/join_codes_controller_test.rb b/test/controllers/accounts/join_codes_controller_test.rb
index 15d41b5ec..a56472c5c 100644
--- a/test/controllers/accounts/join_codes_controller_test.rb
+++ b/test/controllers/accounts/join_codes_controller_test.rb
@@ -24,6 +24,41 @@ class Account::JoinCodesControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to account_join_code_path
   end
 
+  test "show as JSON" do
+    get account_join_code_path, as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert body["code"].present?
+    assert body.key?("usage_count")
+    assert body.key?("usage_limit")
+    assert body.key?("url")
+    assert body.key?("active")
+  end
+
+  test "update as JSON" do
+    put account_join_code_path, params: { account_join_code: { usage_limit: 5 } }, as: :json
+
+    assert_response :no_content
+    assert_equal 5, Current.account.join_code.reload.usage_limit
+  end
+
+  test "update as JSON with invalid data" do
+    huge_number = "99999999999999999999999999999999999"
+
+    put account_join_code_path, params: { account_join_code: { usage_limit: huge_number } }, as: :json
+
+    assert_response :unprocessable_entity
+  end
+
+  test "destroy as JSON" do
+    assert_changes -> { Current.account.join_code.reload.code } do
+      delete account_join_code_path, as: :json
+    end
+
+    assert_response :no_content
+  end
+
   test "update requires admin" do
     logout_and_sign_in_as :david
 
diff --git a/test/controllers/accounts/settings_controller_test.rb b/test/controllers/accounts/settings_controller_test.rb
index 9f17a74a7..6f3fba5b0 100644
--- a/test/controllers/accounts/settings_controller_test.rb
+++ b/test/controllers/accounts/settings_controller_test.rb
@@ -16,6 +16,20 @@ class Account::SettingsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to account_settings_path
   end
 
+  test "show as JSON" do
+    get account_settings_path, as: :json
+    assert_response :success
+
+    assert_equal Current.account.name, @response.parsed_body["name"]
+  end
+
+  test "update as JSON" do
+    put account_settings_path, params: { account: { name: "New Account Name" } }, as: :json
+
+    assert_response :no_content
+    assert_equal "New Account Name", Current.account.reload.name
+  end
+
   test "update requires admin" do
     logout_and_sign_in_as :david
 
diff --git a/test/controllers/api/flat_json_params_test.rb b/test/controllers/api/flat_json_params_test.rb
new file mode 100644
index 000000000..4efba5209
--- /dev/null
+++ b/test/controllers/api/flat_json_params_test.rb
@@ -0,0 +1,71 @@
+require "test_helper"
+
+class FlatJsonParamsTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in_as :kevin
+  end
+
+  test "update user role with flat JSON" do
+    put user_role_path(users(:david)), params: { role: "admin" }, as: :json
+
+    assert_response :no_content
+    assert users(:david).reload.admin?
+  end
+
+  test "update notification settings with flat JSON" do
+    logout_and_sign_in_as :david
+
+    assert_changes -> { users(:david).reload.settings.bundle_email_frequency }, from: "never", to: "every_few_hours" do
+      put notifications_settings_path, params: { bundle_email_frequency: "every_few_hours" }, as: :json
+    end
+
+    assert_response :no_content
+  end
+
+  test "update join code with flat JSON" do
+    put account_join_code_path, params: { usage_limit: 5 }, as: :json
+
+    assert_response :no_content
+    assert_equal 5, Current.account.join_code.reload.usage_limit
+  end
+
+  test "update account settings with flat JSON" do
+    put account_settings_path, params: { name: "New Name" }, as: :json
+
+    assert_response :no_content
+    assert_equal "New Name", Current.account.reload.name
+  end
+
+  test "update board entropy with flat JSON" do
+    board = boards(:writebook)
+
+    put board_entropy_path(board), params: { auto_postpone_period: 99.days }, as: :json
+
+    assert_response :no_content
+    assert_equal 99.days, board.entropy.reload.auto_postpone_period
+  end
+
+  test "update account entropy with flat JSON" do
+    put account_entropy_path, params: { auto_postpone_period: 2.days }, as: :json
+
+    assert_response :no_content
+    assert_equal 2.days, Current.account.entropy.reload.auto_postpone_period
+  end
+
+  test "create push subscription with flat JSON" do
+    stub_dns_resolution("142.250.185.206")
+
+    post user_push_subscriptions_path(users(:kevin)),
+      params: { endpoint: "https://fcm.googleapis.com/fcm/send/abc123", p256dh_key: "key1", auth_key: "key2" },
+      as: :json
+
+    assert_response :created
+  end
+
+  private
+    def stub_dns_resolution(*ips)
+      dns_mock = mock("dns")
+      dns_mock.stubs(:each_address).multiple_yields(*ips)
+      Resolv::DNS.stubs(:open).yields(dns_mock)
+    end
+end
diff --git a/test/controllers/boards/columns/closeds_controller_test.rb b/test/controllers/boards/columns/closeds_controller_test.rb
index f147a2106..90b6c8756 100644
--- a/test/controllers/boards/columns/closeds_controller_test.rb
+++ b/test/controllers/boards/columns/closeds_controller_test.rb
@@ -9,4 +9,11 @@ class Boards::Columns::ClosedsControllerTest < ActionDispatch::IntegrationTest
     get board_columns_closed_path(boards(:writebook))
     assert_response :success
   end
+
+  test "show as JSON" do
+    get board_columns_closed_path(boards(:writebook)), as: :json
+    assert_response :success
+
+    assert_kind_of Array, @response.parsed_body
+  end
 end
diff --git a/test/controllers/boards/columns/not_nows_controller_test.rb b/test/controllers/boards/columns/not_nows_controller_test.rb
index 29088728c..6f9efbf3e 100644
--- a/test/controllers/boards/columns/not_nows_controller_test.rb
+++ b/test/controllers/boards/columns/not_nows_controller_test.rb
@@ -9,4 +9,11 @@ class Boards::Columns::NotNowsControllerTest < ActionDispatch::IntegrationTest
     get board_columns_not_now_path(boards(:writebook))
     assert_response :success
   end
+
+  test "show as JSON" do
+    get board_columns_not_now_path(boards(:writebook)), as: :json
+    assert_response :success
+
+    assert_kind_of Array, @response.parsed_body
+  end
 end
diff --git a/test/controllers/boards/columns/streams_controller_test.rb b/test/controllers/boards/columns/streams_controller_test.rb
index fec9603cc..0fbc13afd 100644
--- a/test/controllers/boards/columns/streams_controller_test.rb
+++ b/test/controllers/boards/columns/streams_controller_test.rb
@@ -9,4 +9,12 @@ class Boards::Columns::StreamsControllerTest < ActionDispatch::IntegrationTest
     get board_columns_stream_path(boards(:writebook))
     assert_response :success
   end
+
+  test "show as JSON" do
+    get board_columns_stream_path(boards(:writebook)), as: :json
+    assert_response :success
+
+    assert_kind_of Array, @response.parsed_body
+    assert response.headers["X-Total-Count"].present?, "Expected X-Total-Count header"
+  end
 end
diff --git a/test/controllers/boards/columns_controller_test.rb b/test/controllers/boards/columns_controller_test.rb
index b9c974321..9fef675f5 100644
--- a/test/controllers/boards/columns_controller_test.rb
+++ b/test/controllers/boards/columns_controller_test.rb
@@ -75,6 +75,7 @@ class Boards::ColumnsControllerTest < ActionDispatch::IntegrationTest
 
     assert_response :created
     assert_equal board_column_path(board, Column.last, format: :json), @response.headers["Location"]
+    assert_equal "New Column", @response.parsed_body["name"]
   end
 
   test "update as JSON" do
diff --git a/test/controllers/boards/entropies_controller_test.rb b/test/controllers/boards/entropies_controller_test.rb
index 0c989c3cd..c0ec089a5 100644
--- a/test/controllers/boards/entropies_controller_test.rb
+++ b/test/controllers/boards/entropies_controller_test.rb
@@ -16,6 +16,13 @@ class Boards::EntropiesControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "update as JSON" do
+    put board_entropy_path(@board), params: { board: { auto_postpone_period: 99.days } }, as: :json
+
+    assert_response :no_content
+    assert_equal 99.days, @board.entropy.reload.auto_postpone_period
+  end
+
   test "update requires board admin permission" do
     logout_and_sign_in_as :jz
 
diff --git a/test/controllers/boards/involvements_controller_test.rb b/test/controllers/boards/involvements_controller_test.rb
index 45587176a..4045df743 100644
--- a/test/controllers/boards/involvements_controller_test.rb
+++ b/test/controllers/boards/involvements_controller_test.rb
@@ -15,4 +15,15 @@ class Boards::InvolvementsControllerTest < ActionDispatch::IntegrationTest
 
     assert_response :success
   end
+
+  test "update as JSON" do
+    board = boards(:writebook)
+    board.access_for(users(:kevin)).access_only!
+
+    assert_changes -> { board.access_for(users(:kevin)).involvement }, from: "access_only", to: "watching" do
+      put board_involvement_path(board), params: { involvement: "watching" }, as: :json
+    end
+
+    assert_response :no_content
+  end
 end
diff --git a/test/controllers/boards_controller_test.rb b/test/controllers/boards_controller_test.rb
index 7dd2b2f06..fedd9d188 100644
--- a/test/controllers/boards_controller_test.rb
+++ b/test/controllers/boards_controller_test.rb
@@ -275,6 +275,7 @@ class BoardsControllerTest < ActionDispatch::IntegrationTest
 
     assert_response :created
     assert_equal board_path(Board.last, format: :json), @response.headers["Location"]
+    assert_equal "My new board", @response.parsed_body["name"]
   end
 
   test "update as JSON" do
diff --git a/test/controllers/cards/comments/reactions_controller_test.rb b/test/controllers/cards/comments/reactions_controller_test.rb
index 21a94c5f3..eda47536f 100644
--- a/test/controllers/cards/comments/reactions_controller_test.rb
+++ b/test/controllers/cards/comments/reactions_controller_test.rb
@@ -49,6 +49,7 @@ class Cards::Comments::ReactionsControllerTest < ActionDispatch::IntegrationTest
     end
 
     assert_response :created
+    assert_equal "👍", @response.parsed_body["content"]
   end
 
   test "destroy as JSON" do
diff --git a/test/controllers/cards/comments_controller_test.rb b/test/controllers/cards/comments_controller_test.rb
index a6e83cbef..eebd62a9c 100644
--- a/test/controllers/cards/comments_controller_test.rb
+++ b/test/controllers/cards/comments_controller_test.rb
@@ -56,6 +56,7 @@ class Cards::CommentsControllerTest < ActionDispatch::IntegrationTest
 
     assert_response :created
     assert_equal card_comment_path(card, Comment.last, format: :json), @response.headers["Location"]
+    assert_equal Comment.last.id, @response.parsed_body["id"]
   end
 
   test "create as JSON with custom created_at" do
diff --git a/test/controllers/cards/publishes_controller_test.rb b/test/controllers/cards/publishes_controller_test.rb
index 537a6f73b..1a6325e2f 100644
--- a/test/controllers/cards/publishes_controller_test.rb
+++ b/test/controllers/cards/publishes_controller_test.rb
@@ -16,6 +16,17 @@ class Cards::PublishesControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to card.board
   end
 
+  test "create as JSON" do
+    card = cards(:logo)
+    card.drafted!
+
+    assert_changes -> { card.reload.published? }, from: false, to: true do
+      post card_publish_path(card), as: :json
+    end
+
+    assert_response :created
+  end
+
   test "create and add another" do
     card = cards(:logo)
     card.drafted!
diff --git a/test/controllers/cards/reactions_controller_test.rb b/test/controllers/cards/reactions_controller_test.rb
index 86ab22639..731d606d8 100644
--- a/test/controllers/cards/reactions_controller_test.rb
+++ b/test/controllers/cards/reactions_controller_test.rb
@@ -53,6 +53,7 @@ class Cards::ReactionsControllerTest < ActionDispatch::IntegrationTest
     end
 
     assert_response :created
+    assert_equal "👍", @response.parsed_body["content"]
   end
 
   test "destroy as JSON" do
diff --git a/test/controllers/cards/readings_controller_test.rb b/test/controllers/cards/readings_controller_test.rb
index 0c9c9aeed..4aaec41d7 100644
--- a/test/controllers/cards/readings_controller_test.rb
+++ b/test/controllers/cards/readings_controller_test.rb
@@ -39,6 +39,18 @@ class Cards::ReadingsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
+  test "create as JSON" do
+    post card_reading_url(cards(:logo)), as: :json
+    assert_response :created
+  end
+
+  test "destroy as JSON" do
+    notifications(:logo_assignment_kevin).read
+
+    delete card_reading_url(cards(:logo)), as: :json
+    assert_response :no_content
+  end
+
   test "unread notification on destroy" do
     notifications(:logo_assignment_kevin).read
 
diff --git a/test/controllers/cards/steps_controller_test.rb b/test/controllers/cards/steps_controller_test.rb
index 039fbf4c4..011b68812 100644
--- a/test/controllers/cards/steps_controller_test.rb
+++ b/test/controllers/cards/steps_controller_test.rb
@@ -53,6 +53,19 @@ class Cards::StepsControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "index as JSON" do
+    card = cards(:logo)
+    card.steps.create!(content: "Step one")
+    card.steps.create!(content: "Step two", completed: true)
+
+    get card_steps_path(card), as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert_equal 2, body.size
+    assert_equal "Step one", body.first["content"]
+  end
+
   test "create as JSON" do
     card = cards(:logo)
 
@@ -62,6 +75,7 @@ class Cards::StepsControllerTest < ActionDispatch::IntegrationTest
 
     assert_response :created
     assert_equal card_step_path(card, Step.last, format: :json), @response.headers["Location"]
+    assert_equal "New step", @response.parsed_body["content"]
   end
 
   test "show as JSON" do
diff --git a/test/controllers/cards_controller_test.rb b/test/controllers/cards_controller_test.rb
index 42e24d927..901a584f9 100644
--- a/test/controllers/cards_controller_test.rb
+++ b/test/controllers/cards_controller_test.rb
@@ -192,6 +192,7 @@ class CardsControllerTest < ActionDispatch::IntegrationTest
 
     card = Card.last
     assert_equal card_path(card, format: :json), @response.headers["Location"]
+    assert_equal "My new card", @response.parsed_body["title"]
 
     assert_equal "My new card", card.title
     assert_equal "Big if true", card.description.to_plain_text
diff --git a/test/controllers/columns/left_positions_controller_test.rb b/test/controllers/columns/left_positions_controller_test.rb
index 6c807b0e5..5f1c0cd26 100644
--- a/test/controllers/columns/left_positions_controller_test.rb
+++ b/test/controllers/columns/left_positions_controller_test.rb
@@ -21,6 +21,22 @@ class Columns::LeftPositionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal original_position_a, column_b.reload.position
   end
 
+  test "move column left as JSON" do
+    board = boards(:writebook)
+    columns = board.columns.sorted.to_a
+
+    column_a = columns[0]
+    column_b = columns[1]
+    original_position_a = column_a.position
+    original_position_b = column_b.position
+
+    post column_left_position_path(column_b), as: :json
+    assert_response :created
+
+    assert_equal original_position_b, column_a.reload.position
+    assert_equal original_position_a, column_b.reload.position
+  end
+
   test "move left refreshes adjacent columns" do
     column = columns(:writebook_in_progress)
 
diff --git a/test/controllers/columns/right_positions_controller_test.rb b/test/controllers/columns/right_positions_controller_test.rb
index c927531be..1ee7a0987 100644
--- a/test/controllers/columns/right_positions_controller_test.rb
+++ b/test/controllers/columns/right_positions_controller_test.rb
@@ -21,6 +21,22 @@ class Columns::RightPositionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal original_position_a, column_b.reload.position
   end
 
+  test "move column right as JSON" do
+    board = boards(:writebook)
+    columns = board.columns.sorted.to_a
+
+    column_a = columns[0]
+    column_b = columns[1]
+    original_position_a = column_a.position
+    original_position_b = column_b.position
+
+    post column_right_position_path(column_a), as: :json
+    assert_response :created
+
+    assert_equal original_position_b, column_a.reload.position
+    assert_equal original_position_a, column_b.reload.position
+  end
+
   test "move right refreshes adjacent columns" do
     column = columns(:writebook_in_progress)
 
diff --git a/test/controllers/my/access_tokens_controller_test.rb b/test/controllers/my/access_tokens_controller_test.rb
index 176302336..bced907db 100644
--- a/test/controllers/my/access_tokens_controller_test.rb
+++ b/test/controllers/my/access_tokens_controller_test.rb
@@ -25,9 +25,11 @@ class My::AccessTokensControllerTest < ActionDispatch::IntegrationTest
     end
     assert_response :created
     body = @response.parsed_body
+    assert body["id"].present?
     assert body["token"].present?
     assert_equal "Fizzy CLI", body["description"]
     assert_equal "write", body["permission"]
+    assert body["created_at"].present?
   end
 
   test "create new token via JSON with bearer token" do
@@ -54,6 +56,36 @@ class My::AccessTokensControllerTest < ActionDispatch::IntegrationTest
     assert_response :unauthorized
   end
 
+  test "index as JSON" do
+    get my_access_tokens_path, as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert_kind_of Array, body
+  end
+
+  test "index as JSON with bearer token and no account scope" do
+    sign_out
+    bearer_token = { "HTTP_AUTHORIZATION" => "Bearer #{identity_access_tokens(:davids_api_token).token}" }
+
+    untenanted do
+      get my_access_tokens_path, as: :json, env: bearer_token
+    end
+
+    assert_response :success
+    assert_kind_of Array, @response.parsed_body
+  end
+
+  test "destroy as JSON" do
+    token = identities(:kevin).access_tokens.create!(description: "To delete", permission: "read")
+
+    assert_difference -> { identities(:kevin).access_tokens.count }, -1 do
+      delete my_access_token_path(token), as: :json
+    end
+
+    assert_response :no_content
+  end
+
   test "accessing new token after reveal window redirects to index" do
     assert_changes -> { identities(:kevin).access_tokens.count }, +1 do
       post my_access_tokens_path, params: { access_token: { description: "GitHub", permission: "read" } }
diff --git a/test/controllers/notifications/settings_controller_test.rb b/test/controllers/notifications/settings_controller_test.rb
index d8472bb02..b5b554c34 100644
--- a/test/controllers/notifications/settings_controller_test.rb
+++ b/test/controllers/notifications/settings_controller_test.rb
@@ -13,6 +13,21 @@ class Notifications::SettingsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
+  test "show as JSON" do
+    get notifications_settings_path, as: :json
+    assert_response :success
+
+    assert_equal @user.settings.bundle_email_frequency, @response.parsed_body["bundle_email_frequency"]
+  end
+
+  test "update as JSON" do
+    assert_changes -> { @user.reload.settings.bundle_email_frequency }, from: "never", to: "every_few_hours" do
+      put notifications_settings_path, params: { user_settings: { bundle_email_frequency: "every_few_hours" } }, as: :json
+    end
+
+    assert_response :no_content
+  end
+
   test "update email frequency" do
     assert_changes -> { @user.reload.settings.bundle_email_frequency }, from: "never", to: "every_few_hours" do
       put notifications_settings_path, params: { user_settings: { bundle_email_frequency: "every_few_hours" } }
diff --git a/test/controllers/searches_controller_test.rb b/test/controllers/searches_controller_test.rb
index 11bac3bc9..b0172cdf5 100644
--- a/test/controllers/searches_controller_test.rb
+++ b/test/controllers/searches_controller_test.rb
@@ -46,6 +46,36 @@ class SearchesControllerTest < ActionDispatch::IntegrationTest
     assert_select ".search__blank-slate", text: "No matches"
   end
 
+  test "search as JSON" do
+    get search_path(q: "broken", script_name: "/#{@account.external_account_id}"), as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert_kind_of Array, body
+    assert_equal 1, body.size
+    assert_equal "Layout is broken", body.first["title"]
+  end
+
+  test "search by card ID as JSON returns array" do
+    get search_path(q: @card.id, script_name: "/#{@account.external_account_id}"), as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert_kind_of Array, body
+    assert_equal 1, body.size
+    assert_equal @card.id, body.first["id"]
+  end
+
+  test "search as JSON deduplicates cards with multiple search hits" do
+    get search_path(q: "haggis", script_name: "/#{@account.external_account_id}"), as: :json
+    assert_response :success
+
+    body = @response.parsed_body
+    assert_kind_of Array, body
+    assert_equal 1, body.size
+    assert_equal @comment2_card.id, body.first["id"]
+  end
+
   test "search highlights matched terms with proper HTML marks" do
     @board.cards.create!(title: "Testing search highlighting", status: "published", creator: @user)
 
diff --git a/test/controllers/users/avatars_controller_test.rb b/test/controllers/users/avatars_controller_test.rb
index 3ded884b8..ac213e46b 100644
--- a/test/controllers/users/avatars_controller_test.rb
+++ b/test/controllers/users/avatars_controller_test.rb
@@ -49,6 +49,11 @@ class Users::AvatarsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to users(:david)
   end
 
+  test "delete self as JSON" do
+    delete user_avatar_path(users(:david)), as: :json
+    assert_response :no_content
+  end
+
   test "unable to delete other" do
     delete user_avatar_path(users(:kevin))
     assert_response :forbidden
diff --git a/test/controllers/users/push_subscriptions_controller_test.rb b/test/controllers/users/push_subscriptions_controller_test.rb
index 4b4dd0a09..b9f43ff0a 100644
--- a/test/controllers/users/push_subscriptions_controller_test.rb
+++ b/test/controllers/users/push_subscriptions_controller_test.rb
@@ -20,6 +20,42 @@ class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal "Mozilla/5.0", users(:david).push_subscriptions.last.user_agent
   end
 
+  test "create as JSON" do
+    subscription_params = { "endpoint" => "https://fcm.googleapis.com/fcm/send/abc123", "p256dh_key" => "123", "auth_key" => "456" }
+
+    post user_push_subscriptions_path(users(:david)),
+      params: { push_subscription: subscription_params }, headers: { "HTTP_USER_AGENT" => "Mozilla/5.0" }, as: :json
+
+    assert_response :created
+  end
+
+  test "create as JSON for duplicate subscription" do
+    subscription_params = { "endpoint" => "https://fcm.googleapis.com/fcm/send/abc123", "p256dh_key" => "123", "auth_key" => "456" }
+
+    users(:david).push_subscriptions.create!(subscription_params)
+
+    assert_no_difference -> { Push::Subscription.count } do
+      post user_push_subscriptions_path(users(:david)),
+        params: { push_subscription: subscription_params }, as: :json
+    end
+
+    assert_response :created
+  end
+
+  test "destroy as JSON" do
+    subscription = users(:david).push_subscriptions.create!(
+      endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
+      p256dh_key: "123",
+      auth_key: "456"
+    )
+
+    assert_difference -> { Push::Subscription.count }, -1 do
+      delete user_push_subscription_path(users(:david), subscription), as: :json
+    end
+
+    assert_response :no_content
+  end
+
   test "destroy a push subscription" do
     subscription = users(:david).push_subscriptions.create!(
       endpoint: "https://fcm.googleapis.com/fcm/send/abc123",
diff --git a/test/controllers/users/roles_controller_test.rb b/test/controllers/users/roles_controller_test.rb
index 37d1f2067..d0091bc53 100644
--- a/test/controllers/users/roles_controller_test.rb
+++ b/test/controllers/users/roles_controller_test.rb
@@ -14,6 +14,13 @@ class Users::RolesControllerTest < ActionDispatch::IntegrationTest
     assert users(:david).reload.admin?
   end
 
+  test "update as JSON" do
+    put user_role_path(users(:david)), params: { user: { role: "admin" } }, as: :json
+
+    assert_response :no_content
+    assert users(:david).reload.admin?
+  end
+
   test "can't promote to special roles" do
     assert_no_changes -> { users(:david).reload.role } do
       put user_role_path(users(:david)), params: { user: { role: "system" } }

From b6ea558de8e55922d645f3a0da2fca0e62208b95 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Mon, 9 Mar 2026 15:14:17 -0400
Subject: [PATCH 012/107] Move TrackTrueClientIp middleware into saas engine
 (#2677)

The True-Client-IP header is set by Cloudflare and is only trustworthy
when behind a Cloudflare proxy. In non-Cloudflare deployments, this
header is attacker-controlled and can be used to spoof IP addresses.

Moving the middleware into the saas engine ensures it only loads for our
Cloudflare-fronted production deployment, not for self-hosted OSS
instances.

GHSA-cpch-9qg2-x8fq
---
 saas/lib/fizzy/saas/engine.rb                                | 5 +++++
 .../initializers => saas/lib/fizzy/saas}/true_client_ip.rb   | 2 --
 {test => saas/test}/lib/true_client_ip_test.rb               | 0
 3 files changed, 5 insertions(+), 2 deletions(-)
 rename {config/initializers => saas/lib/fizzy/saas}/true_client_ip.rb (87%)
 rename {test => saas/test}/lib/true_client_ip_test.rb (100%)

diff --git a/saas/lib/fizzy/saas/engine.rb b/saas/lib/fizzy/saas/engine.rb
index b90113544..1ba45df42 100644
--- a/saas/lib/fizzy/saas/engine.rb
+++ b/saas/lib/fizzy/saas/engine.rb
@@ -1,4 +1,5 @@
 require_relative "transaction_pinning"
+require_relative "true_client_ip"
 require_relative "signup"
 require_relative "authorization"
 require_relative "gvl_instrumentation"
@@ -61,6 +62,10 @@ module Fizzy
         app.config.middleware.insert_after(ActiveRecord::Middleware::DatabaseSelector, TransactionPinning::Middleware)
       end
 
+      initializer "fizzy_saas.true_client_ip" do |app|
+        app.config.middleware.insert_before ActionDispatch::RemoteIp, TrackTrueClientIp
+      end
+
       initializer "fizzy_saas.gvl_instrumentation" do |app|
         app.config.middleware.insert_before(Rack::Runtime, GvlInstrumentation)
       end
diff --git a/config/initializers/true_client_ip.rb b/saas/lib/fizzy/saas/true_client_ip.rb
similarity index 87%
rename from config/initializers/true_client_ip.rb
rename to saas/lib/fizzy/saas/true_client_ip.rb
index cac696107..27c5f0729 100644
--- a/config/initializers/true_client_ip.rb
+++ b/saas/lib/fizzy/saas/true_client_ip.rb
@@ -20,5 +20,3 @@ class TrackTrueClientIp
     @app.call(env)
   end
 end
-
-Rails.application.config.middleware.insert_before ActionDispatch::RemoteIp, TrackTrueClientIp
diff --git a/test/lib/true_client_ip_test.rb b/saas/test/lib/true_client_ip_test.rb
similarity index 100%
rename from test/lib/true_client_ip_test.rb
rename to saas/test/lib/true_client_ip_test.rb

From 0435db30ba79fd37fb3115b28fad037d09dcbf75 Mon Sep 17 00:00:00 2001
From: Rob Zolkos <rob@zolkos.com>
Date: Mon, 9 Mar 2026 17:33:30 -0400
Subject: [PATCH 013/107] Add JSON response format to webhooks (#2671)

* Add JSON response format to webhooks

Support JSON responses for all webhook endpoints: index, show, create,
update, destroy, and activation. Adds jbuilder views, updates controllers
to use respond_to, and documents the API in docs/API.md.

* Address PR review feedback

- Use distinct board ID in API docs webhook example
- Use render "webhooks/show" in activations controller for consistency

* Address PR review feedback from flavorjones

- Include webhook.board in cache key to avoid stale board data
- Use _url instead of _path for location header consistency

* Fix webhook create test to match Location header format

Use board_webhook_url instead of board_webhook_path since the controller
returns a full URL in the Location header.

* Fix board ID in Location header example in API docs

Use distinct board ID in the Location URL to match the JSON body example.
---
 .../webhooks/activations_controller.rb        |   9 +-
 app/controllers/webhooks_controller.rb        |  34 ++++-
 app/views/webhooks/_webhook.json.jbuilder     |   8 +
 app/views/webhooks/index.json.jbuilder        |   1 +
 app/views/webhooks/show.json.jbuilder         |   1 +
 docs/API.md                                   | 118 +++++++++++++++
 .../webhooks/activations_controller_test.rb   |  32 ++++
 test/controllers/webhooks_controller_test.rb  | 139 ++++++++++++++++++
 8 files changed, 334 insertions(+), 8 deletions(-)
 create mode 100644 app/views/webhooks/_webhook.json.jbuilder
 create mode 100644 app/views/webhooks/index.json.jbuilder
 create mode 100644 app/views/webhooks/show.json.jbuilder

diff --git a/app/controllers/webhooks/activations_controller.rb b/app/controllers/webhooks/activations_controller.rb
index 82166043e..2991be51a 100644
--- a/app/controllers/webhooks/activations_controller.rb
+++ b/app/controllers/webhooks/activations_controller.rb
@@ -4,9 +4,12 @@ class Webhooks::ActivationsController < ApplicationController
   before_action :ensure_admin
 
   def create
-    webhook = @board.webhooks.find(params[:webhook_id])
-    webhook.activate
+    @webhook = @board.webhooks.find(params[:webhook_id])
+    @webhook.activate
 
-    redirect_to webhook
+    respond_to do |format|
+      format.html { redirect_to @webhook }
+      format.json { render "webhooks/show", status: :created }
+    end
   end
 end
diff --git a/app/controllers/webhooks_controller.rb b/app/controllers/webhooks_controller.rb
index 7d79c4587..584c2dc7a 100644
--- a/app/controllers/webhooks_controller.rb
+++ b/app/controllers/webhooks_controller.rb
@@ -16,21 +16,45 @@ class WebhooksController < ApplicationController
   end
 
   def create
-    webhook = @board.webhooks.create!(webhook_params)
-    redirect_to webhook
+    @webhook = @board.webhooks.new(webhook_params)
+
+    if @webhook.save
+      respond_to do |format|
+        format.html { redirect_to @webhook }
+        format.json { render :show, status: :created, location: board_webhook_url(@webhook.board, @webhook, format: :json) }
+      end
+    else
+      respond_to do |format|
+        format.html { render :new, status: :unprocessable_entity }
+        format.json { render json: @webhook.errors, status: :unprocessable_entity }
+      end
+    end
   end
 
   def edit
   end
 
   def update
-    @webhook.update!(webhook_params.except(:url))
-    redirect_to @webhook
+    if @webhook.update(webhook_params.except(:url))
+      respond_to do |format|
+        format.html { redirect_to @webhook }
+        format.json { render :show }
+      end
+    else
+      respond_to do |format|
+        format.html { render :edit, status: :unprocessable_entity }
+        format.json { render json: @webhook.errors, status: :unprocessable_entity }
+      end
+    end
   end
 
   def destroy
     @webhook.destroy!
-    redirect_to board_webhooks_path
+
+    respond_to do |format|
+      format.html { redirect_to board_webhooks_path }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/app/views/webhooks/_webhook.json.jbuilder b/app/views/webhooks/_webhook.json.jbuilder
new file mode 100644
index 000000000..a55257984
--- /dev/null
+++ b/app/views/webhooks/_webhook.json.jbuilder
@@ -0,0 +1,8 @@
+json.cache! [ webhook, webhook.board ] do
+  json.(webhook, :id, :name, :active, :signing_secret, :subscribed_actions)
+  json.payload_url webhook.url
+  json.created_at webhook.created_at.utc
+  json.url board_webhook_url(webhook.board, webhook)
+
+  json.board webhook.board, partial: "boards/board", as: :board
+end
diff --git a/app/views/webhooks/index.json.jbuilder b/app/views/webhooks/index.json.jbuilder
new file mode 100644
index 000000000..c63df9ea0
--- /dev/null
+++ b/app/views/webhooks/index.json.jbuilder
@@ -0,0 +1 @@
+json.array! @page.records, partial: "webhooks/webhook", as: :webhook
diff --git a/app/views/webhooks/show.json.jbuilder b/app/views/webhooks/show.json.jbuilder
new file mode 100644
index 000000000..78a9dcdc7
--- /dev/null
+++ b/app/views/webhooks/show.json.jbuilder
@@ -0,0 +1 @@
+json.partial! "webhooks/webhook", webhook: @webhook
diff --git a/docs/API.md b/docs/API.md
index fae64650a..cec58f36e 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -591,6 +591,124 @@ __Response:__
 
 Returns `204 No Content` on success.
 
+## Webhooks
+
+Webhooks notify another application when something happens on a board. Only account admins can list, view, create, update, delete, or reactivate webhooks.
+
+### `GET /:account_slug/boards/:board_id/webhooks`
+
+Returns a paginated list of webhooks for a board.
+
+__Response:__
+
+```json
+[
+  {
+    "id": "03f5v9zkft4hj9qq0lsn9ohcm",
+    "name": "Production API",
+    "payload_url": "https://api.example.com/webhooks",
+    "active": true,
+    "signing_secret": "p94Bx2HjempCdYB4DTyZkY1b",
+    "subscribed_actions": ["card_published", "card_assigned", "card_closed"],
+    "created_at": "2025-12-05T19:36:35.534Z",
+    "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcy/webhooks/03f5v9zkft4hj9qq0lsn9ohcm",
+    "board": {
+      "id": "03f5v9zkft4hj9qq0lsn9ohcy",
+      "name": "Fizzy",
+      "all_access": true,
+      "created_at": "2025-12-05T19:36:35.534Z",
+      "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcy",
+      "creator": {
+        "id": "03f5v9zjw7pz8717a4no1h8a7",
+        "name": "David Heinemeier Hansson",
+        "role": "owner",
+        "active": true,
+        "email_address": "david@example.com",
+        "created_at": "2025-12-05T19:36:35.401Z",
+        "url": "http://fizzy.localhost:3006/897362094/users/03f5v9zjw7pz8717a4no1h8a7"
+      }
+    }
+  }
+]
+```
+
+### `GET /:account_slug/boards/:board_id/webhooks/:id`
+
+Returns a single webhook.
+
+__Response:__
+
+Returns the same webhook shape shown above.
+
+### `POST /:account_slug/boards/:board_id/webhooks`
+
+Creates a webhook.
+
+__Request:__
+
+```json
+{
+  "webhook": {
+    "name": "Production API",
+    "url": "https://api.example.com/webhooks",
+    "subscribed_actions": ["card_published", "card_assigned", "card_closed"]
+  }
+}
+```
+
+`subscribed_actions` accepts any of:
+`card_assigned`, `card_closed`, `card_postponed`, `card_auto_postponed`, `card_board_changed`, `card_published`, `card_reopened`, `card_sent_back_to_triage`, `card_triaged`, `card_unassigned`, `comment_created`
+
+__Response:__
+
+```
+HTTP/1.1 201 Created
+Location: http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcy/webhooks/03f5v9zkft4hj9qq0lsn9ohcm.json
+```
+
+Returns the created webhook in the response body.
+
+### `PATCH /:account_slug/boards/:board_id/webhooks/:id`
+
+Updates a webhook.
+
+__Request:__
+
+```json
+{
+  "webhook": {
+    "name": "Production API",
+    "subscribed_actions": ["card_closed"]
+  }
+}
+```
+
+The `url` is immutable after creation and is ignored on update.
+
+__Response:__
+
+Returns the updated webhook.
+
+### `DELETE /:account_slug/boards/:board_id/webhooks/:id`
+
+Deletes a webhook.
+
+__Response:__
+
+Returns `204 No Content` on success.
+
+### `POST /:account_slug/boards/:board_id/webhooks/:id/activation`
+
+Reactivates a deactivated webhook.
+
+__Response:__
+
+```
+HTTP/1.1 201 Created
+```
+
+Returns the reactivated webhook in the response body.
+
 ## Cards
 
 Cards are tasks or items of work on a board. They can be organized into columns, tagged, assigned to users, and have comments.
diff --git a/test/controllers/webhooks/activations_controller_test.rb b/test/controllers/webhooks/activations_controller_test.rb
index b28fa3924..79a2390aa 100644
--- a/test/controllers/webhooks/activations_controller_test.rb
+++ b/test/controllers/webhooks/activations_controller_test.rb
@@ -32,4 +32,36 @@ class Webhooks::ActivationsControllerTest < ActionDispatch::IntegrationTest
     post board_webhook_activation_path(webhook.board, webhook)
     assert_response :forbidden
   end
+
+  test "create as JSON" do
+    webhook = webhooks(:inactive)
+
+    assert_not webhook.active?
+
+    assert_changes -> { webhook.reload.active? }, from: false, to: true do
+      post board_webhook_activation_path(webhook.board, webhook), as: :json
+    end
+
+    assert_response :created
+    assert_equal webhook.id, @response.parsed_body["id"]
+    assert_equal true, @response.parsed_body["active"]
+  end
+
+  test "cannot activate webhook on board without access as JSON" do
+    logout_and_sign_in_as :jason
+    webhook = webhooks(:inactive)
+
+    post board_webhook_activation_path(webhook.board, webhook), as: :json
+
+    assert_response :not_found
+  end
+
+  test "non-admin cannot activate webhook as JSON" do
+    logout_and_sign_in_as :jz
+    webhook = webhooks(:active)
+
+    post board_webhook_activation_path(webhook.board, webhook), as: :json
+
+    assert_response :forbidden
+  end
 end
diff --git a/test/controllers/webhooks_controller_test.rb b/test/controllers/webhooks_controller_test.rb
index de336bc88..674be64c1 100644
--- a/test/controllers/webhooks_controller_test.rb
+++ b/test/controllers/webhooks_controller_test.rb
@@ -130,4 +130,143 @@ class WebhooksControllerTest < ActionDispatch::IntegrationTest
     get board_webhooks_path(webhook.board)
     assert_response :not_found
   end
+
+  test "index as JSON" do
+    board = boards(:writebook)
+
+    get board_webhooks_path(board), as: :json
+
+    assert_response :success
+    assert_kind_of Array, @response.parsed_body
+    assert_equal board.webhooks.count, @response.parsed_body.count
+    assert_equal webhooks(:active).id, @response.parsed_body.first["id"]
+  end
+
+  test "show as JSON" do
+    webhook = webhooks(:active)
+
+    get board_webhook_path(webhook.board, webhook), as: :json
+
+    assert_response :success
+    assert_equal webhook.id, @response.parsed_body["id"]
+    assert_equal webhook.name, @response.parsed_body["name"]
+    assert_equal webhook.url, @response.parsed_body["payload_url"]
+    assert_equal webhook.active?, @response.parsed_body["active"]
+    assert_equal webhook.signing_secret, @response.parsed_body["signing_secret"]
+    assert_equal webhook.subscribed_actions, @response.parsed_body["subscribed_actions"]
+    assert_equal webhook.board.id, @response.parsed_body.dig("board", "id")
+  end
+
+  test "create as JSON" do
+    board = boards(:writebook)
+
+    assert_difference "Webhook.count", 1 do
+      post board_webhooks_path(board), params: {
+        webhook: {
+          name: "Test Webhook",
+          url: "https://example.com/webhook",
+          subscribed_actions: [ "", "card_published", "card_closed" ]
+        }
+      }, as: :json
+    end
+
+    webhook = Webhook.last
+
+    assert_response :created
+    assert_equal board_webhook_url(board, webhook, format: :json), @response.headers["Location"]
+    assert_equal webhook.id, @response.parsed_body["id"]
+    assert_equal "https://example.com/webhook", @response.parsed_body["payload_url"]
+    assert_equal webhook.signing_secret, @response.parsed_body["signing_secret"]
+  end
+
+  test "create with invalid params as JSON" do
+    board = boards(:writebook)
+
+    assert_no_difference "Webhook.count" do
+      post board_webhooks_path(board), params: {
+        webhook: {
+          name: "",
+          url: "invalid-url"
+        }
+      }, as: :json
+    end
+
+    assert_response :unprocessable_entity
+    assert @response.parsed_body["name"].present?
+    assert @response.parsed_body["url"].present?
+  end
+
+  test "update as JSON" do
+    webhook = webhooks(:active)
+
+    patch board_webhook_path(webhook.board, webhook), params: {
+      webhook: {
+        name: "Updated Webhook",
+        subscribed_actions: [ "card_published" ]
+      }
+    }, as: :json
+
+    webhook.reload
+
+    assert_response :success
+    assert_equal "Updated Webhook", webhook.name
+    assert_equal [ "card_published" ], webhook.subscribed_actions
+    assert_equal "Updated Webhook", @response.parsed_body["name"]
+    assert_equal [ "card_published" ], @response.parsed_body["subscribed_actions"]
+  end
+
+  test "update with invalid params as JSON" do
+    webhook = webhooks(:active)
+
+    patch board_webhook_path(webhook.board, webhook), params: {
+      webhook: {
+        name: ""
+      }
+    }, as: :json
+
+    assert_response :unprocessable_entity
+    assert @response.parsed_body["name"].present?
+  end
+
+  test "update does not change url as JSON" do
+    webhook = webhooks(:active)
+
+    assert_no_changes -> { webhook.reload.url } do
+      patch board_webhook_path(webhook.board, webhook), params: {
+        webhook: {
+          name: "Updated Webhook",
+          url: "https://different.com/webhook"
+        }
+      }, as: :json
+    end
+
+    assert_response :success
+    assert_equal webhook.reload.url, @response.parsed_body["payload_url"]
+  end
+
+  test "destroy as JSON" do
+    webhook = webhooks(:active)
+
+    assert_difference "Webhook.count", -1 do
+      delete board_webhook_path(webhook.board, webhook), as: :json
+    end
+
+    assert_response :no_content
+  end
+
+  test "non-admin cannot access webhook endpoints as JSON" do
+    logout_and_sign_in_as :jz
+
+    get board_webhooks_path(boards(:writebook)), as: :json
+
+    assert_response :forbidden
+  end
+
+  test "cannot access webhooks on board without access as JSON" do
+    logout_and_sign_in_as :jason
+
+    get board_webhooks_path(boards(:private)), as: :json
+
+    assert_response :not_found
+  end
 end

From 23ac76555bc0ddb3ca5fad07d6c0ba08e67fbdaf Mon Sep 17 00:00:00 2001
From: Rob Zolkos <rob@zolkos.com>
Date: Mon, 9 Mar 2026 17:37:56 -0400
Subject: [PATCH 014/107] Validate and normalize auto-postpone period to days
 (#2672)

* Validate and normalize auto-postpone period to days

- Add Entropy::AUTO_POSTPONE_PERIODS and validate auto_postpone_period against the allowed set
- Introduce auto_postpone_period_in_days for forms and entropy update endpoints
- Fall back to index 0 in knob partial when current value isn't in options
- Remove entropy_auto_close_options helper in favor of model constant
- Update tests to use allowed period values

* Use auto_postpone_period_in_days for JSON entropy updates

The JSON API was accepting auto_postpone_period (seconds) which
bypassed the days normalization and validation. Switch to
auto_postpone_period_in_days consistently and add explicit
wrap_parameters so flat JSON params are wrapped correctly for
the virtual attribute.

* Default to account or 30-day fallback when knob value is invalid

* Address PR review feedback for entropy validation

- Fall back to first knob option (index 0) when persisted value isn't in
  the allowed set, preventing nil index errors for legacy values
- Use integer division (1.day.to_i) for consistent day calculations

* Default to account entropy period instead of first option for knob fallback

* Test that default auto-postpone period is in the allowed periods

* Return 422 instead of 500 for invalid entropy auto-postpone values

Rescue ActiveRecord::RecordInvalid in entropy controllers so invalid
auto_postpone_period_in_days values return 422 Unprocessable Entity
instead of raising a 500.

* Fix NoMethodError when board entropy falls back to account default

Use container.account.entropy.auto_postpone_period_in_days instead of
container.account.auto_postpone_period_in_days since Account doesn't
delegate that method.

* Test board entropy fallback to account default for invalid periods
---
 .../account/entropies_controller.rb           |  6 +++-
 .../boards/entropies_controller.rb            |  6 ++--
 app/controllers/boards_controller.rb          |  2 +-
 app/helpers/entropy_helper.rb                 |  4 ---
 app/models/board/auto_postponing.rb           |  4 +--
 app/models/board/entropic.rb                  |  8 +++--
 app/models/entropy.rb                         | 29 +++++++++++++++++++
 app/views/entropy/_auto_close.html.erb        |  5 ++--
 app/views/entropy/_knob.html.erb              |  5 ++--
 .../accounts/entropies_controller_test.rb     | 19 ++++++++----
 test/controllers/api/flat_json_params_test.rb |  8 ++---
 .../boards/entropies_controller_test.rb       | 19 ++++++++----
 test/controllers/boards_controller_test.rb    | 14 +++++++--
 test/models/card/entropic_test.rb             | 10 +++----
 test/models/entropy_test.rb                   | 15 ++++++++--
 15 files changed, 113 insertions(+), 41 deletions(-)

diff --git a/app/controllers/account/entropies_controller.rb b/app/controllers/account/entropies_controller.rb
index 7290c1e4e..327098ee2 100644
--- a/app/controllers/account/entropies_controller.rb
+++ b/app/controllers/account/entropies_controller.rb
@@ -1,4 +1,6 @@
 class Account::EntropiesController < ApplicationController
+  wrap_parameters :entropy, include: [ :auto_postpone_period_in_days ]
+
   before_action :ensure_admin
 
   def update
@@ -8,10 +10,12 @@ class Account::EntropiesController < ApplicationController
       format.html { redirect_to account_settings_path, notice: "Account updated" }
       format.json { head :no_content }
     end
+  rescue ActiveRecord::RecordInvalid
+    head :unprocessable_entity
   end
 
   private
     def entropy_params
-      params.expect(entropy: [ :auto_postpone_period ])
+      params.expect(entropy: [ :auto_postpone_period_in_days ])
     end
 end
diff --git a/app/controllers/boards/entropies_controller.rb b/app/controllers/boards/entropies_controller.rb
index 557adb2d9..132733aac 100644
--- a/app/controllers/boards/entropies_controller.rb
+++ b/app/controllers/boards/entropies_controller.rb
@@ -1,5 +1,5 @@
 class Boards::EntropiesController < ApplicationController
-  wrap_parameters :board
+  wrap_parameters :board, include: [ :auto_postpone_period_in_days ]
 
   include BoardScoped
 
@@ -12,10 +12,12 @@ class Boards::EntropiesController < ApplicationController
       format.turbo_stream
       format.json { head :no_content }
     end
+  rescue ActiveRecord::RecordInvalid
+    head :unprocessable_entity
   end
 
   private
     def entropy_params
-      params.expect(board: [ :auto_postpone_period ])
+      params.expect(board: [ :auto_postpone_period_in_days ])
     end
 end
diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb
index 1e93a5758..8e63455f9 100644
--- a/app/controllers/boards_controller.rb
+++ b/app/controllers/boards_controller.rb
@@ -88,7 +88,7 @@ class BoardsController < ApplicationController
     end
 
     def board_params
-      params.expect(board: [ :name, :all_access, :auto_postpone_period, :public_description ])
+      params.expect(board: [ :name, :all_access, :auto_postpone_period_in_days, :public_description ])
     end
 
     def grantees
diff --git a/app/helpers/entropy_helper.rb b/app/helpers/entropy_helper.rb
index 4329dab88..7257ba481 100644
--- a/app/helpers/entropy_helper.rb
+++ b/app/helpers/entropy_helper.rb
@@ -1,8 +1,4 @@
 module EntropyHelper
-  def entropy_auto_close_options
-    [ 3, 7, 30, 90, 365, 11 ]
-  end
-
   def entropy_bubble_options_for(card)
     {
       daysBeforeReminder: card.entropy.days_before_reminder,
diff --git a/app/models/board/auto_postponing.rb b/app/models/board/auto_postponing.rb
index 4911c5e33..da53692b3 100644
--- a/app/models/board/auto_postponing.rb
+++ b/app/models/board/auto_postponing.rb
@@ -6,9 +6,7 @@ module Board::AutoPostponing
   end
 
   private
-    DEFAULT_AUTO_POSTPONE_PERIOD = 30.days
-
     def set_default_auto_postpone_period
-      self.auto_postpone_period ||= DEFAULT_AUTO_POSTPONE_PERIOD unless attribute_present?(:auto_postpone_period)
+      self.auto_postpone_period ||= Entropy::DEFAULT_AUTO_POSTPONE_PERIOD_IN_DAYS.days unless attribute_present?(:auto_postpone_period)
     end
 end
diff --git a/app/models/board/entropic.rb b/app/models/board/entropic.rb
index beee4883b..d3e48d6ea 100644
--- a/app/models/board/entropic.rb
+++ b/app/models/board/entropic.rb
@@ -2,7 +2,7 @@ module Board::Entropic
   extend ActiveSupport::Concern
 
   included do
-    delegate :auto_postpone_period, to: :entropy
+    delegate :auto_postpone_period, :auto_postpone_period_in_days, to: :entropy
     has_one :entropy, as: :container, dependent: :destroy
   end
 
@@ -12,6 +12,10 @@ module Board::Entropic
 
   def auto_postpone_period=(new_value)
     entropy ||= association(:entropy).reader || self.build_entropy
-    entropy.update auto_postpone_period: new_value
+    entropy.update! auto_postpone_period: new_value
+  end
+
+  def auto_postpone_period_in_days=(value)
+    self.auto_postpone_period = value.to_i.days.to_i
   end
 end
diff --git a/app/models/entropy.rb b/app/models/entropy.rb
index 9a93ba4e8..c896fc494 100644
--- a/app/models/entropy.rb
+++ b/app/models/entropy.rb
@@ -1,6 +1,35 @@
 class Entropy < ApplicationRecord
+  DEFAULT_AUTO_POSTPONE_PERIOD_IN_DAYS = 30
+  AUTO_POSTPONE_PERIODS_IN_DAYS = [ 3, 7, 30, 90, 365, 11 ].freeze
+  AUTO_POSTPONE_PERIODS_IN_SECONDS = AUTO_POSTPONE_PERIODS_IN_DAYS.map { |n| n.day.in_seconds }.freeze
+
   belongs_to :account, default: -> { container.account }
   belongs_to :container, polymorphic: true
 
+  validates :auto_postpone_period, inclusion: { in: AUTO_POSTPONE_PERIODS_IN_SECONDS }
+
   after_commit -> { container.cards.touch_all if container }
+
+  def auto_postpone_period_in_days
+    days = auto_postpone_period / 1.day.to_i
+
+    if days.in?(AUTO_POSTPONE_PERIODS_IN_DAYS)
+      days
+    else
+      default_auto_postpone_period_in_days
+    end
+  end
+
+  def auto_postpone_period_in_days=(new_value)
+    self.auto_postpone_period = new_value.to_i.days.to_i
+  end
+
+  private
+    def default_auto_postpone_period_in_days
+      if container.is_a?(Board)
+        container.account.entropy.auto_postpone_period_in_days
+      else
+        DEFAULT_AUTO_POSTPONE_PERIOD_IN_DAYS
+      end
+    end
 end
diff --git a/app/views/entropy/_auto_close.html.erb b/app/views/entropy/_auto_close.html.erb
index 6ccb5d205..a2e3fe0ab 100644
--- a/app/views/entropy/_auto_close.html.erb
+++ b/app/views/entropy/_auto_close.html.erb
@@ -6,8 +6,9 @@
     <%= form_with model: model, url: url, data: { controller: "form" } do |form| %>
       <%= render "entropy/knob",
             form: form,
-            name: :auto_postpone_period,
-            knob_options: entropy_auto_close_options,
+            name: :auto_postpone_period_in_days,
+            current_value: model.auto_postpone_period_in_days,
+            knob_options: Entropy::AUTO_POSTPONE_PERIODS_IN_DAYS,
             label: "Days until auto-close",
             disabled: disabled  %>
     <% end %>
diff --git a/app/views/entropy/_knob.html.erb b/app/views/entropy/_knob.html.erb
index 69bbb5fb0..ba17c6728 100644
--- a/app/views/entropy/_knob.html.erb
+++ b/app/views/entropy/_knob.html.erb
@@ -1,6 +1,5 @@
 <%
-  period = form.object.send(name)
-  current_index = knob_options.index(period.to_i / 1.day)
+  current_index = knob_options.index(current_value) || knob_options.index(Entropy::DEFAULT_AUTO_POSTPONE_PERIOD_IN_DAYS)
 %>
 
 <fieldset class="knob" data-controller="knob" data-knob-target="field" style="--knob-options: <%= knob_options.length %>; --knob-index: <%= current_index %>">
@@ -8,7 +7,7 @@
     <% knob_options.each_with_index do |value, index| %>
       <label class="knob__option" style="--i: <%= index %>">
         <%= form.radio_button name,
-              value.days,
+              value,
               data: {
                 action: "change->knob#optionChanged change->form#submit",
                 index: index,
diff --git a/test/controllers/accounts/entropies_controller_test.rb b/test/controllers/accounts/entropies_controller_test.rb
index 5903ed7d0..d00c0d768 100644
--- a/test/controllers/accounts/entropies_controller_test.rb
+++ b/test/controllers/accounts/entropies_controller_test.rb
@@ -6,24 +6,33 @@ class Account::EntropiesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "update" do
-    put account_entropy_path, params: { entropy: { auto_postpone_period: 1.day } }
+    put account_entropy_path, params: { entropy: { auto_postpone_period_in_days: 7 } }
 
-    assert_equal 1.day, entropies("37s_account").auto_postpone_period
+    assert_equal 7.days, entropies("37s_account").auto_postpone_period
 
     assert_redirected_to account_settings_path
   end
 
   test "update as JSON" do
-    put account_entropy_path, params: { entropy: { auto_postpone_period: 2.days } }, as: :json
+    put account_entropy_path, params: { entropy: { auto_postpone_period_in_days: 7 } }, as: :json
 
     assert_response :no_content
-    assert_equal 2.days, entropies("37s_account").reload.auto_postpone_period
+    assert_equal 7.days, entropies("37s_account").reload.auto_postpone_period
   end
 
   test "update requires admin" do
     logout_and_sign_in_as :david
 
-    put account_entropy_path, params: { entropy: { auto_postpone_period: 1.day } }
+    put account_entropy_path, params: { entropy: { auto_postpone_period_in_days: 7 } }
     assert_response :forbidden
   end
+
+  test "update rejects invalid auto_postpone_period" do
+    original_period = entropies("37s_account").auto_postpone_period
+
+    put account_entropy_path, params: { entropy: { auto_postpone_period_in_days: 1 } }
+
+    assert_response :unprocessable_entity
+    assert_equal original_period, entropies("37s_account").reload.auto_postpone_period
+  end
 end
diff --git a/test/controllers/api/flat_json_params_test.rb b/test/controllers/api/flat_json_params_test.rb
index 4efba5209..22c51c365 100644
--- a/test/controllers/api/flat_json_params_test.rb
+++ b/test/controllers/api/flat_json_params_test.rb
@@ -39,17 +39,17 @@ class FlatJsonParamsTest < ActionDispatch::IntegrationTest
   test "update board entropy with flat JSON" do
     board = boards(:writebook)
 
-    put board_entropy_path(board), params: { auto_postpone_period: 99.days }, as: :json
+    put board_entropy_path(board), params: { auto_postpone_period_in_days: 90 }, as: :json
 
     assert_response :no_content
-    assert_equal 99.days, board.entropy.reload.auto_postpone_period
+    assert_equal 90.days, board.entropy.reload.auto_postpone_period
   end
 
   test "update account entropy with flat JSON" do
-    put account_entropy_path, params: { auto_postpone_period: 2.days }, as: :json
+    put account_entropy_path, params: { auto_postpone_period_in_days: 7 }, as: :json
 
     assert_response :no_content
-    assert_equal 2.days, Current.account.entropy.reload.auto_postpone_period
+    assert_equal 7.days, Current.account.entropy.reload.auto_postpone_period
   end
 
   test "create push subscription with flat JSON" do
diff --git a/test/controllers/boards/entropies_controller_test.rb b/test/controllers/boards/entropies_controller_test.rb
index c0ec089a5..e0fd4fa52 100644
--- a/test/controllers/boards/entropies_controller_test.rb
+++ b/test/controllers/boards/entropies_controller_test.rb
@@ -8,19 +8,19 @@ class Boards::EntropiesControllerTest < ActionDispatch::IntegrationTest
 
   test "update" do
     assert_no_difference -> { Current.account.entropy.reload.auto_postpone_period } do
-      put board_entropy_path(@board, format: :turbo_stream), params: { board: { auto_postpone_period: 123.days } }
+      put board_entropy_path(@board, format: :turbo_stream), params: { board: { auto_postpone_period_in_days: 90 } }
 
-      assert_equal 123.days, @board.entropy.reload.auto_postpone_period
+      assert_equal 90.days, @board.entropy.reload.auto_postpone_period
 
       assert_turbo_stream action: :replace, target: dom_id(@board, :entropy)
     end
   end
 
   test "update as JSON" do
-    put board_entropy_path(@board), params: { board: { auto_postpone_period: 99.days } }, as: :json
+    put board_entropy_path(@board), params: { board: { auto_postpone_period_in_days: 90 } }, as: :json
 
     assert_response :no_content
-    assert_equal 99.days, @board.entropy.reload.auto_postpone_period
+    assert_equal 90.days, @board.entropy.reload.auto_postpone_period
   end
 
   test "update requires board admin permission" do
@@ -28,9 +28,18 @@ class Boards::EntropiesControllerTest < ActionDispatch::IntegrationTest
 
     original_period = @board.entropy.auto_postpone_period
 
-    put board_entropy_path(@board, format: :turbo_stream), params: { board: { auto_postpone_period: 1.day } }
+    put board_entropy_path(@board, format: :turbo_stream), params: { board: { auto_postpone_period_in_days: 7 } }
 
     assert_response :forbidden
     assert_equal original_period, @board.entropy.reload.auto_postpone_period
   end
+
+  test "update rejects invalid auto_postpone_period" do
+    original_period = @board.entropy.auto_postpone_period
+
+    put board_entropy_path(@board, format: :turbo_stream), params: { board: { auto_postpone_period_in_days: 1 } }
+
+    assert_response :unprocessable_entity
+    assert_equal original_period, @board.entropy.reload.auto_postpone_period
+  end
 end
diff --git a/test/controllers/boards_controller_test.rb b/test/controllers/boards_controller_test.rb
index fedd9d188..915310108 100644
--- a/test/controllers/boards_controller_test.rb
+++ b/test/controllers/boards_controller_test.rb
@@ -41,12 +41,22 @@ class BoardsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
+  test "edit renders 11-day auto-close option last on the knob" do
+    get edit_board_path(boards(:writebook))
+    assert_response :success
+
+    assert_select "input[type=radio][name='board[auto_postpone_period_in_days]']" do |options|
+      assert_equal Entropy::AUTO_POSTPONE_PERIODS_IN_DAYS.map(&:to_s), options.map { |option| option["value"] }
+      assert_equal "11", options.last["value"]
+    end
+  end
+
   test "update" do
     patch board_path(boards(:writebook)), params: {
       board: {
         name: "Writebook bugs",
         all_access: false,
-        auto_postpone_period: 1.day
+        auto_postpone_period_in_days: 7
       },
       user_ids: users(:kevin, :jz).pluck(:id)
     }
@@ -54,7 +64,7 @@ class BoardsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to edit_board_path(boards(:writebook))
     assert_equal "Writebook bugs", boards(:writebook).reload.name
     assert_equal users(:kevin, :jz).sort, boards(:writebook).users.sort
-    assert_equal 1.day, entropies(:writebook_board).auto_postpone_period
+    assert_equal 7.days, entropies(:writebook_board).auto_postpone_period
     assert_not boards(:writebook).all_access?
   end
 
diff --git a/test/models/card/entropic_test.rb b/test/models/card/entropic_test.rb
index 9707eabf4..fe5dfd806 100644
--- a/test/models/card/entropic_test.rb
+++ b/test/models/card/entropic_test.rb
@@ -9,17 +9,17 @@ class Card::EntropicTest < ActiveSupport::TestCase
     freeze_time
 
     entropies(:writebook_board).destroy
-    entropies("37s_account").reload.update! auto_postpone_period: 456.days
+    entropies("37s_account").reload.update! auto_postpone_period: 365.days
     cards(:layout).update! last_active_at: 2.day.ago
-    assert_equal (456 - 2).days.from_now, cards(:layout).entropy.auto_clean_at
+    assert_equal (365 - 2).days.from_now, cards(:layout).entropy.auto_clean_at
   end
 
   test "auto_postpone_at infers the period from the board when present" do
     freeze_time
 
-    entropies(:writebook_board).update! auto_postpone_period: 123.days
+    entropies(:writebook_board).update! auto_postpone_period: 90.days
     cards(:layout).update! last_active_at: 2.day.ago
-    assert_equal (123 - 2).days.from_now, cards(:layout).entropy.auto_clean_at
+    assert_equal (90 - 2).days.from_now, cards(:layout).entropy.auto_clean_at
   end
 
   test "setting auto_postpone_period in the board without entropy will create it, without affecting the account entropy" do
@@ -27,7 +27,7 @@ class Card::EntropicTest < ActiveSupport::TestCase
     original_period = account_entropy.auto_postpone_period
 
     entropies(:writebook_board).destroy
-    boards(:writebook).update! auto_postpone_period: 999.days
+    boards(:writebook).update! auto_postpone_period: 365.days
 
     assert_equal original_period, account_entropy.reload.auto_postpone_period
   end
diff --git a/test/models/entropy_test.rb b/test/models/entropy_test.rb
index 0648bbd3b..98abb0af0 100644
--- a/test/models/entropy_test.rb
+++ b/test/models/entropy_test.rb
@@ -3,15 +3,26 @@ require "test_helper"
 class Entropy::Test < ActiveSupport::TestCase
   test "touch cards when entropy changes for board" do
     assert_changes -> { boards(:writebook).cards.first.updated_at } do
-      boards(:writebook).entropy.update!(auto_postpone_period: 15.days)
+      boards(:writebook).entropy.update!(auto_postpone_period: 7.days)
     end
   end
 
+  test "default auto-postpone period is included in allowed periods" do
+    assert_includes Entropy::AUTO_POSTPONE_PERIODS_IN_DAYS, Entropy::DEFAULT_AUTO_POSTPONE_PERIOD_IN_DAYS
+  end
+
+  test "board entropy falls back to account entropy period when value is invalid" do
+    board = boards(:writebook)
+    board.entropy.update_column(:auto_postpone_period, 999.days.to_i)
+
+    assert_equal Current.account.entropy.auto_postpone_period_in_days, board.entropy.auto_postpone_period_in_days
+  end
+
   test "touch cards when entropy changes for account container" do
     account = Current.account
 
     assert_changes -> { account.cards.first.updated_at } do
-      boards(:writebook).entropy.update!(auto_postpone_period: 15.days)
+      boards(:writebook).entropy.update!(auto_postpone_period: 7.days)
     end
   end
 end

From 71a1ee703160945f1844740a68d4d6f23258b044 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Mon, 9 Mar 2026 17:02:08 -0700
Subject: [PATCH 015/107] Wrap comment params for flat JSON payloads (#2679)

* Wrap comment params for flat JSON payloads

The SDK sends flat JSON ({"body": "..."}) but Rails wrap_parameters
auto-detection misses :body since it's a virtual ActionText attribute,
not in Comment.attribute_names. Explicitly declare wrap_parameters so
params.expect(comment: [...]) works with both wrapped and flat payloads.

* Test comment create and update with flat JSON params
---
 app/controllers/cards/comments_controller.rb  |  1 +
 .../cards/comments_controller_test.rb         | 20 +++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/app/controllers/cards/comments_controller.rb b/app/controllers/cards/comments_controller.rb
index 6a377bc2c..7aed33c8c 100644
--- a/app/controllers/cards/comments_controller.rb
+++ b/app/controllers/cards/comments_controller.rb
@@ -1,4 +1,5 @@
 class Cards::CommentsController < ApplicationController
+  wrap_parameters :comment, include: %i[ body created_at ]
   include CardScoped
 
   before_action :set_comment, only: %i[ show edit update destroy ]
diff --git a/test/controllers/cards/comments_controller_test.rb b/test/controllers/cards/comments_controller_test.rb
index eebd62a9c..be5831e39 100644
--- a/test/controllers/cards/comments_controller_test.rb
+++ b/test/controllers/cards/comments_controller_test.rb
@@ -84,6 +84,26 @@ class Cards::CommentsControllerTest < ActionDispatch::IntegrationTest
     assert_equal card_comment_url(comment.card, comment), @response.parsed_body["url"]
   end
 
+  test "create as JSON with flat params" do
+    card = cards(:logo)
+
+    assert_difference -> { card.comments.count }, +1 do
+      post card_comments_path(card), params: { body: "Flat comment" }, as: :json
+    end
+
+    assert_response :created
+    assert_equal "Flat comment", Comment.last.body.to_plain_text
+  end
+
+  test "update as JSON with flat params" do
+    comment = comments(:logo_agreement_kevin)
+
+    put card_comment_path(cards(:logo), comment), params: { body: "Flat update" }, as: :json
+
+    assert_response :success
+    assert_equal "Flat update", comment.reload.body.to_plain_text
+  end
+
   test "update as JSON" do
     comment = comments(:logo_agreement_kevin)
 

From a52b6f1c878f465acc6097137b361fa62488185c Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Mon, 9 Mar 2026 21:47:05 -0700
Subject: [PATCH 016/107] Add explicit wrap_parameters to all controllers
 (#2680)

* Add explicit wrap_parameters to controllers for flat JSON API support

Virtual attributes (has_rich_text, has_one_attached, delegated setters,
ActiveModel attrs) are not in Model.attribute_names, so wrap_parameters
auto-detection silently drops them from flat JSON requests. Add explicit
include: lists matching each controller's permitted params.

* Convert short-form wrap_parameters to explicit include: lists

Defense-in-depth: these controllers only have real-column params today,
so auto-detection works, but explicit lists prevent future regressions
if virtual attributes are added.

* Add flat JSON param tests for all wrap_parameters controllers

17 new tests covering every controller with wrap_parameters, verifying
that flat (unwrapped) JSON payloads are correctly wrapped and processed.
Focuses on virtual attributes that would be silently dropped without
explicit include: lists.
---
 .../account/join_codes_controller.rb          |   2 +-
 .../account/settings_controller.rb            |   2 +-
 app/controllers/boards/columns_controller.rb  |   2 +
 app/controllers/boards_controller.rb          |   2 +
 .../cards/comments/reactions_controller.rb    |   2 +
 app/controllers/cards/reactions_controller.rb |   2 +
 app/controllers/cards/steps_controller.rb     |   2 +
 app/controllers/cards_controller.rb           |   2 +
 .../my/access_tokens_controller.rb            |   2 +
 .../notifications/settings_controller.rb      |   2 +-
 .../signups/completions_controller.rb         |   2 +
 app/controllers/signups_controller.rb         |   2 +
 app/controllers/users/joins_controller.rb     |   2 +
 .../users/push_subscriptions_controller.rb    |   2 +
 app/controllers/users/roles_controller.rb     |   2 +-
 app/controllers/users_controller.rb           |   2 +
 app/controllers/webhooks_controller.rb        |   2 +
 test/controllers/api/flat_json_params_test.rb | 183 ++++++++++++++++++
 18 files changed, 213 insertions(+), 4 deletions(-)

diff --git a/app/controllers/account/join_codes_controller.rb b/app/controllers/account/join_codes_controller.rb
index 3df9552db..e7306308b 100644
--- a/app/controllers/account/join_codes_controller.rb
+++ b/app/controllers/account/join_codes_controller.rb
@@ -1,5 +1,5 @@
 class Account::JoinCodesController < ApplicationController
-  wrap_parameters :account_join_code
+  wrap_parameters :account_join_code, include: %i[ usage_limit ]
 
   before_action :set_join_code
   before_action :ensure_admin, only: %i[ update destroy ]
diff --git a/app/controllers/account/settings_controller.rb b/app/controllers/account/settings_controller.rb
index 6201ca656..47036d606 100644
--- a/app/controllers/account/settings_controller.rb
+++ b/app/controllers/account/settings_controller.rb
@@ -1,5 +1,5 @@
 class Account::SettingsController < ApplicationController
-  wrap_parameters :account
+  wrap_parameters :account, include: %i[ name ]
 
   before_action :ensure_admin, only: :update
   before_action :set_account
diff --git a/app/controllers/boards/columns_controller.rb b/app/controllers/boards/columns_controller.rb
index a3cf867ea..d0bd13c55 100644
--- a/app/controllers/boards/columns_controller.rb
+++ b/app/controllers/boards/columns_controller.rb
@@ -1,4 +1,6 @@
 class Boards::ColumnsController < ApplicationController
+  wrap_parameters :column, include: %i[ name color ]
+
   include BoardScoped
 
   before_action :set_column, only: %i[ show update destroy ]
diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb
index 8e63455f9..3d5485f1f 100644
--- a/app/controllers/boards_controller.rb
+++ b/app/controllers/boards_controller.rb
@@ -1,4 +1,6 @@
 class BoardsController < ApplicationController
+  wrap_parameters :board, include: %i[ name all_access auto_postpone_period_in_days public_description ]
+
   include FilterScoped
 
   before_action :set_board, except: %i[ index new create ]
diff --git a/app/controllers/cards/comments/reactions_controller.rb b/app/controllers/cards/comments/reactions_controller.rb
index 32ca9f2f8..d6b202bb3 100644
--- a/app/controllers/cards/comments/reactions_controller.rb
+++ b/app/controllers/cards/comments/reactions_controller.rb
@@ -1,4 +1,6 @@
 class Cards::Comments::ReactionsController < ApplicationController
+  wrap_parameters :reaction, include: %i[ content ]
+
   include CardScoped
 
   before_action :set_comment
diff --git a/app/controllers/cards/reactions_controller.rb b/app/controllers/cards/reactions_controller.rb
index 4f19a1c64..aedb4194f 100644
--- a/app/controllers/cards/reactions_controller.rb
+++ b/app/controllers/cards/reactions_controller.rb
@@ -1,4 +1,6 @@
 class Cards::ReactionsController < ApplicationController
+  wrap_parameters :reaction, include: %i[ content ]
+
   include CardScoped
 
   before_action :set_reactable
diff --git a/app/controllers/cards/steps_controller.rb b/app/controllers/cards/steps_controller.rb
index 387dd8e23..4843da232 100644
--- a/app/controllers/cards/steps_controller.rb
+++ b/app/controllers/cards/steps_controller.rb
@@ -1,4 +1,6 @@
 class Cards::StepsController < ApplicationController
+  wrap_parameters :step, include: %i[ content completed ]
+
   include CardScoped
 
   before_action :set_step, only: %i[ show edit update destroy ]
diff --git a/app/controllers/cards_controller.rb b/app/controllers/cards_controller.rb
index 482d2ff78..015ecda1f 100644
--- a/app/controllers/cards_controller.rb
+++ b/app/controllers/cards_controller.rb
@@ -1,4 +1,6 @@
 class CardsController < ApplicationController
+  wrap_parameters :card, include: %i[ title description image created_at last_active_at ]
+
   include FilterScoped
 
   before_action :set_board, only: %i[ create ]
diff --git a/app/controllers/my/access_tokens_controller.rb b/app/controllers/my/access_tokens_controller.rb
index c9fcf38c3..dc7e9826a 100644
--- a/app/controllers/my/access_tokens_controller.rb
+++ b/app/controllers/my/access_tokens_controller.rb
@@ -1,4 +1,6 @@
 class My::AccessTokensController < ApplicationController
+  wrap_parameters :access_token, include: %i[ description permission ]
+
   skip_before_action :require_account
 
   def index
diff --git a/app/controllers/notifications/settings_controller.rb b/app/controllers/notifications/settings_controller.rb
index 252abec2e..a7ae3d8a6 100644
--- a/app/controllers/notifications/settings_controller.rb
+++ b/app/controllers/notifications/settings_controller.rb
@@ -1,5 +1,5 @@
 class Notifications::SettingsController < ApplicationController
-  wrap_parameters :user_settings
+  wrap_parameters :user_settings, include: %i[ bundle_email_frequency ]
 
   before_action :set_settings
 
diff --git a/app/controllers/signups/completions_controller.rb b/app/controllers/signups/completions_controller.rb
index de3d81b63..5c2d9568c 100644
--- a/app/controllers/signups/completions_controller.rb
+++ b/app/controllers/signups/completions_controller.rb
@@ -1,4 +1,6 @@
 class Signups::CompletionsController < ApplicationController
+  wrap_parameters :signup, include: %i[ full_name ]
+
   layout "public"
 
   disallow_account_scope
diff --git a/app/controllers/signups_controller.rb b/app/controllers/signups_controller.rb
index 56614158f..cf43724f1 100644
--- a/app/controllers/signups_controller.rb
+++ b/app/controllers/signups_controller.rb
@@ -1,4 +1,6 @@
 class SignupsController < ApplicationController
+  wrap_parameters :signup, include: %i[ email_address ]
+
   disallow_account_scope
   allow_unauthenticated_access
   rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_signup_path, alert: "Try again later." }
diff --git a/app/controllers/users/joins_controller.rb b/app/controllers/users/joins_controller.rb
index 6baa888ae..bbcb039e6 100644
--- a/app/controllers/users/joins_controller.rb
+++ b/app/controllers/users/joins_controller.rb
@@ -1,4 +1,6 @@
 class Users::JoinsController < ApplicationController
+  wrap_parameters :user, include: %i[ name avatar ]
+
   layout "public"
 
   def new
diff --git a/app/controllers/users/push_subscriptions_controller.rb b/app/controllers/users/push_subscriptions_controller.rb
index 91b47264c..c52b89541 100644
--- a/app/controllers/users/push_subscriptions_controller.rb
+++ b/app/controllers/users/push_subscriptions_controller.rb
@@ -1,4 +1,6 @@
 class Users::PushSubscriptionsController < ApplicationController
+  wrap_parameters :push_subscription, include: %i[ endpoint p256dh_key auth_key ]
+
   before_action :set_push_subscriptions
 
   def index
diff --git a/app/controllers/users/roles_controller.rb b/app/controllers/users/roles_controller.rb
index fb11d4e08..61c3262ed 100644
--- a/app/controllers/users/roles_controller.rb
+++ b/app/controllers/users/roles_controller.rb
@@ -1,5 +1,5 @@
 class Users::RolesController < ApplicationController
-  wrap_parameters :user
+  wrap_parameters :user, include: %i[ role ]
 
   before_action :set_user
   before_action :ensure_permission_to_administer_user
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 7062b85e5..fdc528d3e 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -1,4 +1,6 @@
 class UsersController < ApplicationController
+  wrap_parameters :user, include: %i[ name avatar ]
+
   before_action :set_user, except: %i[ index ]
   before_action :ensure_permission_to_change_user, only: %i[ update destroy ]
 
diff --git a/app/controllers/webhooks_controller.rb b/app/controllers/webhooks_controller.rb
index 584c2dc7a..ab29badaa 100644
--- a/app/controllers/webhooks_controller.rb
+++ b/app/controllers/webhooks_controller.rb
@@ -1,4 +1,6 @@
 class WebhooksController < ApplicationController
+  wrap_parameters :webhook, include: %i[ name url subscribed_actions ]
+
   include BoardScoped
 
   before_action :ensure_admin
diff --git a/test/controllers/api/flat_json_params_test.rb b/test/controllers/api/flat_json_params_test.rb
index 22c51c365..84c4667b4 100644
--- a/test/controllers/api/flat_json_params_test.rb
+++ b/test/controllers/api/flat_json_params_test.rb
@@ -62,6 +62,189 @@ class FlatJsonParamsTest < ActionDispatch::IntegrationTest
     assert_response :created
   end
 
+  test "create card with flat JSON" do
+    assert_difference -> { Card.count }, +1 do
+      post board_cards_path(boards(:writebook)),
+        params: { title: "Flat card", description: "<p>Flat description</p>" },
+        as: :json
+    end
+
+    assert_response :created
+    card = Card.last
+    assert_equal "Flat card", card.title
+    assert_equal "Flat description", card.description.to_plain_text
+  end
+
+  test "update card with flat JSON" do
+    card = cards(:logo)
+
+    put card_path(card),
+      params: { title: "Flat update", description: "<p>Updated flat</p>" },
+      as: :json
+
+    assert_response :success
+    card.reload
+    assert_equal "Flat update", card.title
+    assert_equal "Updated flat", card.description.to_plain_text
+  end
+
+  test "create board with flat JSON" do
+    assert_difference -> { Board.count }, +1 do
+      post boards_path, params: { name: "Flat board" }, as: :json
+    end
+
+    assert_response :created
+    assert_equal "Flat board", Board.last.name
+  end
+
+  test "update board with flat JSON" do
+    board = boards(:writebook)
+
+    put board_path(board),
+      params: { name: "Flat board", auto_postpone_period_in_days: 7, public_description: "<p>Flat public desc</p>" },
+      as: :json
+
+    assert_response :no_content
+    board.reload
+    assert_equal "Flat board", board.name
+    assert_equal 7.days, board.entropy.auto_postpone_period
+    assert_equal "Flat public desc", board.public_description.to_plain_text
+  end
+
+  test "create column with flat JSON" do
+    board = boards(:writebook)
+
+    assert_difference -> { board.columns.count }, +1 do
+      post board_columns_path(board), params: { name: "Flat Column" }, as: :json
+    end
+
+    assert_response :created
+    assert_equal "Flat Column", Column.last.name
+  end
+
+  test "update column with flat JSON" do
+    column = columns(:writebook_in_progress)
+
+    put board_column_path(column.board, column), params: { name: "Flat Updated" }, as: :json
+
+    assert_response :no_content
+    assert_equal "Flat Updated", column.reload.name
+  end
+
+  test "create step with flat JSON" do
+    card = cards(:logo)
+
+    assert_difference -> { card.steps.count }, +1 do
+      post card_steps_path(card), params: { content: "Flat step" }, as: :json
+    end
+
+    assert_response :created
+    assert_equal "Flat step", Step.last.content
+  end
+
+  test "update step with flat JSON" do
+    card = cards(:logo)
+    step = card.steps.create!(content: "Original")
+
+    put card_step_path(card, step), params: { content: "Flat updated" }, as: :json
+
+    assert_response :success
+    assert_equal "Flat updated", step.reload.content
+  end
+
+  test "create card reaction with flat JSON" do
+    card = cards(:logo)
+
+    assert_difference -> { card.reactions.count }, +1 do
+      post card_reactions_path(card), params: { content: "🎉" }, as: :json
+    end
+
+    assert_response :created
+  end
+
+  test "create comment reaction with flat JSON" do
+    comment = comments(:logo_agreement_kevin)
+
+    assert_difference -> { comment.reactions.count }, +1 do
+      post card_comment_reactions_path(comment.card, comment), params: { content: "👍" }, as: :json
+    end
+
+    assert_response :created
+  end
+
+  test "create access token with flat JSON" do
+    assert_difference -> { identities(:kevin).access_tokens.count }, +1 do
+      post my_access_tokens_path, params: { description: "Flat token", permission: "read" }, as: :json
+    end
+
+    assert_response :created
+    assert_equal "Flat token", @response.parsed_body["description"]
+  end
+
+  test "update user with flat JSON" do
+    put user_path(users(:david)), params: { name: "Flat Name" }, as: :json
+
+    assert_response :no_content
+    assert_equal "Flat Name", users(:david).reload.name
+  end
+
+  test "create webhook with flat JSON" do
+    board = boards(:writebook)
+
+    assert_difference -> { Webhook.count }, +1 do
+      post board_webhooks_path(board),
+        params: { name: "Flat Webhook", url: "https://example.com/flat", subscribed_actions: [ "card_published" ] },
+        as: :json
+    end
+
+    assert_response :created
+    assert_equal "Flat Webhook", Webhook.last.name
+  end
+
+  test "update webhook with flat JSON" do
+    webhook = webhooks(:active)
+
+    patch board_webhook_path(webhook.board, webhook),
+      params: { name: "Flat Updated", subscribed_actions: [ "card_published" ] },
+      as: :json
+
+    assert_response :success
+    assert_equal "Flat Updated", webhook.reload.name
+  end
+
+  test "create signup with flat JSON" do
+    sign_out
+    email = "flatjson-#{SecureRandom.hex(6)}@example.com"
+
+    untenanted do
+      assert_difference -> { Identity.count }, +1 do
+        post signup_path, params: { email_address: email }, as: :json
+      end
+    end
+  end
+
+  test "complete signup with flat JSON" do
+    signup = Signup.new(email_address: "flatjson-#{SecureRandom.hex(6)}@example.com", full_name: "Flat User")
+    signup.create_identity || raise("Failed to create identity")
+    logout_and_sign_in_as signup.identity
+
+    untenanted do
+      assert_difference -> { Account.count }, +1 do
+        post signup_completion_path, params: { full_name: "Flat JSON User" }, as: :json
+      end
+    end
+
+    assert_response :created
+  end
+
+  test "update user via join with flat JSON" do
+    logout_and_sign_in_as :david
+
+    post users_joins_path, params: { name: "Flat Join" }, as: :json
+
+    assert_equal "Flat Join", users(:david).reload.name
+  end
+
   private
     def stub_dns_resolution(*ips)
       dns_mock = mock("dns")

From d33aa8b7578b9bec05df1feb1477e3804b727d51 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Mon, 9 Mar 2026 21:53:43 -0700
Subject: [PATCH 017/107] Wrap params coverage nits (#2681)

* Add missing assert_response to signup API test

* Add JSON response format to joins#create
---
 app/controllers/users/joins_controller.rb     | 6 +++++-
 test/controllers/api/flat_json_params_test.rb | 3 +++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/app/controllers/users/joins_controller.rb b/app/controllers/users/joins_controller.rb
index bbcb039e6..402dd34a3 100644
--- a/app/controllers/users/joins_controller.rb
+++ b/app/controllers/users/joins_controller.rb
@@ -8,7 +8,11 @@ class Users::JoinsController < ApplicationController
 
   def create
     Current.user.update!(user_params)
-    redirect_to landing_path
+
+    respond_to do |format|
+      format.html { redirect_to landing_path }
+      format.json { head :no_content }
+    end
   end
 
   private
diff --git a/test/controllers/api/flat_json_params_test.rb b/test/controllers/api/flat_json_params_test.rb
index 84c4667b4..90f55f8fd 100644
--- a/test/controllers/api/flat_json_params_test.rb
+++ b/test/controllers/api/flat_json_params_test.rb
@@ -221,6 +221,8 @@ class FlatJsonParamsTest < ActionDispatch::IntegrationTest
         post signup_path, params: { email_address: email }, as: :json
       end
     end
+
+    assert_response :created
   end
 
   test "complete signup with flat JSON" do
@@ -242,6 +244,7 @@ class FlatJsonParamsTest < ActionDispatch::IntegrationTest
 
     post users_joins_path, params: { name: "Flat Join" }, as: :json
 
+    assert_response :no_content
     assert_equal "Flat Join", users(:david).reload.name
   end
 

From 5d084a46ce58217bde19302dd1044a693c766177 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Fri, 2 Jan 2026 19:25:47 +0100
Subject: [PATCH 018/107] Switch to turbo-rails version with offline mode
 support

---
 Gemfile      |  2 +-
 Gemfile.lock | 14 ++++++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/Gemfile b/Gemfile
index 17e7496c0..da66e1473 100644
--- a/Gemfile
+++ b/Gemfile
@@ -8,7 +8,7 @@ gem "rails", github: "rails/rails", branch: "main"
 gem "importmap-rails"
 gem "propshaft"
 gem "stimulus-rails"
-gem "turbo-rails"
+gem "turbo-rails", github: "hotwired/turbo-rails", branch: "offline-cache"
 
 # Deployment and drivers
 gem "bootsnap", require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 3f8461b39..3a35c35c7 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -11,6 +11,15 @@ GIT
   specs:
     useragent (0.16.11)
 
+GIT
+  remote: https://github.com/hotwired/turbo-rails.git
+  revision: e3795ef6aac6a3d18039751febe6a301cfe71a7b
+  branch: offline-cache
+  specs:
+    turbo-rails (2.0.20)
+      actionpack (>= 7.1.0)
+      railties (>= 7.1.0)
+
 GIT
   remote: https://github.com/rails/rails.git
   revision: 12e24eaf2f0a9613e015653f013dd131317d9bf5
@@ -461,9 +470,6 @@ GEM
     trilogy (2.10.0)
       bigdecimal
     tsort (0.2.0)
-    turbo-rails (2.0.23)
-      actionpack (>= 7.1.0)
-      railties (>= 7.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
@@ -539,7 +545,7 @@ DEPENDENCIES
   stimulus-rails
   thruster
   trilogy (~> 2.10)
-  turbo-rails
+  turbo-rails!
   useragent!
   vcr
   web-console!

From ada4688c4e0bc2a6adcdd757821d1779ed4cd570 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Mon, 5 Jan 2026 12:10:57 +0100
Subject: [PATCH 019/107] Take a first stab at offline mode support

---
 Gemfile.lock                           |  4 +-
 Gemfile.saas.lock                      | 14 +++--
 app/javascript/initializers/index.js   |  1 +
 app/javascript/initializers/offline.js |  6 ++
 app/views/pwa/service_worker.js        | 41 --------------
 app/views/pwa/service_worker.js.erb    | 76 ++++++++++++++++++++++++++
 config/importmap.rb                    |  1 +
 7 files changed, 96 insertions(+), 47 deletions(-)
 create mode 100644 app/javascript/initializers/offline.js
 delete mode 100644 app/views/pwa/service_worker.js
 create mode 100644 app/views/pwa/service_worker.js.erb

diff --git a/Gemfile.lock b/Gemfile.lock
index 3a35c35c7..a710d0f9e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,10 +13,10 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: e3795ef6aac6a3d18039751febe6a301cfe71a7b
+  revision: 49be3f2d43edeeedad48cb492b35242fdb27af74
   branch: offline-cache
   specs:
-    turbo-rails (2.0.20)
+    turbo-rails (2.0.21)
       actionpack (>= 7.1.0)
       railties (>= 7.1.0)
 
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 152d1889c..cec5be07b 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -60,6 +60,15 @@ GIT
       rails (>= 6.1)
       yabeda (~> 0.6)
 
+GIT
+  remote: https://github.com/hotwired/turbo-rails.git
+  revision: 49be3f2d43edeeedad48cb492b35242fdb27af74
+  branch: offline-cache
+  specs:
+    turbo-rails (2.0.21)
+      actionpack (>= 7.1.0)
+      railties (>= 7.1.0)
+
 GIT
   remote: https://github.com/rails/rails.git
   revision: 12e24eaf2f0a9613e015653f013dd131317d9bf5
@@ -633,9 +642,6 @@ GEM
     trilogy (2.10.0)
       bigdecimal
     tsort (0.2.0)
-    turbo-rails (2.0.23)
-      actionpack (>= 7.1.0)
-      railties (>= 7.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
@@ -752,7 +758,7 @@ DEPENDENCIES
   stripe (~> 18.0)
   thruster
   trilogy (~> 2.10)
-  turbo-rails
+  turbo-rails!
   useragent!
   vcr
   web-console!
diff --git a/app/javascript/initializers/index.js b/app/javascript/initializers/index.js
index 90ef36a26..1d16ef205 100644
--- a/app/javascript/initializers/index.js
+++ b/app/javascript/initializers/index.js
@@ -1,2 +1,3 @@
 import "initializers/current"
 import "initializers/bridge/bridge_element"
+import "initializers/offline"
diff --git a/app/javascript/initializers/offline.js b/app/javascript/initializers/offline.js
new file mode 100644
index 000000000..c5eff824e
--- /dev/null
+++ b/app/javascript/initializers/offline.js
@@ -0,0 +1,6 @@
+import { Turbo } from "@hotwired/turbo-rails"
+
+Turbo.offline.start("/service-worker.js", { 
+  scope: "/", 
+  native: true 
+})
diff --git a/app/views/pwa/service_worker.js b/app/views/pwa/service_worker.js
deleted file mode 100644
index 91903e735..000000000
--- a/app/views/pwa/service_worker.js
+++ /dev/null
@@ -1,41 +0,0 @@
-self.addEventListener('fetch', (event) => {
-  if (event.request.method !== 'GET') return
-
-  if (event.request.destination === 'document') {
-    event.respondWith(
-      fetch(event.request, { cache: 'no-cache' })
-        .catch(() => caches.match(event.request))
-    )
-  }
-})
-
-self.addEventListener("push", (event) => {
-  const data = event.data.json()
-  event.waitUntil(Promise.all([ showNotification(data), updateBadgeCount(data.options) ]))
-})
-
-async function showNotification({ title, options }) {
-  return self.registration.showNotification(title, options)
-}
-
-async function updateBadgeCount({ data: { badge } }) {
-  return self.navigator.setAppBadge?.(badge || 0)
-}
-
-self.addEventListener("notificationclick", (event) => {
-  event.notification.close()
-
-  const url = new URL(event.notification.data.url, self.location.origin).href
-  event.waitUntil(openURL(url))
-})
-
-async function openURL(url) {
-  const clients = await self.clients.matchAll({ type: "window" })
-  const focused = clients.find((client) => client.focused)
-
-  if (focused) {
-    await focused.navigate(url)
-  } else {
-    await self.clients.openWindow(url)
-  }
-}
diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
new file mode 100644
index 000000000..fb583658c
--- /dev/null
+++ b/app/views/pwa/service_worker.js.erb
@@ -0,0 +1,76 @@
+importScripts("<%= javascript_url("turbo-offline-umd.min") %>")
+
+TurboOffline.addRule({
+  match: /\/assets\/.+[-\.][0-9a-f]+\.(js|css|svg|png|jpg|webp|woff2?|ico)$/,
+  handler: TurboOffline.handlers.cacheFirst({
+    cacheName: "assets",
+    maxAge: 60 * 60 * 24 * 7
+  })
+})
+
+TurboOffline.addRule({
+  match: (request) => {
+    const url = request.url
+    return /\/(boards|cards|users)\//.test(url) && !/\/(edit|pin|watch|new)$/.test(url)
+  },
+  handler: TurboOffline.handlers.networkFirst({
+    cacheName: "cards",
+    maxAge: 60 * 60 * 24 * 3,
+    networkTimeout: 3
+  })
+})
+
+TurboOffline.addRule({
+  match: /\/rails\/active_storage\//,
+  handler: TurboOffline.handlers.networkFirst({
+    cacheName: "storage",
+    maxAge: 60 * 60 * 24 * 7,
+    networkTimeout: 3
+  })
+})
+
+// Everything else
+TurboOffline.addRule({
+  handler: TurboOffline.handlers.networkFirst({
+    cacheName: "misc",
+    maxAge: 60 * 60 * 24,
+    networkTimeout: 3
+  })
+})
+
+TurboOffline.start()
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(self.clients.claim())
+})
+
+self.addEventListener("push", (event) => {
+  const data = event.data.json()
+  event.waitUntil(Promise.all([ showNotification(data), updateBadgeCount(data.options) ]))
+})
+
+async function showNotification({ title, options }) {
+  return self.registration.showNotification(title, options)
+}
+
+async function updateBadgeCount({ data: { badge } }) {
+  return self.navigator.setAppBadge?.(badge || 0)
+}
+
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close()
+
+  const url = new URL(event.notification.data.url, self.location.origin).href
+  event.waitUntil(openURL(url))
+})
+
+async function openURL(url) {
+  const clients = await self.clients.matchAll({ type: "window" })
+  const focused = clients.find((client) => client.focused)
+
+  if (focused) {
+    await focused.navigate(url)
+  } else {
+    await self.clients.openWindow(url)
+  }
+}
diff --git a/config/importmap.rb b/config/importmap.rb
index 5da84683c..f6910c3e1 100644
--- a/config/importmap.rb
+++ b/config/importmap.rb
@@ -2,6 +2,7 @@
 
 pin "application"
 pin "@hotwired/turbo-rails", to: "turbo.min.js"
+pin "@hotwired/turbo/offline", to: "turbo-offline.min.js"
 pin "@hotwired/stimulus", to: "stimulus.min.js"
 pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
 pin "@hotwired/hotwire-native-bridge", to: "@hotwired--hotwire-native-bridge.js"

From 9fc724572e900953ca500178e3615ec19b7e8602 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Tue, 20 Jan 2026 10:53:40 +0100
Subject: [PATCH 020/107] Use new `except` option for offline rules

---
 app/views/pwa/service_worker.js.erb | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index fb583658c..0c4ab6ea5 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -9,14 +9,12 @@ TurboOffline.addRule({
 })
 
 TurboOffline.addRule({
-  match: (request) => {
-    const url = request.url
-    return /\/(boards|cards|users)\//.test(url) && !/\/(edit|pin|watch|new)$/.test(url)
-  },
+  match: /\/(boards|cards|users)\//,
+  except: /\/(edit|pin|watch|new)$/,
   handler: TurboOffline.handlers.networkFirst({
     cacheName: "cards",
     maxAge: 60 * 60 * 24 * 3,
-    networkTimeout: 3
+    networkTimeout: 2
   })
 })
 
@@ -25,7 +23,7 @@ TurboOffline.addRule({
   handler: TurboOffline.handlers.networkFirst({
     cacheName: "storage",
     maxAge: 60 * 60 * 24 * 7,
-    networkTimeout: 3
+    networkTimeout: 2
   })
 })
 

From 975968b50f9c8033e278460736e82bbfc2b3dec2 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Tue, 20 Jan 2026 19:16:17 +0100
Subject: [PATCH 021/107] Only enable offline caching for Hotwire Native apps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This change conditionally renders the TurboOffline caching rules based on
whether the request comes from a Hotwire Native app. Web browsers get a
minimal service worker that only handles push notifications and a simple
document fetch fallback.

Why separate behavior for native vs web?
-----------------------------------------
We want offline caching for Hotwire Native apps (where users expect
app-like offline behavior) but not for regular web browsers.

Why use ERB conditional rendering?
----------------------------------
We explored several approaches to detect Hotwire Native requests in the
service worker:

1. User-Agent detection in fetch handler: Would be ideal, but Android
   WebViews override the User-Agent header with the system default when
   requests are intercepted by service workers, stripping the custom
   "Hotwire Native" identifier.

2. Custom header (X-Hotwire-Native) from native apps: Would require
   intercepting ALL requests at the native level using both
   WebViewClient.shouldInterceptRequest() and ServiceWorkerClient.
   Complex to implement and still incomplete coverage for all request
   types (navigation, resources loaded by HTML).

3. In-memory flag with IndexedDB persistence: Service workers can be
   terminated when idle and restart with fresh state. Reading from
   IndexedDB is async, but the decision to call respondWith() in a
   fetch handler must be synchronous.

4. Separate service worker URLs: Same theoretical churn problem as ERB
   rendering, with more complexity.

Why ERB conditional rendering works in practice
-----------------------------------------------
The main concern with conditional ERB rendering was "churn" — the service
worker constantly updating as different client types fetch it. However,
this only happens when web and native share storage on the same device.

In practice, this is rare because:
- Android native apps use isolated WebView storage
- iOS doesn't support service workers in WebViews (yet)
- Web browsers have completely separate storage

So each context gets its own stable service worker without churn.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 app/views/pwa/service_worker.js.erb | 73 +++++++++++++++++------------
 1 file changed, 43 insertions(+), 30 deletions(-)

diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index 0c4ab6ea5..b3f59aa60 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -1,44 +1,57 @@
 importScripts("<%= javascript_url("turbo-offline-umd.min") %>")
 
-TurboOffline.addRule({
-  match: /\/assets\/.+[-\.][0-9a-f]+\.(js|css|svg|png|jpg|webp|woff2?|ico)$/,
-  handler: TurboOffline.handlers.cacheFirst({
-    cacheName: "assets",
-    maxAge: 60 * 60 * 24 * 7
+<% if hotwire_native_app? %>
+  TurboOffline.addRule({
+    match: /\/assets\/.+[-\.][0-9a-f]+\.(js|css|svg|png|jpg|webp|woff2?|ico)$/,
+    handler: TurboOffline.handlers.cacheFirst({
+      cacheName: "assets",
+      maxAge: 60 * 60 * 24 * 7
+    })
   })
-})
 
-TurboOffline.addRule({
-  match: /\/(boards|cards|users)\//,
-  except: /\/(edit|pin|watch|new)$/,
-  handler: TurboOffline.handlers.networkFirst({
-    cacheName: "cards",
-    maxAge: 60 * 60 * 24 * 3,
-    networkTimeout: 2
+  TurboOffline.addRule({
+    match: /\/(boards|cards|users)\//,
+    except: /\/(edit|pin|watch|new)$/,
+    handler: TurboOffline.handlers.networkFirst({
+      cacheName: "cards",
+      maxAge: 60 * 60 * 24 * 3,
+      networkTimeout: 2
+    })
   })
-})
 
-TurboOffline.addRule({
-  match: /\/rails\/active_storage\//,
-  handler: TurboOffline.handlers.networkFirst({
-    cacheName: "storage",
-    maxAge: 60 * 60 * 24 * 7,
-    networkTimeout: 2
+  TurboOffline.addRule({
+    match: /\/rails\/active_storage\//,
+    handler: TurboOffline.handlers.networkFirst({
+      cacheName: "storage",
+      maxAge: 60 * 60 * 24 * 7,
+      networkTimeout: 2
+    })
   })
-})
 
-// Everything else
-TurboOffline.addRule({
-  handler: TurboOffline.handlers.networkFirst({
-    cacheName: "misc",
-    maxAge: 60 * 60 * 24,
-    networkTimeout: 3
+  // Everything else
+  TurboOffline.addRule({
+    handler: TurboOffline.handlers.networkFirst({
+      cacheName: "misc",
+      maxAge: 60 * 60 * 24,
+      networkTimeout: 3
+    })
   })
-})
 
-TurboOffline.start()
+  TurboOffline.start()
+<% else %>
+  self.addEventListener("fetch", (event) => {
+    if (event.request.method !== "GET") return
 
-self.addEventListener('activate', (event) => {
+    if (event.request.destination === "document") {
+      event.respondWith(
+        fetch(event.request, { cache: "no-cache" })
+          .catch(() => caches.match(event.request))
+      )
+    }
+  })
+<% end %>
+
+self.addEventListener("activate", (event) => {
   event.waitUntil(self.clients.claim())
 })
 

From a949f1e3aed45b89e8a8a9caa6f486c858f87acf Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Tue, 27 Jan 2026 09:32:15 +0100
Subject: [PATCH 022/107] Clear offline cache when logging out

Adds a logout Stimulus controller that sends a message to the service
worker to clear all cached content when the user logs out. This ensures
that cached data from one user isn't accessible after logout.

The implementation:
- Adds logout_controller.js that posts { action: "clearCache" } to the
  service worker via postMessage
- Updates logout buttons to use the controller on form submission

Also fixes data-turbo placement: moved from button to form element where
it actually takes effect for disabling Turbo Drive form submissions.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 Gemfile.lock                                    | 2 +-
 Gemfile.saas.lock                               | 2 +-
 app/javascript/controllers/logout_controller.js | 8 ++++++++
 app/views/my/menus/_settings.html.erb           | 2 +-
 app/views/users/show.html.erb                   | 2 +-
 5 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100644 app/javascript/controllers/logout_controller.js

diff --git a/Gemfile.lock b/Gemfile.lock
index a710d0f9e..a17769c07 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 49be3f2d43edeeedad48cb492b35242fdb27af74
+  revision: 45a2a40be0a677808a3a269311f1b5abaa3b30ba
   branch: offline-cache
   specs:
     turbo-rails (2.0.21)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index cec5be07b..03c8e9141 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 49be3f2d43edeeedad48cb492b35242fdb27af74
+  revision: 45a2a40be0a677808a3a269311f1b5abaa3b30ba
   branch: offline-cache
   specs:
     turbo-rails (2.0.21)
diff --git a/app/javascript/controllers/logout_controller.js b/app/javascript/controllers/logout_controller.js
new file mode 100644
index 000000000..bc0511a7f
--- /dev/null
+++ b/app/javascript/controllers/logout_controller.js
@@ -0,0 +1,8 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  async clearCache() {
+    const registration = await navigator.serviceWorker?.ready
+    registration?.active?.postMessage({ action: "clearCache" })
+  }
+}
diff --git a/app/views/my/menus/_settings.html.erb b/app/views/my/menus/_settings.html.erb
index d1251b7c0..6b711544b 100644
--- a/app/views/my/menus/_settings.html.erb
+++ b/app/views/my/menus/_settings.html.erb
@@ -6,7 +6,7 @@
 
   <%= tag.li class: "popup__item", data: { filter_target: "item", navigable_list_target: "item" } do %>
     <%= icon_tag "logout", class: "popup__icon" %>
-    <%= button_to session_path(script_name: nil), method: :delete, class: "popup__btn btn", data: { turbo: false } do %>
+    <%= button_to session_path(script_name: nil), method: :delete, class: "popup__btn btn", form: { data: { turbo: false, controller: "logout", action: "submit->logout#clearCache" } } do %>
       <span>Sign out</span>
     <% end %>
   <% end %>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 58068d2d6..a285a4f5a 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -41,7 +41,7 @@
       <% if Current.user == @user %>
         <hr class="separator--horizontal full-width flex-item-grow margin-block-start-double" style="--border-color: var(--color-ink-light);" aria-hidden="true">
 
-        <%= button_to session_path(script_name: nil), method: :delete, class: "btn txt-x-small center", data: { turbo: false } do %>
+        <%= button_to session_path(script_name: nil), method: :delete, class: "btn txt-x-small center", form: { data: { turbo: false, controller: "logout", action: "submit->logout#clearCache" } } do %>
           <span>Sign out of Fizzy on this device</span>
         <% end %>
       <% end %>

From cf8d92afeaf031980296da10340674477c339f4f Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Wed, 28 Jan 2026 21:30:50 +0100
Subject: [PATCH 023/107] Enable offline caching for all web users

Previously, offline caching was conditionally enabled only for Hotwire
Native apps. This removes that restriction and enables offline support
for all users, including PWAs and regular browsers.

This Uses the new `fetchOptions` support in `TurboOffline` handlers
to pass `cache: "no-cache"` for document fetches, which we need
to work around a quite annoying Safari PWA bug
(see https://github.com/basecamp/fizzy/pull/1014).

Also, simplify a bit the cache names and remove the `misc` one.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 Gemfile.lock                        |  2 +-
 Gemfile.saas.lock                   |  2 +-
 app/views/pwa/service_worker.js.erb | 83 +++++++++++++++--------------
 3 files changed, 44 insertions(+), 43 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index a17769c07..3cad12c54 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 45a2a40be0a677808a3a269311f1b5abaa3b30ba
+  revision: 9bcc244043b16ef0202f8fe93aaeb246d841f9eb
   branch: offline-cache
   specs:
     turbo-rails (2.0.21)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 03c8e9141..3517a420e 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 45a2a40be0a677808a3a269311f1b5abaa3b30ba
+  revision: 9bcc244043b16ef0202f8fe93aaeb246d841f9eb
   branch: offline-cache
   specs:
     turbo-rails (2.0.21)
diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index b3f59aa60..cfdf5468f 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -1,60 +1,61 @@
 importScripts("<%= javascript_url("turbo-offline-umd.min") %>")
 
-<% if hotwire_native_app? %>
-  TurboOffline.addRule({
-    match: /\/assets\/.+[-\.][0-9a-f]+\.(js|css|svg|png|jpg|webp|woff2?|ico)$/,
-    handler: TurboOffline.handlers.cacheFirst({
-      cacheName: "assets",
-      maxAge: 60 * 60 * 24 * 7
-    })
+// Documents - top-level navigation requests only
+// We need `cache: "no-cache"` here to work around
+// an annoying Safari PWA bug that predates offline mode
+TurboOffline.addRule({
+  match: (request) => request.destination === "document",
+  handler: TurboOffline.handlers.networkFirst({
+    cacheName: "main",
+    maxAge: 60 * 60 * 24 * 3,
+    networkTimeout: 3,
+    fetchOptions: { cache: "no-cache" }
   })
+})
 
-  TurboOffline.addRule({
-    match: /\/(boards|cards|users)\//,
-    except: /\/(edit|pin|watch|new)$/,
-    handler: TurboOffline.handlers.networkFirst({
-      cacheName: "cards",
-      maxAge: 60 * 60 * 24 * 3,
-      networkTimeout: 2
-    })
+TurboOffline.addRule({
+  match: /\/assets\/.+[-\.][0-9a-f]+\.(js|css|svg|png|jpg|webp|woff2?|ico)$/,
+  handler: TurboOffline.handlers.cacheFirst({
+    cacheName: "assets",
+    maxAge: 60 * 60 * 24 * 7
   })
+})
 
-  TurboOffline.addRule({
-    match: /\/rails\/active_storage\//,
-    handler: TurboOffline.handlers.networkFirst({
-      cacheName: "storage",
-      maxAge: 60 * 60 * 24 * 7,
-      networkTimeout: 2
-    })
+TurboOffline.addRule({
+  match: /\/(boards|cards|users)\//,
+  except: /\/(edit|pin|watch|new)$/,
+  handler: TurboOffline.handlers.networkFirst({
+    cacheName: "main",
+    maxAge: 60 * 60 * 24 * 3,
+    networkTimeout: 2
   })
+})
 
-  // Everything else
-  TurboOffline.addRule({
-    handler: TurboOffline.handlers.networkFirst({
-      cacheName: "misc",
-      maxAge: 60 * 60 * 24,
-      networkTimeout: 3
-    })
+TurboOffline.addRule({
+  match: /\/rails\/active_storage\//,
+  handler: TurboOffline.handlers.networkFirst({
+    cacheName: "storage",
+    maxAge: 60 * 60 * 24 * 7,
+    networkTimeout: 2
   })
+})
 
-  TurboOffline.start()
-<% else %>
-  self.addEventListener("fetch", (event) => {
-    if (event.request.method !== "GET") return
-
-    if (event.request.destination === "document") {
-      event.respondWith(
-        fetch(event.request, { cache: "no-cache" })
-          .catch(() => caches.match(event.request))
-      )
-    }
+// Everything else
+TurboOffline.addRule({
+  handler: TurboOffline.handlers.networkFirst({
+    cacheName: "main",
+    maxAge: 60 * 60 * 24,
+    networkTimeout: 3
   })
-<% end %>
+})
 
 self.addEventListener("activate", (event) => {
   event.waitUntil(self.clients.claim())
 })
 
+TurboOffline.start()
+
+
 self.addEventListener("push", (event) => {
   const data = event.data.json()
   event.waitUntil(Promise.all([ showNotification(data), updateBadgeCount(data.options) ]))

From 90d5a351f0ef3ab712056710f17ff4df65b33ea0 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Thu, 29 Jan 2026 21:03:50 +0100
Subject: [PATCH 024/107] Bump turbo-rails for Range requests support

Cached video and audio files.
---
 Gemfile.lock      | 4 ++--
 Gemfile.saas.lock | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 3cad12c54..405a68bac 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,10 +13,10 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 9bcc244043b16ef0202f8fe93aaeb246d841f9eb
+  revision: 9bc39c9d72f2f78ebcb30dac645eb1261a1574b3
   branch: offline-cache
   specs:
-    turbo-rails (2.0.21)
+    turbo-rails (2.0.23)
       actionpack (>= 7.1.0)
       railties (>= 7.1.0)
 
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 3517a420e..2b9f32fd6 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,10 +62,10 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 9bcc244043b16ef0202f8fe93aaeb246d841f9eb
+  revision: 9bc39c9d72f2f78ebcb30dac645eb1261a1574b3
   branch: offline-cache
   specs:
-    turbo-rails (2.0.21)
+    turbo-rails (2.0.23)
       actionpack (>= 7.1.0)
       railties (>= 7.1.0)
 

From 32134be88216b0c7c6e5407171a5be88da6d4253 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Sun, 1 Feb 2026 15:15:34 +0100
Subject: [PATCH 025/107] Bump turbo-rails for network-first strategy fix on
 network error

---
 Gemfile.lock      | 2 +-
 Gemfile.saas.lock | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 405a68bac..aa14545ca 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 9bc39c9d72f2f78ebcb30dac645eb1261a1574b3
+  revision: cdf9d18a99906c349e01fbe05c6c7cdaa71ce550
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 2b9f32fd6..a4033b12b 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 9bc39c9d72f2f78ebcb30dac645eb1261a1574b3
+  revision: cdf9d18a99906c349e01fbe05c6c7cdaa71ce550
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)

From 9b264483d11123827ccf556e2eedf91601eae9fe Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Thu, 5 Feb 2026 20:23:36 +0100
Subject: [PATCH 026/107] Bump `turbo-rails` for cache size limits

---
 Gemfile.lock      | 2 +-
 Gemfile.saas.lock | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index aa14545ca..9dd682dce 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: cdf9d18a99906c349e01fbe05c6c7cdaa71ce550
+  revision: 0becdbbcdbf607eab6632463bc63f94d64249b7b
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index a4033b12b..8f5c9dd95 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: cdf9d18a99906c349e01fbe05c6c7cdaa71ce550
+  revision: 0becdbbcdbf607eab6632463bc63f94d64249b7b
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)

From b93808235c058c1f2ed422a713f4f97cf09389ab Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Thu, 5 Feb 2026 21:15:22 +0100
Subject: [PATCH 027/107] Limit cached entry sizes

1MB and no limit for number of entries except for attachments, where we
limit individual entries to 2MB and total of entries to 500. The number
is based on the following percentiles for Active Storage blobs:

```
p50: 97.1044921875 KB
p75: 236.9140625 KB
p90: 917.7548828125 KB
```
---
 app/views/pwa/service_worker.js.erb | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index cfdf5468f..84f274673 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -9,7 +9,8 @@ TurboOffline.addRule({
     cacheName: "main",
     maxAge: 60 * 60 * 24 * 3,
     networkTimeout: 3,
-    fetchOptions: { cache: "no-cache" }
+    fetchOptions: { cache: "no-cache" },
+    maxEntrySize: 1024 * 1024
   })
 })
 
@@ -17,7 +18,8 @@ TurboOffline.addRule({
   match: /\/assets\/.+[-\.][0-9a-f]+\.(js|css|svg|png|jpg|webp|woff2?|ico)$/,
   handler: TurboOffline.handlers.cacheFirst({
     cacheName: "assets",
-    maxAge: 60 * 60 * 24 * 7
+    maxAge: 60 * 60 * 24 * 7,
+    maxEntrySize: 1024 * 1024
   })
 })
 
@@ -27,7 +29,8 @@ TurboOffline.addRule({
   handler: TurboOffline.handlers.networkFirst({
     cacheName: "main",
     maxAge: 60 * 60 * 24 * 3,
-    networkTimeout: 2
+    networkTimeout: 2,
+    maxEntrySize: 1024 * 1024
   })
 })
 
@@ -36,7 +39,9 @@ TurboOffline.addRule({
   handler: TurboOffline.handlers.networkFirst({
     cacheName: "storage",
     maxAge: 60 * 60 * 24 * 7,
-    networkTimeout: 2
+    networkTimeout: 2,
+    maxEntrySize: 2 * 1024 * 1024, // 2MB covers about 95% of all Fizzy blobs
+    maxEntries: 500
   })
 })
 
@@ -45,7 +50,8 @@ TurboOffline.addRule({
   handler: TurboOffline.handlers.networkFirst({
     cacheName: "main",
     maxAge: 60 * 60 * 24,
-    networkTimeout: 3
+    networkTimeout: 3,
+    maxEntrySize: 1024 * 1024
   })
 })
 

From 089fcf94f8969b432ba113b18a924cd85836ab05 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Fri, 6 Feb 2026 12:37:39 +0100
Subject: [PATCH 028/107] Preload resources after service worker installation

When the service worker is registered for the first time, resources loaded
before it becomes active won't go through the service worker. These resources
may be served from the browser's HTTP cache on subsequent requests, bypassing
the service worker cache entirely.

The new `preload` option accepts a regex pattern. On first visit (when no
controller exists), it waits for the service worker to take control, then
sends a message with URLs from `performance.getEntriesByType("resource")`
that match the pattern. The service worker fetches and caches these resources.
---
 Gemfile.lock                           | 2 +-
 Gemfile.saas.lock                      | 2 +-
 app/javascript/initializers/offline.js | 7 ++++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 9dd682dce..758936188 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 0becdbbcdbf607eab6632463bc63f94d64249b7b
+  revision: ca62e8bdad88d01914d512ad24424e0670f239c9
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 8f5c9dd95..a3552dacd 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 0becdbbcdbf607eab6632463bc63f94d64249b7b
+  revision: ca62e8bdad88d01914d512ad24424e0670f239c9
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/app/javascript/initializers/offline.js b/app/javascript/initializers/offline.js
index c5eff824e..446a9671e 100644
--- a/app/javascript/initializers/offline.js
+++ b/app/javascript/initializers/offline.js
@@ -1,6 +1,7 @@
 import { Turbo } from "@hotwired/turbo-rails"
 
-Turbo.offline.start("/service-worker.js", { 
-  scope: "/", 
-  native: true 
+Turbo.offline.start("/service-worker.js", {
+  scope: "/",
+  native: true,
+  preload: /\/assets\//
 })

From 1c2de6ca79bdd5617e5668c6cb37bf525f3c7085 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Fri, 20 Feb 2026 11:31:36 +0100
Subject: [PATCH 029/107] Clear offline cache on sign-in as well as sign-out

Rename logout controller to clear-offline-cache and attach it to the
magic link verification form so the service worker cache is cleared
when a different user signs in.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../{logout_controller.js => clear_offline_cache_controller.js} | 0
 app/views/my/menus/_settings.html.erb                           | 2 +-
 app/views/sessions/magic_links/show.html.erb                    | 2 +-
 app/views/users/show.html.erb                                   | 2 +-
 4 files changed, 3 insertions(+), 3 deletions(-)
 rename app/javascript/controllers/{logout_controller.js => clear_offline_cache_controller.js} (100%)

diff --git a/app/javascript/controllers/logout_controller.js b/app/javascript/controllers/clear_offline_cache_controller.js
similarity index 100%
rename from app/javascript/controllers/logout_controller.js
rename to app/javascript/controllers/clear_offline_cache_controller.js
diff --git a/app/views/my/menus/_settings.html.erb b/app/views/my/menus/_settings.html.erb
index 6b711544b..bf34b991d 100644
--- a/app/views/my/menus/_settings.html.erb
+++ b/app/views/my/menus/_settings.html.erb
@@ -6,7 +6,7 @@
 
   <%= tag.li class: "popup__item", data: { filter_target: "item", navigable_list_target: "item" } do %>
     <%= icon_tag "logout", class: "popup__icon" %>
-    <%= button_to session_path(script_name: nil), method: :delete, class: "popup__btn btn", form: { data: { turbo: false, controller: "logout", action: "submit->logout#clearCache" } } do %>
+    <%= button_to session_path(script_name: nil), method: :delete, class: "popup__btn btn", form: { data: { turbo: false, controller: "clear-offline-cache", action: "submit->clear-offline-cache#clearCache" } } do %>
       <span>Sign out</span>
     <% end %>
   <% end %>
diff --git a/app/views/sessions/magic_links/show.html.erb b/app/views/sessions/magic_links/show.html.erb
index aba8411f5..968624a10 100644
--- a/app/views/sessions/magic_links/show.html.erb
+++ b/app/views/sessions/magic_links/show.html.erb
@@ -8,7 +8,7 @@
     </p>
   </header>
 
-  <%= form_with url: session_magic_link_path, method: :post, html: { data: { controller: "magic-link" } } do |form| %>
+  <%= form_with url: session_magic_link_path, method: :post, html: { data: { controller: "magic-link clear-offline-cache", action: "submit->clear-offline-cache#clearCache" } } do |form| %>
     <%= form.text_field :code, required: true, class: "input center txt-align-enter txt-large txt-uppercase",
         autofocus: true, autocorrect: "off", autocapitalize: "off", spellcheck: "false", "data-1p-ignore": true,
         autocomplete: "one-time-code", maxlength: "6", placeholder: "••••••", value: params[:code],
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index a285a4f5a..eb3e40c64 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -41,7 +41,7 @@
       <% if Current.user == @user %>
         <hr class="separator--horizontal full-width flex-item-grow margin-block-start-double" style="--border-color: var(--color-ink-light);" aria-hidden="true">
 
-        <%= button_to session_path(script_name: nil), method: :delete, class: "btn txt-x-small center", form: { data: { turbo: false, controller: "logout", action: "submit->logout#clearCache" } } do %>
+        <%= button_to session_path(script_name: nil), method: :delete, class: "btn txt-x-small center", form: { data: { turbo: false, controller: "clear-offline-cache", action: "submit->clear-offline-cache#clearCache" } } do %>
           <span>Sign out of Fizzy on this device</span>
         <% end %>
       <% end %>

From de6d70cc2efa1aa3f972d2bb1427a1731c9c2710 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Fri, 20 Feb 2026 11:45:06 +0100
Subject: [PATCH 030/107] Bump turbo-rails for Turbo.offline.clearCache()

Simplify the clear-offline-cache controller to use the new
Turbo.offline.clearCache() API instead of messaging the service
worker directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 Gemfile.lock                                                | 2 +-
 Gemfile.saas.lock                                           | 2 +-
 .../controllers/clear_offline_cache_controller.js           | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 758936188..8a49b38a5 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: ca62e8bdad88d01914d512ad24424e0670f239c9
+  revision: 4104a353cfe728232dc0eed6d54c77466a9849f2
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index a3552dacd..751dc55fb 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: ca62e8bdad88d01914d512ad24424e0670f239c9
+  revision: 4104a353cfe728232dc0eed6d54c77466a9849f2
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/app/javascript/controllers/clear_offline_cache_controller.js b/app/javascript/controllers/clear_offline_cache_controller.js
index bc0511a7f..7caa2e89b 100644
--- a/app/javascript/controllers/clear_offline_cache_controller.js
+++ b/app/javascript/controllers/clear_offline_cache_controller.js
@@ -1,8 +1,8 @@
 import { Controller } from "@hotwired/stimulus"
+import { Turbo } from "@hotwired/turbo-rails"
 
 export default class extends Controller {
-  async clearCache() {
-    const registration = await navigator.serviceWorker?.ready
-    registration?.active?.postMessage({ action: "clearCache" })
+  clearCache() {
+    Turbo.offline.clearCache()
   }
 }

From 0482670fec187f3361531a6b8a4672430b65345f Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Fri, 20 Feb 2026 12:07:38 +0100
Subject: [PATCH 031/107] Exclude service worker and edit/pin/watch/new pages
 from main cache

We don't need the service worker to cache itself, or pages that won't
work offline anyway.
---
 app/javascript/controllers/magic_link_controller.js | 2 +-
 app/views/pwa/service_worker.js.erb                 | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/javascript/controllers/magic_link_controller.js b/app/javascript/controllers/magic_link_controller.js
index 3e2e4618c..8217af5aa 100644
--- a/app/javascript/controllers/magic_link_controller.js
+++ b/app/javascript/controllers/magic_link_controller.js
@@ -15,7 +15,7 @@ export default class extends Controller {
 
   submit() {
     if (this.inputTarget.disabled) return
-    this.element.submit()
+    this.element.requestSubmit()
     this.inputTarget.disabled = true
   }
 }
diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index 84f274673..095595f4e 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -5,6 +5,7 @@ importScripts("<%= javascript_url("turbo-offline-umd.min") %>")
 // an annoying Safari PWA bug that predates offline mode
 TurboOffline.addRule({
   match: (request) => request.destination === "document",
+  except: /\/(edit|pin|watch|new)$/,
   handler: TurboOffline.handlers.networkFirst({
     cacheName: "main",
     maxAge: 60 * 60 * 24 * 3,
@@ -47,6 +48,7 @@ TurboOffline.addRule({
 
 // Everything else
 TurboOffline.addRule({
+  except: /\/(service-worker\.js|edit|pin|watch|new)$/,
   handler: TurboOffline.handlers.networkFirst({
     cacheName: "main",
     maxAge: 60 * 60 * 24,

From 99382db7203f1598c27d71b612a75230cc8b83b6 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Fri, 20 Feb 2026 12:43:18 +0100
Subject: [PATCH 032/107] Only start offline mode when signed in

Gate Turbo.offline.start() behind Current.user so the service worker
is only registered for authenticated users. This avoids errors on
unauthenticated pages where /service-worker.js requires auth.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 app/javascript/initializers/offline.js | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/app/javascript/initializers/offline.js b/app/javascript/initializers/offline.js
index 446a9671e..877ffa0ef 100644
--- a/app/javascript/initializers/offline.js
+++ b/app/javascript/initializers/offline.js
@@ -1,7 +1,9 @@
 import { Turbo } from "@hotwired/turbo-rails"
 
-Turbo.offline.start("/service-worker.js", {
-  scope: "/",
-  native: true,
-  preload: /\/assets\//
-})
+if (Current.user) {
+  Turbo.offline.start("/service-worker.js", {
+    scope: "/",
+    native: true,
+    preload: /\/assets\//
+  })
+}

From 67d629f72219b72936127bd12ae7721c4e7a33bb Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Fri, 20 Feb 2026 20:48:01 +0100
Subject: [PATCH 033/107] Use CORS fetch mode for Active Storage to enable
 `maxEntrySize` checks

Otherwise, for resources like images loaded via <img> tags, the browser
sets `mode: "no-cors"` (as these aren't CORS requests), so the service
worker gets an opaque response even though the server sends CORS
headers.

We could upgrade all no-cors requests to cors mode, sending a `mode:
"cors"` request to a server that doesn't send CORS headers will fail
entirely: the `fetch` call throws a `TypeError` (network error), and the
browser blocks the response. So the resource wouldn't load at all, not
even as opaque. We wouldn't be able to cache it at all.

By opting in via `fetchOptions`, we can do it only for rules where we
know the server will send CORS headers.
---
 Gemfile.lock                        | 2 +-
 Gemfile.saas.lock                   | 2 +-
 app/views/pwa/service_worker.js.erb | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 8a49b38a5..e811a1c2f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 4104a353cfe728232dc0eed6d54c77466a9849f2
+  revision: 43bc205155b0eb57e5e016ed0e87a12c29ba2ab2
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 751dc55fb..af3c102c1 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 4104a353cfe728232dc0eed6d54c77466a9849f2
+  revision: 43bc205155b0eb57e5e016ed0e87a12c29ba2ab2
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index 095595f4e..5ab493e22 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -42,7 +42,8 @@ TurboOffline.addRule({
     maxAge: 60 * 60 * 24 * 7,
     networkTimeout: 2,
     maxEntrySize: 2 * 1024 * 1024, // 2MB covers about 95% of all Fizzy blobs
-    maxEntries: 500
+    maxEntries: 500,
+    fetchOptions: { mode: "cors", credentials: "omit" }
   })
 })
 

From 1855490f805477db7bd0eebdca3fc52da1a8f0c7 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Sat, 21 Feb 2026 09:20:47 +0100
Subject: [PATCH 034/107] Revert CORS fetch mode for Active Storage

CORS mode doesn't work with redirect-based Active Storage URLs
when the storage bucket uses wildcard Access-Control-Allow-Origin.
Relying on maxEntries alone until specific origin CORS is available.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 Gemfile.lock                        | 2 +-
 Gemfile.saas.lock                   | 2 +-
 app/views/pwa/service_worker.js.erb | 3 +--
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index e811a1c2f..8db6817dc 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 43bc205155b0eb57e5e016ed0e87a12c29ba2ab2
+  revision: 93ce5bc461cd71af1797e79fcd7e09a19242d080
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index af3c102c1..37ff08294 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -62,7 +62,7 @@ GIT
 
 GIT
   remote: https://github.com/hotwired/turbo-rails.git
-  revision: 43bc205155b0eb57e5e016ed0e87a12c29ba2ab2
+  revision: 93ce5bc461cd71af1797e79fcd7e09a19242d080
   branch: offline-cache
   specs:
     turbo-rails (2.0.23)
diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index 5ab493e22..095595f4e 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -42,8 +42,7 @@ TurboOffline.addRule({
     maxAge: 60 * 60 * 24 * 7,
     networkTimeout: 2,
     maxEntrySize: 2 * 1024 * 1024, // 2MB covers about 95% of all Fizzy blobs
-    maxEntries: 500,
-    fetchOptions: { mode: "cors", credentials: "omit" }
+    maxEntries: 500
   })
 })
 

From 49a86c7cbf7905d7cb67e1e69e2922040658a279 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Tue, 3 Mar 2026 15:59:25 +0000
Subject: [PATCH 035/107] Enable CORS fetch mode for storage requests

The load balancer now returns a specific `Access-Control-Allow-Origin`
instead of a wildcard, so credentials can be included by default.
This enables `maxEntrySize` enforcement for storage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 app/views/pwa/service_worker.js.erb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/views/pwa/service_worker.js.erb b/app/views/pwa/service_worker.js.erb
index 095595f4e..41fac1446 100644
--- a/app/views/pwa/service_worker.js.erb
+++ b/app/views/pwa/service_worker.js.erb
@@ -42,7 +42,8 @@ TurboOffline.addRule({
     maxAge: 60 * 60 * 24 * 7,
     networkTimeout: 2,
     maxEntrySize: 2 * 1024 * 1024, // 2MB covers about 95% of all Fizzy blobs
-    maxEntries: 500
+    maxEntries: 500,
+    fetchOptions: { mode: "cors" }
   })
 })
 

From 0483ae530286ee696d6f6e1df608670b521cd329 Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Tue, 10 Mar 2026 10:52:47 +0100
Subject: [PATCH 036/107] Add support for "bridge-slot" parameter

---
 app/javascript/initializers/bridge/bridge_element.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/app/javascript/initializers/bridge/bridge_element.js b/app/javascript/initializers/bridge/bridge_element.js
index 438cf22e1..414f8ee30 100644
--- a/app/javascript/initializers/bridge/bridge_element.js
+++ b/app/javascript/initializers/bridge/bridge_element.js
@@ -5,7 +5,8 @@ BridgeElement.prototype.getButton = function() {
     title: this.title,
     icon: this.getIcon(),
     displayTitle: this.getDisplayTitle(),
-    displayAsPrimaryAction: this.getDisplayAsPrimaryAction()
+    displayAsPrimaryAction: this.getDisplayAsPrimaryAction(),
+    slot: this.getSlot()
   }
 }
 
@@ -26,3 +27,7 @@ BridgeElement.prototype.getDisplayTitle = function() {
 BridgeElement.prototype.getDisplayAsPrimaryAction = function() {
   return !!this.bridgeAttribute(`display-as-primary-action`)
 }
+
+BridgeElement.prototype.getSlot = function () {
+  return this.bridgeAttribute("slot") ?? "right"
+}

From 1d523a98f91cfb5fd64421530824842067672e84 Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Tue, 10 Mar 2026 10:53:15 +0100
Subject: [PATCH 037/107] Use it on the home's "Add board" button

---
 app/views/events/index/_add_board_button.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/events/index/_add_board_button.html.erb b/app/views/events/index/_add_board_button.html.erb
index b8134266a..e6707165e 100644
--- a/app/views/events/index/_add_board_button.html.erb
+++ b/app/views/events/index/_add_board_button.html.erb
@@ -1,7 +1,7 @@
 <div class="header__actions header__actions--end">
   <div>
     <%= link_to new_board_path, class: "btn btn--link btn--circle-mobile",
-          data: { controller: "hotkey", action: "keydown.b@document->hotkey#click", bridge__buttons_target: "button", bridge_title: "Add board", bridge_display_title: true, bridge_icon_url: bridge_icon("board") } do %>
+          data: { controller: "hotkey", action: "keydown.b@document->hotkey#click", bridge__buttons_target: "button", bridge_title: "Add board", bridge_display_title: true, bridge_icon_url: bridge_icon("board"), bridge_slot: "left" } do %>
       <%= icon_tag "board" %>
       <span class="overflow-ellipsis">Add a board</span>
       <kbd class="hide-on-touch">B</kbd>

From 71b99c1e18bf49f19839e088b8abad417a119fbb Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 10 Mar 2026 11:03:40 -0400
Subject: [PATCH 038/107] Fix path traversal vulnerability in ActiveStorage
 blob key import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

BlobRecordSet#import_batch preserved blob keys from exported ZIP files
verbatim. A crafted ZIP with a traversal key like "../../config/deploy.yml"
would create a blob whose key resolves to an arbitrary filesystem path
when served by ActiveStorage's DiskService, allowing an attacker to read
local files.

Fix: generate fresh blob keys on import, discarding whatever key was in
the ZIP. This is safe because nothing else in the import pipeline
references blobs by key — attachments use blob_id, ActionText uses GIDs
based on record IDs, and only FileRecordSet used the old key for file
data lookup.

Update FileRecordSet to build an old_key→blob_id mapping from the blob
JSON metadata in the ZIP, then look up blobs by ID instead of by key.
Both check_record and import_batch are now fail-closed: they raise
IntegrityError for unmapped storage files, missing blobs, and duplicate
keys in the export.

Backfill test coverage for BlobRecordSet and FileRecordSet import, and
add a round-trip test verifying blob data survives export/import with
regenerated keys.
---
 .../active_storage/blob_record_set.rb         |   1 +
 .../active_storage/file_record_set.rb         |  38 +++-
 test/integration/blob_key_traversal_test.rb   |  45 +++++
 .../active_storage/blob_record_set_test.rb    |  58 ++++++
 .../active_storage/file_record_set_test.rb    | 177 ++++++++++++++++++
 test/models/account/import_test.rb            |  46 +++++
 6 files changed, 357 insertions(+), 8 deletions(-)
 create mode 100644 test/integration/blob_key_traversal_test.rb
 create mode 100644 test/models/account/data_transfer/active_storage/blob_record_set_test.rb
 create mode 100644 test/models/account/data_transfer/active_storage/file_record_set_test.rb

diff --git a/app/models/account/data_transfer/active_storage/blob_record_set.rb b/app/models/account/data_transfer/active_storage/blob_record_set.rb
index 1637768f3..0c4a553c1 100644
--- a/app/models/account/data_transfer/active_storage/blob_record_set.rb
+++ b/app/models/account/data_transfer/active_storage/blob_record_set.rb
@@ -13,6 +13,7 @@ class Account::DataTransfer::ActiveStorage::BlobRecordSet < Account::DataTransfe
         data = load(file)
         data.slice(*attributes).merge(
           "account_id" => account.id,
+          "key" => ::ActiveStorage::Blob.generate_unique_secure_token(length: ::ActiveStorage::Blob::MINIMUM_TOKEN_LENGTH),
           "service_name" => ::ActiveStorage::Blob.service.name
         )
       end
diff --git a/app/models/account/data_transfer/active_storage/file_record_set.rb b/app/models/account/data_transfer/active_storage/file_record_set.rb
index 15d359353..421a2e520 100644
--- a/app/models/account/data_transfer/active_storage/file_record_set.rb
+++ b/app/models/account/data_transfer/active_storage/file_record_set.rb
@@ -22,9 +22,12 @@ class Account::DataTransfer::ActiveStorage::FileRecordSet < Account::DataTransfe
 
     def import_batch(files)
       files.each do |file|
-        key = File.basename(file)
-        blob = ::ActiveStorage::Blob.find_by(key: key, account: account)
-        next unless blob
+        old_key = file.delete_prefix("storage/")
+        blob_id = old_key_to_blob_id[old_key]
+        raise IntegrityError, "Storage file #{old_key} has no matching blob metadata in export" unless blob_id
+
+        blob = ::ActiveStorage::Blob.find_by(id: blob_id, account: account)
+        raise IntegrityError, "Blob #{blob_id} not found for storage key #{old_key}" unless blob
 
         zip.read(file) do |stream|
           blob.upload(stream)
@@ -32,12 +35,31 @@ class Account::DataTransfer::ActiveStorage::FileRecordSet < Account::DataTransfe
       end
     end
 
-    def check_record(file_path)
-      key = File.basename(file_path)
+    def old_key_to_blob_id
+      @old_key_to_blob_id ||= build_old_key_to_blob_id
+    end
 
-      unless zip.exists?("data/active_storage_blobs/#{key}.json") || ::ActiveStorage::Blob.exists?(key: key, account: account)
-        # File exists without corresponding blob record - could be orphaned or blob not yet imported
-        # We allow this since blob metadata is imported before files
+    def build_old_key_to_blob_id
+      zip.glob("data/active_storage_blobs/*.json").each_with_object({}) do |file, map|
+        data = load(file)
+        old_key = data["key"]
+        if map.key?(old_key)
+          raise IntegrityError, "Duplicate blob key in export: #{old_key}"
+        end
+        map[old_key] = data["id"]
+      end
+    end
+
+    def with_zip(zip)
+      @old_key_to_blob_id = nil
+      super
+    end
+
+    def check_record(file_path)
+      old_key = file_path.delete_prefix("storage/")
+
+      unless old_key_to_blob_id.key?(old_key)
+        raise IntegrityError, "Storage file #{old_key} has no matching blob metadata in export"
       end
     end
 end
diff --git a/test/integration/blob_key_traversal_test.rb b/test/integration/blob_key_traversal_test.rb
new file mode 100644
index 000000000..31dc8e179
--- /dev/null
+++ b/test/integration/blob_key_traversal_test.rb
@@ -0,0 +1,45 @@
+require "test_helper"
+
+class Account::DataTransfer::ActiveStorage::BlobKeyTraversalTest < ActionDispatch::IntegrationTest
+  test "import with path traversal blob key does not leak local files" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+    traversal_key = "../../config/deploy.yml"
+    zip = build_zip_with_blob(id: blob_id, key: traversal_key)
+    Account::DataTransfer::ActiveStorage::BlobRecordSet.new(Current.account).import(from: zip)
+    blob = ActiveStorage::Blob.find(blob_id)
+
+    assert_not_equal traversal_key, blob.key
+
+    sign_in_as identities(:david)
+    get rails_blob_path(blob, disposition: "inline")
+
+    assert_response :redirect
+
+    follow_redirect!
+
+    assert_response :not_found
+  end
+
+  private
+    def build_zip_with_blob(id:, key:)
+      tempfile = Tempfile.new([ "malicious", ".zip" ])
+      tempfile.binmode
+
+      writer = ZipFile::Writer.new(tempfile)
+      writer.add_file("data/active_storage_blobs/#{id}.json", {
+        id: id,
+        account_id: ActiveRecord::Type::Uuid.generate,
+        byte_size: 32,
+        checksum: "",
+        content_type: "text/plain",
+        created_at: Time.current.iso8601,
+        filename: "traversal.txt",
+        key: key,
+        metadata: {}
+      }.to_json)
+      writer.close
+
+      tempfile.rewind
+      ZipFile::Reader.new(tempfile)
+    end
+end
diff --git a/test/models/account/data_transfer/active_storage/blob_record_set_test.rb b/test/models/account/data_transfer/active_storage/blob_record_set_test.rb
new file mode 100644
index 000000000..82b83f428
--- /dev/null
+++ b/test/models/account/data_transfer/active_storage/blob_record_set_test.rb
@@ -0,0 +1,58 @@
+require "test_helper"
+
+class Account::DataTransfer::ActiveStorage::BlobRecordSetTest < ActiveSupport::TestCase
+  test "import generates fresh keys instead of using exported keys" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+    exported_key = "original-exported-key-abc123"
+
+    zip = build_zip_with_blob(id: blob_id, key: exported_key)
+    Account::DataTransfer::ActiveStorage::BlobRecordSet.new(Current.account).import(from: zip)
+
+    blob = ActiveStorage::Blob.find(blob_id)
+    assert_not_equal exported_key, blob.key
+    assert_equal 28, blob.key.length
+  end
+
+  test "import preserves blob metadata" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+
+    zip = build_zip_with_blob(
+      id: blob_id,
+      key: "some-key",
+      filename: "report.pdf",
+      content_type: "application/pdf",
+      byte_size: 12345,
+      checksum: "abc123checksum"
+    )
+    Account::DataTransfer::ActiveStorage::BlobRecordSet.new(Current.account).import(from: zip)
+
+    blob = ActiveStorage::Blob.find(blob_id)
+    assert_equal "report.pdf", blob.filename.to_s
+    assert_equal "application/pdf", blob.content_type
+    assert_equal 12345, blob.byte_size
+    assert_equal "abc123checksum", blob.checksum
+  end
+
+  private
+    def build_zip_with_blob(id:, key:, filename: "test.txt", content_type: "text/plain", byte_size: 32, checksum: "")
+      tempfile = Tempfile.new([ "test_export", ".zip" ])
+      tempfile.binmode
+
+      writer = ZipFile::Writer.new(tempfile)
+      writer.add_file("data/active_storage_blobs/#{id}.json", {
+        id: id,
+        account_id: ActiveRecord::Type::Uuid.generate,
+        byte_size: byte_size,
+        checksum: checksum,
+        content_type: content_type,
+        created_at: Time.current.iso8601,
+        filename: filename,
+        key: key,
+        metadata: {}
+      }.to_json)
+      writer.close
+
+      tempfile.rewind
+      ZipFile::Reader.new(tempfile)
+    end
+end
diff --git a/test/models/account/data_transfer/active_storage/file_record_set_test.rb b/test/models/account/data_transfer/active_storage/file_record_set_test.rb
new file mode 100644
index 000000000..4784754ae
--- /dev/null
+++ b/test/models/account/data_transfer/active_storage/file_record_set_test.rb
@@ -0,0 +1,177 @@
+require "test_helper"
+
+class Account::DataTransfer::ActiveStorage::FileRecordSetTest < ActiveSupport::TestCase
+  test "import uploads file data to blobs with regenerated keys" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+    old_key = "original-key-for-file"
+    file_content = "hello world file content"
+
+    zip = build_zip_with_blob_and_file(blob_id: blob_id, old_key: old_key, file_content: file_content)
+
+    Account::DataTransfer::ActiveStorage::BlobRecordSet.new(Current.account).import(from: zip)
+    Account::DataTransfer::ActiveStorage::FileRecordSet.new(Current.account).import(from: zip)
+
+    blob = ActiveStorage::Blob.find(blob_id)
+    assert_not_equal old_key, blob.key
+    assert_equal file_content, blob.download
+  end
+
+  test "import handles keys containing path separators" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+    old_key = "folder/subfolder/file-key"
+    file_content = "nested key content"
+
+    zip = build_zip_with_blob_and_file(blob_id: blob_id, old_key: old_key, file_content: file_content)
+
+    Account::DataTransfer::ActiveStorage::BlobRecordSet.new(Current.account).import(from: zip)
+    Account::DataTransfer::ActiveStorage::FileRecordSet.new(Current.account).import(from: zip)
+
+    blob = ActiveStorage::Blob.find(blob_id)
+    assert_not_equal old_key, blob.key
+    assert_equal file_content, blob.download
+  end
+
+  test "import raises IntegrityError for storage file without matching blob metadata" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+    old_key = "key-with-metadata"
+    orphan_key = "orphaned-storage-key"
+
+    zip = build_zip_with_orphaned_storage_file(
+      blob_id: blob_id,
+      old_key: old_key,
+      orphan_key: orphan_key
+    )
+
+    Account::DataTransfer::ActiveStorage::BlobRecordSet.new(Current.account).import(from: zip)
+
+    assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
+      Account::DataTransfer::ActiveStorage::FileRecordSet.new(Current.account).import(from: zip)
+    end
+  end
+
+  test "import raises IntegrityError when mapped blob is not found in database" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+    old_key = "key-for-missing-blob"
+
+    zip = build_zip_with_blob_and_file(blob_id: blob_id, old_key: old_key, file_content: "data")
+
+    # Import file data WITHOUT importing blob metadata first
+    assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
+      Account::DataTransfer::ActiveStorage::FileRecordSet.new(Current.account).import(from: zip)
+    end
+  end
+
+  test "check raises IntegrityError for storage file without matching blob metadata" do
+    blob_id = ActiveRecord::Type::Uuid.generate
+    old_key = "key-with-metadata"
+    orphan_key = "orphaned-storage-key"
+
+    zip = build_zip_with_orphaned_storage_file(
+      blob_id: blob_id,
+      old_key: old_key,
+      orphan_key: orphan_key
+    )
+
+    assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
+      Account::DataTransfer::ActiveStorage::FileRecordSet.new(Current.account).check(from: zip)
+    end
+  end
+
+  test "import raises IntegrityError for duplicate blob keys in export" do
+    blob_id_1 = ActiveRecord::Type::Uuid.generate
+    blob_id_2 = ActiveRecord::Type::Uuid.generate
+    duplicate_key = "same-key-for-both"
+
+    zip = build_zip_with_duplicate_keys(
+      blob_id_1: blob_id_1,
+      blob_id_2: blob_id_2,
+      key: duplicate_key
+    )
+
+    assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
+      Account::DataTransfer::ActiveStorage::FileRecordSet.new(Current.account).import(from: zip)
+    end
+  end
+
+  private
+    def build_zip_with_blob_and_file(blob_id:, old_key:, file_content:)
+      tempfile = Tempfile.new([ "test_export", ".zip" ])
+      tempfile.binmode
+
+      writer = ZipFile::Writer.new(tempfile)
+      writer.add_file("data/active_storage_blobs/#{blob_id}.json", {
+        id: blob_id,
+        account_id: ActiveRecord::Type::Uuid.generate,
+        byte_size: file_content.bytesize,
+        checksum: Digest::MD5.base64digest(file_content),
+        content_type: "text/plain",
+        created_at: Time.current.iso8601,
+        filename: "test.txt",
+        key: old_key,
+        metadata: {}
+      }.to_json)
+      writer.add_file("storage/#{old_key}", file_content, compress: false)
+      writer.close
+
+      tempfile.rewind
+      ZipFile::Reader.new(tempfile)
+    end
+
+    def build_zip_with_orphaned_storage_file(blob_id:, old_key:, orphan_key:)
+      tempfile = Tempfile.new([ "test_export", ".zip" ])
+      tempfile.binmode
+
+      writer = ZipFile::Writer.new(tempfile)
+      writer.add_file("data/active_storage_blobs/#{blob_id}.json", {
+        id: blob_id,
+        account_id: ActiveRecord::Type::Uuid.generate,
+        byte_size: 10,
+        checksum: "",
+        content_type: "text/plain",
+        created_at: Time.current.iso8601,
+        filename: "test.txt",
+        key: old_key,
+        metadata: {}
+      }.to_json)
+      writer.add_file("storage/#{old_key}", "file data", compress: false)
+      writer.add_file("storage/#{orphan_key}", "orphan data", compress: false)
+      writer.close
+
+      tempfile.rewind
+      ZipFile::Reader.new(tempfile)
+    end
+
+    def build_zip_with_duplicate_keys(blob_id_1:, blob_id_2:, key:)
+      tempfile = Tempfile.new([ "test_export", ".zip" ])
+      tempfile.binmode
+
+      writer = ZipFile::Writer.new(tempfile)
+      writer.add_file("data/active_storage_blobs/#{blob_id_1}.json", {
+        id: blob_id_1,
+        account_id: ActiveRecord::Type::Uuid.generate,
+        byte_size: 10,
+        checksum: "",
+        content_type: "text/plain",
+        created_at: Time.current.iso8601,
+        filename: "file1.txt",
+        key: key,
+        metadata: {}
+      }.to_json)
+      writer.add_file("data/active_storage_blobs/#{blob_id_2}.json", {
+        id: blob_id_2,
+        account_id: ActiveRecord::Type::Uuid.generate,
+        byte_size: 10,
+        checksum: "",
+        content_type: "text/plain",
+        created_at: Time.current.iso8601,
+        filename: "file2.txt",
+        key: key,
+        metadata: {}
+      }.to_json)
+      writer.add_file("storage/#{key}", "file data", compress: false)
+      writer.close
+
+      tempfile.rewind
+      ZipFile::Reader.new(tempfile)
+    end
+end
diff --git a/test/models/account/import_test.rb b/test/models/account/import_test.rb
index 7bf407041..de384b385 100644
--- a/test/models/account/import_test.rb
+++ b/test/models/account/import_test.rb
@@ -174,6 +174,52 @@ class Account::ImportTest < ActiveSupport::TestCase
     export_tempfile&.unlink
   end
 
+  test "export and import round-trip preserves blobs and attachments" do
+    source_account = accounts("37s")
+    exporter = users(:david)
+    identity = exporter.identity
+
+    ActiveStorage::Blob.create_and_upload!(
+      io: StringIO.new("test image data"),
+      filename: "logo.png",
+      content_type: "image/png"
+    )
+
+    source_blob_count = ActiveStorage::Blob.where(account: source_account).count
+    source_blob_keys = ActiveStorage::Blob.where(account: source_account).pluck(:key)
+
+    assert_operator source_blob_count, :>, 0
+
+    export = Account::Export.create!(account: source_account, user: exporter)
+    export.build
+
+    export_tempfile = Tempfile.new([ "export", ".zip" ])
+    export.file.open { |f| FileUtils.cp(f.path, export_tempfile.path) }
+
+    ActiveStorage::Blob.where(account: source_account).delete_all
+    source_account.destroy!
+
+    target_account = Account.create_with_owner(account: { name: "Import Test" }, owner: { identity: identity, name: exporter.name })
+    import = Account::Import.create!(identity: identity, account: target_account)
+    Current.set(account: target_account) do
+      import.file.attach(io: File.open(export_tempfile.path), filename: "export.zip", content_type: "application/zip")
+    end
+
+    import.check
+    assert_not import.failed?
+
+    import.process
+    assert import.completed?
+
+    imported_blob = ActiveStorage::Blob.find_by(account: target_account, filename: "logo.png")
+    assert_not_nil imported_blob
+    assert_not_includes source_blob_keys, imported_blob.key
+    assert_equal "test image data", imported_blob.download
+  ensure
+    export_tempfile&.close
+    export_tempfile&.unlink
+  end
+
   private
     def account_digest(account)
       {

From 8c2318e2674cbafed12cf63e9a1faac5b02eecdb Mon Sep 17 00:00:00 2001
From: Rob Zolkos <rob@zolkos.com>
Date: Tue, 10 Mar 2026 11:31:00 -0400
Subject: [PATCH 039/107] Add JSON response format to entropy endpoints (#2673)

* Add JSON response format to entropy endpoints

Add account settings JSON endpoint returning account info including auto_postpone_period. Add auto_postpone_period to board JSON responses. Add JSON update support to both account and board entropy controllers.

* Add auto_postpone_period to all board response examples in API docs

* Use auto_postpone_period_in_days in JSON responses and API docs

* Use valid period values in permission tests
---
 .../account/entropies_controller.rb           |  5 +-
 .../account/settings_controller.rb            |  5 +-
 .../boards/entropies_controller.rb            |  2 +-
 app/views/account/settings/show.json.jbuilder |  4 +-
 app/views/boards/_board.json.jbuilder         |  1 +
 docs/API.md                                   | 78 ++++++++++++++++++-
 .../accounts/entropies_controller_test.rb     | 19 ++++-
 .../accounts/settings_controller_test.rb      | 16 ++--
 test/controllers/api/flat_json_params_test.rb |  4 +-
 .../boards/entropies_controller_test.rb       | 29 ++++++-
 test/controllers/boards_controller_test.rb    |  1 +
 11 files changed, 143 insertions(+), 21 deletions(-)

diff --git a/app/controllers/account/entropies_controller.rb b/app/controllers/account/entropies_controller.rb
index 327098ee2..44c9debe5 100644
--- a/app/controllers/account/entropies_controller.rb
+++ b/app/controllers/account/entropies_controller.rb
@@ -4,11 +4,12 @@ class Account::EntropiesController < ApplicationController
   before_action :ensure_admin
 
   def update
-    Current.account.entropy.update!(entropy_params)
+    @account = Current.account
+    @account.entropy.update!(entropy_params)
 
     respond_to do |format|
       format.html { redirect_to account_settings_path, notice: "Account updated" }
-      format.json { head :no_content }
+      format.json { render "account/settings/show", status: :ok }
     end
   rescue ActiveRecord::RecordInvalid
     head :unprocessable_entity
diff --git a/app/controllers/account/settings_controller.rb b/app/controllers/account/settings_controller.rb
index 47036d606..e4b949070 100644
--- a/app/controllers/account/settings_controller.rb
+++ b/app/controllers/account/settings_controller.rb
@@ -5,7 +5,10 @@ class Account::SettingsController < ApplicationController
   before_action :set_account
 
   def show
-    @users = @account.users.active.alphabetically.includes(:identity)
+    respond_to do |format|
+      format.html { @users = @account.users.active.alphabetically.includes(:identity) }
+      format.json
+    end
   end
 
   def update
diff --git a/app/controllers/boards/entropies_controller.rb b/app/controllers/boards/entropies_controller.rb
index 132733aac..89e262545 100644
--- a/app/controllers/boards/entropies_controller.rb
+++ b/app/controllers/boards/entropies_controller.rb
@@ -10,7 +10,7 @@ class Boards::EntropiesController < ApplicationController
 
     respond_to do |format|
       format.turbo_stream
-      format.json { head :no_content }
+      format.json { render "boards/show", status: :ok }
     end
   rescue ActiveRecord::RecordInvalid
     head :unprocessable_entity
diff --git a/app/views/account/settings/show.json.jbuilder b/app/views/account/settings/show.json.jbuilder
index 9a62dabc6..55b623f9d 100644
--- a/app/views/account/settings/show.json.jbuilder
+++ b/app/views/account/settings/show.json.jbuilder
@@ -1 +1,3 @@
-json.(Current.account, :name)
+json.(@account, :id, :name, :cards_count)
+json.created_at @account.created_at.utc
+json.auto_postpone_period_in_days @account.entropy.auto_postpone_period_in_days
diff --git a/app/views/boards/_board.json.jbuilder b/app/views/boards/_board.json.jbuilder
index 7c85a1dc5..0eeff1896 100644
--- a/app/views/boards/_board.json.jbuilder
+++ b/app/views/boards/_board.json.jbuilder
@@ -1,6 +1,7 @@
 json.cache! board do
   json.(board, :id, :name, :all_access)
   json.created_at board.created_at.utc
+  json.auto_postpone_period_in_days board.auto_postpone_period_in_days
   json.url board_url(board)
 
   json.creator board.creator, partial: "users/user", as: :user
diff --git a/docs/API.md b/docs/API.md
index cec58f36e..e8b60697c 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -434,6 +434,7 @@ __Response:__
     "name": "Fizzy",
     "all_access": true,
     "created_at": "2025-12-05T19:36:35.534Z",
+    "auto_postpone_period_in_days": 30,
     "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcm",
     "creator": {
       "id": "03f5v9zjw7pz8717a4no1h8a7",
@@ -460,6 +461,7 @@ __Response:__
   "name": "Fizzy",
   "all_access": true,
   "created_at": "2025-12-05T19:36:35.534Z",
+  "auto_postpone_period_in_days": 30,
   "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcm",
   "creator": {
     "id": "03f5v9zjw7pz8717a4no1h8a7",
@@ -484,7 +486,7 @@ Creates a new Board in the account.
 |-----------|------|----------|-------------|
 | `name` | string | Yes | The name of the board |
 | `all_access` | boolean | No | Whether any user in the account can access this board. Defaults to `true` |
-| `auto_postpone_period` | integer | No | Number of days of inactivity before cards are automatically postponed |
+| `auto_postpone_period_in_days` | integer | No | Number of days of inactivity before cards are automatically postponed (e.g. `30`) |
 | `public_description` | string | No | Rich text description shown on the public board page |
 
 __Request:__
@@ -514,7 +516,7 @@ Updates a Board. Only board administrators can update a board.
 |-----------|------|----------|-------------|
 | `name` | string | No | The name of the board |
 | `all_access` | boolean | No | Whether any user in the account can access this board |
-| `auto_postpone_period` | integer | No | Number of days of inactivity before cards are automatically postponed |
+| `auto_postpone_period_in_days` | integer | No | Number of days of inactivity before cards are automatically postponed (e.g. `30`) |
 | `public_description` | string | No | Rich text description shown on the public board page |
 | `user_ids` | array | No | Array of *all* user IDs who should have access to this board (only applicable when `all_access` is `false`) |
 
@@ -524,7 +526,7 @@ __Request:__
 {
   "board": {
     "name": "Updated board name",
-    "auto_postpone_period": 14,
+    "auto_postpone_period_in_days": 30,
     "public_description": "This is a **public** description of the board.",
     "all_access": false,
     "user_ids": [
@@ -567,6 +569,7 @@ HTTP/1.1 201 Created
   "name": "Fizzy",
   "all_access": true,
   "created_at": "2025-12-05T19:36:35.534Z",
+  "auto_postpone_period_in_days": 30,
   "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcm",
   "creator": {
     "id": "03f5v9zjw7pz8717a4no1h8a7",
@@ -591,6 +594,72 @@ __Response:__
 
 Returns `204 No Content` on success.
 
+## Account
+
+### `GET /account/settings`
+
+Returns the current account.
+
+__Response:__
+
+```json
+{
+  "id": "03f5v9zjvypwh0t0e2rfh0h7k",
+  "name": "37signals",
+  "cards_count": 5,
+  "created_at": "2025-12-05T19:36:35.401Z",
+  "auto_postpone_period_in_days": 30
+}
+```
+
+The `auto_postpone_period_in_days` is the account-level default in days (e.g. `30`). Cards are automatically moved to "Not Now" after this period of inactivity. Each board can override this with its own value.
+
+### `PUT /account/entropy`
+
+Updates the account-level default auto close period. Requires admin role.
+
+__Request:__
+
+```json
+{
+  "entropy": {
+    "auto_postpone_period_in_days": 30
+  }
+}
+```
+
+__Response:__
+
+Returns the account object:
+
+```json
+{
+  "id": "03f5v9zjvypwh0t0e2rfh0h7k",
+  "name": "37signals",
+  "cards_count": 5,
+  "created_at": "2025-12-05T19:36:35.401Z",
+  "auto_postpone_period_in_days": 30
+}
+```
+
+### `PUT /:account_slug/boards/:board_id/entropy`
+
+Updates the auto close period for a specific board. Requires board admin permission.
+
+__Request:__
+
+```json
+{
+  "board": {
+    "auto_postpone_period_in_days": 90
+  }
+}
+```
+
+__Response:__
+
+Returns the board object.
+
 ## Webhooks
 
 Webhooks notify another application when something happens on a board. Only account admins can list, view, create, update, delete, or reactivate webhooks.
@@ -757,6 +826,7 @@ __Response:__
       "name": "Fizzy",
       "all_access": true,
       "created_at": "2025-12-05T19:36:35.534Z",
+      "auto_postpone_period_in_days": 30,
       "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcm",
       "creator": {
         "id": "03f5v9zjw7pz8717a4no1h8a7",
@@ -810,6 +880,7 @@ __Response:__
     "name": "Fizzy",
     "all_access": true,
     "created_at": "2025-12-05T19:36:35.534Z",
+    "auto_postpone_period_in_days": 30,
     "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcm",
     "creator": {
       "id": "03f5v9zjw7pz8717a4no1h8a7",
@@ -1077,6 +1148,7 @@ __Response:__
       "name": "Fizzy",
       "all_access": true,
       "created_at": "2025-12-05T19:36:35.534Z",
+      "auto_postpone_period_in_days": 30,
       "url": "http://fizzy.localhost:3006/897362094/boards/03f5v9zkft4hj9qq0lsn9ohcm",
       "creator": {
         "id": "03f5v9zjw7pz8717a4no1h8a7",
diff --git a/test/controllers/accounts/entropies_controller_test.rb b/test/controllers/accounts/entropies_controller_test.rb
index d00c0d768..fa2819d48 100644
--- a/test/controllers/accounts/entropies_controller_test.rb
+++ b/test/controllers/accounts/entropies_controller_test.rb
@@ -16,8 +16,9 @@ class Account::EntropiesControllerTest < ActionDispatch::IntegrationTest
   test "update as JSON" do
     put account_entropy_path, params: { entropy: { auto_postpone_period_in_days: 7 } }, as: :json
 
-    assert_response :no_content
+    assert_response :success
     assert_equal 7.days, entropies("37s_account").reload.auto_postpone_period
+    assert_equal 7, @response.parsed_body["auto_postpone_period_in_days"]
   end
 
   test "update requires admin" do
@@ -35,4 +36,20 @@ class Account::EntropiesControllerTest < ActionDispatch::IntegrationTest
     assert_response :unprocessable_entity
     assert_equal original_period, entropies("37s_account").reload.auto_postpone_period
   end
+
+  test "update as JSON rejects invalid auto_postpone_period" do
+    original_period = entropies("37s_account").auto_postpone_period
+
+    put account_entropy_path, params: { entropy: { auto_postpone_period_in_days: 1 } }, as: :json
+
+    assert_response :unprocessable_entity
+    assert_equal original_period, entropies("37s_account").reload.auto_postpone_period
+  end
+
+  test "update as JSON requires admin" do
+    logout_and_sign_in_as :david
+
+    put account_entropy_path, params: { entropy: { auto_postpone_period_in_days: 7 } }, as: :json
+    assert_response :forbidden
+  end
 end
diff --git a/test/controllers/accounts/settings_controller_test.rb b/test/controllers/accounts/settings_controller_test.rb
index 6f3fba5b0..88a6ef137 100644
--- a/test/controllers/accounts/settings_controller_test.rb
+++ b/test/controllers/accounts/settings_controller_test.rb
@@ -16,13 +16,6 @@ class Account::SettingsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to account_settings_path
   end
 
-  test "show as JSON" do
-    get account_settings_path, as: :json
-    assert_response :success
-
-    assert_equal Current.account.name, @response.parsed_body["name"]
-  end
-
   test "update as JSON" do
     put account_settings_path, params: { account: { name: "New Account Name" } }, as: :json
 
@@ -36,4 +29,13 @@ class Account::SettingsControllerTest < ActionDispatch::IntegrationTest
     put account_settings_path, params: { account: { name: "New Account Name" } }
     assert_response :forbidden
   end
+
+  test "show as JSON" do
+    get account_settings_path, as: :json
+
+    assert_response :success
+    assert_equal Current.account.name, @response.parsed_body["name"]
+    assert_equal Current.account.cards_count, @response.parsed_body["cards_count"]
+    assert_equal Current.account.entropy.auto_postpone_period_in_days, @response.parsed_body["auto_postpone_period_in_days"]
+  end
 end
diff --git a/test/controllers/api/flat_json_params_test.rb b/test/controllers/api/flat_json_params_test.rb
index 90f55f8fd..7a9a5ea5d 100644
--- a/test/controllers/api/flat_json_params_test.rb
+++ b/test/controllers/api/flat_json_params_test.rb
@@ -41,14 +41,14 @@ class FlatJsonParamsTest < ActionDispatch::IntegrationTest
 
     put board_entropy_path(board), params: { auto_postpone_period_in_days: 90 }, as: :json
 
-    assert_response :no_content
+    assert_response :success
     assert_equal 90.days, board.entropy.reload.auto_postpone_period
   end
 
   test "update account entropy with flat JSON" do
     put account_entropy_path, params: { auto_postpone_period_in_days: 7 }, as: :json
 
-    assert_response :no_content
+    assert_response :success
     assert_equal 7.days, Current.account.entropy.reload.auto_postpone_period
   end
 
diff --git a/test/controllers/boards/entropies_controller_test.rb b/test/controllers/boards/entropies_controller_test.rb
index e0fd4fa52..4173694ca 100644
--- a/test/controllers/boards/entropies_controller_test.rb
+++ b/test/controllers/boards/entropies_controller_test.rb
@@ -17,10 +17,13 @@ class Boards::EntropiesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "update as JSON" do
-    put board_entropy_path(@board), params: { board: { auto_postpone_period_in_days: 90 } }, as: :json
+    assert_no_difference -> { Current.account.entropy.reload.auto_postpone_period } do
+      put board_entropy_path(@board), params: { board: { auto_postpone_period_in_days: 90 } }, as: :json
 
-    assert_response :no_content
-    assert_equal 90.days, @board.entropy.reload.auto_postpone_period
+      assert_response :success
+      assert_equal 90.days, @board.entropy.reload.auto_postpone_period
+      assert_equal 90, @response.parsed_body["auto_postpone_period_in_days"]
+    end
   end
 
   test "update requires board admin permission" do
@@ -42,4 +45,24 @@ class Boards::EntropiesControllerTest < ActionDispatch::IntegrationTest
     assert_response :unprocessable_entity
     assert_equal original_period, @board.entropy.reload.auto_postpone_period
   end
+
+  test "update as JSON rejects invalid auto_postpone_period" do
+    original_period = @board.entropy.auto_postpone_period
+
+    put board_entropy_path(@board), params: { board: { auto_postpone_period_in_days: 1 } }, as: :json
+
+    assert_response :unprocessable_entity
+    assert_equal original_period, @board.entropy.reload.auto_postpone_period
+  end
+
+  test "update as JSON requires board admin permission" do
+    logout_and_sign_in_as :jz
+
+    original_period = @board.entropy.auto_postpone_period
+
+    put board_entropy_path(@board), params: { board: { auto_postpone_period_in_days: 7 } }, as: :json
+
+    assert_response :forbidden
+    assert_equal original_period, @board.entropy.reload.auto_postpone_period
+  end
 end
diff --git a/test/controllers/boards_controller_test.rb b/test/controllers/boards_controller_test.rb
index 915310108..059c38026 100644
--- a/test/controllers/boards_controller_test.rb
+++ b/test/controllers/boards_controller_test.rb
@@ -258,6 +258,7 @@ class BoardsControllerTest < ActionDispatch::IntegrationTest
     get board_path(boards(:writebook)), as: :json
     assert_response :success
     assert_equal boards(:writebook).name, @response.parsed_body["name"]
+    assert_equal boards(:writebook).auto_postpone_period_in_days, @response.parsed_body["auto_postpone_period_in_days"]
   end
 
   test "show as JSON includes public_url when published" do

From 66039c92f3c30487551202b79efe035395c8d7d8 Mon Sep 17 00:00:00 2001
From: Rosa Gutierrez <rosa@37signals.com>
Date: Tue, 10 Mar 2026 15:27:42 +0100
Subject: [PATCH 040/107] Use x_user_agent cookie for platform detection in
 Hotwire Native

Turbo's offline/service worker sets an x_user_agent cookie with the
original browser user agent. This ensures platform detection works
correctly for Hotwire Native apps where service worker requests may
not carry the overridden user agent header.
---
 app/controllers/concerns/set_platform.rb      |  2 +-
 .../controllers/concerns/set_platform_test.rb | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 test/controllers/concerns/set_platform_test.rb

diff --git a/app/controllers/concerns/set_platform.rb b/app/controllers/concerns/set_platform.rb
index 54e77d517..66de85f12 100644
--- a/app/controllers/concerns/set_platform.rb
+++ b/app/controllers/concerns/set_platform.rb
@@ -7,6 +7,6 @@ module SetPlatform
 
   private
     def platform
-      @platform ||= ApplicationPlatform.new(request.user_agent)
+      @platform ||= ApplicationPlatform.new(cookies[:x_user_agent].presence || request.user_agent)
     end
 end
diff --git a/test/controllers/concerns/set_platform_test.rb b/test/controllers/concerns/set_platform_test.rb
new file mode 100644
index 000000000..26ce9d66a
--- /dev/null
+++ b/test/controllers/concerns/set_platform_test.rb
@@ -0,0 +1,21 @@
+require "test_helper"
+
+class SetPlatformTest < ActionDispatch::IntegrationTest
+  DESKTOP_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+  NATIVE_IOS_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Hotwire Native iOS/1.0"
+
+  test "uses the request user agent by default" do
+    sign_in_as :david
+
+    get board_path(boards(:writebook)), headers: { "User-Agent" => DESKTOP_UA }
+    assert_match 'data-platform="desktop web"', response.body
+  end
+
+  test "prefers x_user_agent cookie over request user agent" do
+    sign_in_as :david
+
+    cookies[:x_user_agent] = NATIVE_IOS_UA
+    get board_path(boards(:writebook)), headers: { "User-Agent" => DESKTOP_UA }
+    assert_match 'data-platform="native ios"', response.body
+  end
+end

From 0f5216f4332da48b579b429a5bdd795f0c4303a5 Mon Sep 17 00:00:00 2001
From: Jeffrey Hardy <jeff@37signals.com>
Date: Tue, 10 Mar 2026 14:44:50 -0400
Subject: [PATCH 041/107] Fix that the "maybe" stream wouldn't be replaced
 after triaging a card

The element was originally named "the-stream" and later renamed to "maybe",
but the original references weren't updated.

Refs:
- https://github.com/basecamp/fizzy/pull/2211
- https://github.com/basecamp/fizzy/commit/b3cfae35
---
 app/views/boards/show/_stream.html.erb            | 2 +-
 app/views/cards/closures/create.turbo_stream.erb  | 2 +-
 app/views/cards/closures/destroy.turbo_stream.erb | 2 +-
 app/views/cards/not_nows/create.turbo_stream.erb  | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/views/boards/show/_stream.html.erb b/app/views/boards/show/_stream.html.erb
index b43309100..f66fb8fa6 100644
--- a/app/views/boards/show/_stream.html.erb
+++ b/app/views/boards/show/_stream.html.erb
@@ -12,7 +12,7 @@
   </div>
   <div class="cards__list hide-scrollbar" data-drag-drop-item-container>
     <% if page.used? %>
-      <%= with_automatic_pagination "maybe", @page do %>
+      <%= with_automatic_pagination "maybe", page do %>
         <%= render "cards/display/previews", cards: page.records, draggable: true %>
       <% end %>
     <% end %>
diff --git a/app/views/cards/closures/create.turbo_stream.erb b/app/views/cards/closures/create.turbo_stream.erb
index c4898e471..5b76efe7b 100644
--- a/app/views/cards/closures/create.turbo_stream.erb
+++ b/app/views/cards/closures/create.turbo_stream.erb
@@ -3,7 +3,7 @@
 <% if @source_column %>
   <%= turbo_stream.replace(dom_id(@source_column), partial: "boards/show/column", method: :morph, locals: { column: @source_column }) %>
 <% elsif @was_in_stream %>
-  <%= turbo_stream.replace("the-stream", partial: "boards/show/stream", method: :morph, locals: { board: @card.board, page: @page }) %>
+  <%= turbo_stream.replace("maybe", partial: "boards/show/stream", method: :morph, locals: { board: @card.board, page: @page }) %>
 <% end %>
 
 <%= turbo_stream.replace([ @card, :card_container ], partial: "cards/container", method: :morph, locals: { card: @card.reload }) %>
diff --git a/app/views/cards/closures/destroy.turbo_stream.erb b/app/views/cards/closures/destroy.turbo_stream.erb
index 8df408979..31a9e41c3 100644
--- a/app/views/cards/closures/destroy.turbo_stream.erb
+++ b/app/views/cards/closures/destroy.turbo_stream.erb
@@ -3,7 +3,7 @@
 <% if @card.column %>
   <%= turbo_stream.replace(dom_id(@card.column), partial: "boards/show/column", method: :morph, locals: { column: @card.column }) %>
 <% elsif @card.awaiting_triage? %>
-  <%= turbo_stream.replace("the-stream", partial: "boards/show/stream", method: :morph, locals: { board: @card.board, page: @page }) %>
+  <%= turbo_stream.replace("maybe", partial: "boards/show/stream", method: :morph, locals: { board: @card.board, page: @page }) %>
 <% end %>
 
 <%= turbo_stream.replace([ @card, :card_container ], partial: "cards/container", method: :morph, locals: { card: @card.reload }) %>
diff --git a/app/views/cards/not_nows/create.turbo_stream.erb b/app/views/cards/not_nows/create.turbo_stream.erb
index 9128580e2..945d86ab2 100644
--- a/app/views/cards/not_nows/create.turbo_stream.erb
+++ b/app/views/cards/not_nows/create.turbo_stream.erb
@@ -3,7 +3,7 @@
 <% if @source_column %>
   <%= turbo_stream.replace(dom_id(@source_column), partial: "boards/show/column", method: :morph, locals: { column: @source_column }) %>
 <% elsif @was_in_stream %>
-  <%= turbo_stream.replace("the-stream", partial: "boards/show/stream", method: :morph, locals: { board: @card.board, page: @page }) %>
+  <%= turbo_stream.replace("maybe", partial: "boards/show/stream", method: :morph, locals: { board: @card.board, page: @page }) %>
 <% end %>
 
 <%= turbo_stream.replace([ @card, :card_container ], partial: "cards/container", method: :morph, locals: { card: @card.reload }) %>

From 8fb57ace010e462811a41ad1266bdbf4b699c29b Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Mon, 9 Mar 2026 16:13:18 -0400
Subject: [PATCH 042/107] Validate polymorphic types against importable models
 allowlist

Add IMPORTABLE_MODEL_NAMES to RecordSet and verify polymorphic type
columns during import check against this allowlist before calling
constantize. This prevents arbitrary class instantiation from
untrusted import ZIP data.
---
 .../account/data_transfer/record_set.rb       | 45 +++++++++-
 .../account/data_transfer/record_set_test.rb  | 89 +++++++++++++++++++
 2 files changed, 133 insertions(+), 1 deletion(-)
 create mode 100644 test/models/account/data_transfer/record_set_test.rb

diff --git a/app/models/account/data_transfer/record_set.rb b/app/models/account/data_transfer/record_set.rb
index 8eeafbe10..2d64d2e1c 100644
--- a/app/models/account/data_transfer/record_set.rb
+++ b/app/models/account/data_transfer/record_set.rb
@@ -4,6 +4,41 @@ class Account::DataTransfer::RecordSet
 
   IMPORT_BATCH_SIZE = 100
 
+  IMPORTABLE_MODEL_NAMES = %w[
+    Access
+    Account
+    ActionText::RichText
+    ActiveStorage::Attachment
+    ActiveStorage::Blob
+    Assignment
+    Board
+    Board::Publication
+    Card
+    Card::ActivitySpike
+    Card::Goldness
+    Card::NotNow
+    Closure
+    Column
+    Comment
+    Entropy
+    Event
+    Filter
+    Mention
+    Notification
+    Notification::Bundle
+    Pin
+    Reaction
+    Step
+    Tag
+    Tagging
+    User
+    User::Settings
+    Watch
+    Webhook
+    Webhook::DelinquencyTracker
+    Webhook::Delivery
+  ].freeze
+
   attr_reader :account, :model, :attributes
 
   def initialize(account:, model:, attributes: nil)
@@ -113,7 +148,7 @@ class Account::DataTransfer::RecordSet
     def check_association_doesnt_exist(data, association, associated_id)
       if association.polymorphic?
         type_column = association.foreign_type.to_s
-        associated_class = data[type_column].constantize
+        associated_class = verify_model_type(data[type_column])
       else
         associated_class = association.klass
       end
@@ -123,6 +158,14 @@ class Account::DataTransfer::RecordSet
       end
     end
 
+    def verify_model_type(type_name)
+      if IMPORTABLE_MODEL_NAMES.include?(type_name)
+        type_name.constantize
+      else
+        raise IntegrityError, "Unrecognized model type: #{type_name}"
+      end
+    end
+
     def skip_to(file_list, last_id)
       index = file_list.index(last_id)
 
diff --git a/test/models/account/data_transfer/record_set_test.rb b/test/models/account/data_transfer/record_set_test.rb
new file mode 100644
index 000000000..74b457edf
--- /dev/null
+++ b/test/models/account/data_transfer/record_set_test.rb
@@ -0,0 +1,89 @@
+require "test_helper"
+
+class Account::DataTransfer::RecordSetTest < ActiveSupport::TestCase
+  test "check rejects polymorphic type not in the importable models allowlist" do
+    event_data = build_event_data(eventable_type: "Identity")
+
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+
+    error = assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
+      record_set.check(from: build_reader(dir: "events", data: event_data))
+    end
+
+    assert_match(/unrecognized.*type/i, error.message)
+  end
+
+  test "check rejects nonexistent polymorphic type" do
+    event_data = build_event_data(eventable_type: "Nonexistent::ClassName")
+
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+
+    error = assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
+      record_set.check(from: build_reader(dir: "events", data: event_data))
+    end
+
+    assert_match(/unrecognized.*type/i, error.message)
+  end
+
+  test "check rejects non-ActiveRecord class used as polymorphic type" do
+    event_data = build_event_data(eventable_type: "ActiveSupport::BroadcastLogger")
+
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+
+    error = assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
+      record_set.check(from: build_reader(dir: "events", data: event_data))
+    end
+
+    assert_match(/unrecognized.*type/i, error.message)
+  end
+
+  test "check accepts polymorphic type in the importable models allowlist" do
+    event_data = build_event_data(eventable_type: "Card")
+
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+
+    assert_nothing_raised do
+      record_set.check(from: build_reader(dir: "events", data: event_data))
+    end
+  end
+
+  private
+    def importing_account
+      @importing_account ||= Account.create!(name: "Importing Account", external_account_id: 99999999)
+    end
+
+    def build_event_data(eventable_type:)
+      {
+        "id" => "test_event_id_12345678901234",
+        "account_id" => "nonexistent_account_id_1234567",
+        "board_id" => "nonexistent_board_id_12345678",
+        "creator_id" => "nonexistent_user_id_123456789",
+        "eventable_type" => eventable_type,
+        "eventable_id" => "nonexistent_id_1234567890123",
+        "action" => "created",
+        "particulars" => "{}",
+        "created_at" => Time.current.iso8601,
+        "updated_at" => Time.current.iso8601
+      }
+    end
+
+    def build_reader(dir:, data:)
+      tempfile = Tempfile.new([ "import_test", ".zip" ])
+      tempfile.binmode
+
+      writer = ZipFile::Writer.new(tempfile)
+      writer.add_file("data/#{dir}/#{data['id']}.json", data.to_json)
+      writer.close
+      tempfile.rewind
+
+      @tempfiles ||= []
+      @tempfiles << tempfile
+
+      ZipFile::Reader.new(tempfile)
+    end
+
+    def teardown
+      @tempfiles&.each { |f| f.close; f.unlink }
+      @importing_account&.destroy
+    end
+end

From b4fd22644c7e1d2311431254a26d36d141e711b3 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Tue, 10 Mar 2026 09:48:23 +0100
Subject: [PATCH 043/107] Set the list of importable models based on the record
 sets in the manifest

---
 app/models/account/data_transfer/manifest.rb  | 42 +++++++++++++++----
 .../account/data_transfer/record_set.rb       | 41 ++----------------
 .../action_text/rich_text_record_set_test.rb  |  1 +
 .../account/data_transfer/record_set_test.rb  | 12 ++++--
 4 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/app/models/account/data_transfer/manifest.rb b/app/models/account/data_transfer/manifest.rb
index 2159926d5..9de76f9bf 100644
--- a/app/models/account/data_transfer/manifest.rb
+++ b/app/models/account/data_transfer/manifest.rb
@@ -26,20 +26,42 @@ class Account::DataTransfer::Manifest
       [
         Account::DataTransfer::AccountRecordSet.new(account),
         Account::DataTransfer::UserRecordSet.new(account),
-        *build_record_sets(::User::Settings, ::Tag, ::Board, ::Column),
+        *build_record_sets(
+          ::User::Settings,
+          ::Tag,
+          ::Board,
+          ::Column
+        ),
         Account::DataTransfer::EntropyRecordSet.new(account),
         *build_record_sets(
-          ::Board::Publication, ::Webhook, ::Access, ::Card, ::Comment, ::Step,
-          ::Assignment, ::Tagging, ::Closure, ::Card::Goldness, ::Card::NotNow,
-          ::Card::ActivitySpike, ::Watch, ::Pin, ::Reaction, ::Mention,
-          ::Filter, ::Webhook::DelinquencyTracker, ::Event,
-          ::Notification, ::Notification::Bundle, ::Webhook::Delivery
+          ::Board::Publication,
+          ::Webhook,
+          ::Access,
+          ::Card,
+          ::Comment,
+          ::Step,
+          ::Assignment,
+          ::Tagging,
+          ::Closure,
+          ::Card::Goldness,
+          ::Card::NotNow,
+          ::Card::ActivitySpike,
+          ::Watch,
+          ::Pin,
+          ::Reaction,
+          ::Mention,
+          ::Filter,
+          ::Webhook::DelinquencyTracker,
+          ::Event,
+          ::Notification,
+          ::Notification::Bundle,
+          ::Webhook::Delivery
         ),
         Account::DataTransfer::ActiveStorage::BlobRecordSet.new(account),
         *build_record_sets(::ActiveStorage::Attachment),
         Account::DataTransfer::ActionText::RichTextRecordSet.new(account),
         Account::DataTransfer::ActiveStorage::FileRecordSet.new(account)
-      ]
+      ].then { set_importable_model_names(it) }
     end
 
     def build_record_sets(*models)
@@ -47,4 +69,10 @@ class Account::DataTransfer::Manifest
         Account::DataTransfer::RecordSet.new(account: account, model: model)
       end
     end
+
+    def set_importable_model_names(record_sets)
+      model_names = record_sets.filter_map { |record_set| record_set.model&.name }
+      record_sets.each { |record_set| record_set.importable_model_names = model_names }
+      record_sets
+    end
 end
diff --git a/app/models/account/data_transfer/record_set.rb b/app/models/account/data_transfer/record_set.rb
index 2d64d2e1c..2fba9402d 100644
--- a/app/models/account/data_transfer/record_set.rb
+++ b/app/models/account/data_transfer/record_set.rb
@@ -4,47 +4,14 @@ class Account::DataTransfer::RecordSet
 
   IMPORT_BATCH_SIZE = 100
 
-  IMPORTABLE_MODEL_NAMES = %w[
-    Access
-    Account
-    ActionText::RichText
-    ActiveStorage::Attachment
-    ActiveStorage::Blob
-    Assignment
-    Board
-    Board::Publication
-    Card
-    Card::ActivitySpike
-    Card::Goldness
-    Card::NotNow
-    Closure
-    Column
-    Comment
-    Entropy
-    Event
-    Filter
-    Mention
-    Notification
-    Notification::Bundle
-    Pin
-    Reaction
-    Step
-    Tag
-    Tagging
-    User
-    User::Settings
-    Watch
-    Webhook
-    Webhook::DelinquencyTracker
-    Webhook::Delivery
-  ].freeze
-
+  attr_accessor :importable_model_names
   attr_reader :account, :model, :attributes
 
-  def initialize(account:, model:, attributes: nil)
+  def initialize(account:, model:, attributes: nil, importable_model_names: nil)
     @account = account
     @model = model
     @attributes = (attributes || model.column_names).map(&:to_s)
+    @importable_model_names = importable_model_names || [ model.name ]
   end
 
   def export(to:, start: nil)
@@ -159,7 +126,7 @@ class Account::DataTransfer::RecordSet
     end
 
     def verify_model_type(type_name)
-      if IMPORTABLE_MODEL_NAMES.include?(type_name)
+      if importable_model_names.include?(type_name)
         type_name.constantize
       else
         raise IntegrityError, "Unrecognized model type: #{type_name}"
diff --git a/test/models/account/data_transfer/action_text/rich_text_record_set_test.rb b/test/models/account/data_transfer/action_text/rich_text_record_set_test.rb
index a28935a3e..2fe2c4b93 100644
--- a/test/models/account/data_transfer/action_text/rich_text_record_set_test.rb
+++ b/test/models/account/data_transfer/action_text/rich_text_record_set_test.rb
@@ -30,6 +30,7 @@ class Account::DataTransfer::ActionText::RichTextRecordSetTest < ActiveSupport::
     reader = ZipFile::Reader.new(tempfile)
 
     record_set = Account::DataTransfer::ActionText::RichTextRecordSet.new(importing_account)
+    record_set.importable_model_names = %w[ ActionText::RichText Card ]
 
     error = assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
       record_set.check(from: reader)
diff --git a/test/models/account/data_transfer/record_set_test.rb b/test/models/account/data_transfer/record_set_test.rb
index 74b457edf..8c8d75e5e 100644
--- a/test/models/account/data_transfer/record_set_test.rb
+++ b/test/models/account/data_transfer/record_set_test.rb
@@ -1,10 +1,14 @@
 require "test_helper"
 
 class Account::DataTransfer::RecordSetTest < ActiveSupport::TestCase
+  setup do
+    @importable_model_names = %w[ Card Board Event ]
+  end
+
   test "check rejects polymorphic type not in the importable models allowlist" do
     event_data = build_event_data(eventable_type: "Identity")
 
-    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event, importable_model_names: @importable_model_names)
 
     error = assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
       record_set.check(from: build_reader(dir: "events", data: event_data))
@@ -16,7 +20,7 @@ class Account::DataTransfer::RecordSetTest < ActiveSupport::TestCase
   test "check rejects nonexistent polymorphic type" do
     event_data = build_event_data(eventable_type: "Nonexistent::ClassName")
 
-    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event, importable_model_names: @importable_model_names)
 
     error = assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
       record_set.check(from: build_reader(dir: "events", data: event_data))
@@ -28,7 +32,7 @@ class Account::DataTransfer::RecordSetTest < ActiveSupport::TestCase
   test "check rejects non-ActiveRecord class used as polymorphic type" do
     event_data = build_event_data(eventable_type: "ActiveSupport::BroadcastLogger")
 
-    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event, importable_model_names: @importable_model_names)
 
     error = assert_raises(Account::DataTransfer::RecordSet::IntegrityError) do
       record_set.check(from: build_reader(dir: "events", data: event_data))
@@ -40,7 +44,7 @@ class Account::DataTransfer::RecordSetTest < ActiveSupport::TestCase
   test "check accepts polymorphic type in the importable models allowlist" do
     event_data = build_event_data(eventable_type: "Card")
 
-    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event)
+    record_set = Account::DataTransfer::RecordSet.new(account: importing_account, model: Event, importable_model_names: @importable_model_names)
 
     assert_nothing_raised do
       record_set.check(from: build_reader(dir: "events", data: event_data))

From 99e5af6f9525172f7c22bbfbc5a1998c062825df Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Wed, 11 Mar 2026 13:19:48 +0100
Subject: [PATCH 044/107] Tweak the layout

... left aligning
---
 app/assets/stylesheets/card-perma.css | 77 +++++++++++++++++++++------
 1 file changed, 60 insertions(+), 17 deletions(-)

diff --git a/app/assets/stylesheets/card-perma.css b/app/assets/stylesheets/card-perma.css
index 3dc16d5a2..5db9e7df7 100644
--- a/app/assets/stylesheets/card-perma.css
+++ b/app/assets/stylesheets/card-perma.css
@@ -156,37 +156,74 @@
       @media (max-width: 639px) {
         --meta-spacer-block: 0.75ch;
 
-        inline-size: 100%;
-        grid-template-areas:
-          "avatars-author text-added"
-          "avatars-author text-author"
-          "text-updated text-updated"
-          "text-assignees text-assignees"
-          "avatars-assignees avatars-assignees";
-        grid-template-columns: auto 1fr;
+        min-inline-size: 0;
+        gap: calc(var(--meta-spacer-block) / 2);
+        display: flex;
+        flex-wrap: wrap;
 
         .card__meta-text {
           border: 0;
           padding: 0;
         }
 
-        .card__meta-text + .card__meta-text {
+        .card__meta-avatars--author {
+          --btn-size: 1.5em;
+
+          display: initial;
+          margin-inline-end: unset;
+          order: 3;
+        }
+
+        .card__meta-text--added {
+          inline-size: 100%;
+          order: 1;
+        }
+
+        .card__meta-text--author {
+          order: 2;
+        }
+
+        .card__meta-text--updated {
           border-block-start: var(--card-border);
-          margin-block-start: var(--meta-spacer-block);
+          inline-size: 100%;
+          margin-block-start: calc(var(--meta-spacer-block) * 0.5);
+          order: 4;
           padding-block-start: var(--meta-spacer-block);
         }
 
+        .card__meta-text--assignees {
+          margin-block-start: calc(var(--meta-spacer-block) * 3);
+          order: 6;
+          white-space: unset !important;
+        }
+
         .card__meta-avatars--assignees {
-          margin-inline: 0;
-          margin-block-start: var(--meta-spacer-block);
+          margin-inline: 0 var(--meta-spacer-inline);
+          margin-block-start: calc(var(--meta-spacer-block) * 3);
+          order: 5;
+
+          .avatar {
+            display: grid;
+          }
         }
 
-        .card__meta-avatars--author {
-          display: initial;
-        }
+        &:has(.card__meta-avatars--assignees .avatar) {
+          .card__meta-text--assignees {
+            order: 5;
+          }
 
-        .card__meta-avatars--assignees .avatar {
-          display: grid;
+          .card__meta-avatars--assignees {
+            margin-block-start: var(--meta-spacer-block);
+            order: 6;
+          }
+        }
+      }
+    }
+
+    &:has(.card__closed) .card__meta {
+      @media (max-width: 639px) {
+        .card__meta-avatars--assignees {
+          display: none;
         }
       }
     }
@@ -252,10 +289,16 @@
       @media (max-width: 639px) {
         display: grid;
         font-size: var(--text-x-small);
+        gap: 1ch 0;
         grid-template-columns: 1fr auto;
         grid-template-areas:
           "meta bg-zoom"
           "meta reactions";
+
+        &:not(:has(.reaction)),
+        &:has(.card__background) {
+          column-gap: 2ch;
+        }
       }
     }
 

From 7a6c905a323b91f6a6f3678692a26e480f089e3c Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Wed, 11 Mar 2026 13:20:40 +0100
Subject: [PATCH 045/107] Prevent line breaks in the middle of familiar_name

---
 app/models/user/named.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/models/user/named.rb b/app/models/user/named.rb
index d052a79ad..73cc763de 100644
--- a/app/models/user/named.rb
+++ b/app/models/user/named.rb
@@ -20,6 +20,6 @@ module User::Named
   def familiar_name
     names = name.split
     return name if names.length <= 1
-    "#{names.first} #{names[1..].map { |n| "#{n[0]}." }.join}"
+    "#{names.first}&nbsp;#{names[1..].map { |n| "#{n[0]}." }.join}".html_safe
   end
 end

From 31975be1fa3c737718a90d153f21617fd59d0eb5 Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrimaston@gmail.com>
Date: Wed, 11 Mar 2026 13:36:09 +0100
Subject: [PATCH 046/107] Update app/models/user/named.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 app/models/user/named.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/models/user/named.rb b/app/models/user/named.rb
index 73cc763de..804e516ee 100644
--- a/app/models/user/named.rb
+++ b/app/models/user/named.rb
@@ -20,6 +20,6 @@ module User::Named
   def familiar_name
     names = name.split
     return name if names.length <= 1
-    "#{names.first}&nbsp;#{names[1..].map { |n| "#{n[0]}." }.join}".html_safe
+    "#{names.first}\u00A0#{names[1..].map { |n| "#{n[0]}." }.join}"
   end
 end

From ab5283441d2309426f91c41a5efc6e7b88c3c3fc Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 11 Mar 2026 10:11:13 -0400
Subject: [PATCH 047/107] SaaS usage reporting (#2690)

* Add saas:usage_report rake task and extract Subscription.paid scope

Add a rake task to generate a CSV usage report with per-account data:
Queenbee ID, sign up date, paid date, card count, storage used, and
last active date.

Extract the paid subscriptions query from Admin::StatsController into
an Account::Subscription.paid scope so both the controller and the
new rake task can share it.

* Add comped and account name columns to usage report

* Update saas/lib/tasks/fizzy/usage_report.rake

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Preload storage_total to avoid N+1 in usage report

* Batch last_active_at queries to avoid per-account aggregates

* Add tests for Account::Subscription.paid scope

* Update saas/app/models/account/subscription.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Aggregate paid dates in SQL instead of loading all subscriptions

* Fix paid scope to derive plan keys from Plan.all instead of PLANS hash

* Move paid dates and comped lookups into per-batch queries

* Materialize batch IDs to avoid cross-database subquery

SaasRecord models live on a separate database (fizzy_saas) that doesn't
have the accounts table. Using batch.select(:id) generated a subquery
that ran on the saas database, causing a table-not-found error. Using
pluck(:id) materializes the IDs into an array instead.

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 Gemfile.saas                                  |  1 +
 Gemfile.saas.lock                             |  2 +
 .../app/controllers/admin/stats_controller.rb | 14 ++---
 saas/app/models/account/subscription.rb       |  6 +++
 saas/lib/tasks/fizzy/usage_report.rake        | 37 ++++++++++++++
 saas/test/models/account/subscription_test.rb | 51 +++++++++++++++++++
 6 files changed, 100 insertions(+), 11 deletions(-)
 create mode 100644 saas/lib/tasks/fizzy/usage_report.rake

diff --git a/Gemfile.saas b/Gemfile.saas
index 39aa49a71..e57fcf206 100644
--- a/Gemfile.saas
+++ b/Gemfile.saas
@@ -10,6 +10,7 @@ gem "queenbee", bc: "queenbee-plugin"
 gem "fizzy-saas", path: "saas"
 gem "console1984", bc: "console1984"
 gem "audits1984", bc: "audits1984", branch: "flavorjones/coworker-api"
+gem "csv"
 
 # Native push notifications (iOS/Android)
 gem "action_push_native"
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 37ff08294..e4ed7406e 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -281,6 +281,7 @@ GEM
       bigdecimal
       rexml
     crass (1.0.6)
+    csv (3.3.5)
     date (3.5.1)
     debug (1.11.1)
       irb (~> 1.10)
@@ -720,6 +721,7 @@ DEPENDENCIES
   bundler-audit
   capybara
   console1984!
+  csv
   debug
   faker
   fizzy-saas!
diff --git a/saas/app/controllers/admin/stats_controller.rb b/saas/app/controllers/admin/stats_controller.rb
index 6b9592fca..287b49024 100644
--- a/saas/app/controllers/admin/stats_controller.rb
+++ b/saas/app/controllers/admin/stats_controller.rb
@@ -6,9 +6,9 @@ class Admin::StatsController < AdminController
     @accounts_last_7_days = Account.where(created_at: 7.days.ago..).count
     @accounts_last_24_hours = Account.where(created_at: 24.hours.ago..).count
 
-    @paid_accounts_total = paid_subscriptions.distinct.count(:account_id)
-    @paid_accounts_last_7_days = paid_subscriptions.where(created_at: 7.days.ago..).distinct.count(:account_id)
-    @paid_accounts_last_24_hours = paid_subscriptions.where(created_at: 24.hours.ago..).distinct.count(:account_id)
+    @paid_accounts_total = Account::Subscription.paid.distinct.count(:account_id)
+    @paid_accounts_last_7_days = Account::Subscription.paid.where(created_at: 7.days.ago..).distinct.count(:account_id)
+    @paid_accounts_last_24_hours = Account::Subscription.paid.where(created_at: 24.hours.ago..).distinct.count(:account_id)
 
     @identities_total = Identity.count
     @identities_last_7_days = Identity.where(created_at: 7.days.ago..).count
@@ -21,12 +21,4 @@ class Admin::StatsController < AdminController
 
     @recent_accounts = Account.order(created_at: :desc).limit(10)
   end
-
-  private
-    def paid_subscriptions
-      Account::Subscription
-        .where(status: %w[active trialing past_due])
-        .where(plan_key: %w[monthly_v1 monthly_extra_storage_v1])
-        .where.not(account_id: Account::BillingWaiver.select(:account_id))
-    end
 end
diff --git a/saas/app/models/account/subscription.rb b/saas/app/models/account/subscription.rb
index 2ae7e3171..c1ec9e47c 100644
--- a/saas/app/models/account/subscription.rb
+++ b/saas/app/models/account/subscription.rb
@@ -3,6 +3,12 @@ class Account::Subscription < SaasRecord
 
   enum :status, %w[ active past_due unpaid canceled incomplete incomplete_expired trialing paused ].index_by(&:itself)
 
+  scope :paid, -> {
+    where(status: %w[active trialing past_due])
+      .where(plan_key: Plan.all.select(&:paid?).map(&:key))
+      .where.not(account_id: Account::BillingWaiver.select(:account_id))
+  }
+
   validates :plan_key, presence: true, inclusion: { in: Plan::PLANS.keys.map(&:to_s) }
 
   delegate :paid?, to: :plan
diff --git a/saas/lib/tasks/fizzy/usage_report.rake b/saas/lib/tasks/fizzy/usage_report.rake
new file mode 100644
index 000000000..d8b3ba108
--- /dev/null
+++ b/saas/lib/tasks/fizzy/usage_report.rake
@@ -0,0 +1,37 @@
+require "csv"
+
+namespace :saas do
+  desc "Generate a CSV usage report for all active accounts"
+  task usage_report: :environment do
+    output_path = Rails.root.join("tmp/usage_report.csv")
+
+    CSV.open(output_path, "w") do |csv|
+      csv << [ "Queenbee ID", "Account Name", "Sign Up Date", "Paid Date", "Comped", "Card Count", "Storage Used (Bytes)", "Last Active" ]
+
+      Account.active.includes(:storage_total).in_batches do |batch|
+        batch_ids = batch.pluck(:id)
+        paid_dates = Account::Subscription.paid.where(account_id: batch_ids)
+          .group(:account_id).minimum(:created_at)
+        comped_account_ids = Account::BillingWaiver.where(account_id: batch_ids)
+          .pluck(:account_id).to_set
+        last_active_dates = Card.where(account_id: batch_ids)
+          .group(:account_id).maximum(:last_active_at)
+
+        batch.each do |account|
+          csv << [
+            account.external_account_id,
+            account.name,
+            account.created_at.to_date,
+            paid_dates[account.id]&.to_date,
+            comped_account_ids.include?(account.id),
+            account.cards_count,
+            account.bytes_used,
+            last_active_dates[account.id]&.to_date
+          ]
+        end
+      end
+    end
+
+    puts "Report written to #{output_path}"
+  end
+end
diff --git a/saas/test/models/account/subscription_test.rb b/saas/test/models/account/subscription_test.rb
index eaf7e103d..f9f16f2bb 100644
--- a/saas/test/models/account/subscription_test.rb
+++ b/saas/test/models/account/subscription_test.rb
@@ -16,6 +16,57 @@ class Account::SubscriptionTest < ActiveSupport::TestCase
     assert_not Account::Subscription.new(plan_key: "free_v1", status: "active").paid?
   end
 
+  test "paid scope includes active paid subscriptions" do
+    subscription = Account::Subscription.create!(
+      account: accounts(:initech), plan_key: "monthly_v1", status: "active",
+      stripe_customer_id: "cus_paid"
+    )
+
+    assert_includes Account::Subscription.paid, subscription
+  end
+
+  test "paid scope includes trialing and past_due subscriptions" do
+    trialing = Account::Subscription.create!(
+      account: accounts(:initech), plan_key: "monthly_v1", status: "trialing",
+      stripe_customer_id: "cus_trialing"
+    )
+    past_due = Account::Subscription.create!(
+      account: accounts(:acme), plan_key: "monthly_extra_storage_v1", status: "past_due",
+      stripe_customer_id: "cus_past_due"
+    )
+
+    assert_includes Account::Subscription.paid, trialing
+    assert_includes Account::Subscription.paid, past_due
+  end
+
+  test "paid scope excludes free plan subscriptions" do
+    subscription = Account::Subscription.create!(
+      account: accounts(:initech), plan_key: "free_v1", status: "active",
+      stripe_customer_id: "cus_free"
+    )
+
+    assert_not_includes Account::Subscription.paid, subscription
+  end
+
+  test "paid scope excludes canceled subscriptions" do
+    subscription = Account::Subscription.create!(
+      account: accounts(:initech), plan_key: "monthly_v1", status: "canceled",
+      stripe_customer_id: "cus_canceled"
+    )
+
+    assert_not_includes Account::Subscription.paid, subscription
+  end
+
+  test "paid scope excludes comped accounts" do
+    subscription = Account::Subscription.create!(
+      account: accounts(:initech), plan_key: "monthly_v1", status: "active",
+      stripe_customer_id: "cus_comped"
+    )
+    Account::BillingWaiver.create!(account: accounts(:initech))
+
+    assert_not_includes Account::Subscription.paid, subscription
+  end
+
   test "pause pauses Stripe subscription with void behavior" do
     subscription = Account::Subscription.new(stripe_subscription_id: "sub_123")
 

From d6bf103efd5d284518c656e11e28acfa5dab634d Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 11 Mar 2026 17:49:04 -0400
Subject: [PATCH 048/107] Configure Lexxy to add extra spacing between block
 elements

Updating Lexxy to v0.8.0 for the insert-markdown event.
---
 Gemfile                                             |  2 +-
 Gemfile.lock                                        | 11 +++--------
 Gemfile.saas.lock                                   | 11 +++--------
 app/javascript/initializers/index.js                |  1 +
 app/javascript/initializers/lexxy_markdown_paste.js |  3 +++
 5 files changed, 11 insertions(+), 17 deletions(-)
 create mode 100644 app/javascript/initializers/lexxy_markdown_paste.js

diff --git a/Gemfile b/Gemfile
index da66e1473..f5e26850a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -27,7 +27,7 @@ gem "geared_pagination", "~> 1.2"
 gem "rqrcode"
 gem "rouge"
 gem "jbuilder"
-gem "lexxy", bc: "lexxy"
+gem "lexxy", "0.8.0.beta"
 gem "image_processing", "~> 1.14"
 gem "platform_agent"
 gem "aws-sdk-s3", require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 8db6817dc..37579ff78 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,10 +1,3 @@
-GIT
-  remote: https://github.com/basecamp/lexxy
-  revision: b7f0f1429df5fa425eac043191ae2b65edee7488
-  specs:
-    lexxy (0.7.6.beta)
-      rails (>= 8.0.2)
-
 GIT
   remote: https://github.com/basecamp/useragent
   revision: 433ca320a42db1266c4b89df74d0abdb9a880c5e
@@ -261,6 +254,8 @@ GEM
       logger (~> 1.6)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
+    lexxy (0.8.0.beta)
+      rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
     loofah (2.25.0)
@@ -523,7 +518,7 @@ DEPENDENCIES
   jbuilder
   kamal
   letter_opener
-  lexxy!
+  lexxy (= 0.8.0.beta)
   mission_control-jobs
   mittens
   mocha
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index e4ed7406e..dbaaa9df4 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -21,13 +21,6 @@ GIT
       rails (>= 7.0)
       rainbow
 
-GIT
-  remote: https://github.com/basecamp/lexxy
-  revision: b7f0f1429df5fa425eac043191ae2b65edee7488
-  specs:
-    lexxy (0.7.6.beta)
-      rails (>= 8.0.2)
-
 GIT
   remote: https://github.com/basecamp/queenbee-plugin
   revision: 14312a940471e20617b38cdec7c092a01567d18b
@@ -375,6 +368,8 @@ GEM
       logger (~> 1.6)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
+    lexxy (0.8.0.beta)
+      rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
     loofah (2.25.0)
@@ -732,7 +727,7 @@ DEPENDENCIES
   jbuilder
   kamal
   letter_opener
-  lexxy!
+  lexxy (= 0.8.0.beta)
   mission_control-jobs
   mittens
   mocha
diff --git a/app/javascript/initializers/index.js b/app/javascript/initializers/index.js
index 1d16ef205..d2c20451e 100644
--- a/app/javascript/initializers/index.js
+++ b/app/javascript/initializers/index.js
@@ -1,3 +1,4 @@
 import "initializers/current"
 import "initializers/bridge/bridge_element"
 import "initializers/offline"
+import "initializers/lexxy_markdown_paste"
diff --git a/app/javascript/initializers/lexxy_markdown_paste.js b/app/javascript/initializers/lexxy_markdown_paste.js
new file mode 100644
index 000000000..cf7600306
--- /dev/null
+++ b/app/javascript/initializers/lexxy_markdown_paste.js
@@ -0,0 +1,3 @@
+document.addEventListener("lexxy:insert-markdown", (event) => {
+  event.detail.addBlockSpacing()
+})

From 3959d91148a4aa1e25406d65b0f7b204ec47b12b Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Thu, 12 Mar 2026 12:24:35 -0400
Subject: [PATCH 049/107] Revert "Configure Lexxy to add extra spacing between
 block elements"

This reverts commit d6bf103efd5d284518c656e11e28acfa5dab634d.
---
 Gemfile                                             |  2 +-
 Gemfile.lock                                        | 11 ++++++++---
 Gemfile.saas.lock                                   | 11 ++++++++---
 app/javascript/initializers/index.js                |  1 -
 app/javascript/initializers/lexxy_markdown_paste.js |  3 ---
 5 files changed, 17 insertions(+), 11 deletions(-)
 delete mode 100644 app/javascript/initializers/lexxy_markdown_paste.js

diff --git a/Gemfile b/Gemfile
index f5e26850a..da66e1473 100644
--- a/Gemfile
+++ b/Gemfile
@@ -27,7 +27,7 @@ gem "geared_pagination", "~> 1.2"
 gem "rqrcode"
 gem "rouge"
 gem "jbuilder"
-gem "lexxy", "0.8.0.beta"
+gem "lexxy", bc: "lexxy"
 gem "image_processing", "~> 1.14"
 gem "platform_agent"
 gem "aws-sdk-s3", require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 37579ff78..8db6817dc 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,3 +1,10 @@
+GIT
+  remote: https://github.com/basecamp/lexxy
+  revision: b7f0f1429df5fa425eac043191ae2b65edee7488
+  specs:
+    lexxy (0.7.6.beta)
+      rails (>= 8.0.2)
+
 GIT
   remote: https://github.com/basecamp/useragent
   revision: 433ca320a42db1266c4b89df74d0abdb9a880c5e
@@ -254,8 +261,6 @@ GEM
       logger (~> 1.6)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
-    lexxy (0.8.0.beta)
-      rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
     loofah (2.25.0)
@@ -518,7 +523,7 @@ DEPENDENCIES
   jbuilder
   kamal
   letter_opener
-  lexxy (= 0.8.0.beta)
+  lexxy!
   mission_control-jobs
   mittens
   mocha
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index dbaaa9df4..e4ed7406e 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -21,6 +21,13 @@ GIT
       rails (>= 7.0)
       rainbow
 
+GIT
+  remote: https://github.com/basecamp/lexxy
+  revision: b7f0f1429df5fa425eac043191ae2b65edee7488
+  specs:
+    lexxy (0.7.6.beta)
+      rails (>= 8.0.2)
+
 GIT
   remote: https://github.com/basecamp/queenbee-plugin
   revision: 14312a940471e20617b38cdec7c092a01567d18b
@@ -368,8 +375,6 @@ GEM
       logger (~> 1.6)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
-    lexxy (0.8.0.beta)
-      rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
     loofah (2.25.0)
@@ -727,7 +732,7 @@ DEPENDENCIES
   jbuilder
   kamal
   letter_opener
-  lexxy (= 0.8.0.beta)
+  lexxy!
   mission_control-jobs
   mittens
   mocha
diff --git a/app/javascript/initializers/index.js b/app/javascript/initializers/index.js
index d2c20451e..1d16ef205 100644
--- a/app/javascript/initializers/index.js
+++ b/app/javascript/initializers/index.js
@@ -1,4 +1,3 @@
 import "initializers/current"
 import "initializers/bridge/bridge_element"
 import "initializers/offline"
-import "initializers/lexxy_markdown_paste"
diff --git a/app/javascript/initializers/lexxy_markdown_paste.js b/app/javascript/initializers/lexxy_markdown_paste.js
deleted file mode 100644
index cf7600306..000000000
--- a/app/javascript/initializers/lexxy_markdown_paste.js
+++ /dev/null
@@ -1,3 +0,0 @@
-document.addEventListener("lexxy:insert-markdown", (event) => {
-  event.detail.addBlockSpacing()
-})

From ad30df0ac58b7cd199bbbb296f3985561bedde7f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 12 Mar 2026 17:35:54 +0000
Subject: [PATCH 050/107] Bump action_text-trix from 2.1.16 to 2.1.17

Bumps [action_text-trix](https://github.com/basecamp/trix) from 2.1.16 to 2.1.17.
- [Release notes](https://github.com/basecamp/trix/releases)
- [Commits](https://github.com/basecamp/trix/compare/v2.1.16...v2.1.17)

---
updated-dependencies:
- dependency-name: action_text-trix
  dependency-version: 2.1.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Gemfile.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 8db6817dc..d00191d4f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -134,7 +134,7 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    action_text-trix (2.1.16)
+    action_text-trix (2.1.17)
       railties
     addressable (2.8.8)
       public_suffix (>= 2.0.2, < 8.0)
@@ -240,7 +240,7 @@ GEM
       actionview (>= 7.0.0)
       activesupport (>= 7.0.0)
     jmespath (1.6.2)
-    json (2.18.1)
+    json (2.19.1)
     jwt (3.1.2)
       base64
     kamal (2.10.1)

From 585375b3ecb8dbf52e3bbbe84859cc6b058cc4de Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 12 Mar 2026 17:36:05 +0000
Subject: [PATCH 051/107] Sync Gemfile.saas.lock

---
 Gemfile.saas.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index e4ed7406e..a9eef0d7e 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -211,7 +211,7 @@ GEM
       httpx (~> 1.6)
       jwt (>= 2)
       railties (>= 8.0)
-    action_text-trix (2.1.16)
+    action_text-trix (2.1.17)
       railties
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
@@ -354,7 +354,7 @@ GEM
       actionview (>= 7.0.0)
       activesupport (>= 7.0.0)
     jmespath (1.6.2)
-    json (2.18.1)
+    json (2.19.1)
     jwt (3.1.2)
       base64
     kamal (2.10.1)

From e5fd8e30debeaba112fed27e4f7d58747b486bc9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 20:24:36 +0000
Subject: [PATCH 052/107] Bump faker from 3.6.0 to 3.6.1 in the
 development-dependencies group

Bumps the development-dependencies group with 1 update: [faker](https://github.com/faker-ruby/faker).


Updates `faker` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/faker-ruby/faker/releases)
- [Changelog](https://github.com/faker-ruby/faker/blob/main/CHANGELOG.md)
- [Commits](https://github.com/faker-ruby/faker/compare/v3.6.0...v3.6.1)

---
updated-dependencies:
- dependency-name: faker
  dependency-version: 3.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 8db6817dc..cb2882461 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -202,7 +202,7 @@ GEM
     erubi (1.13.1)
     et-orbi (1.4.0)
       tzinfo
-    faker (3.6.0)
+    faker (3.6.1)
       i18n (>= 1.8.11, < 2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-aarch64-linux-musl)

From 09ac251445910cad40797157894baf4f7705feb0 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 20:24:48 +0000
Subject: [PATCH 053/107] Sync Gemfile.saas.lock

---
 Gemfile.saas.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index e4ed7406e..07eaa895a 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -294,7 +294,7 @@ GEM
     erubi (1.13.1)
     et-orbi (1.4.0)
       tzinfo
-    faker (3.6.0)
+    faker (3.6.1)
       i18n (>= 1.8.11, < 2)
     faraday (2.14.0)
       faraday-net_http (>= 2.0, < 3.5)

From b3fe9cba82646146a109f9f0e6f84196607de5f6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 20:25:34 +0000
Subject: [PATCH 054/107] Bump thruster from 0.1.18 to 0.1.19

Bumps [thruster](https://github.com/basecamp/thruster) from 0.1.18 to 0.1.19.
- [Changelog](https://github.com/basecamp/thruster/blob/main/CHANGELOG.md)
- [Commits](https://github.com/basecamp/thruster/compare/v0.1.18...v0.1.19)

---
updated-dependencies:
- dependency-name: thruster
  dependency-version: 0.1.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Gemfile.lock | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 8db6817dc..02156bca5 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -461,11 +461,11 @@ GEM
       railties (>= 6.0.0)
     stringio (3.2.0)
     thor (1.5.0)
-    thruster (0.1.18)
-    thruster (0.1.18-aarch64-linux)
-    thruster (0.1.18-arm64-darwin)
-    thruster (0.1.18-x86_64-darwin)
-    thruster (0.1.18-x86_64-linux)
+    thruster (0.1.19)
+    thruster (0.1.19-aarch64-linux)
+    thruster (0.1.19-arm64-darwin)
+    thruster (0.1.19-x86_64-darwin)
+    thruster (0.1.19-x86_64-linux)
     timeout (0.6.0)
     trilogy (2.10.0)
       bigdecimal

From d9f330112507775a7a4e9a0429304a1113c26ea5 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 20:25:45 +0000
Subject: [PATCH 055/107] Sync Gemfile.saas.lock

---
 Gemfile.saas.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index e4ed7406e..f8612e0ab 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -634,7 +634,7 @@ GEM
     stringio (3.2.0)
     stripe (18.0.1)
     thor (1.5.0)
-    thruster (0.1.18)
+    thruster (0.1.19)
     thruster (0.1.18-aarch64-linux)
     thruster (0.1.18-arm64-darwin)
     thruster (0.1.18-x86_64-darwin)

From 521b7ffb855ea82a1ce4f1c3bd831e84f97a0775 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 20:25:49 +0000
Subject: [PATCH 056/107] Bump aws-sdk-s3 from 1.213.0 to 1.215.0

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.213.0 to 1.215.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

---
updated-dependencies:
- dependency-name: aws-sdk-s3
  dependency-version: 1.215.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Gemfile.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 8db6817dc..b0dcdd349 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -141,8 +141,8 @@ GEM
     ast (2.4.3)
     autotuner (1.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1218.0)
-    aws-sdk-core (3.242.0)
+    aws-partitions (1.1226.0)
+    aws-sdk-core (3.243.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -153,8 +153,8 @@ GEM
     aws-sdk-kms (1.122.0)
       aws-sdk-core (~> 3, >= 3.241.4)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.213.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+    aws-sdk-s3 (1.215.0)
+      aws-sdk-core (~> 3, >= 3.243.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)

From d579b6409c21a3aef8383251aa6ce2f6c7953044 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 20:25:58 +0000
Subject: [PATCH 057/107] Sync Gemfile.saas.lock

---
 Gemfile.saas.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index e4ed7406e..65c599262 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -231,8 +231,8 @@ GEM
     ast (2.4.3)
     autotuner (1.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1218.0)
-    aws-sdk-core (3.242.0)
+    aws-partitions (1.1226.0)
+    aws-sdk-core (3.243.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -243,7 +243,7 @@ GEM
     aws-sdk-kms (1.122.0)
       aws-sdk-core (~> 3, >= 3.241.4)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.213.0)
+    aws-sdk-s3 (1.215.0)
       aws-sdk-core (~> 3, >= 3.241.4)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)

From 8f6fca94fa4ac356e56be7260a3fc5e824be2c60 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Mon, 16 Mar 2026 17:50:31 +0100
Subject: [PATCH 058/107] Prevent HTML injection through filenames

---
 app/javascript/controllers/upload_preview_controller.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/javascript/controllers/upload_preview_controller.js b/app/javascript/controllers/upload_preview_controller.js
index d7b0bd478..7e25d50a3 100644
--- a/app/javascript/controllers/upload_preview_controller.js
+++ b/app/javascript/controllers/upload_preview_controller.js
@@ -15,7 +15,7 @@ export default class extends Controller {
   }
 
   #showFileName() {
-    this.fileNameTarget.innerHTML = this.#file.name
+    this.fileNameTarget.innerText = this.#file.name
     this.fileNameTarget.removeAttribute("hidden")
     this.placeholderTarget.setAttribute("hidden", true)
   }

From ddc6ce020e127439c0a456844140321bb3567288 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Mon, 16 Mar 2026 17:57:26 +0100
Subject: [PATCH 059/107] Conditionally disable peer verification for ZIP
 streaming

---
 app/models/zip_file.rb           | 3 ++-
 app/models/zip_file/remote_io.rb | 8 ++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/app/models/zip_file.rb b/app/models/zip_file.rb
index dc5b7ee8d..3415f5879 100644
--- a/app/models/zip_file.rb
+++ b/app/models/zip_file.rb
@@ -84,7 +84,8 @@ class ZipFile
 
       def read_from_s3(blob)
         url = blob.url(expires_in: 6.hour)
-        remote_io = RemoteIO.new(url)
+        ssl_verify_peer = blob.service.client.client.config.ssl_verify_peer
+        remote_io = RemoteIO.new(url, ssl_verify_peer: ssl_verify_peer)
         reader = Reader.new(remote_io)
         yield reader
       end
diff --git a/app/models/zip_file/remote_io.rb b/app/models/zip_file/remote_io.rb
index 1cb00831a..59329d811 100644
--- a/app/models/zip_file/remote_io.rb
+++ b/app/models/zip_file/remote_io.rb
@@ -1,4 +1,9 @@
 class ZipFile::RemoteIO < ZipKit::RemoteIO
+  def initialize(url, ssl_verify_peer: true)
+    super(url)
+    @ssl_verify_peer = ssl_verify_peer
+  end
+
   protected
     def request_range(range)
       with_http do |http|
@@ -37,8 +42,7 @@ class ZipFile::RemoteIO < ZipKit::RemoteIO
     def with_http
       http = Net::HTTP.new(@uri.hostname, @uri.port)
       http.use_ssl = @uri.scheme == "https"
-      # FIXME: Disable SSL verification for now to avoid issues with our self-signed certificates for PureStorage
-      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      http.verify_mode = OpenSSL::SSL::VERIFY_NONE unless @ssl_verify_peer
       http.start { yield http }
     end
 end

From 964915bc665b4a8be86303200a5f643d1b41cdb2 Mon Sep 17 00:00:00 2001
From: Jorge Manrubia <jorge@37signals.com>
Date: Tue, 17 Mar 2026 09:22:04 +0100
Subject: [PATCH 060/107] Remove payment/subscription system and card/storage
 limits

Fizzy is now free. Remove the entire Stripe billing system,
subscription management, and card/storage limit enforcement.

Removes from saas/: Plan model, Account::Billing, Account::Subscription,
Account::Limited, Account::OverriddenLimits, Account::BillingWaiver,
all subscription/billing controllers and views, Stripe webhook handler,
card creation/publishing limit enforcement, admin account override UI,
usage report rake task, and all related tests.

Removes from main app: Fizzy.saas? guards for subscription panel,
SaaS card footer override, near-limit notices, and saas.css stylesheet.

Adds migration to drop billing tables from the SaaS database.

Non-billing SaaS features (push notifications, signup, authorization,
telemetry, console1984/audits1984) are preserved.
---
 Gemfile.saas                                  |   2 -
 Gemfile.saas.lock                             |   4 -
 app/views/account/settings/show.html.erb      |   2 -
 .../cards/container/footer/_create.html.erb   |   2 -
 app/views/cards/drafts/_container.html.erb    |   6 +-
 app/views/layouts/shared/_head.html.erb       |   1 -
 saas/app/assets/stylesheets/fizzy/saas.css    |  70 -----
 .../account/billing_portals_controller.rb     |  19 --
 .../subscriptions/downgrades_controller.rb    |  12 -
 .../subscriptions/update_plan_controller.rb   |  32 ---
 .../subscriptions/upgrades_controller.rb      |  12 -
 .../account/subscriptions_controller.rb       |  46 ----
 .../admin/account_searches_controller.rb      |   5 -
 .../controllers/admin/accounts_controller.rb  |  27 --
 .../admin/billing_waivers_controller.rb       |  13 -
 .../admin/overridden_limits_controller.rb     |   8 -
 .../app/controllers/admin/stats_controller.rb |   4 -
 .../concerns/admin/account_scoped.rb          |  12 -
 saas/app/controllers/concerns/card/limited.rb |   8 -
 .../concerns/card/limited_creation.rb         |  11 -
 .../concerns/card/limited_publishing.rb       |   9 -
 .../controllers/stripe/webhooks_controller.rb |  85 ------
 saas/app/helpers/subscriptions_helper.rb      |  19 --
 .../account/sync_stripe_customer_email_job.rb |   8 -
 saas/app/models/account/billing.rb            |  50 ----
 saas/app/models/account/billing_waiver.rb     |   7 -
 saas/app/models/account/limited.rb            |  56 ----
 saas/app/models/account/overridden_limits.rb  |   4 -
 saas/app/models/account/subscription.rb       |  73 ------
 saas/app/models/plan.rb                       |  59 -----
 .../user/notifies_account_of_email_change.rb  |  23 --
 .../account/settings/_free_plan.html.erb      |  18 --
 .../account/settings/_paid_plan.html.erb      |  21 --
 .../account/settings/_subscription.html.erb   |  20 --
 .../settings/_subscription_panel.html.erb     |  11 -
 .../account/subscriptions/_upgrade.html.erb   |   9 -
 .../_admin_exceeding_card_limit.html.erb      |   4 -
 .../_admin_exceeding_storage_limit.html.erb   |   4 -
 .../_user_exceeding_card_limit.html.erb       |   3 -
 .../_user_exceeding_storage_limit.html.erb    |   3 -
 .../views/account/subscriptions/show.html.erb |   9 -
 saas/app/views/admin/accounts/edit.html.erb   |  63 -----
 saas/app/views/admin/accounts/index.html.erb  |  13 -
 saas/app/views/admin/stats/show.html.erb      |  26 --
 .../container/footer/saas/_create.html.erb    |   5 -
 .../footer/saas/_near_notice.html.erb         |   9 -
 .../_admin_nearing_card_limit.html.erb        |   1 -
 .../_admin_nearing_storage_limit.html.erb     |   1 -
 .../notices/_user_nearing_card_limit.html.erb |   1 -
 .../_user_nearing_storage_limit.html.erb      |   1 -
 saas/config/routes.rb                         |   5 -
 .../20260317000000_drop_billing_tables.rb     |   7 +
 saas/db/saas_schema.rb                        |  34 +--
 saas/exe/stripe-dev                           |  83 ------
 saas/lib/fizzy/saas/engine.rb                 |  31 ---
 saas/lib/tasks/fizzy/usage_report.rake        |  37 ---
 .../billing_portals_controller_test.rb        |  29 ---
 .../subscriptions/card_creation_test.rb       |  73 ------
 .../downgrades_controller_test.rb             |  35 ---
 .../accounts/subscriptions/settings_test.rb   |  62 -----
 .../subscriptions/upgrades_controller_test.rb |  35 ---
 .../accounts/subscriptions_controller_test.rb |  60 -----
 .../admin/accounts_controller_test.rb         |  54 ----
 .../admin/billing_waivers_controller_test.rb  |  32 ---
 .../overridden_limits_controller_test.rb      |  22 --
 .../controllers/card/limited_creation_test.rb |  55 ----
 .../card/limited_publishing_test.rb           |  25 --
 .../stripe/webhooks_controller_test.rb        | 100 -------
 saas/test/fixtures/account_subscriptions.yml  |  11 -
 saas/test/models/account/billing_test.rb      |  93 -------
 saas/test/models/account/limited_test.rb      | 122 ---------
 saas/test/models/account/subscription_test.rb | 245 ------------------
 saas/test/models/plan_test.rb                 |  18 --
 .../notifies_account_of_email_change_test.rb  |  51 ----
 74 files changed, 9 insertions(+), 2221 deletions(-)
 delete mode 100644 saas/app/assets/stylesheets/fizzy/saas.css
 delete mode 100644 saas/app/controllers/account/billing_portals_controller.rb
 delete mode 100644 saas/app/controllers/account/subscriptions/downgrades_controller.rb
 delete mode 100644 saas/app/controllers/account/subscriptions/update_plan_controller.rb
 delete mode 100644 saas/app/controllers/account/subscriptions/upgrades_controller.rb
 delete mode 100644 saas/app/controllers/account/subscriptions_controller.rb
 delete mode 100644 saas/app/controllers/admin/account_searches_controller.rb
 delete mode 100644 saas/app/controllers/admin/accounts_controller.rb
 delete mode 100644 saas/app/controllers/admin/billing_waivers_controller.rb
 delete mode 100644 saas/app/controllers/admin/overridden_limits_controller.rb
 delete mode 100644 saas/app/controllers/concerns/admin/account_scoped.rb
 delete mode 100644 saas/app/controllers/concerns/card/limited.rb
 delete mode 100644 saas/app/controllers/concerns/card/limited_creation.rb
 delete mode 100644 saas/app/controllers/concerns/card/limited_publishing.rb
 delete mode 100644 saas/app/controllers/stripe/webhooks_controller.rb
 delete mode 100644 saas/app/helpers/subscriptions_helper.rb
 delete mode 100644 saas/app/jobs/account/sync_stripe_customer_email_job.rb
 delete mode 100644 saas/app/models/account/billing.rb
 delete mode 100644 saas/app/models/account/billing_waiver.rb
 delete mode 100644 saas/app/models/account/limited.rb
 delete mode 100644 saas/app/models/account/overridden_limits.rb
 delete mode 100644 saas/app/models/account/subscription.rb
 delete mode 100644 saas/app/models/plan.rb
 delete mode 100644 saas/app/models/user/notifies_account_of_email_change.rb
 delete mode 100644 saas/app/views/account/settings/_free_plan.html.erb
 delete mode 100644 saas/app/views/account/settings/_paid_plan.html.erb
 delete mode 100644 saas/app/views/account/settings/_subscription.html.erb
 delete mode 100644 saas/app/views/account/settings/_subscription_panel.html.erb
 delete mode 100644 saas/app/views/account/subscriptions/_upgrade.html.erb
 delete mode 100644 saas/app/views/account/subscriptions/notices/_admin_exceeding_card_limit.html.erb
 delete mode 100644 saas/app/views/account/subscriptions/notices/_admin_exceeding_storage_limit.html.erb
 delete mode 100644 saas/app/views/account/subscriptions/notices/_user_exceeding_card_limit.html.erb
 delete mode 100644 saas/app/views/account/subscriptions/notices/_user_exceeding_storage_limit.html.erb
 delete mode 100644 saas/app/views/account/subscriptions/show.html.erb
 delete mode 100644 saas/app/views/admin/accounts/edit.html.erb
 delete mode 100644 saas/app/views/admin/accounts/index.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/_create.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/_near_notice.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/notices/_admin_nearing_card_limit.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/notices/_admin_nearing_storage_limit.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/notices/_user_nearing_card_limit.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/notices/_user_nearing_storage_limit.html.erb
 create mode 100644 saas/db/migrate/20260317000000_drop_billing_tables.rb
 delete mode 100755 saas/exe/stripe-dev
 delete mode 100644 saas/lib/tasks/fizzy/usage_report.rake
 delete mode 100644 saas/test/controllers/accounts/billing_portals_controller_test.rb
 delete mode 100644 saas/test/controllers/accounts/subscriptions/card_creation_test.rb
 delete mode 100644 saas/test/controllers/accounts/subscriptions/downgrades_controller_test.rb
 delete mode 100644 saas/test/controllers/accounts/subscriptions/settings_test.rb
 delete mode 100644 saas/test/controllers/accounts/subscriptions/upgrades_controller_test.rb
 delete mode 100644 saas/test/controllers/accounts/subscriptions_controller_test.rb
 delete mode 100644 saas/test/controllers/admin/accounts_controller_test.rb
 delete mode 100644 saas/test/controllers/admin/billing_waivers_controller_test.rb
 delete mode 100644 saas/test/controllers/admin/overridden_limits_controller_test.rb
 delete mode 100644 saas/test/controllers/card/limited_creation_test.rb
 delete mode 100644 saas/test/controllers/card/limited_publishing_test.rb
 delete mode 100644 saas/test/controllers/stripe/webhooks_controller_test.rb
 delete mode 100644 saas/test/fixtures/account_subscriptions.yml
 delete mode 100644 saas/test/models/account/billing_test.rb
 delete mode 100644 saas/test/models/account/limited_test.rb
 delete mode 100644 saas/test/models/account/subscription_test.rb
 delete mode 100644 saas/test/models/plan_test.rb
 delete mode 100644 saas/test/models/user/notifies_account_of_email_change_test.rb

diff --git a/Gemfile.saas b/Gemfile.saas
index e57fcf206..384f5b4b7 100644
--- a/Gemfile.saas
+++ b/Gemfile.saas
@@ -5,12 +5,10 @@ git_source(:bc) { |repo| "https://github.com/basecamp/#{repo}" }
 
 gem "activeresource", require: "active_resource"
 gem "actionpack-xml_parser" # needed by queenbee for XML request body parsing
-gem "stripe", "~> 18.0"
 gem "queenbee", bc: "queenbee-plugin"
 gem "fizzy-saas", path: "saas"
 gem "console1984", bc: "console1984"
 gem "audits1984", bc: "audits1984", branch: "flavorjones/coworker-api"
-gem "csv"
 
 # Native push notifications (iOS/Android)
 gem "action_push_native"
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index e4ed7406e..6f9b0d088 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -281,7 +281,6 @@ GEM
       bigdecimal
       rexml
     crass (1.0.6)
-    csv (3.3.5)
     date (3.5.1)
     debug (1.11.1)
       irb (~> 1.10)
@@ -632,7 +631,6 @@ GEM
     stimulus-rails (1.3.4)
       railties (>= 6.0.0)
     stringio (3.2.0)
-    stripe (18.0.1)
     thor (1.5.0)
     thruster (0.1.18)
     thruster (0.1.18-aarch64-linux)
@@ -721,7 +719,6 @@ DEPENDENCIES
   bundler-audit
   capybara
   console1984!
-  csv
   debug
   faker
   fizzy-saas!
@@ -757,7 +754,6 @@ DEPENDENCIES
   sqlite3 (>= 2.0)
   stackprof
   stimulus-rails
-  stripe (~> 18.0)
   thruster
   trilogy (~> 2.10)
   turbo-rails!
diff --git a/app/views/account/settings/show.html.erb b/app/views/account/settings/show.html.erb
index 91bb85aff..fdb118e57 100644
--- a/app/views/account/settings/show.html.erb
+++ b/app/views/account/settings/show.html.erb
@@ -21,5 +21,3 @@
     <%= render "account/settings/cancellation" %>
   </div>
 </div>
-
-<%= render "account/settings/subscription_panel" if Fizzy.saas? %>
diff --git a/app/views/cards/container/footer/_create.html.erb b/app/views/cards/container/footer/_create.html.erb
index b55cae344..648beffd1 100644
--- a/app/views/cards/container/footer/_create.html.erb
+++ b/app/views/cards/container/footer/_create.html.erb
@@ -13,7 +13,5 @@
       <span>Create and add another</span>
     <% end %>
   </div>
-
-  <%= render "cards/container/footer/saas/near_notice" if Fizzy.saas? %>
 </div>
 
diff --git a/app/views/cards/drafts/_container.html.erb b/app/views/cards/drafts/_container.html.erb
index fa7134b55..9ffc04711 100644
--- a/app/views/cards/drafts/_container.html.erb
+++ b/app/views/cards/drafts/_container.html.erb
@@ -26,9 +26,5 @@
     </div>
   <% end %>
 
-  <% if Fizzy.saas? %>
-    <%= render "cards/container/footer/saas/create", card: card %>
-  <% else %>
-    <%= render "cards/container/footer/create", card: card %>
-  <% end %>
+  <%= render "cards/container/footer/create", card: card %>
 </section>
diff --git a/app/views/layouts/shared/_head.html.erb b/app/views/layouts/shared/_head.html.erb
index 4be536454..9ef153df2 100644
--- a/app/views/layouts/shared/_head.html.erb
+++ b/app/views/layouts/shared/_head.html.erb
@@ -17,7 +17,6 @@
 
   <%= render "layouts/theme_preference" %>
   <%= stylesheet_link_tag :app, "data-turbo-track": "reload" %>
-  <%= stylesheet_link_tag "fizzy/saas", "data-turbo-track": "reload" if Fizzy.saas? %>
   <%= javascript_importmap_tags %>
 
   <%= tenanted_action_cable_meta_tag %>
diff --git a/saas/app/assets/stylesheets/fizzy/saas.css b/saas/app/assets/stylesheets/fizzy/saas.css
deleted file mode 100644
index a3fedc53d..000000000
--- a/saas/app/assets/stylesheets/fizzy/saas.css
+++ /dev/null
@@ -1,70 +0,0 @@
-/* Subscriptions
-/* ------------------------------------------------------------------------ */
-:root {
-  --settings-subscription-background: linear-gradient(to bottom, var(--color-canvas), oklch(var(--lch-violet-lighter)));
-  --settings-subscription-color: oklch(var(--lch-violet-medium));
-  --settings-subscription-text-color: oklch(var(--lch-violet-dark));
-
-  .settings-subscription__button {
-    --btn-background: var(--settings-subscription-color);
-    --btn-border-color: var(--color-canvas);
-    --btn-color: var(--color-canvas);
-    --focus-ring-color: var(--color-ink);
-  }
-
-  .settings-subscription__divider {
-    --divider-color: currentColor;
-
-    color: var(--settings-subscription-color);
-    margin-block-start: calc(var(--block-space-half) * -1);
-  }
-
-  .settings-subscription__footer {
-    color: var(--settings-subscription-text-color);
-
-    &::before {
-      border-block-start: 1px solid var(--settings-subscription-text-color);
-      content: "";
-      display: block;
-      inline-size: 8ch;
-      margin: 0 auto 1ch;
-    }
-  }
-
-  .settings-subscription__link {
-    color: var(--settings-subscription-text-color);
-  }
-
-  .settings-subscription__notch {
-    animation: wiggle 500ms ease;
-    background: var(--settings-subscription-background);
-    border-radius: 3em;
-    box-shadow: 0 0 0.3em 0.2em var(--settings-subscription-color);
-    color: var(--settings-subscription-text-color);
-    margin-inline: auto;
-    padding: 0.3em 0.3em 0.3em 1.2em;
-    transform: rotate(-1deg);
-
-    @media (max-width: 640px) {
-      border-radius: 1ch;
-      padding-block: 1ch;
-      padding-inline: 2ch;
-    }
-
-    .btn {
-      /* margin-block: 0.3em; */
-    }
-  }
-
-  .settings-subscription__panel {
-    background: var(--settings-subscription-background);
-  }
-
-  .settings_subscription__warning {
-    color: var(--settings-subscription-text-color);
-
-    a {
-      color: var(--settings-subscription-text-color);
-    }
-  }
-}
diff --git a/saas/app/controllers/account/billing_portals_controller.rb b/saas/app/controllers/account/billing_portals_controller.rb
deleted file mode 100644
index 67eaffe6c..000000000
--- a/saas/app/controllers/account/billing_portals_controller.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-class Account::BillingPortalsController < ApplicationController
-  before_action :ensure_admin
-  before_action :ensure_subscribed_account
-
-  def show
-    redirect_to create_stripe_billing_portal_session.url, allow_other_host: true
-  end
-
-  private
-    def ensure_subscribed_account
-      unless Current.account.subscribed?
-        redirect_to account_subscription_path, alert: "No billing information found"
-      end
-    end
-
-    def create_stripe_billing_portal_session
-      Stripe::BillingPortal::Session.create(customer: Current.account.subscription.stripe_customer_id, return_url: account_settings_url)
-    end
-end
diff --git a/saas/app/controllers/account/subscriptions/downgrades_controller.rb b/saas/app/controllers/account/subscriptions/downgrades_controller.rb
deleted file mode 100644
index d06795841..000000000
--- a/saas/app/controllers/account/subscriptions/downgrades_controller.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-class Account::Subscriptions::DowngradesController < Account::Subscriptions::UpdatePlanController
-  before_action :ensure_downgradeable
-
-  private
-    def target_plan
-      Plan.paid
-    end
-
-    def ensure_downgradeable
-      head :bad_request unless subscription.plan == Plan.paid_with_extra_storage
-    end
-end
diff --git a/saas/app/controllers/account/subscriptions/update_plan_controller.rb b/saas/app/controllers/account/subscriptions/update_plan_controller.rb
deleted file mode 100644
index c6a665cec..000000000
--- a/saas/app/controllers/account/subscriptions/update_plan_controller.rb
+++ /dev/null
@@ -1,32 +0,0 @@
-class Account::Subscriptions::UpdatePlanController < ApplicationController
-  before_action :ensure_admin
-
-  def create
-    portal_session = Stripe::BillingPortal::Session.create(
-      customer: subscription.stripe_customer_id,
-      return_url: account_settings_url(anchor: "subscription"),
-      flow_data: {
-        type: "subscription_update_confirm",
-        subscription_update_confirm: {
-          subscription: subscription.stripe_subscription_id,
-          items: [ { id: stripe_subscription_item_id, price: target_plan.stripe_price_id } ]
-        }
-      }
-    )
-
-    redirect_to portal_session.url, allow_other_host: true
-  end
-
-  private
-    def target_plan
-      raise NotImplementedError
-    end
-
-    def subscription
-      @subscription ||= Current.account.subscription
-    end
-
-    def stripe_subscription_item_id
-      Stripe::Subscription.retrieve(subscription.stripe_subscription_id).items.data.first.id
-    end
-end
diff --git a/saas/app/controllers/account/subscriptions/upgrades_controller.rb b/saas/app/controllers/account/subscriptions/upgrades_controller.rb
deleted file mode 100644
index 1de6d8c6c..000000000
--- a/saas/app/controllers/account/subscriptions/upgrades_controller.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-class Account::Subscriptions::UpgradesController < Account::Subscriptions::UpdatePlanController
-  before_action :ensure_upgradeable
-
-  private
-    def target_plan
-      Plan.paid_with_extra_storage
-    end
-
-    def ensure_upgradeable
-      head :bad_request unless subscription.plan == Plan.paid
-    end
-end
diff --git a/saas/app/controllers/account/subscriptions_controller.rb b/saas/app/controllers/account/subscriptions_controller.rb
deleted file mode 100644
index bbc4ec47a..000000000
--- a/saas/app/controllers/account/subscriptions_controller.rb
+++ /dev/null
@@ -1,46 +0,0 @@
-class Account::SubscriptionsController < ApplicationController
-  before_action :ensure_admin
-  before_action :set_stripe_session, only: :show
-
-  def show
-  end
-
-  def create
-    session = Stripe::Checkout::Session.create \
-      customer: find_or_create_stripe_customer,
-      mode: "subscription",
-      line_items: [ { price: plan_param.stripe_price_id, quantity: 1 } ],
-      success_url: account_subscription_url + "?session_id={CHECKOUT_SESSION_ID}",
-      cancel_url: account_subscription_url,
-      metadata: { account_id: Current.account.id, plan_key: plan_param.key },
-      automatic_tax: { enabled: true },
-      tax_id_collection: { enabled: true },
-      billing_address_collection: "required",
-      customer_update: { address: "auto", name: "auto" }
-
-    redirect_to session.url, allow_other_host: true
-  end
-
-  private
-    def plan_param
-      @plan_param ||= Plan[params[:plan_key]] || Plan.paid
-    end
-
-    def set_stripe_session
-      @stripe_session = Stripe::Checkout::Session.retrieve(params[:session_id]) if params[:session_id]
-    end
-
-    def find_or_create_stripe_customer
-      find_stripe_customer || create_stripe_customer
-    end
-
-    def find_stripe_customer
-      Stripe::Customer.retrieve(Current.account.subscription.stripe_customer_id) if Current.account.subscription&.stripe_customer_id
-    end
-
-    def create_stripe_customer
-      Stripe::Customer.create(email: Current.user.identity.email_address, name: Current.account.name, metadata: { account_id: Current.account.id }).tap do |customer|
-        Current.account.create_subscription!(stripe_customer_id: customer.id, plan_key: plan_param.key, status: "incomplete")
-      end
-    end
-end
diff --git a/saas/app/controllers/admin/account_searches_controller.rb b/saas/app/controllers/admin/account_searches_controller.rb
deleted file mode 100644
index db655a9ef..000000000
--- a/saas/app/controllers/admin/account_searches_controller.rb
+++ /dev/null
@@ -1,5 +0,0 @@
-class Admin::AccountSearchesController < AdminController
-  def create
-    redirect_to saas.edit_admin_account_path(params[:q])
-  end
-end
diff --git a/saas/app/controllers/admin/accounts_controller.rb b/saas/app/controllers/admin/accounts_controller.rb
deleted file mode 100644
index 26a2b9c82..000000000
--- a/saas/app/controllers/admin/accounts_controller.rb
+++ /dev/null
@@ -1,27 +0,0 @@
-class Admin::AccountsController < AdminController
-  include Admin::AccountScoped
-
-  layout "public"
-
-  before_action :set_account, only: %i[ edit update ]
-
-  def index
-  end
-
-  def edit
-  end
-
-  def update
-    @account.override_limits(**overridden_limits_params.to_h.symbolize_keys)
-    redirect_to saas.edit_admin_account_path(@account.external_account_id), notice: "Account limits updated"
-  end
-
-  private
-    def set_account
-      @account = Account.find_by!(external_account_id: params[:id])
-    end
-
-    def overridden_limits_params
-      params.expect(account: [ :card_count, :bytes_used ])
-    end
-end
diff --git a/saas/app/controllers/admin/billing_waivers_controller.rb b/saas/app/controllers/admin/billing_waivers_controller.rb
deleted file mode 100644
index 713891069..000000000
--- a/saas/app/controllers/admin/billing_waivers_controller.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-class Admin::BillingWaiversController < AdminController
-  include Admin::AccountScoped
-
-  def create
-    @account.comp
-    redirect_to saas.edit_admin_account_path(@account.external_account_id), notice: "Account comped"
-  end
-
-  def destroy
-    @account.uncomp
-    redirect_to saas.edit_admin_account_path(@account.external_account_id), notice: "Account uncomped"
-  end
-end
diff --git a/saas/app/controllers/admin/overridden_limits_controller.rb b/saas/app/controllers/admin/overridden_limits_controller.rb
deleted file mode 100644
index fff8ea3e3..000000000
--- a/saas/app/controllers/admin/overridden_limits_controller.rb
+++ /dev/null
@@ -1,8 +0,0 @@
-class Admin::OverriddenLimitsController < AdminController
-  include Admin::AccountScoped
-
-  def destroy
-    @account.reset_overridden_limits
-    redirect_to saas.edit_admin_account_path(@account.external_account_id), notice: "Limits reset"
-  end
-end
diff --git a/saas/app/controllers/admin/stats_controller.rb b/saas/app/controllers/admin/stats_controller.rb
index 287b49024..6d508fc2c 100644
--- a/saas/app/controllers/admin/stats_controller.rb
+++ b/saas/app/controllers/admin/stats_controller.rb
@@ -6,10 +6,6 @@ class Admin::StatsController < AdminController
     @accounts_last_7_days = Account.where(created_at: 7.days.ago..).count
     @accounts_last_24_hours = Account.where(created_at: 24.hours.ago..).count
 
-    @paid_accounts_total = Account::Subscription.paid.distinct.count(:account_id)
-    @paid_accounts_last_7_days = Account::Subscription.paid.where(created_at: 7.days.ago..).distinct.count(:account_id)
-    @paid_accounts_last_24_hours = Account::Subscription.paid.where(created_at: 24.hours.ago..).distinct.count(:account_id)
-
     @identities_total = Identity.count
     @identities_last_7_days = Identity.where(created_at: 7.days.ago..).count
     @identities_last_24_hours = Identity.where(created_at: 24.hours.ago..).count
diff --git a/saas/app/controllers/concerns/admin/account_scoped.rb b/saas/app/controllers/concerns/admin/account_scoped.rb
deleted file mode 100644
index 314720cd2..000000000
--- a/saas/app/controllers/concerns/admin/account_scoped.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-module Admin::AccountScoped
-  extend ActiveSupport::Concern
-
-  included do
-    before_action :set_account
-  end
-
-  private
-    def set_account
-      @account = Account.find_by!(external_account_id: params[:account_id] || params[:id])
-    end
-end
diff --git a/saas/app/controllers/concerns/card/limited.rb b/saas/app/controllers/concerns/card/limited.rb
deleted file mode 100644
index 0576c6c4e..000000000
--- a/saas/app/controllers/concerns/card/limited.rb
+++ /dev/null
@@ -1,8 +0,0 @@
-module Card::Limited
-  extend ActiveSupport::Concern
-
-  private
-    def ensure_under_limits
-      head :forbidden if Current.account.exceeding_limits?
-    end
-end
diff --git a/saas/app/controllers/concerns/card/limited_creation.rb b/saas/app/controllers/concerns/card/limited_creation.rb
deleted file mode 100644
index 0e992008a..000000000
--- a/saas/app/controllers/concerns/card/limited_creation.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module Card::LimitedCreation
-  extend ActiveSupport::Concern
-
-  included do
-    include Card::Limited
-
-    # Only limit API requests. We let you create drafts in the app to actually show the banner, no matter the card count.
-    # We limit card publications separately. See +Card::LimitedPublishing+.
-    before_action :ensure_under_limits, only: %i[ create ], if: -> { request.format.json? }
-  end
-end
diff --git a/saas/app/controllers/concerns/card/limited_publishing.rb b/saas/app/controllers/concerns/card/limited_publishing.rb
deleted file mode 100644
index 8b60a4b53..000000000
--- a/saas/app/controllers/concerns/card/limited_publishing.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-module Card::LimitedPublishing
-  extend ActiveSupport::Concern
-
-  included do
-    include Card::Limited
-
-    before_action :ensure_under_limits, only: %i[ create ]
-  end
-end
diff --git a/saas/app/controllers/stripe/webhooks_controller.rb b/saas/app/controllers/stripe/webhooks_controller.rb
deleted file mode 100644
index 13dcd4699..000000000
--- a/saas/app/controllers/stripe/webhooks_controller.rb
+++ /dev/null
@@ -1,85 +0,0 @@
-class Stripe::WebhooksController < ApplicationController
-  allow_unauthenticated_access
-  skip_before_action :require_account
-  skip_forgery_protection
-
-  def create
-    if event = verify_webhook_signature
-      dispatch_stripe_event(event)
-      head :ok
-    else
-      head :bad_request
-    end
-  end
-
-  private
-    def dispatch_stripe_event(event)
-      case event.type
-      when "checkout.session.completed"
-        sync_new_subscription(event.data.object.subscription, plan_key: event.data.object.metadata["plan_key"]) if event.data.object.mode == "subscription"
-      when "customer.subscription.updated", "customer.subscription.deleted"
-        sync_subscription(event.data.object.id)
-      end
-    end
-
-    def verify_webhook_signature
-      payload = request.body.read
-      sig_header = request.env["HTTP_STRIPE_SIGNATURE"]
-
-      Stripe::Webhook.construct_event(payload, sig_header, ENV["STRIPE_WEBHOOK_SECRET"])
-    rescue Stripe::SignatureVerificationError => e
-      Rails.logger.error "Stripe webhook signature verification failed: #{e.message}"
-      nil
-    end
-
-    def sync_new_subscription(stripe_subscription_id, plan_key:)
-      sync_subscription(stripe_subscription_id) do |subscription_properties|
-        subscription_properties[:plan_key] = plan_key if plan_key
-      end
-    end
-
-    # Always fetch fresh subscription data from Stripe to handle out-of-order
-    # event delivery. Not relying on payload data.
-    def sync_subscription(stripe_subscription_id)
-      stripe_subscription = Stripe::Subscription.retrieve(stripe_subscription_id)
-
-      if subscription = find_subscription_by_stripe_customer(stripe_subscription.customer)
-        subscription_properties = {
-          stripe_subscription_id: stripe_subscription.id,
-          status: stripe_subscription.status,
-          current_period_end: current_period_end_for(stripe_subscription),
-          cancel_at: stripe_subscription.cancel_at ? Time.at(stripe_subscription.cancel_at) : nil,
-          next_amount_due_in_cents: next_amount_due_for(stripe_subscription),
-          plan_key: plan_key_for(stripe_subscription)
-        }
-
-        yield subscription_properties if block_given?
-        subscription_properties[:stripe_subscription_id] = nil if stripe_subscription.status == "canceled"
-
-        subscription.update!(subscription_properties)
-      end
-    end
-
-    def find_subscription_by_stripe_customer(id)
-      Account::Subscription.find_by(stripe_customer_id: id)
-    end
-
-    def current_period_end_for(stripe_subscription)
-      timestamp = stripe_subscription.items.data.first&.current_period_end
-      Time.at(timestamp) if timestamp
-    end
-
-    def next_amount_due_for(stripe_subscription)
-      return nil if stripe_subscription.status == "canceled"
-
-      preview = Stripe::Invoice.create_preview(customer: stripe_subscription.customer, subscription: stripe_subscription.id)
-      preview.amount_due
-    rescue Stripe::InvalidRequestError
-      nil
-    end
-
-    def plan_key_for(stripe_subscription)
-      price_id = stripe_subscription.items.data.first&.price&.id
-      Plan.find_by_price_id(price_id)&.key
-    end
-end
diff --git a/saas/app/helpers/subscriptions_helper.rb b/saas/app/helpers/subscriptions_helper.rb
deleted file mode 100644
index fd6b5aa47..000000000
--- a/saas/app/helpers/subscriptions_helper.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-module SubscriptionsHelper
-  def storage_to_human_size(bytes)
-    number_to_human_size(bytes).delete(" ")
-  end
-
-  def subscription_period_end_action(subscription)
-    if subscription.to_be_canceled?
-      "Your Fizzy subscription ends on"
-    elsif subscription.canceled?
-      "Your Fizzy subscription ended on"
-    else
-      "Your next payment is <b>#{ format_currency(subscription.next_amount_due) }</b> on".html_safe
-    end
-  end
-
-  def format_currency(amount)
-    number_to_currency(amount, precision: (amount % 1).zero? ? 0 : 2)
-  end
-end
diff --git a/saas/app/jobs/account/sync_stripe_customer_email_job.rb b/saas/app/jobs/account/sync_stripe_customer_email_job.rb
deleted file mode 100644
index b84eafa76..000000000
--- a/saas/app/jobs/account/sync_stripe_customer_email_job.rb
+++ /dev/null
@@ -1,8 +0,0 @@
-class Account::SyncStripeCustomerEmailJob < ApplicationJob
-  queue_as :default
-  retry_on Stripe::StripeError, wait: :polynomially_longer
-
-  def perform(subscription)
-    subscription.sync_customer_email_to_stripe
-  end
-end
diff --git a/saas/app/models/account/billing.rb b/saas/app/models/account/billing.rb
deleted file mode 100644
index c124fd64c..000000000
--- a/saas/app/models/account/billing.rb
+++ /dev/null
@@ -1,50 +0,0 @@
-module Account::Billing
-  extend ActiveSupport::Concern
-
-  included do
-    has_one :subscription, class_name: "Account::Subscription", dependent: :destroy
-    has_one :billing_waiver, class_name: "Account::BillingWaiver", dependent: :destroy
-
-    set_callback :incinerate, :before, -> { subscription&.cancel }
-    set_callback :cancel, :after, -> { subscription&.pause }
-    set_callback :reactivate, :before, -> { subscription&.resume }
-  end
-
-  def plan
-    active_subscription&.plan || Plan.free
-  end
-
-  def subscribed?
-    subscription.present?
-  end
-
-  def comped?
-    billing_waiver.present?
-  end
-
-  def comp
-    create_billing_waiver unless billing_waiver
-  end
-
-  def uncomp
-    billing_waiver&.destroy!
-    reload_billing_waiver
-  end
-
-  def owner_email_changed
-    Account::SyncStripeCustomerEmailJob.perform_later(subscription) if subscription
-  end
-
-  private
-    def active_subscription
-      if comped?
-        comped_subscription
-      elsif subscription&.active?
-        subscription
-      end
-    end
-
-    def comped_subscription
-      @comped_subscription ||= billing_waiver&.subscription
-    end
-end
diff --git a/saas/app/models/account/billing_waiver.rb b/saas/app/models/account/billing_waiver.rb
deleted file mode 100644
index a9ec35eb8..000000000
--- a/saas/app/models/account/billing_waiver.rb
+++ /dev/null
@@ -1,7 +0,0 @@
-class Account::BillingWaiver < SaasRecord
-  belongs_to :account
-
-  def subscription
-    @subscription ||= Account::Subscription.new(plan: Plan.paid_with_extra_storage)
-  end
-end
diff --git a/saas/app/models/account/limited.rb b/saas/app/models/account/limited.rb
deleted file mode 100644
index 2918e90a3..000000000
--- a/saas/app/models/account/limited.rb
+++ /dev/null
@@ -1,56 +0,0 @@
-module Account::Limited
-  extend ActiveSupport::Concern
-
-  included do
-    has_one :overridden_limits, class_name: "Account::OverriddenLimits", dependent: :destroy
-  end
-
-  NEAR_CARD_LIMIT_THRESHOLD = 100
-  NEAR_STORAGE_LIMIT_THRESHOLD = 500.megabytes
-
-  def override_limits(card_count: nil, bytes_used: nil)
-    (overridden_limits || build_overridden_limits).update!(card_count:, bytes_used:)
-  end
-
-  def billed_cards_count
-    overridden_limits&.card_count || cards_count
-  end
-
-  def billed_bytes_used
-    overridden_limits&.bytes_used || bytes_used
-  end
-
-  def nearing_plan_cards_limit?
-    plan.limit_cards? && remaining_cards_count <= NEAR_CARD_LIMIT_THRESHOLD
-  end
-
-  def exceeding_card_limit?
-    plan.limit_cards? && billed_cards_count >= plan.card_limit
-  end
-
-  def nearing_plan_storage_limit?
-    remaining_storage < NEAR_STORAGE_LIMIT_THRESHOLD
-  end
-
-  def exceeding_storage_limit?
-    billed_bytes_used > plan.storage_limit
-  end
-
-  def exceeding_limits?
-    exceeding_card_limit? || exceeding_storage_limit?
-  end
-
-  def reset_overridden_limits
-    overridden_limits&.destroy
-    reload_overridden_limits
-  end
-
-  private
-    def remaining_cards_count
-      plan.card_limit - billed_cards_count
-    end
-
-    def remaining_storage
-      plan.storage_limit - billed_bytes_used
-    end
-end
diff --git a/saas/app/models/account/overridden_limits.rb b/saas/app/models/account/overridden_limits.rb
deleted file mode 100644
index cdf3c51ec..000000000
--- a/saas/app/models/account/overridden_limits.rb
+++ /dev/null
@@ -1,4 +0,0 @@
-# To ease testing of limits
-class Account::OverriddenLimits < SaasRecord
-  belongs_to :account
-end
diff --git a/saas/app/models/account/subscription.rb b/saas/app/models/account/subscription.rb
deleted file mode 100644
index c1ec9e47c..000000000
--- a/saas/app/models/account/subscription.rb
+++ /dev/null
@@ -1,73 +0,0 @@
-class Account::Subscription < SaasRecord
-  belongs_to :account
-
-  enum :status, %w[ active past_due unpaid canceled incomplete incomplete_expired trialing paused ].index_by(&:itself)
-
-  scope :paid, -> {
-    where(status: %w[active trialing past_due])
-      .where(plan_key: Plan.all.select(&:paid?).map(&:key))
-      .where.not(account_id: Account::BillingWaiver.select(:account_id))
-  }
-
-  validates :plan_key, presence: true, inclusion: { in: Plan::PLANS.keys.map(&:to_s) }
-
-  delegate :paid?, to: :plan
-
-  def plan
-    @plan ||= Plan.find(plan_key)
-  end
-
-  def plan=(plan)
-    self.plan_key = plan.key
-  end
-
-  def to_be_canceled?
-    active? && cancel_at.present?
-  end
-
-  def next_amount_due
-    next_amount_due_in_cents ? next_amount_due_in_cents / 100.0 : plan.price
-  end
-
-  def pause
-    if stripe_subscription_id.present?
-      Stripe::Subscription.update(
-        stripe_subscription_id,
-        pause_collection: { behavior: "void" }
-      )
-    end
-  end
-
-  def resume
-    if stripe_subscription_id.present?
-      Stripe::Subscription.update(
-        stripe_subscription_id,
-        pause_collection: ""
-      )
-    end
-  end
-
-  def cancel
-    Stripe::Subscription.cancel(stripe_subscription_id) if stripe_subscription_id.present?
-  rescue Stripe::InvalidRequestError => e
-    # Subscription already deleted/canceled in Stripe - treat as success
-    Rails.logger.warn "Stripe subscription #{stripe_subscription_id} not found during cancel: #{e.message}"
-  end
-
-  def sync_customer_email_to_stripe
-    if stripe_customer_id && (email = owner_email)
-      Stripe::Customer.update(stripe_customer_id, email: email)
-    end
-  rescue Stripe::InvalidRequestError => e
-    # Customer already deleted in Stripe - treat as success
-    Rails.logger.warn "Stripe customer #{stripe_customer_id} not found during email sync: #{e.message}"
-  end
-
-  private
-    # Account owner email for Stripe customer record. Returns nil when:
-    # - No owner exists (ownership being transferred, account in limbo)
-    # - Owner has no identity (deactivated user)
-    def owner_email
-      account.users.owner.first&.identity&.email_address
-    end
-end
diff --git a/saas/app/models/plan.rb b/saas/app/models/plan.rb
deleted file mode 100644
index e77ea81e8..000000000
--- a/saas/app/models/plan.rb
+++ /dev/null
@@ -1,59 +0,0 @@
-class Plan
-  PLANS = {
-    free_v1: { name: "Free", price: 0, card_limit: 1000, storage_limit: 1.gigabytes },
-    monthly_v1: { name: "Unlimited", price: 20, card_limit: Float::INFINITY, storage_limit: 5.gigabytes, stripe_price_id: ENV["STRIPE_MONTHLY_V1_PRICE_ID"] },
-    monthly_extra_storage_v1: { name: "Unlimited + Extra Storage", price: 25, card_limit: Float::INFINITY, storage_limit: 500.gigabytes, stripe_price_id: ENV["STRIPE_MONTHLY_EXTRA_STORAGE_V1_PRICE_ID"] }
-  }
-
-  attr_reader :key, :name, :price, :card_limit, :storage_limit, :stripe_price_id
-
-  class << self
-    def all
-      @all ||= PLANS.map { |key, properties| new(key: key, **properties) }
-    end
-
-    def free
-      @free ||= find(:free_v1)
-    end
-
-    def paid
-      @paid ||= find(:monthly_v1)
-    end
-
-    def paid_with_extra_storage
-      @paid_with_extra_storage ||= find(:monthly_extra_storage_v1)
-    end
-
-    def find(key)
-      @all_by_key ||= all.index_by(&:key).with_indifferent_access
-      @all_by_key[key]
-    end
-
-    def find_by_price_id(price_id)
-      all.find { |plan| plan.stripe_price_id == price_id }
-    end
-
-    alias [] find
-  end
-
-  def initialize(key:, name:, price:, card_limit:, storage_limit:, stripe_price_id: nil)
-    @key = key
-    @name = name
-    @price = price
-    @card_limit = card_limit
-    @storage_limit = storage_limit
-    @stripe_price_id = stripe_price_id
-  end
-
-  def free?
-    price.zero?
-  end
-
-  def paid?
-    !free?
-  end
-
-  def limit_cards?
-    !card_limit.infinite?
-  end
-end
diff --git a/saas/app/models/user/notifies_account_of_email_change.rb b/saas/app/models/user/notifies_account_of_email_change.rb
deleted file mode 100644
index daba4ba3d..000000000
--- a/saas/app/models/user/notifies_account_of_email_change.rb
+++ /dev/null
@@ -1,23 +0,0 @@
-module User::NotifiesAccountOfEmailChange
-  extend ActiveSupport::Concern
-
-  included do
-    after_update :notify_account_of_owner_change, if: :account_owner_changed?
-  end
-
-  private
-    # Account owner changed when:
-    # - The current owner changed their email
-    # - A user just became the owner (ownership transfer)
-    def account_owner_changed?
-      owner? && identity && (saved_change_to_identity_id? || became_owner?)
-    end
-
-    def became_owner?
-      saved_change_to_role? && role_before_last_save != "owner"
-    end
-
-    def notify_account_of_owner_change
-      account.owner_email_changed
-    end
-end
diff --git a/saas/app/views/account/settings/_free_plan.html.erb b/saas/app/views/account/settings/_free_plan.html.erb
deleted file mode 100644
index ca467d8af..000000000
--- a/saas/app/views/account/settings/_free_plan.html.erb
+++ /dev/null
@@ -1,18 +0,0 @@
-<h3 class="margin-block-start txt-large font-weight-black txt-tight-lines">
-  <% if Current.account.exceeding_card_limit? && Current.account.exceeding_storage_limit? %>
-    You’ve used up your <u><%= number_with_delimiter(Plan.free.card_limit) %></u> free cards and all <u><%= storage_to_human_size(Plan.free.storage_limit) %></u> of free storage
-  <% elsif Current.account.exceeding_card_limit? %>
-    You’ve used up your <u><%= number_with_delimiter(Plan.free.card_limit) %></u> free cards
-  <% elsif Current.account.exceeding_storage_limit? %>
-    You’ve used up all <u><%= storage_to_human_size(Plan.free.storage_limit) %></u> of free storage
-  <% else %>
-    You’ve used <u><%= Current.account.billed_cards_count %></u> free cards out of <%= number_with_delimiter(Plan.free.card_limit) %>
-  <% end %>
-</h3>
-
-<p class="margin-block-start-half">To keep using Fizzy <%= "past #{ number_with_delimiter(Plan.free.card_limit) } cards," unless Current.account.exceeding_storage_limit? %> it’s only <strong><%= format_currency(Plan.paid.price) %>/month</strong> for <strong class="txt-nowrap">unlimited cards</strong>, <strong class="txt-nowrap">unlimited users</strong>, and <strong><%= storage_to_human_size(Plan.paid.storage_limit) %></strong> of storage.</p>
-
-<%= button_to "Upgrade to #{Plan.paid.name} for #{ format_currency(Plan.paid.price) }/month", account_subscription_path, class: "btn settings-subscription__button txt-medium", form: { data: { turbo: false } } %>
-
-<p>Cancel anytime, no contracts, take your data with you whenever.</p>
-<p class="settings-subscription__footer txt-small margin-none-block-end">Right now you’re on the <strong><%= Current.account.plan.name %></strong> plan which includes <%= number_with_delimiter(Plan.free.card_limit) %> cards, unlimited users, and <%= storage_to_human_size(Plan.free.storage_limit) %> of storage.</p>
diff --git a/saas/app/views/account/settings/_paid_plan.html.erb b/saas/app/views/account/settings/_paid_plan.html.erb
deleted file mode 100644
index 6ea99a066..000000000
--- a/saas/app/views/account/settings/_paid_plan.html.erb
+++ /dev/null
@@ -1,21 +0,0 @@
-<h3 class="margin-block-start txt-x-large font-weight-black txt-tight-lines">
-  <% if Current.account.exceeding_storage_limit? %>
-    You’ve run out of storage
-  <% elsif Current.account.nearing_plan_storage_limit? %>
-    You’ve used <strong><%= storage_to_human_size(Current.account.billed_bytes_used) %></strong> of storage
-  <% else %>
-    Thank you for buying Fizzy
-  <% end %>
-</h3>
-
-<% if Current.account.nearing_plan_storage_limit? || Current.account.exceeding_storage_limit? %>
-  <p class="margin-block-start-half">
-    The <strong><%= Current.account.plan.name %></strong> plan includes <strong><%= storage_to_human_size(Plan.paid.storage_limit) %></strong>. Upgrade to get <strong><%= storage_to_human_size(Plan.paid_with_extra_storage.storage_limit) %></strong> extra storage for <%= format_currency(Plan.paid_with_extra_storage.price - Plan.paid.price) %>/month more.
-  </p>
-
-  <%= button_to "Upgrade to #{Plan.paid_with_extra_storage.name} for #{ number_to_currency(Plan.paid_with_extra_storage.price, strip_insignificant_zeros: true) }/month", account_subscription_upgrade_path, class: "btn settings-subscription__button txt-medium", form: { data: { turbo: false } } %>
-<% end %>
-
-<% if Current.account.subscription %>
-  <%= render "account/settings/subscription", subscription: Current.account.subscription %>
-<% end %>
diff --git a/saas/app/views/account/settings/_subscription.html.erb b/saas/app/views/account/settings/_subscription.html.erb
deleted file mode 100644
index 4eca0ad2d..000000000
--- a/saas/app/views/account/settings/_subscription.html.erb
+++ /dev/null
@@ -1,20 +0,0 @@
-<% if subscription.current_period_end %>
-  <p class="margin-block-start-half"><%= subscription_period_end_action(subscription) %> <strong><%= subscription.current_period_end.to_date.to_fs(:long) %></strong></p>
-<% end %>
-
-<p>
-  <%= link_to "Manage your subscription", account_billing_portal_path, class: "btn btn--plain settings-subscription__link txt-link", data: { turbo_prefetch: false } %>
-</p>
-
-<div class="settings-subscription__footer txt-small margin-block">
-  Right now you’re on the <strong><%= Current.account.plan.name %></strong> plan which includes unlimited cards, unlimited users, and <%= storage_to_human_size(Current.account.plan.storage_limit) %> of storage.
-
-  <% if subscription.plan == Plan.paid && !(Current.account.nearing_plan_storage_limit? || Current.account.exceeding_storage_limit?) %>
-    <%= button_to "Upgrade", account_subscription_upgrade_path, class: "btn btn--plain settings-subscription__link txt-link", form: { class: "flex-inline flex-wrap", data: { turbo: false } } %>
-    to <%= storage_to_human_size(Plan.paid_with_extra_storage.storage_limit) %> storage for <%= format_currency(Plan.paid_with_extra_storage.price - Plan.paid.price) %>/month more.
-  <% elsif subscription.plan == Plan.paid_with_extra_storage && !Current.account.exceeding_storage_limit? %>
-    <%= button_to "Downgrade", account_subscription_downgrade_path, class: "btn btn--plain settings-subscription__link txt-link", form: { class: "flex-inline flex-wrap", data: { turbo: false } } %>
-    to <%= storage_to_human_size(Plan.paid.storage_limit) %> storage.
-  <% end %>
-</div>
-
diff --git a/saas/app/views/account/settings/_subscription_panel.html.erb b/saas/app/views/account/settings/_subscription_panel.html.erb
deleted file mode 100644
index 1cfcda4d8..000000000
--- a/saas/app/views/account/settings/_subscription_panel.html.erb
+++ /dev/null
@@ -1,11 +0,0 @@
-<% if Current.user.admin? && !Current.account.comped? %>
-  <section class="panel panel--wide settings-subscription__panel shadow center margin-block-double hide-on-native">
-    <h2 id="subscription" class="divider settings-subscription__divider txt-small txt-uppercase margin-none">Subscription</h2>
-
-    <% if Current.account.plan.free? %>
-      <%= render "account/settings/free_plan" %>
-    <% else %>
-      <%= render "account/settings/paid_plan" %>
-    <% end %>
-  </section>
-<% end %>
diff --git a/saas/app/views/account/subscriptions/_upgrade.html.erb b/saas/app/views/account/subscriptions/_upgrade.html.erb
deleted file mode 100644
index 449fecf16..000000000
--- a/saas/app/views/account/subscriptions/_upgrade.html.erb
+++ /dev/null
@@ -1,9 +0,0 @@
-<div class="settings-subscription__notch card-perma__notch card-perma__notch--bottom">
-  <% if Current.user.admin? %>
-    <%= render "account/subscriptions/notices/admin_exceeding_card_limit" if Current.account.exceeding_card_limit? %>
-    <%= render "account/subscriptions/notices/admin_exceeding_storage_limit" if Current.account.exceeding_storage_limit? %>
-  <% else %>
-    <%= render "account/subscriptions/notices/user_exceeding_card_limit" if Current.account.exceeding_card_limit? %>
-    <%= render "account/subscriptions/notices/user_exceeding_storage_limit" if Current.account.exceeding_storage_limit? %>
-  <% end %>
-</div>
diff --git a/saas/app/views/account/subscriptions/notices/_admin_exceeding_card_limit.html.erb b/saas/app/views/account/subscriptions/notices/_admin_exceeding_card_limit.html.erb
deleted file mode 100644
index 3dc759d9e..000000000
--- a/saas/app/views/account/subscriptions/notices/_admin_exceeding_card_limit.html.erb
+++ /dev/null
@@ -1,4 +0,0 @@
-<strong>You’ve used your <u><%= Plan.free.card_limit %></u> free cards.</strong>
-<%= link_to account_settings_path(anchor: "subscription"), class: "btn settings-subscription__button" do %>
-  <span>Upgrade to Unlimited</span>
-<% end %>
diff --git a/saas/app/views/account/subscriptions/notices/_admin_exceeding_storage_limit.html.erb b/saas/app/views/account/subscriptions/notices/_admin_exceeding_storage_limit.html.erb
deleted file mode 100644
index 8770c1460..000000000
--- a/saas/app/views/account/subscriptions/notices/_admin_exceeding_storage_limit.html.erb
+++ /dev/null
@@ -1,4 +0,0 @@
-<strong>You’ve run out of <%= Current.account.plan.free? ? "free storage" : "storage" %>.</strong>
-<%= link_to account_settings_path(anchor: "subscription"), class: "btn settings-subscription__button" do %>
-  <span>Upgrade to get more</span>
-<% end %>
diff --git a/saas/app/views/account/subscriptions/notices/_user_exceeding_card_limit.html.erb b/saas/app/views/account/subscriptions/notices/_user_exceeding_card_limit.html.erb
deleted file mode 100644
index f3f65f3be..000000000
--- a/saas/app/views/account/subscriptions/notices/_user_exceeding_card_limit.html.erb
+++ /dev/null
@@ -1,3 +0,0 @@
-<div class="pad-inline pad-block-half">
-  <strong>This account has used <u><%= Plan.free.card_limit %></u> free cards. Upgrade to get more.</strong>
-</div>
diff --git a/saas/app/views/account/subscriptions/notices/_user_exceeding_storage_limit.html.erb b/saas/app/views/account/subscriptions/notices/_user_exceeding_storage_limit.html.erb
deleted file mode 100644
index f230443a1..000000000
--- a/saas/app/views/account/subscriptions/notices/_user_exceeding_storage_limit.html.erb
+++ /dev/null
@@ -1,3 +0,0 @@
-<div class="pad-inline pad-block-half">
-  <strong>This account has run out of <%= Current.account.plan.free? ? "free storage" : "storage" %>. Upgrade to get more.</strong>
-</div>
diff --git a/saas/app/views/account/subscriptions/show.html.erb b/saas/app/views/account/subscriptions/show.html.erb
deleted file mode 100644
index 8d29a379e..000000000
--- a/saas/app/views/account/subscriptions/show.html.erb
+++ /dev/null
@@ -1,9 +0,0 @@
-<% @page_title = "Thank you" %>
-
-<% if @stripe_session&.payment_status == "paid" %>
-  <section class="panel panel--wide panel--centered center borderless">
-    <h1 class="txt-x-large font-weight-black margin-none">Thanks for buying Fizzy!</h1>
-    <p class="txt-medium margin-none-block-start">Your payment was successful. You’re now on the <strong><%= Current.account.plan.name %></strong> plan.</p>
-    <%= link_to "Done", account_settings_path, class: "btn settings-subscription__button txt-medium" %>
-  </section>
-<% end %>
diff --git a/saas/app/views/admin/accounts/edit.html.erb b/saas/app/views/admin/accounts/edit.html.erb
deleted file mode 100644
index 76c23497c..000000000
--- a/saas/app/views/admin/accounts/edit.html.erb
+++ /dev/null
@@ -1,63 +0,0 @@
-<% @page_title = "Account admin" %>
-
-<% content_for :header do %>
-  <div class="header__actions header__actions--start">
-    <%= back_link_to "Accounts", saas.admin_accounts_path, "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
-  </div>
-<% end %>
-
-
-<div class="panel panel--wide shadow center">
-  <div class="flex flex-column gap txt-medium">
-    <h1 class="txt-x-large font-weight-black margin-none">Edit Account <%= @account.external_account_id %></h1>
-
-    <%= form_with model: @account, url: saas.admin_account_path(@account.external_account_id), class: "flex flex-column gap" do |form| %>
-      <table class="txt-align-start">
-        <tr>
-          <td class="txt-subtle">Account Name:</td>
-          <td class="margin-inline-start-none"><%= @account.name %></td>
-        </tr>
-        <tr>
-          <td class="txt-subtle">Subscription plan:</td>
-          <td class="margin-inline-start-none"><%= @account.plan.name %></td>
-        </tr>
-        <tr>
-          <td class="txt-subtle">Actual card count:</td>
-          <td class="margin-inline-start-none"><%= @account.cards_count %> cards </td>
-        </tr>
-        <tr>
-          <td class="txt-subtle">Actual bytes used:</td>
-          <td class="margin-inline-start-none"><%= storage_to_human_size(@account.bytes_used) %></td>
-        </tr>
-        <tr>
-          <td>
-            <%= form.label :card_count, class: "txt-subtle" do %>
-              <span>Override card count</span><br><%= "(Exceeds plan limit)" if @account.exceeding_card_limit? %>
-            <% end %>
-          </td>
-          <td><%= form.number_field :card_count, value: @account.overridden_limits&.card_count, class: "input" %></td>
-        </tr>
-        <tr>
-          <td>
-            <%= form.label :bytes_used, class: "txt-subtle" do %>
-              <span>Override bytes used</span><br><%= "(Exceeds plan limit)" if @account.exceeding_storage_limit? %>
-            <% end %>
-          </td>
-          <td><%= form.number_field :bytes_used, value: @account.overridden_limits&.bytes_used, class: "input" %></td>
-        </tr>
-      </table>
-
-      <button type="submit" class="btn btn--link full-width">Save changes</button>
-    <% end %>
-
-    <% if @account.overridden_limits %>
-      <%= button_to "Reset limits", saas.admin_account_overridden_limits_path(@account.external_account_id), method: :delete, class: "btn btn--negative full-width" %>
-    <% end %>
-
-    <% if @account.comped? %>
-      <%= button_to "Uncomp account", saas.admin_account_billing_waiver_path(@account.external_account_id), method: :delete, class: "btn btn--plain txt-negative txt-underline" %>
-    <% else %>
-      <%= button_to "Comp account", saas.admin_account_billing_waiver_path(@account.external_account_id), method: :post, class: "btn btn--plain txt-positive txt-underline" %>
-    <% end %>
-  </div>
-</div>
diff --git a/saas/app/views/admin/accounts/index.html.erb b/saas/app/views/admin/accounts/index.html.erb
deleted file mode 100644
index 96bed2338..000000000
--- a/saas/app/views/admin/accounts/index.html.erb
+++ /dev/null
@@ -1,13 +0,0 @@
-<div class="panel panel--centered">
-  <div class="flex flex-column gap txt-medium">
-    <h1 class="txt-x-large font-weight-black margin-none">Find an account</h1>
-
-    <%= form_with url: saas.admin_account_search_path, class: "flex flex-column gap" do |form| %>
-      <%= form.text_field :q, placeholder: "Account ID", autofocus: true, class: "input" %>
-      <%= form.submit "Search", class: "btn btn--link" %>
-    <% end %>
-  </div>
-</div>
-
-
-
diff --git a/saas/app/views/admin/stats/show.html.erb b/saas/app/views/admin/stats/show.html.erb
index f93bd3eba..c2b1e1d5d 100644
--- a/saas/app/views/admin/stats/show.html.erb
+++ b/saas/app/views/admin/stats/show.html.erb
@@ -33,32 +33,6 @@
         </div>
       </div>
 
-      <div class="flex flex-column gap-half">
-        <header>
-          <h2 class="divider txt-medium margin-block-start">Accounts Subscribed</h2>
-        </header>
-        <div class="flex gap-half">
-          <div class="flex flex-column gap-quarter flex-item-grow">
-            <div class="txt-x-small">Total</div>
-            <div class="txt-large">
-              <strong><%= @paid_accounts_total %></strong>
-            </div>
-          </div>
-          <div class="flex flex-column gap-quarter flex-item-grow">
-            <div class="txt-x-small">7 days</div>
-            <div class="txt-large">
-              <strong><%= @paid_accounts_last_7_days %></strong>
-            </div>
-          </div>
-          <div class="flex flex-column gap-quarter flex-item-grow">
-            <div class="txt-x-small">24 hours</div>
-            <div class="txt-large">
-              <strong><%= @paid_accounts_last_24_hours %></strong>
-            </div>
-          </div>
-        </div>
-      </div>
-
       <div class="flex flex-column gap-half">
         <header>
           <h2 class="divider txt-medium margin-block-start">Identities Created</h2>
diff --git a/saas/app/views/cards/container/footer/saas/_create.html.erb b/saas/app/views/cards/container/footer/saas/_create.html.erb
deleted file mode 100644
index 8b0edd308..000000000
--- a/saas/app/views/cards/container/footer/saas/_create.html.erb
+++ /dev/null
@@ -1,5 +0,0 @@
-<% if Current.account.exceeding_limits? %>
-  <%= render "account/subscriptions/upgrade" %>
-<% else %>
-  <%= render "cards/container/footer/create", card: card %>
-<% end %>
diff --git a/saas/app/views/cards/container/footer/saas/_near_notice.html.erb b/saas/app/views/cards/container/footer/saas/_near_notice.html.erb
deleted file mode 100644
index 4cf480f3c..000000000
--- a/saas/app/views/cards/container/footer/saas/_near_notice.html.erb
+++ /dev/null
@@ -1,9 +0,0 @@
-<div class="settings_subscription__warning full-width pad-inline center margin-block-half">
-  <% if Current.user.admin? %>
-    <%= render "cards/container/footer/saas/notices/admin_nearing_card_limit" if Current.account.nearing_plan_cards_limit? %>
-    <%= render "cards/container/footer/saas/notices/admin_nearing_storage_limit" if Current.account.nearing_plan_storage_limit? %>
-  <% else %>
-    <%= render "cards/container/footer/saas/notices/user_nearing_card_limit" if Current.account.nearing_plan_cards_limit? %>
-    <%= render "cards/container/footer/saas/notices/user_nearing_storage_limit" if Current.account.nearing_plan_storage_limit? %>
-  <% end %>
-</div>
diff --git a/saas/app/views/cards/container/footer/saas/notices/_admin_nearing_card_limit.html.erb b/saas/app/views/cards/container/footer/saas/notices/_admin_nearing_card_limit.html.erb
deleted file mode 100644
index caa7bd958..000000000
--- a/saas/app/views/cards/container/footer/saas/notices/_admin_nearing_card_limit.html.erb
+++ /dev/null
@@ -1 +0,0 @@
-You’ve used <%= Current.account.billed_cards_count %> out of <%= Plan.free.card_limit %> free cards. <strong><%= link_to "Upgrade to unlimited", account_settings_path(anchor: "subscription") %></strong>.
diff --git a/saas/app/views/cards/container/footer/saas/notices/_admin_nearing_storage_limit.html.erb b/saas/app/views/cards/container/footer/saas/notices/_admin_nearing_storage_limit.html.erb
deleted file mode 100644
index ab1a3ca34..000000000
--- a/saas/app/views/cards/container/footer/saas/notices/_admin_nearing_storage_limit.html.erb
+++ /dev/null
@@ -1 +0,0 @@
-You’ve used <%= storage_to_human_size(Current.account.billed_bytes_used) %> out of <%= storage_to_human_size(Current.account.plan.storage_limit) %> <%= Current.account.plan.free? ? "free storage" : "storage" %>. <strong><%= link_to "Upgrade to get more", account_settings_path(anchor: "subscription") %></strong>.
diff --git a/saas/app/views/cards/container/footer/saas/notices/_user_nearing_card_limit.html.erb b/saas/app/views/cards/container/footer/saas/notices/_user_nearing_card_limit.html.erb
deleted file mode 100644
index 8ab80e162..000000000
--- a/saas/app/views/cards/container/footer/saas/notices/_user_nearing_card_limit.html.erb
+++ /dev/null
@@ -1 +0,0 @@
-This account has used <%= Current.account.billed_cards_count %> out of <%= Plan.free.card_limit %> free cards. Upgrade soon.
diff --git a/saas/app/views/cards/container/footer/saas/notices/_user_nearing_storage_limit.html.erb b/saas/app/views/cards/container/footer/saas/notices/_user_nearing_storage_limit.html.erb
deleted file mode 100644
index 25428980a..000000000
--- a/saas/app/views/cards/container/footer/saas/notices/_user_nearing_storage_limit.html.erb
+++ /dev/null
@@ -1 +0,0 @@
-This account has used <%= storage_to_human_size(Current.account.billed_bytes_used) %> out of <%= storage_to_human_size(Current.account.plan.storage_limit) %> <%= Current.account.plan.free? ? "free storage" : "storage" %>. Upgrade soon.
diff --git a/saas/config/routes.rb b/saas/config/routes.rb
index 581a2ae02..3eafab92f 100644
--- a/saas/config/routes.rb
+++ b/saas/config/routes.rb
@@ -8,10 +8,5 @@ Fizzy::Saas::Engine.routes.draw do
   namespace :admin do
     mount Audits1984::Engine, at: "/console"
     get "stats", to: "stats#show"
-    resource :account_search, only: :create
-    resources :accounts do
-      resource :overridden_limits, only: :destroy
-      resource :billing_waiver, only: [ :create, :destroy ]
-    end
   end
 end
diff --git a/saas/db/migrate/20260317000000_drop_billing_tables.rb b/saas/db/migrate/20260317000000_drop_billing_tables.rb
new file mode 100644
index 000000000..2ac9a808d
--- /dev/null
+++ b/saas/db/migrate/20260317000000_drop_billing_tables.rb
@@ -0,0 +1,7 @@
+class DropBillingTables < ActiveRecord::Migration[8.2]
+  def change
+    drop_table :account_subscriptions
+    drop_table :account_overridden_limits
+    drop_table :account_billing_waivers
+  end
+end
diff --git a/saas/db/saas_schema.rb b/saas/db/saas_schema.rb
index 298cc033a..5ae786764 100644
--- a/saas/db/saas_schema.rb
+++ b/saas/db/saas_schema.rb
@@ -10,39 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.2].define(version: 2026_01_26_230838) do
-  create_table "account_billing_waivers", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
-    t.uuid "account_id", null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
-    t.index ["account_id"], name: "index_account_billing_waivers_on_account_id", unique: true
-  end
-
-  create_table "account_overridden_limits", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
-    t.uuid "account_id", null: false
-    t.bigint "bytes_used"
-    t.integer "card_count"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
-    t.index ["account_id"], name: "index_account_overridden_limits_on_account_id", unique: true
-  end
-
-  create_table "account_subscriptions", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
-    t.uuid "account_id", null: false
-    t.datetime "cancel_at"
-    t.datetime "created_at", null: false
-    t.datetime "current_period_end"
-    t.integer "next_amount_due_in_cents"
-    t.string "plan_key"
-    t.string "status"
-    t.string "stripe_customer_id", null: false
-    t.string "stripe_subscription_id"
-    t.datetime "updated_at", null: false
-    t.index ["account_id"], name: "index_account_subscriptions_on_account_id"
-    t.index ["stripe_customer_id"], name: "index_account_subscriptions_on_stripe_customer_id", unique: true
-    t.index ["stripe_subscription_id"], name: "index_account_subscriptions_on_stripe_subscription_id", unique: true
-  end
-
+ActiveRecord::Schema[8.2].define(version: 2026_03_17_000000) do
   create_table "action_push_native_devices", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.datetime "created_at", null: false
     t.string "name"
diff --git a/saas/exe/stripe-dev b/saas/exe/stripe-dev
deleted file mode 100755
index d3e63a754..000000000
--- a/saas/exe/stripe-dev
+++ /dev/null
@@ -1,83 +0,0 @@
-#!/usr/bin/env ruby
-#
-# Fetches Stripe development environment variables from 1Password and starts
-# the Stripe CLI webhook listener.
-#
-# Usage: eval "$(bundle exec stripe-dev)"
-
-require "json"
-require "fileutils"
-
-LOG_FILE = "log/stripe.development.log"
-PID_FILE = "tmp/stripe.tunnel.pid"
-
-# Ensure directories exist
-FileUtils.mkdir_p("log")
-FileUtils.mkdir_p("tmp")
-
-# Kill any existing stripe tunnel process
-if File.exist?(PID_FILE)
-  old_pid = File.read(PID_FILE).strip.to_i
-  if old_pid > 0
-    Process.kill("TERM", old_pid) rescue nil
-  end
-  File.delete(PID_FILE)
-end
-
-# Fetch secrets from 1Password
-secrets_escaped = `kamal secrets fetch \
-  --adapter 1password \
-  --account 23QPQDKZC5BKBIIG7UGT5GR5RM \
-  --from "Deploy/Fizzy" \
-  "Development/STRIPE_SECRET_KEY" \
-  "Development/STRIPE_MONTHLY_V1_PRICE_ID" \
-  "Development/STRIPE_MONTHLY_EXTRA_STORAGE_V1_PRICE_ID" 2>/dev/null`
-
-secrets_json = secrets_escaped.gsub(/\\(.)/, '\1')
-secrets = JSON.parse(secrets_json)
-
-stripe_secret_key = secrets["Deploy/Fizzy/Development/STRIPE_SECRET_KEY"]
-stripe_price_id = secrets["Deploy/Fizzy/Development/STRIPE_MONTHLY_V1_PRICE_ID"]
-stripe_extra_storage_price_id = secrets["Deploy/Fizzy/Development/STRIPE_MONTHLY_EXTRA_STORAGE_V1_PRICE_ID"]
-
-# Clear previous log file
-File.write(LOG_FILE, "")
-
-# Start stripe listen in background
-pid = spawn(
-  "stripe", "listen", "--forward-to", "localhost:3006/stripe/webhooks",
-  out: [ LOG_FILE, "a" ],
-  err: [ LOG_FILE, "a" ]
-)
-Process.detach(pid)
-
-# Save PID for cleanup
-File.write(PID_FILE, pid.to_s)
-
-# Wait for the webhook secret to appear in logs
-webhook_secret = nil
-20.times do
-  sleep 0.5
-  if File.exist?(LOG_FILE)
-    content = File.read(LOG_FILE)
-    if match = content.match(/webhook signing secret is (whsec_\w+)/)
-      webhook_secret = match[1]
-      break
-    end
-  end
-end
-
-if webhook_secret.nil?
-  warn "Warning: Could not capture webhook secret from stripe listen"
-end
-
-# Output export statements
-puts %Q(export STRIPE_SECRET_KEY="#{stripe_secret_key}")
-puts %Q(export STRIPE_MONTHLY_V1_PRICE_ID="#{stripe_price_id}")
-puts %Q(export STRIPE_MONTHLY_EXTRA_STORAGE_V1_PRICE_ID="#{stripe_extra_storage_price_id}")
-puts %Q(export STRIPE_WEBHOOK_SECRET="#{webhook_secret}") if webhook_secret
-
-# Informational message to stderr (won't be eval'd)
-warn ""
-warn "Stripe CLI listening (PID: #{pid})"
-warn "Logs: #{LOG_FILE}"
diff --git a/saas/lib/fizzy/saas/engine.rb b/saas/lib/fizzy/saas/engine.rb
index 1ba45df42..dea321cfc 100644
--- a/saas/lib/fizzy/saas/engine.rb
+++ b/saas/lib/fizzy/saas/engine.rb
@@ -16,10 +16,6 @@ module Fizzy
         connects_to database: { writing: :saas, reading: :saas }
       end
 
-      initializer "fizzy_saas.content_security_policy", before: :load_config_initializers do |app|
-        app.config.x.content_security_policy.form_action = "https://checkout.stripe.com https://billing.stripe.com"
-      end
-
       initializer "fizzy_saas.assets" do |app|
         app.config.assets.paths << root.join("app/assets/stylesheets")
       end
@@ -33,25 +29,6 @@ module Fizzy
         app.paths["config/push"].unshift(root.join("config/push.yml").to_s)
       end
 
-      initializer "fizzy.saas.routes", after: :add_routing_paths do |app|
-        # Routes that rely on the implicit account tenant should go here instead of in +routes.rb+.
-        app.routes.prepend do
-          namespace :account do
-            resource :billing_portal, only: :show
-            resource :subscription do
-              scope module: :subscriptions do
-                resource :upgrade, only: :create
-                resource :downgrade, only: :create
-              end
-            end
-          end
-
-          namespace :stripe do
-            resource :webhooks, only: :create
-          end
-        end
-      end
-
       initializer "fizzy.saas.mount" do |app|
         app.routes.append do
           mount Fizzy::Saas::Engine => "/", as: "saas"
@@ -98,10 +75,6 @@ module Fizzy
         end
       end
 
-      initializer "fizzy_saas.stripe" do
-        Stripe.api_key = ENV["STRIPE_SECRET_KEY"]
-      end
-
       initializer "fizzy_saas.sentry" do
         if !Rails.env.local? && ENV["SKIP_TELEMETRY"].blank?
           Sentry.init do |config|
@@ -160,14 +133,10 @@ module Fizzy
       end
 
       config.to_prepare do
-        ::Account.include Account::Billing, Account::Limited
-        ::User.include User::NotifiesAccountOfEmailChange
         ::Identity.include Authorization::Identity, Identity::Devices
         ::Session.include Session::Devices
         ::Signup.prepend Signup
         ApplicationController.include Authorization::Controller
-        CardsController.include(Card::LimitedCreation)
-        Cards::PublishesController.include(Card::LimitedPublishing)
 
         Notification.register_push_target(:native)
 
diff --git a/saas/lib/tasks/fizzy/usage_report.rake b/saas/lib/tasks/fizzy/usage_report.rake
deleted file mode 100644
index d8b3ba108..000000000
--- a/saas/lib/tasks/fizzy/usage_report.rake
+++ /dev/null
@@ -1,37 +0,0 @@
-require "csv"
-
-namespace :saas do
-  desc "Generate a CSV usage report for all active accounts"
-  task usage_report: :environment do
-    output_path = Rails.root.join("tmp/usage_report.csv")
-
-    CSV.open(output_path, "w") do |csv|
-      csv << [ "Queenbee ID", "Account Name", "Sign Up Date", "Paid Date", "Comped", "Card Count", "Storage Used (Bytes)", "Last Active" ]
-
-      Account.active.includes(:storage_total).in_batches do |batch|
-        batch_ids = batch.pluck(:id)
-        paid_dates = Account::Subscription.paid.where(account_id: batch_ids)
-          .group(:account_id).minimum(:created_at)
-        comped_account_ids = Account::BillingWaiver.where(account_id: batch_ids)
-          .pluck(:account_id).to_set
-        last_active_dates = Card.where(account_id: batch_ids)
-          .group(:account_id).maximum(:last_active_at)
-
-        batch.each do |account|
-          csv << [
-            account.external_account_id,
-            account.name,
-            account.created_at.to_date,
-            paid_dates[account.id]&.to_date,
-            comped_account_ids.include?(account.id),
-            account.cards_count,
-            account.bytes_used,
-            last_active_dates[account.id]&.to_date
-          ]
-        end
-      end
-    end
-
-    puts "Report written to #{output_path}"
-  end
-end
diff --git a/saas/test/controllers/accounts/billing_portals_controller_test.rb b/saas/test/controllers/accounts/billing_portals_controller_test.rb
deleted file mode 100644
index 00f16e4df..000000000
--- a/saas/test/controllers/accounts/billing_portals_controller_test.rb
+++ /dev/null
@@ -1,29 +0,0 @@
-require "test_helper"
-require "ostruct"
-
-class Account::BillingPortalsControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    sign_in_as :kevin
-  end
-
-  test "redirects to stripe billing portal" do
-    Current.account.subscription.update!(stripe_customer_id: "cus_test123")
-
-    session = OpenStruct.new(url: "https://billing.stripe.com/session123")
-    Stripe::BillingPortal::Session.expects(:create)
-      .with(customer: "cus_test123", return_url: account_settings_url)
-      .returns(session)
-
-    get account_billing_portal_path
-
-    assert_redirected_to "https://billing.stripe.com/session123"
-  end
-
-  test "requires admin" do
-    logout_and_sign_in_as :david
-
-    get account_billing_portal_path
-
-    assert_response :forbidden
-  end
-end
diff --git a/saas/test/controllers/accounts/subscriptions/card_creation_test.rb b/saas/test/controllers/accounts/subscriptions/card_creation_test.rb
deleted file mode 100644
index 1ddc4bc1c..000000000
--- a/saas/test/controllers/accounts/subscriptions/card_creation_test.rb
+++ /dev/null
@@ -1,73 +0,0 @@
-require "test_helper"
-
-class Account::Subscriptions::CardCreationTest < ActionDispatch::IntegrationTest
-  setup do
-    sign_in_as :mike
-  end
-
-  # Nearing limits - shown in card creation footer
-
-  test "admin sees nearing card limit notice" do
-    accounts(:initech).update_column(:cards_count, 950)
-
-    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_match /upgrade to unlimited/i, response.body
-  end
-
-  test "admin sees nearing storage limit notice" do
-    Account.any_instance.stubs(:bytes_used).returns(600.megabytes)
-
-    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_match /upgrade to get more/i, response.body
-  end
-
-  # Exceeding limits - shown instead of create buttons
-
-  test "admin sees exceeding card limit notice" do
-    accounts(:initech).update_column(:cards_count, 1001)
-
-    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_match /you’ve used your.*free cards/i, response.body
-  end
-
-  test "admin sees exceeding storage limit notice" do
-    Account.any_instance.stubs(:bytes_used).returns(1.1.gigabytes)
-
-    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_match /you’ve run out of.*free storage/i, response.body
-  end
-
-  # Paid accounts under limits - no notices
-
-  test "paid account under limits sees no notices" do
-    logout_and_sign_in_as :kevin
-
-    accounts(:"37s").subscription.update!(plan: Plan.paid, status: :active)
-
-    get card_path(cards(:layout), script_name: accounts(:"37s").slug)
-
-    assert_response :success
-    assert_no_match /upgrade/i, response.body
-    assert_no_match /you’ve used your/i, response.body
-  end
-
-  # Comped accounts under limits - no notices
-
-  test "comped account under limits sees no notices" do
-    accounts(:initech).comp
-
-    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_no_match /upgrade/i, response.body
-    assert_no_match /you’ve used your/i, response.body
-  end
-end
diff --git a/saas/test/controllers/accounts/subscriptions/downgrades_controller_test.rb b/saas/test/controllers/accounts/subscriptions/downgrades_controller_test.rb
deleted file mode 100644
index e4680a1f8..000000000
--- a/saas/test/controllers/accounts/subscriptions/downgrades_controller_test.rb
+++ /dev/null
@@ -1,35 +0,0 @@
-require "test_helper"
-require "ostruct"
-
-class Account::Subscriptions::DowngradesControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    sign_in_as :kevin
-    accounts(:"37s").subscription.update!(stripe_subscription_id: "sub_123", plan: Plan.paid_with_extra_storage)
-  end
-
-  test "downgrade redirects to stripe billing portal" do
-    stripe_subscription = OpenStruct.new(items: OpenStruct.new(data: [ OpenStruct.new(id: "si_123") ]))
-    portal_session = OpenStruct.new(url: "https://billing.stripe.com/session/abc123")
-
-    Stripe::Subscription.stubs(:retrieve).with("sub_123").returns(stripe_subscription)
-    Stripe::BillingPortal::Session.stubs(:create).returns(portal_session)
-
-    post account_subscription_downgrade_path
-
-    assert_redirected_to "https://billing.stripe.com/session/abc123"
-  end
-
-  test "downgrade requires admin" do
-    logout_and_sign_in_as :david
-
-    post account_subscription_downgrade_path
-    assert_response :forbidden
-  end
-
-  test "downgrade requires downgradeable plan" do
-    accounts(:"37s").subscription.update!(plan: Plan.paid)
-
-    post account_subscription_downgrade_path
-    assert_response :bad_request
-  end
-end
diff --git a/saas/test/controllers/accounts/subscriptions/settings_test.rb b/saas/test/controllers/accounts/subscriptions/settings_test.rb
deleted file mode 100644
index 63feac2c5..000000000
--- a/saas/test/controllers/accounts/subscriptions/settings_test.rb
+++ /dev/null
@@ -1,62 +0,0 @@
-require "test_helper"
-
-class Account::Subscriptions::SettingsTest < ActionDispatch::IntegrationTest
-  test "free users see current usage" do
-    sign_in_as :mike
-
-    accounts(:initech).update_column(:cards_count, 3)
-
-    get account_settings_path(script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_match /You’ve used.*3.*free cards out of 1,000/i, response.body
-  end
-
-  test "paid users see thank you message" do
-    sign_in_as :kevin
-
-    accounts(:"37s").subscription.update!(plan: Plan.paid, status: :active)
-
-    get account_settings_path(script_name: accounts(:"37s").slug)
-
-    assert_response :success
-    assert_select "h3", text: "Thank you for buying Fizzy"
-  end
-
-  test "regular plan users see upgrade option" do
-    sign_in_as :kevin
-
-    accounts(:"37s").subscription.update!(plan: Plan.paid, status: :active)
-
-    get account_settings_path(script_name: accounts(:"37s").slug)
-
-    assert_response :success
-    assert_select "button", text: /upgrade/i
-    assert_select "button", text: /downgrade/i, count: 0
-  end
-
-  test "extra storage plan users see downgrade option" do
-    sign_in_as :kevin
-
-    accounts(:"37s").subscription.update!(plan: Plan.paid_with_extra_storage, status: :active)
-
-    get account_settings_path(script_name: accounts(:"37s").slug)
-
-    assert_response :success
-    assert_select "button", text: /downgrade/i
-  end
-
-  test "comped accounts see no subscription panel" do
-    sign_in_as :mike
-
-    accounts(:initech).comp
-
-    get account_settings_path(script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_no_match /thank you for buying/i, response.body
-    assert_no_match /free cards out of/i, response.body
-    assert_no_match /upgrade/i, response.body
-    assert_no_match /downgrade/i, response.body
-  end
-end
diff --git a/saas/test/controllers/accounts/subscriptions/upgrades_controller_test.rb b/saas/test/controllers/accounts/subscriptions/upgrades_controller_test.rb
deleted file mode 100644
index 65e268af1..000000000
--- a/saas/test/controllers/accounts/subscriptions/upgrades_controller_test.rb
+++ /dev/null
@@ -1,35 +0,0 @@
-require "test_helper"
-require "ostruct"
-
-class Account::Subscriptions::UpgradesControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    sign_in_as :kevin
-    accounts(:"37s").subscription.update!(stripe_subscription_id: "sub_123", plan: Plan.paid)
-  end
-
-  test "upgrade redirects to stripe billing portal" do
-    stripe_subscription = OpenStruct.new(items: OpenStruct.new(data: [ OpenStruct.new(id: "si_123") ]))
-    portal_session = OpenStruct.new(url: "https://billing.stripe.com/session/abc123")
-
-    Stripe::Subscription.stubs(:retrieve).with("sub_123").returns(stripe_subscription)
-    Stripe::BillingPortal::Session.stubs(:create).returns(portal_session)
-
-    post account_subscription_upgrade_path
-
-    assert_redirected_to "https://billing.stripe.com/session/abc123"
-  end
-
-  test "upgrade requires admin" do
-    logout_and_sign_in_as :david
-
-    post account_subscription_upgrade_path
-    assert_response :forbidden
-  end
-
-  test "upgrade requires upgradeable plan" do
-    accounts(:"37s").subscription.update!(plan: Plan.paid_with_extra_storage)
-
-    post account_subscription_upgrade_path
-    assert_response :bad_request
-  end
-end
diff --git a/saas/test/controllers/accounts/subscriptions_controller_test.rb b/saas/test/controllers/accounts/subscriptions_controller_test.rb
deleted file mode 100644
index 9e086df39..000000000
--- a/saas/test/controllers/accounts/subscriptions_controller_test.rb
+++ /dev/null
@@ -1,60 +0,0 @@
-require "test_helper"
-require "ostruct"
-
-class Account::SubscriptionsControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    sign_in_as :kevin
-  end
-
-  test "show" do
-    get account_subscription_path
-    assert_response :success
-  end
-
-  test "show with session_id retrieves stripe session" do
-    Stripe::Checkout::Session.stubs(:retrieve).with("sess_123").returns(OpenStruct.new(id: "sess_123"))
-
-    get account_subscription_path(session_id: "sess_123")
-    assert_response :success
-  end
-
-  test "show requires admin" do
-    logout_and_sign_in_as :david
-
-    get account_subscription_path
-    assert_response :forbidden
-  end
-
-  test "create redirects to stripe checkout" do
-    customer = OpenStruct.new(id: "cus_test_37signals")
-    session = OpenStruct.new(url: "https://checkout.stripe.com/session123")
-
-    Stripe::Customer.stubs(:retrieve).returns(customer)
-    Stripe::Checkout::Session.stubs(:create).returns(session)
-
-    post account_subscription_path
-
-    assert_redirected_to "https://checkout.stripe.com/session123"
-  end
-
-  test "create requires admin" do
-    logout_and_sign_in_as :david
-
-    post account_subscription_path
-    assert_response :forbidden
-  end
-
-  test "create with custom plan_key redirects to stripe checkout" do
-    customer = OpenStruct.new(id: "cus_test_37signals")
-    session = OpenStruct.new(url: "https://checkout.stripe.com/session123")
-
-    Stripe::Customer.stubs(:retrieve).returns(customer)
-    Stripe::Checkout::Session.stubs(:create).with do |params|
-      params[:metadata][:plan_key] == :monthly_extra_storage_v1
-    end.returns(session)
-
-    post account_subscription_path(plan_key: :monthly_extra_storage_v1)
-
-    assert_redirected_to "https://checkout.stripe.com/session123"
-  end
-end
diff --git a/saas/test/controllers/admin/accounts_controller_test.rb b/saas/test/controllers/admin/accounts_controller_test.rb
deleted file mode 100644
index 3849c07a5..000000000
--- a/saas/test/controllers/admin/accounts_controller_test.rb
+++ /dev/null
@@ -1,54 +0,0 @@
-require "test_helper"
-
-class Admin::AccountsControllerTest < ActionDispatch::IntegrationTest
-  test "staff can access index" do
-    sign_in_as :david
-
-    untenanted do
-      get saas.admin_accounts_path
-    end
-
-    assert_response :success
-  end
-
-  test "search account" do
-    sign_in_as :david
-
-    untenanted do
-      post saas.admin_account_search_path, params: { q: accounts(:"37s").external_account_id }
-      assert_redirected_to saas.edit_admin_account_path(accounts(:"37s").external_account_id)
-    end
-  end
-
-  test "staff can edit account" do
-    sign_in_as :david
-
-    untenanted do
-      get saas.edit_admin_account_path(accounts(:"37s").external_account_id)
-    end
-
-    assert_response :success
-  end
-
-  test "staff can override card count" do
-    sign_in_as :david
-
-    untenanted do
-      patch saas.admin_account_path(accounts(:"37s").external_account_id), params: { account: { card_count: 500 } }
-      assert_redirected_to saas.edit_admin_account_path(accounts(:"37s").external_account_id)
-    end
-
-    assert_equal 500, accounts(:"37s").reload.billed_cards_count
-  end
-
-  test "non-staff cannot access accounts" do
-    sign_in_as :jz
-
-    untenanted do
-      patch saas.admin_account_path(accounts(:"37s").external_account_id), params: { account: { cards_count: 9999 } }
-    end
-
-    assert_response :forbidden
-    assert_not_equal 9999, accounts(:"37s").reload.cards_count
-  end
-end
diff --git a/saas/test/controllers/admin/billing_waivers_controller_test.rb b/saas/test/controllers/admin/billing_waivers_controller_test.rb
deleted file mode 100644
index 8f7d14199..000000000
--- a/saas/test/controllers/admin/billing_waivers_controller_test.rb
+++ /dev/null
@@ -1,32 +0,0 @@
-require "test_helper"
-
-class Admin::BillingWaiversControllerTest < ActionDispatch::IntegrationTest
-  test "staff can comp an account" do
-    sign_in_as :david
-    account = accounts(:"37s")
-
-    assert_not account.comped?
-
-    untenanted do
-      post saas.admin_account_billing_waiver_path(account.external_account_id)
-      assert_redirected_to saas.edit_admin_account_path(account.external_account_id)
-    end
-
-    assert account.reload.comped?
-  end
-
-  test "staff can uncomp an account" do
-    sign_in_as :david
-    account = accounts(:"37s")
-    account.comp
-
-    assert account.comped?
-
-    untenanted do
-      delete saas.admin_account_billing_waiver_path(account.external_account_id)
-      assert_redirected_to saas.edit_admin_account_path(account.external_account_id)
-    end
-
-    assert_not account.reload.comped?
-  end
-end
diff --git a/saas/test/controllers/admin/overridden_limits_controller_test.rb b/saas/test/controllers/admin/overridden_limits_controller_test.rb
deleted file mode 100644
index b660e08b0..000000000
--- a/saas/test/controllers/admin/overridden_limits_controller_test.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-require "test_helper"
-
-class Admin::OverriddenLimitsControllerTest < ActionDispatch::IntegrationTest
-  test "staff can reset overridden limits" do
-    sign_in_as :david
-    account = accounts(:"37s")
-
-    # First set an override
-    account.override_limits(card_count: 500)
-    assert_equal 500, account.reload.billed_cards_count
-
-    # Then reset it
-    untenanted do
-      delete saas.admin_account_overridden_limits_path(account.external_account_id)
-      assert_redirected_to saas.edit_admin_account_path(account.external_account_id)
-    end
-
-    # Verify override was removed
-    assert_nil account.reload.overridden_limits
-    assert_equal account.cards_count, account.billed_cards_count
-  end
-end
diff --git a/saas/test/controllers/card/limited_creation_test.rb b/saas/test/controllers/card/limited_creation_test.rb
deleted file mode 100644
index 4105091be..000000000
--- a/saas/test/controllers/card/limited_creation_test.rb
+++ /dev/null
@@ -1,55 +0,0 @@
-require "test_helper"
-
-class Card::LimitedCreationTest < ActionDispatch::IntegrationTest
-  test "cannot create cards via JSON when card limit exceeded" do
-    sign_in_as :mike
-
-    accounts(:initech).update_column(:cards_count, 1001)
-
-    assert_no_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug, format: :json)
-    end
-
-    assert_response :forbidden
-  end
-
-  test "can create cards via HTML when card limit exceeded but they are drafts" do
-    sign_in_as :mike
-
-    accounts(:initech).update_column(:cards_count, 1001)
-    boards(:miltons_wish_list).cards.drafted.where(creator: users(:mike)).destroy_all
-
-    assert_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug)
-    end
-
-    assert_response :redirect
-    assert Card.last.drafted?
-  end
-
-  test "cannot force published status via HTML when card limit exceeded" do
-    sign_in_as :mike
-
-    accounts(:initech).update_column(:cards_count, 1001)
-    boards(:miltons_wish_list).cards.drafted.where(creator: users(:mike)).destroy_all
-
-    assert_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug), params: { card: { status: "published" } }
-    end
-
-    assert_response :redirect
-    assert Card.last.drafted?
-  end
-
-  test "cannot create cards via JSON when storage limit exceeded" do
-    sign_in_as :mike
-
-    Account.any_instance.stubs(:bytes_used).returns(1.1.gigabytes)
-
-    assert_no_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug, format: :json)
-    end
-
-    assert_response :forbidden
-  end
-end
diff --git a/saas/test/controllers/card/limited_publishing_test.rb b/saas/test/controllers/card/limited_publishing_test.rb
deleted file mode 100644
index 90e4e5696..000000000
--- a/saas/test/controllers/card/limited_publishing_test.rb
+++ /dev/null
@@ -1,25 +0,0 @@
-require "test_helper"
-
-class Card::LimitedPublishingTest < ActionDispatch::IntegrationTest
-  test "cannot publish cards when card limit exceeded" do
-    sign_in_as :mike
-
-    accounts(:initech).update_column(:cards_count, 1001)
-
-    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :forbidden
-    assert cards(:unfinished_thoughts).reload.drafted?
-  end
-
-  test "cannot publish cards when storage limit exceeded" do
-    sign_in_as :mike
-
-    Account.any_instance.stubs(:bytes_used).returns(1.1.gigabytes)
-
-    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :forbidden
-    assert cards(:unfinished_thoughts).reload.drafted?
-  end
-end
diff --git a/saas/test/controllers/stripe/webhooks_controller_test.rb b/saas/test/controllers/stripe/webhooks_controller_test.rb
deleted file mode 100644
index 92f6b7508..000000000
--- a/saas/test/controllers/stripe/webhooks_controller_test.rb
+++ /dev/null
@@ -1,100 +0,0 @@
-require "test_helper"
-require "ostruct"
-
-class Stripe::WebhooksControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    @account = Account.create!(name: "Test")
-    @subscription = @account.create_subscription! \
-      plan_key: "monthly_v1",
-      status: "incomplete",
-      stripe_customer_id: "cus_test123"
-  end
-
-  test "invalid signature returns bad request" do
-    Stripe::Webhook.stubs(:construct_event).raises(Stripe::SignatureVerificationError.new("invalid", "sig"))
-
-    post stripe_webhooks_path
-    assert_response :bad_request
-  end
-
-  test "checkout session completed activates subscription" do
-    stripe_sub = OpenStruct.new(id: "sub_123", customer: "cus_test123", status: "active", cancel_at: nil, items: stub_items(1.month.from_now.to_i))
-
-    event = stripe_event("checkout.session.completed",
-      mode: "subscription",
-      customer: "cus_test123",
-      subscription: "sub_123",
-      metadata: { "plan_key" => "monthly_v1" }
-    )
-
-    Stripe::Webhook.stubs(:construct_event).returns(event)
-    Stripe::Subscription.stubs(:retrieve).returns(stripe_sub)
-    Stripe::Invoice.stubs(:create_preview).returns(OpenStruct.new(amount_due: 1999))
-
-    post stripe_webhooks_path
-
-    assert_response :ok
-    @subscription.reload
-    assert_equal "sub_123", @subscription.stripe_subscription_id
-    assert_equal "active", @subscription.status
-  end
-
-  test "subscription updated changes status and syncs next amount due" do
-    @subscription.update!(stripe_subscription_id: "sub_123", status: "active")
-
-    stripe_sub = OpenStruct.new(
-      id: "sub_123",
-      customer: "cus_test123",
-      status: "past_due",
-      cancel_at: nil,
-      items: stub_items(1.month.from_now.to_i)
-    )
-
-    event = stripe_event("customer.subscription.updated", id: "sub_123")
-
-    Stripe::Webhook.stubs(:construct_event).returns(event)
-    Stripe::Subscription.stubs(:retrieve).returns(stripe_sub)
-    Stripe::Invoice.stubs(:create_preview).returns(OpenStruct.new(amount_due: 1999))
-
-    post stripe_webhooks_path
-
-    assert_response :ok
-    @subscription.reload
-    assert_equal "past_due", @subscription.status
-    assert_equal 1999, @subscription.next_amount_due_in_cents
-  end
-
-  test "subscription deleted cancels subscription" do
-    @subscription.update!(stripe_subscription_id: "sub_123", status: "active")
-
-    stripe_sub = OpenStruct.new(
-      id: "sub_123",
-      customer: "cus_test123",
-      status: "canceled",
-      cancel_at: nil,
-      items: stub_items(1.month.from_now.to_i)
-    )
-
-    event = stripe_event("customer.subscription.deleted", id: "sub_123")
-
-    Stripe::Webhook.stubs(:construct_event).returns(event)
-    Stripe::Subscription.stubs(:retrieve).returns(stripe_sub)
-
-    post stripe_webhooks_path
-
-    assert_response :ok
-    @subscription.reload
-    assert_equal "canceled", @subscription.status
-    assert_nil @subscription.stripe_subscription_id
-    assert_nil @subscription.next_amount_due_in_cents
-  end
-
-  private
-    def stripe_event(type, **attributes)
-      OpenStruct.new(type: type, data: OpenStruct.new(object: OpenStruct.new(attributes)))
-    end
-
-    def stub_items(current_period_end)
-      OpenStruct.new(data: [ OpenStruct.new(current_period_end: current_period_end) ])
-    end
-end
diff --git a/saas/test/fixtures/account_subscriptions.yml b/saas/test/fixtures/account_subscriptions.yml
deleted file mode 100644
index a18ff961b..000000000
--- a/saas/test/fixtures/account_subscriptions.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-_fixture:
-  model_class: Account::Subscription
-
-signals_monthly:
-  id: <%= ActiveRecord::FixtureSet.identify("signals_monthly", :uuid) %>
-  account_id: <%= ActiveRecord::FixtureSet.identify("37s", :uuid) %>
-  plan_key: monthly_v1
-  status: active
-  stripe_customer_id: cus_test_37signals
-  created_at: <%= Time.current %>
-  updated_at: <%= Time.current %>
diff --git a/saas/test/models/account/billing_test.rb b/saas/test/models/account/billing_test.rb
deleted file mode 100644
index 0e70d37a5..000000000
--- a/saas/test/models/account/billing_test.rb
+++ /dev/null
@@ -1,93 +0,0 @@
-require "test_helper"
-
-class Account::BillingTest < ActiveSupport::TestCase
-  test "plan reflects active subscription" do
-    account = accounts(:initech)
-
-    # No subscription
-    assert_equal Plan.free, account.plan
-
-    # Subscription but it is not active
-    account.create_subscription!(plan_key: "monthly_v1", status: "canceled", stripe_customer_id: "cus_test")
-    assert_equal Plan.free, account.plan
-
-    # Active subscription exists
-    account.subscription.update!(status: "active")
-    assert_equal Plan.paid, account.plan
-  end
-
-  test "comped account" do
-    account = accounts(:"37s")
-
-    assert_not account.comped?
-
-    account.comp
-    assert account.comped?
-
-    # Calling comp again does not create duplicate
-    account.comp
-    assert_equal 1, Account::BillingWaiver.where(account: account).count
-  end
-
-  test "cancel callback pauses subscription" do
-    account = accounts(:"37s")
-    user = users(:david)
-
-    subscription = mock("subscription")
-    subscription.expects(:pause).once
-    account.stubs(:subscription).returns(subscription)
-
-    account.cancel(initiated_by: user)
-  end
-
-  test "reactivate callback resumes subscription" do
-    account = accounts(:"37s")
-    user = users(:david)
-
-    # First cancel with a subscription mock
-    subscription_for_cancel = mock("subscription")
-    subscription_for_cancel.expects(:pause).once
-    account.stubs(:subscription).returns(subscription_for_cancel)
-
-    account.cancel(initiated_by: user)
-
-    # Now stub for reactivation
-    subscription_for_reactivate = mock("subscription")
-    subscription_for_reactivate.expects(:resume).once
-    account.stubs(:subscription).returns(subscription_for_reactivate)
-
-    account.reactivate
-  end
-
-  test "incinerate callback cancels subscription before destroying account" do
-    account = accounts(:"37s")
-
-    subscription = mock("subscription")
-    subscription.expects(:cancel).once
-    account.stubs(:subscription).returns(subscription)
-
-    account.incinerate
-  end
-
-  test "owner_email_changed enqueues sync job when subscription exists" do
-    account = accounts(:"37s")
-    account.create_subscription!(
-      stripe_customer_id: "cus_test",
-      plan_key: "monthly_v1",
-      status: "active"
-    )
-
-    assert_enqueued_with(job: Account::SyncStripeCustomerEmailJob, args: [ account.subscription ]) do
-      account.owner_email_changed
-    end
-  end
-
-  test "owner_email_changed does nothing without subscription" do
-    account = accounts(:initech)
-    account.subscription&.destroy
-
-    assert_no_enqueued_jobs do
-      account.owner_email_changed
-    end
-  end
-end
diff --git a/saas/test/models/account/limited_test.rb b/saas/test/models/account/limited_test.rb
deleted file mode 100644
index fff154451..000000000
--- a/saas/test/models/account/limited_test.rb
+++ /dev/null
@@ -1,122 +0,0 @@
-require "test_helper"
-
-class Account::LimitedTest < ActiveSupport::TestCase
-  test "detect nearing card limit" do
-    # Paid plans are never limited
-    accounts(:"37s").update_column(:cards_count, 1_000_000)
-    assert_not accounts(:"37s").nearing_plan_cards_limit?
-
-    # Free plan not near limit
-    accounts(:initech).update_column(:cards_count, 899)
-    assert_not accounts(:initech).nearing_plan_cards_limit?
-
-    # Free plan at exactly the threshold (remaining = 100)
-    accounts(:initech).update_column(:cards_count, 900)
-    assert accounts(:initech).nearing_plan_cards_limit?
-
-    # Free plan over the threshold
-    accounts(:initech).update_column(:cards_count, 901)
-    assert accounts(:initech).nearing_plan_cards_limit?
-  end
-
-  test "detect exceeding card limit" do
-    # Paid plans are never limited
-    accounts(:"37s").update_column(:cards_count, 1_000_000)
-    assert_not accounts(:"37s").exceeding_card_limit?
-
-    # Free plan under limit
-    accounts(:initech).update_column(:cards_count, 999)
-    assert_not accounts(:initech).exceeding_card_limit?
-
-    # Free plan at exactly the limit
-    accounts(:initech).update_column(:cards_count, 1000)
-    assert accounts(:initech).exceeding_card_limit?
-
-    # Free plan over limit
-    accounts(:initech).update_column(:cards_count, 1001)
-    assert accounts(:initech).exceeding_card_limit?
-  end
-
-  test "override limits" do
-    account = accounts(:initech)
-    account.update_column(:cards_count, 1001)
-
-    assert account.exceeding_card_limit?
-    assert_equal 1001, account.billed_cards_count
-
-    account.override_limits card_count: 500
-    assert_not account.exceeding_card_limit?
-    assert_equal 500, account.billed_cards_count
-    assert_equal 1001, account.cards_count # original unchanged
-
-    account.reset_overridden_limits
-    assert account.exceeding_card_limit?
-    assert_equal 1001, account.billed_cards_count
-  end
-
-  test "comped accounts are never limited" do
-    account = accounts(:initech)
-    account.update_column(:cards_count, 1_000_000)
-
-    assert account.exceeding_card_limit?
-    assert account.nearing_plan_cards_limit?
-
-    account.comp
-
-    assert_not account.exceeding_card_limit?
-    assert_not account.nearing_plan_cards_limit?
-  end
-
-  test "uncomping an account restores limits" do
-    account = accounts(:initech)
-    account.update_column(:cards_count, 1_000_000)
-    account.comp
-
-    assert_not account.exceeding_card_limit?
-
-    account.uncomp
-
-    assert account.exceeding_card_limit?
-  end
-
-  test "detect nearing storage limit" do
-    # Paid plans have large storage limits
-    accounts(:"37s").stubs(:bytes_used).returns(4.gigabytes)
-    assert_not accounts(:"37s").nearing_plan_storage_limit?
-
-    # Free plan not near limit
-    accounts(:initech).stubs(:bytes_used).returns(400.megabytes)
-    assert_not accounts(:initech).nearing_plan_storage_limit?
-
-    # Free plan near limit
-    accounts(:initech).stubs(:bytes_used).returns(600.megabytes)
-    assert accounts(:initech).nearing_plan_storage_limit?
-  end
-
-  test "detect exceeding storage limit" do
-    # Free plan under limit
-    accounts(:initech).stubs(:bytes_used).returns(900.megabytes)
-    assert_not accounts(:initech).exceeding_storage_limit?
-
-    # Free plan over limit
-    accounts(:initech).stubs(:bytes_used).returns(1.1.gigabytes)
-    assert accounts(:initech).exceeding_storage_limit?
-  end
-
-  test "override bytes_used limits" do
-    account = accounts(:initech)
-    account.stubs(:bytes_used).returns(1.1.gigabytes)
-
-    assert account.exceeding_storage_limit?
-    assert_equal 1.1.gigabytes, account.billed_bytes_used
-
-    account.override_limits bytes_used: 500.megabytes
-    assert_not account.exceeding_storage_limit?
-    assert_equal 500.megabytes, account.billed_bytes_used
-    assert_equal 1.1.gigabytes, account.bytes_used # original unchanged
-
-    account.reset_overridden_limits
-    assert account.exceeding_storage_limit?
-    assert_equal 1.1.gigabytes, account.billed_bytes_used
-  end
-end
diff --git a/saas/test/models/account/subscription_test.rb b/saas/test/models/account/subscription_test.rb
deleted file mode 100644
index f9f16f2bb..000000000
--- a/saas/test/models/account/subscription_test.rb
+++ /dev/null
@@ -1,245 +0,0 @@
-require "test_helper"
-
-class Account::SubscriptionTest < ActiveSupport::TestCase
-  test "get the account plan" do
-    subscription = Account::Subscription.new(plan_key: "free_v1")
-    assert_equal Plan[:free_v1], subscription.plan
-  end
-
-  test "check if account is active" do
-    subscription = Account::Subscription.new(status: "active")
-    assert subscription.active?
-  end
-
-  test "check if account is paid" do
-    assert Account::Subscription.new(plan_key: "monthly_v1", status: "active").paid?
-    assert_not Account::Subscription.new(plan_key: "free_v1", status: "active").paid?
-  end
-
-  test "paid scope includes active paid subscriptions" do
-    subscription = Account::Subscription.create!(
-      account: accounts(:initech), plan_key: "monthly_v1", status: "active",
-      stripe_customer_id: "cus_paid"
-    )
-
-    assert_includes Account::Subscription.paid, subscription
-  end
-
-  test "paid scope includes trialing and past_due subscriptions" do
-    trialing = Account::Subscription.create!(
-      account: accounts(:initech), plan_key: "monthly_v1", status: "trialing",
-      stripe_customer_id: "cus_trialing"
-    )
-    past_due = Account::Subscription.create!(
-      account: accounts(:acme), plan_key: "monthly_extra_storage_v1", status: "past_due",
-      stripe_customer_id: "cus_past_due"
-    )
-
-    assert_includes Account::Subscription.paid, trialing
-    assert_includes Account::Subscription.paid, past_due
-  end
-
-  test "paid scope excludes free plan subscriptions" do
-    subscription = Account::Subscription.create!(
-      account: accounts(:initech), plan_key: "free_v1", status: "active",
-      stripe_customer_id: "cus_free"
-    )
-
-    assert_not_includes Account::Subscription.paid, subscription
-  end
-
-  test "paid scope excludes canceled subscriptions" do
-    subscription = Account::Subscription.create!(
-      account: accounts(:initech), plan_key: "monthly_v1", status: "canceled",
-      stripe_customer_id: "cus_canceled"
-    )
-
-    assert_not_includes Account::Subscription.paid, subscription
-  end
-
-  test "paid scope excludes comped accounts" do
-    subscription = Account::Subscription.create!(
-      account: accounts(:initech), plan_key: "monthly_v1", status: "active",
-      stripe_customer_id: "cus_comped"
-    )
-    Account::BillingWaiver.create!(account: accounts(:initech))
-
-    assert_not_includes Account::Subscription.paid, subscription
-  end
-
-  test "pause pauses Stripe subscription with void behavior" do
-    subscription = Account::Subscription.new(stripe_subscription_id: "sub_123")
-
-    Stripe::Subscription.expects(:update).with(
-      "sub_123",
-      pause_collection: { behavior: "void" }
-    ).returns(true)
-
-    subscription.pause
-  end
-
-  test "pause does nothing when no stripe_subscription_id" do
-    subscription = Account::Subscription.new(stripe_subscription_id: nil)
-
-    Stripe::Subscription.expects(:update).never
-
-    subscription.pause
-  end
-
-  test "pause raises on Stripe errors" do
-    subscription = Account::Subscription.new(stripe_subscription_id: "sub_123")
-
-    Stripe::Subscription.stubs(:update).raises(
-      Stripe::APIConnectionError.new("Network error")
-    )
-
-    assert_raises Stripe::APIConnectionError do
-      subscription.pause
-    end
-  end
-
-  test "resume resumes Stripe subscription" do
-    subscription = Account::Subscription.new(stripe_subscription_id: "sub_123")
-
-    Stripe::Subscription.expects(:update).with(
-      "sub_123",
-      pause_collection: ""
-    ).returns(true)
-
-    subscription.resume
-  end
-
-  test "resume does nothing when no stripe_subscription_id" do
-    subscription = Account::Subscription.new(stripe_subscription_id: nil)
-
-    Stripe::Subscription.expects(:update).never
-
-    subscription.resume
-  end
-
-  test "resume raises on Stripe errors" do
-    subscription = Account::Subscription.new(stripe_subscription_id: "sub_123")
-
-    Stripe::Subscription.stubs(:update).raises(
-      Stripe::AuthenticationError.new("Invalid API key")
-    )
-
-    assert_raises Stripe::AuthenticationError do
-      subscription.resume
-    end
-  end
-
-  test "cancel cancels Stripe subscription" do
-    subscription = Account::Subscription.new(stripe_subscription_id: "sub_123")
-
-    Stripe::Subscription.expects(:cancel).with("sub_123").returns(true)
-
-    subscription.cancel
-  end
-
-  test "cancel does nothing when no stripe_subscription_id" do
-    subscription = Account::Subscription.new(stripe_subscription_id: nil)
-
-    Stripe::Subscription.expects(:cancel).never
-
-    subscription.cancel
-  end
-
-  test "cancel treats 404 as success" do
-    subscription = Account::Subscription.new(stripe_subscription_id: "sub_deleted")
-
-    Stripe::Subscription.stubs(:cancel).raises(
-      Stripe::InvalidRequestError.new("No such subscription", {})
-    )
-
-    assert_nothing_raised do
-      subscription.cancel
-    end
-  end
-
-  test "cancel raises on other Stripe errors" do
-    subscription = Account::Subscription.new(stripe_subscription_id: "sub_123")
-
-    Stripe::Subscription.stubs(:cancel).raises(
-      Stripe::RateLimitError.new("Rate limit exceeded")
-    )
-
-    assert_raises Stripe::RateLimitError do
-      subscription.cancel
-    end
-  end
-
-  test "sync_customer_email_to_stripe updates Stripe customer with owner email" do
-    account = accounts(:"37s")
-    owner = account.users.find_by(role: :owner) || account.users.first.tap { |u| u.update!(role: :owner) }
-    subscription = account.create_subscription!(
-      stripe_customer_id: "cus_test",
-      plan_key: "monthly_v1",
-      status: "active"
-    )
-
-    Stripe::Customer.expects(:update).with("cus_test", email: owner.identity.email_address).once
-
-    subscription.sync_customer_email_to_stripe
-  end
-
-  test "sync_customer_email_to_stripe does nothing without stripe_customer_id" do
-    account = accounts(:"37s")
-    subscription = account.build_subscription(
-      stripe_customer_id: nil,
-      plan_key: "free_v1",
-      status: "active"
-    )
-
-    Stripe::Customer.expects(:update).never
-
-    subscription.sync_customer_email_to_stripe
-  end
-
-  test "sync_customer_email_to_stripe does nothing without owner" do
-    account = accounts(:"37s")
-    account.users.update_all(role: :member)
-    subscription = account.create_subscription!(
-      stripe_customer_id: "cus_test",
-      plan_key: "monthly_v1",
-      status: "active"
-    )
-
-    Stripe::Customer.expects(:update).never
-
-    subscription.sync_customer_email_to_stripe
-  end
-
-  test "sync_customer_email_to_stripe does nothing when owner has no identity" do
-    account = accounts(:"37s")
-    owner = account.users.find_by(role: :owner) || account.users.first.tap { |u| u.update!(role: :owner) }
-    owner.update_column(:identity_id, nil)
-    subscription = account.create_subscription!(
-      stripe_customer_id: "cus_test",
-      plan_key: "monthly_v1",
-      status: "active"
-    )
-
-    Stripe::Customer.expects(:update).never
-
-    subscription.sync_customer_email_to_stripe
-  end
-
-  test "sync_customer_email_to_stripe treats deleted customer as success" do
-    account = accounts(:"37s")
-    account.users.find_by(role: :owner) || account.users.first.tap { |u| u.update!(role: :owner) }
-    subscription = account.create_subscription!(
-      stripe_customer_id: "cus_deleted",
-      plan_key: "monthly_v1",
-      status: "active"
-    )
-
-    Stripe::Customer.stubs(:update).raises(
-      Stripe::InvalidRequestError.new("No such customer", {})
-    )
-
-    assert_nothing_raised do
-      subscription.sync_customer_email_to_stripe
-    end
-  end
-end
diff --git a/saas/test/models/plan_test.rb b/saas/test/models/plan_test.rb
deleted file mode 100644
index 54ed279d6..000000000
--- a/saas/test/models/plan_test.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-require "test_helper"
-
-class PlanTest < ActiveSupport::TestCase
-  test "free plan is free" do
-    assert Plan[:free_v1].free?
-  end
-
-  test "monthly plan is not free" do
-    assert_not Plan[:monthly_v1].free?
-  end
-
-  test "find plan by its price id" do
-    Plan.paid.stubs(:stripe_price_id).returns("price_monthly_v1")
-
-    assert_equal Plan.paid, Plan.find_by_price_id("price_monthly_v1")
-    assert_nil Plan.find_by_price_id("unknown_price_id")
-  end
-end
diff --git a/saas/test/models/user/notifies_account_of_email_change_test.rb b/saas/test/models/user/notifies_account_of_email_change_test.rb
deleted file mode 100644
index 442a89fff..000000000
--- a/saas/test/models/user/notifies_account_of_email_change_test.rb
+++ /dev/null
@@ -1,51 +0,0 @@
-require "test_helper"
-
-class User::NotifiesAccountOfEmailChangeTest < ActiveSupport::TestCase
-  setup do
-    @account = accounts(:"37s")
-    @owner = @account.users.find_by(role: :owner) || @account.users.first.tap { |u| u.update!(role: :owner) }
-    @member = @account.users.where.not(id: @owner.id).first || @account.users.create!(
-      name: "Member",
-      identity: Identity.create!(email_address: "member@example.com"),
-      role: :member
-    )
-  end
-
-  test "notifies account when owner changes email" do
-    @account.expects(:owner_email_changed).once
-
-    new_identity = Identity.create!(email_address: "new-owner@example.com")
-    @owner.update!(identity: new_identity)
-  end
-
-  test "does not notify account when non-owner changes email" do
-    @account.expects(:owner_email_changed).never
-
-    new_identity = Identity.create!(email_address: "new-member@example.com")
-    @member.update!(identity: new_identity)
-  end
-
-  test "does not notify account when owner is deactivated" do
-    @account.expects(:owner_email_changed).never
-
-    @owner.update!(identity: nil)
-  end
-
-  test "does not notify account when identity unchanged" do
-    @account.expects(:owner_email_changed).never
-
-    @owner.update!(name: "New Name")
-  end
-
-  test "notifies account when user becomes owner" do
-    @account.expects(:owner_email_changed).once
-
-    @member.update!(role: :owner)
-  end
-
-  test "does not notify account when owner becomes member" do
-    @account.expects(:owner_email_changed).never
-
-    @owner.update!(role: :member)
-  end
-end

From 0b29a67e17e1b8438ae1ae2e37e7f3365c7954f5 Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Tue, 17 Mar 2026 11:09:37 +0100
Subject: [PATCH 061/107] Change date and closedBy properties for a more
 generic description

---
 .../controllers/bridge/stamp_controller.js       | 10 +++++++++-
 .../initializers/bridge/bridge_element.js        | 16 ----------------
 app/views/cards/display/common/_stamp.html.erb   |  6 ++----
 3 files changed, 11 insertions(+), 21 deletions(-)

diff --git a/app/javascript/controllers/bridge/stamp_controller.js b/app/javascript/controllers/bridge/stamp_controller.js
index 6c04d3140..2be17dc35 100644
--- a/app/javascript/controllers/bridge/stamp_controller.js
+++ b/app/javascript/controllers/bridge/stamp_controller.js
@@ -14,6 +14,14 @@ export default class extends BridgeComponent {
   }
 
   notifyBridgeOfConnect() {
-    this.send("connect", this.bridgeElement.getStamp())
+    this.send("connect", this.#data)
+  }
+
+  get #data() {
+    const bridgeElement = this.bridgeElement
+    return {
+      title: bridgeElement.title,
+      description: bridgeElement.bridgeAttribute("description") ?? null
+    }
   }
 }
diff --git a/app/javascript/initializers/bridge/bridge_element.js b/app/javascript/initializers/bridge/bridge_element.js
index b118c9265..76f0db8a7 100644
--- a/app/javascript/initializers/bridge/bridge_element.js
+++ b/app/javascript/initializers/bridge/bridge_element.js
@@ -9,14 +9,6 @@ BridgeElement.prototype.getButton = function() {
   }
 }
 
-BridgeElement.prototype.getStamp = function() {
-  return {
-    title: this.title,
-    date: this.getDate(),
-    closedBy: this.getClosedBy()
-  }
-}
-
 BridgeElement.prototype.getIcon = function() {
   const url = this.bridgeAttribute("icon-url")
 
@@ -27,14 +19,6 @@ BridgeElement.prototype.getIcon = function() {
   return null
 }
 
-BridgeElement.prototype.getDate = function() {
-  return this.bridgeAttribute("date") ?? null
-}
-
-BridgeElement.prototype.getClosedBy = function() {
-  return this.bridgeAttribute("closed-by") ?? null
-}
-
 BridgeElement.prototype.getDisplayTitle = function() {
   return !!this.bridgeAttribute("display-title")
 }
diff --git a/app/views/cards/display/common/_stamp.html.erb b/app/views/cards/display/common/_stamp.html.erb
index 75c11ad4a..3416fff59 100644
--- a/app/views/cards/display/common/_stamp.html.erb
+++ b/app/views/cards/display/common/_stamp.html.erb
@@ -2,8 +2,7 @@
   <%= tag.div class: token_list("card__closed", "card__closed--system": card.postponed_by&.system?), data: {
     controller: "bridge--stamp",
     bridge_title: "Not Now",
-    bridge_date: card.postponed_at.strftime("%b %d, %Y"),
-    bridge_closed_by: card.postponed_by&.familiar_name
+    bridge_description: card.postponed_at.strftime("%b %d, %Y")
   } do %>
     <span class="card__closed-title" data-text="Not Now">Not Now</span>
     <strong class="card__closed-date"><%= card.postponed_at.strftime("%b %d, %Y") %></strong>
@@ -15,8 +14,7 @@
   <%= tag.div class: "card__closed", data: {
     controller: "bridge--stamp",
     bridge_title: "Done",
-    bridge_date: card.closed_at.strftime("%b %d, %Y"),
-    bridge_closed_by: card.closed_by.familiar_name
+    bridge_description: card.closed_at.strftime("%b %d, %Y")
   } do %>
     <span class="card__closed-title" data-text="Done">Done</span>
     <strong class="card__closed-date"><%= card.closed_at.strftime("%b %d, %Y") %></strong>

From 2d1e2019460a6a3c52f995ea0d9c38dc52dec9b4 Mon Sep 17 00:00:00 2001
From: Adrien Maston <adrien@37signals.com>
Date: Tue, 17 Mar 2026 11:57:59 +0100
Subject: [PATCH 062/107] Add scope selector value

---
 app/javascript/controllers/bridge/stamp_controller.js | 11 +++++------
 app/views/cards/display/common/_stamp.html.erb        |  2 ++
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/app/javascript/controllers/bridge/stamp_controller.js b/app/javascript/controllers/bridge/stamp_controller.js
index 2be17dc35..735e4c830 100644
--- a/app/javascript/controllers/bridge/stamp_controller.js
+++ b/app/javascript/controllers/bridge/stamp_controller.js
@@ -2,10 +2,13 @@ import { BridgeComponent } from "@hotwired/hotwire-native-bridge"
 
 export default class extends BridgeComponent {
   static component = "stamp"
+  static values = { scopeSelector: { type: String, default: "body" } }
 
   connect() {
-    super.connect()
-    this.notifyBridgeOfConnect()
+    if (this.element.closest(this.scopeSelectorValue)) {
+      super.connect()
+      this.send("connect", this.#data)
+    }
   }
 
   disconnect() {
@@ -13,10 +16,6 @@ export default class extends BridgeComponent {
     this.send("disconnect")
   }
 
-  notifyBridgeOfConnect() {
-    this.send("connect", this.#data)
-  }
-
   get #data() {
     const bridgeElement = this.bridgeElement
     return {
diff --git a/app/views/cards/display/common/_stamp.html.erb b/app/views/cards/display/common/_stamp.html.erb
index 3416fff59..86190e0f6 100644
--- a/app/views/cards/display/common/_stamp.html.erb
+++ b/app/views/cards/display/common/_stamp.html.erb
@@ -1,6 +1,7 @@
 <% if card.postponed? %>
   <%= tag.div class: token_list("card__closed", "card__closed--system": card.postponed_by&.system?), data: {
     controller: "bridge--stamp",
+    bridge__stamp_scope_selector_value: ".card-perma",
     bridge_title: "Not Now",
     bridge_description: card.postponed_at.strftime("%b %d, %Y")
   } do %>
@@ -13,6 +14,7 @@
 <% if card.closed? %>
   <%= tag.div class: "card__closed", data: {
     controller: "bridge--stamp",
+    bridge__stamp_scope_selector_value: ".card-perma",
     bridge_title: "Done",
     bridge_description: card.closed_at.strftime("%b %d, %Y")
   } do %>

From a761d809aef1763fa9e595f5cdd23fa7d6f1aae9 Mon Sep 17 00:00:00 2001
From: Jorge Manrubia <jorge@37signals.com>
Date: Tue, 17 Mar 2026 12:10:24 +0100
Subject: [PATCH 063/107] Add 1GB storage limit with self-host notice for SaaS

Limit free storage to 1GB on the SaaS version. When exceeded, card
publishing, comment creation, and JSON card creation are blocked,
and the card footer shows a "self-host Fizzy for unlimited storage"
notice instead of the create buttons. A nearing-limit warning
appears when usage exceeds 500MB.

Uses the same SaaS engine patterns as the removed billing system:
model concern on Account, controller concerns included via
config.to_prepare, view partials in saas/ with Fizzy.saas? guards
in the main app.
---
 app/views/cards/_messages.html.erb            |  6 ++-
 .../cards/container/footer/_create.html.erb   |  2 +
 app/views/cards/drafts/_container.html.erb    |  6 ++-
 .../concerns/card/storage_limited.rb          |  8 ++++
 .../card/storage_limited/commenting.rb        |  9 ++++
 .../concerns/card/storage_limited/creation.rb |  9 ++++
 .../card/storage_limited/publishing.rb        |  9 ++++
 saas/app/models/account/storage_limited.rb    | 14 ++++++
 .../views/cards/comments/saas/_new.html.erb   |  5 ++
 .../saas/_storage_limit_exceeded.html.erb     |  4 ++
 .../container/footer/saas/_create.html.erb    |  5 ++
 .../saas/_storage_limit_exceeded.html.erb     |  8 ++++
 .../saas/_storage_limit_notice.html.erb       |  5 ++
 saas/lib/fizzy/saas/engine.rb                 |  4 ++
 .../card/storage_limited/commenting_test.rb   | 29 ++++++++++++
 .../card/storage_limited/creation_test.rb     | 47 +++++++++++++++++++
 .../card/storage_limited/publishing_test.rb   | 23 +++++++++
 .../controllers/card/storage_limited_test.rb  | 27 +++++++++++
 .../comment/storage_limited_test.rb           | 25 ++++++++++
 .../models/account/storage_limited_test.rb    | 39 +++++++++++++++
 20 files changed, 282 insertions(+), 2 deletions(-)
 create mode 100644 saas/app/controllers/concerns/card/storage_limited.rb
 create mode 100644 saas/app/controllers/concerns/card/storage_limited/commenting.rb
 create mode 100644 saas/app/controllers/concerns/card/storage_limited/creation.rb
 create mode 100644 saas/app/controllers/concerns/card/storage_limited/publishing.rb
 create mode 100644 saas/app/models/account/storage_limited.rb
 create mode 100644 saas/app/views/cards/comments/saas/_new.html.erb
 create mode 100644 saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
 create mode 100644 saas/app/views/cards/container/footer/saas/_create.html.erb
 create mode 100644 saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
 create mode 100644 saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
 create mode 100644 saas/test/controllers/card/storage_limited/commenting_test.rb
 create mode 100644 saas/test/controllers/card/storage_limited/creation_test.rb
 create mode 100644 saas/test/controllers/card/storage_limited/publishing_test.rb
 create mode 100644 saas/test/controllers/card/storage_limited_test.rb
 create mode 100644 saas/test/controllers/comment/storage_limited_test.rb
 create mode 100644 saas/test/models/account/storage_limited_test.rb

diff --git a/app/views/cards/_messages.html.erb b/app/views/cards/_messages.html.erb
index a2784e72a..c51ab6d8b 100644
--- a/app/views/cards/_messages.html.erb
+++ b/app/views/cards/_messages.html.erb
@@ -1,7 +1,11 @@
 <%= messages_tag(card) do %>
   <% if card.published? %>
     <%= render partial: "cards/comments/comment", collection: card.comments.preloaded.chronologically, cached: true %>
-    <%= render "cards/comments/new", card: card %>
+    <% if Fizzy.saas? %>
+      <%= render "cards/comments/saas/new", card: card %>
+    <% else %>
+      <%= render "cards/comments/new", card: card %>
+    <% end %>
 
     <%= render "cards/comments/watchers", card: card %>
   <% end %>
diff --git a/app/views/cards/container/footer/_create.html.erb b/app/views/cards/container/footer/_create.html.erb
index 648beffd1..4e5a83e20 100644
--- a/app/views/cards/container/footer/_create.html.erb
+++ b/app/views/cards/container/footer/_create.html.erb
@@ -13,5 +13,7 @@
       <span>Create and add another</span>
     <% end %>
   </div>
+
+  <%= render "cards/container/footer/saas/storage_limit_notice" if Fizzy.saas? %>
 </div>
 
diff --git a/app/views/cards/drafts/_container.html.erb b/app/views/cards/drafts/_container.html.erb
index 9ffc04711..fa7134b55 100644
--- a/app/views/cards/drafts/_container.html.erb
+++ b/app/views/cards/drafts/_container.html.erb
@@ -26,5 +26,9 @@
     </div>
   <% end %>
 
-  <%= render "cards/container/footer/create", card: card %>
+  <% if Fizzy.saas? %>
+    <%= render "cards/container/footer/saas/create", card: card %>
+  <% else %>
+    <%= render "cards/container/footer/create", card: card %>
+  <% end %>
 </section>
diff --git a/saas/app/controllers/concerns/card/storage_limited.rb b/saas/app/controllers/concerns/card/storage_limited.rb
new file mode 100644
index 000000000..05357f43f
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited.rb
@@ -0,0 +1,8 @@
+module Card::StorageLimited
+  extend ActiveSupport::Concern
+
+  private
+    def ensure_within_storage_limit
+      head :forbidden if Current.account.exceeding_storage_limit?
+    end
+end
diff --git a/saas/app/controllers/concerns/card/storage_limited/commenting.rb b/saas/app/controllers/concerns/card/storage_limited/commenting.rb
new file mode 100644
index 000000000..a4b7e3307
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited/commenting.rb
@@ -0,0 +1,9 @@
+module Card::StorageLimited::Commenting
+  extend ActiveSupport::Concern
+
+  included do
+    include Card::StorageLimited
+
+    before_action :ensure_within_storage_limit, only: :create
+  end
+end
diff --git a/saas/app/controllers/concerns/card/storage_limited/creation.rb b/saas/app/controllers/concerns/card/storage_limited/creation.rb
new file mode 100644
index 000000000..9d894779d
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited/creation.rb
@@ -0,0 +1,9 @@
+module Card::StorageLimited::Creation
+  extend ActiveSupport::Concern
+
+  included do
+    include Card::StorageLimited
+
+    before_action :ensure_within_storage_limit, only: :create, if: -> { request.format.json? }
+  end
+end
diff --git a/saas/app/controllers/concerns/card/storage_limited/publishing.rb b/saas/app/controllers/concerns/card/storage_limited/publishing.rb
new file mode 100644
index 000000000..abf7731a4
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited/publishing.rb
@@ -0,0 +1,9 @@
+module Card::StorageLimited::Publishing
+  extend ActiveSupport::Concern
+
+  included do
+    include Card::StorageLimited
+
+    before_action :ensure_within_storage_limit, only: :create
+  end
+end
diff --git a/saas/app/models/account/storage_limited.rb b/saas/app/models/account/storage_limited.rb
new file mode 100644
index 000000000..dbab32b5d
--- /dev/null
+++ b/saas/app/models/account/storage_limited.rb
@@ -0,0 +1,14 @@
+module Account::StorageLimited
+  extend ActiveSupport::Concern
+
+  STORAGE_LIMIT = 1.gigabyte
+  NEAR_STORAGE_LIMIT_THRESHOLD = 500.megabytes
+
+  def exceeding_storage_limit?
+    bytes_used > STORAGE_LIMIT
+  end
+
+  def nearing_storage_limit?
+    !exceeding_storage_limit? && bytes_used > STORAGE_LIMIT - NEAR_STORAGE_LIMIT_THRESHOLD
+  end
+end
diff --git a/saas/app/views/cards/comments/saas/_new.html.erb b/saas/app/views/cards/comments/saas/_new.html.erb
new file mode 100644
index 000000000..74cb6dd43
--- /dev/null
+++ b/saas/app/views/cards/comments/saas/_new.html.erb
@@ -0,0 +1,5 @@
+<% if Current.account.exceeding_storage_limit? %>
+  <%= render "cards/comments/saas/storage_limit_exceeded" %>
+<% else %>
+  <%= render "cards/comments/new", card: card %>
+<% end %>
diff --git a/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
new file mode 100644
index 000000000..6be5fb587
--- /dev/null
+++ b/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
@@ -0,0 +1,4 @@
+<div class="full-width pad-inline center margin-block txt-small txt-ink-medium">
+  <strong>This account has used all <%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %> of free storage.</strong>
+  <%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.
+</div>
diff --git a/saas/app/views/cards/container/footer/saas/_create.html.erb b/saas/app/views/cards/container/footer/saas/_create.html.erb
new file mode 100644
index 000000000..e5544e576
--- /dev/null
+++ b/saas/app/views/cards/container/footer/saas/_create.html.erb
@@ -0,0 +1,5 @@
+<% if Current.account.exceeding_storage_limit? %>
+  <%= render "cards/container/footer/saas/storage_limit_exceeded" %>
+<% else %>
+  <%= render "cards/container/footer/create", card: card %>
+<% end %>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
new file mode 100644
index 000000000..6fb95be11
--- /dev/null
+++ b/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
@@ -0,0 +1,8 @@
+<div class="card-perma__notch card-perma__notch--bottom flex-column center">
+  <div class="pad-inline pad-block-half">
+    <strong>This account has used all <%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %> of free storage.</strong>
+    <div class="margin-block-start-quarter txt-small">
+      <%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.
+    </div>
+  </div>
+</div>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
new file mode 100644
index 000000000..942041fb4
--- /dev/null
+++ b/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
@@ -0,0 +1,5 @@
+<% if Current.account.nearing_storage_limit? %>
+  <div class="full-width pad-inline center margin-block-half txt-small txt-ink-medium">
+    This account has used <%= number_to_human_size(Current.account.bytes_used) %> of <%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %> storage.
+  </div>
+<% end %>
diff --git a/saas/lib/fizzy/saas/engine.rb b/saas/lib/fizzy/saas/engine.rb
index dea321cfc..673be1147 100644
--- a/saas/lib/fizzy/saas/engine.rb
+++ b/saas/lib/fizzy/saas/engine.rb
@@ -133,10 +133,14 @@ module Fizzy
       end
 
       config.to_prepare do
+        ::Account.include Account::StorageLimited
         ::Identity.include Authorization::Identity, Identity::Devices
         ::Session.include Session::Devices
         ::Signup.prepend Signup
         ApplicationController.include Authorization::Controller
+        CardsController.include(Card::StorageLimited::Creation)
+        Cards::CommentsController.include(Card::StorageLimited::Commenting)
+        Cards::PublishesController.include(Card::StorageLimited::Publishing)
 
         Notification.register_push_target(:native)
 
diff --git a/saas/test/controllers/card/storage_limited/commenting_test.rb b/saas/test/controllers/card/storage_limited/commenting_test.rb
new file mode 100644
index 000000000..e32015130
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited/commenting_test.rb
@@ -0,0 +1,29 @@
+require "test_helper"
+
+class Card::StorageLimited::CommentingTest < ActionDispatch::IntegrationTest
+  test "cannot create comments when storage limit exceeded" do
+    sign_in_as :david
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert_no_difference -> { Comment.count } do
+      post card_comments_path(cards(:logo), script_name: accounts(:"37s").slug),
+        params: { comment: { body: "Blocked comment" } },
+        as: :turbo_stream
+    end
+
+    assert_response :forbidden
+  end
+
+  test "can create comments when under storage limit" do
+    sign_in_as :david
+
+    assert_difference -> { Comment.count } do
+      post card_comments_path(cards(:logo), script_name: accounts(:"37s").slug),
+        params: { comment: { body: "Allowed comment" } },
+        as: :turbo_stream
+    end
+
+    assert_response :success
+  end
+end
diff --git a/saas/test/controllers/card/storage_limited/creation_test.rb b/saas/test/controllers/card/storage_limited/creation_test.rb
new file mode 100644
index 000000000..ab04774fe
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited/creation_test.rb
@@ -0,0 +1,47 @@
+require "test_helper"
+
+class Card::StorageLimited::CreationTest < ActionDispatch::IntegrationTest
+  test "cannot create cards via JSON when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert_no_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug),
+        params: { card: { title: "Blocked card" } },
+        as: :json
+    end
+
+    assert_response :forbidden
+  end
+
+  test "can create cards via HTML when storage limit exceeded since they become drafts" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+    accounts(:initech).update_column(:cards_count, 100)
+    boards(:miltons_wish_list).cards.drafted.where(creator: users(:mike)).destroy_all
+
+    assert_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug)
+    end
+
+    assert_response :redirect
+    assert Card.last.drafted?
+  end
+
+  test "can create cards via JSON when under storage limit" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(500.megabytes)
+    accounts(:initech).update_column(:cards_count, 100)
+
+    assert_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug),
+        params: { card: { title: "Allowed card" } },
+        as: :json
+    end
+
+    assert_response :created
+  end
+end
diff --git a/saas/test/controllers/card/storage_limited/publishing_test.rb b/saas/test/controllers/card/storage_limited/publishing_test.rb
new file mode 100644
index 000000000..94e9b8e4f
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited/publishing_test.rb
@@ -0,0 +1,23 @@
+require "test_helper"
+
+class Card::StorageLimited::PublishingTest < ActionDispatch::IntegrationTest
+  test "cannot publish cards when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :forbidden
+    assert cards(:unfinished_thoughts).reload.drafted?
+  end
+
+  test "can publish cards when under storage limit" do
+    sign_in_as :mike
+
+    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :redirect
+    assert cards(:unfinished_thoughts).reload.published?
+  end
+end
diff --git a/saas/test/controllers/card/storage_limited_test.rb b/saas/test/controllers/card/storage_limited_test.rb
new file mode 100644
index 000000000..69790c363
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited_test.rb
@@ -0,0 +1,27 @@
+require "test_helper"
+
+class Card::StorageLimitedTest < ActionDispatch::IntegrationTest
+  test "draft card shows storage limit notice instead of create buttons when limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :success
+    assert_select ".card-perma__notch" do
+      assert_select "strong", text: /used all/
+      assert_select "a[href='https://github.com/basecamp/fizzy']", text: "Self-host Fizzy"
+    end
+    assert_select ".card-perma__notch-new-card-buttons", count: 0
+  end
+
+  test "draft card shows create buttons when under storage limit" do
+    sign_in_as :mike
+
+    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :success
+    assert_select ".card-perma__notch-new-card-buttons"
+  end
+end
diff --git a/saas/test/controllers/comment/storage_limited_test.rb b/saas/test/controllers/comment/storage_limited_test.rb
new file mode 100644
index 000000000..4137971b1
--- /dev/null
+++ b/saas/test/controllers/comment/storage_limited_test.rb
@@ -0,0 +1,25 @@
+require "test_helper"
+
+class Comment::StorageLimitedTest < ActionDispatch::IntegrationTest
+  test "published card shows storage limit notice instead of comment form when limit exceeded" do
+    sign_in_as :david
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    get card_path(cards(:logo), script_name: accounts(:"37s").slug)
+
+    assert_response :success
+    assert_select "strong", text: /used all/
+    assert_select "a[href='https://github.com/basecamp/fizzy']", text: "Self-host Fizzy"
+    assert_select "##{dom_id(cards(:logo), :new_comment)}", count: 0
+  end
+
+  test "published card shows comment form when under storage limit" do
+    sign_in_as :david
+
+    get card_path(cards(:logo), script_name: accounts(:"37s").slug)
+
+    assert_response :success
+    assert_select "##{dom_id(cards(:logo), :new_comment)}"
+  end
+end
diff --git a/saas/test/models/account/storage_limited_test.rb b/saas/test/models/account/storage_limited_test.rb
new file mode 100644
index 000000000..f587d9ef1
--- /dev/null
+++ b/saas/test/models/account/storage_limited_test.rb
@@ -0,0 +1,39 @@
+require "test_helper"
+
+class Account::StorageLimitedTest < ActiveSupport::TestCase
+  test "exceeding storage limit when bytes used exceeds 1 GB" do
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert accounts(:initech).exceeding_storage_limit?
+  end
+
+  test "not exceeding storage limit when bytes used equals 1 GB" do
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte)
+
+    assert_not accounts(:initech).exceeding_storage_limit?
+  end
+
+  test "not exceeding storage limit when under 1 GB" do
+    Account.any_instance.stubs(:bytes_used).returns(500.megabytes)
+
+    assert_not accounts(:initech).exceeding_storage_limit?
+  end
+
+  test "nearing storage limit when within 500 MB of the limit" do
+    Account.any_instance.stubs(:bytes_used).returns(600.megabytes)
+
+    assert accounts(:initech).nearing_storage_limit?
+  end
+
+  test "not nearing storage limit when well under the threshold" do
+    Account.any_instance.stubs(:bytes_used).returns(400.megabytes)
+
+    assert_not accounts(:initech).nearing_storage_limit?
+  end
+
+  test "not nearing storage limit when already exceeding it" do
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert_not accounts(:initech).nearing_storage_limit?
+  end
+end

From 00b588fcef0370ff01f9e2d80e53d251cb4a30cd Mon Sep 17 00:00:00 2001
From: Jay Ohms <jay@37signals.com>
Date: Tue, 17 Mar 2026 07:43:13 -0400
Subject: [PATCH 064/107] Don't display the "Mark done" bridge component button
 when the card has been marked as "Not Now"

---
 .../cards/container/_closure_buttons.html.erb | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/app/views/cards/container/_closure_buttons.html.erb b/app/views/cards/container/_closure_buttons.html.erb
index 27db6590e..99fcad627 100644
--- a/app/views/cards/container/_closure_buttons.html.erb
+++ b/app/views/cards/container/_closure_buttons.html.erb
@@ -1,13 +1,27 @@
 <div class="flex gap-half">
   <%= link_to edit_card_path(card), class: "btn btn--circle-mobile borderless",
-        data: { controller: "hotkey", action: "keydown.e@document->hotkey#click", bridge__overflow_menu_target: "item", bridge_title: "Edit", turbo_frame: dom_id(card, :edit) } do %>
+        data: {
+          controller: "hotkey",
+          action: "keydown.e@document->hotkey#click",
+          bridge__overflow_menu_target: "item",
+          bridge_title: "Edit",
+          turbo_frame: dom_id(card, :edit)
+        } do %>
     <%= icon_tag "pencil", class: "icon--mobile-only" %>
     <span>Edit</span>
     <kbd class="txt-x-small hide-on-touch">e</kbd>
   <% end %>
 
-  <%= button_to card_closure_path(card), class: "btn btn--circle-mobile borderless",
-        data: { controller: "hotkey", form_target: "submit", bridge__buttons_target: "button", bridge_title: "Mark done", bridge_display_as_primary_action: true, bridge_display_title: true, bridge_icon_url: bridge_icon("check"), action: "keydown.d@document->hotkey#click" },
+  <%= button_to card_closure_path(card), class: "btn btn--circle-mobile borderless hide-on-native",
+        data: {
+          controller: "hotkey",
+          form_target: "submit",
+          bridge__buttons_target: ("button" unless card.postponed?),
+          bridge_title: "Mark done",
+          bridge_display_as_primary_action: true,
+          bridge_display_title: true, bridge_icon_url: bridge_icon("check"),
+          action: "keydown.d@document->hotkey#click"
+        },
         form: { data: { controller: "form" } } do %>
     <%= icon_tag "check", class: "icon--mobile-only" %>
     <span class="overflow-ellipsis">Mark as Done</span>

From 5c1f3a1f4f375eaf4104cc47935dbb578c29f68f Mon Sep 17 00:00:00 2001
From: Jay Ohms <jay@37signals.com>
Date: Tue, 17 Mar 2026 08:12:57 -0400
Subject: [PATCH 065/107] Refactor stamp component and observe element changes
 so subsequent "connect" messages will be sent

---
 .../controllers/bridge/stamp_controller.js    | 34 ++++++++++++++-----
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/app/javascript/controllers/bridge/stamp_controller.js b/app/javascript/controllers/bridge/stamp_controller.js
index 735e4c830..747f5d48d 100644
--- a/app/javascript/controllers/bridge/stamp_controller.js
+++ b/app/javascript/controllers/bridge/stamp_controller.js
@@ -5,22 +5,40 @@ export default class extends BridgeComponent {
   static values = { scopeSelector: { type: String, default: "body" } }
 
   connect() {
+    super.connect()
+
     if (this.element.closest(this.scopeSelectorValue)) {
-      super.connect()
-      this.send("connect", this.#data)
+      this.notifyBridgeOfConnect()
+      this.#observeStamp()
     }
   }
 
   disconnect() {
     super.disconnect()
+    this.notifyBridgeOfDisconnect()
+    this.stampObserver?.disconnect()
+  }
+
+  notifyBridgeOfConnect() {
+    const bridgeElement = this.bridgeElement
+
+    this.send("connect", {
+      title: bridgeElement.title,
+      description: bridgeElement.bridgeAttribute("description")
+    })
+  }
+
+  notifyBridgeOfDisconnect() {
     this.send("disconnect")
   }
 
-  get #data() {
-    const bridgeElement = this.bridgeElement
-    return {
-      title: bridgeElement.title,
-      description: bridgeElement.bridgeAttribute("description") ?? null
-    }
+  #observeStamp() {
+    this.stampObserver = new MutationObserver(() => {
+      this.notifyBridgeOfConnect()
+    })
+
+    this.stampObserver.observe(this.element, {
+      attributes: true
+    })
   }
 }

From 09e4bb13d3c8057dcb52469da0bf5f9a26b9a48f Mon Sep 17 00:00:00 2001
From: Jay Ohms <jay@37signals.com>
Date: Tue, 17 Mar 2026 09:59:45 -0400
Subject: [PATCH 066/107] Preset the data-bridge-platform and
 data-bridge-components on the body element from the user-agent. This prevents
 css flashes before the native bridge is registered in the app.

---
 app/models/application_platform.rb     | 20 ++++++++++++++++++++
 app/views/layouts/application.html.erb |  5 ++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/app/models/application_platform.rb b/app/models/application_platform.rb
index 9b2695cd5..388c183eb 100644
--- a/app/models/application_platform.rb
+++ b/app/models/application_platform.rb
@@ -43,6 +43,17 @@ class ApplicationPlatform < PlatformAgent
     operating_system == "Windows"
   end
 
+  def bridge_name
+    case
+    when native? && android? then :android
+    when native? && ios?     then :ios
+    end
+  end
+
+  def bridge_components
+    extract_list_from_native_user_agent("bridge-components")
+  end
+
   def type
     if native? && android?
       "native android"
@@ -67,4 +78,13 @@ class ApplicationPlatform < PlatformAgent
       os =~ /Linux/ ? "Linux" : os
     end
   end
+
+  private
+    def extract_list_from_native_user_agent(prefix)
+      if native?
+        user_agent.to_s.match(/#{prefix}: \[(.+)\]/) { |matches| matches[1] }.to_s
+      else
+        ""
+      end
+    end
 end
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 475a7a79e..b83d199d2 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -5,7 +5,10 @@
   <body class="<%= @body_class %>"
     data-controller="local-time timezone-cookie turbo-navigation theme bridge--title bridge--text-size bridge--insets"
     data-action="turbo:morph@window->local-time#refreshAll turbo:before-visit@document->turbo-navigation#rememberLocation"
-    data-platform="<%= platform.type %>" data-bridge--title-title-value="<%= @page_title %>">
+    data-platform="<%= platform.type %>"
+    data-bridge-platform="<%= platform.bridge_name %>"
+    data-bridge-components="<%= platform.bridge_components %>"
+    data-bridge--title-title-value="<%= @page_title %>">
     <div id="global-container" data-controller="bridge--buttons bridge--overflow-menu">
       <header class="header header--mobile-actions-stack <%= @header_class %>" id="header">
         <a href="#main" class="header__skip-navigation btn" data-turbo="false">Skip to main content</a>

From 139f4cb8694e890094758337c9c842a1c0b7e0e1 Mon Sep 17 00:00:00 2001
From: Jay Ohms <jay@37signals.com>
Date: Tue, 17 Mar 2026 10:12:56 -0400
Subject: [PATCH 067/107] Add test coverage for native bridge user agents

---
 test/models/application_platform_test.rb | 41 ++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 test/models/application_platform_test.rb

diff --git a/test/models/application_platform_test.rb b/test/models/application_platform_test.rb
new file mode 100644
index 000000000..597fd714b
--- /dev/null
+++ b/test/models/application_platform_test.rb
@@ -0,0 +1,41 @@
+require "test_helper"
+
+class ApplicationPlatformTest < ActiveSupport::TestCase
+  NATIVE_ANDROID_UA = "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Hotwire Native Android/1.0 bridge-components: [buttons overflow-menu form]"
+  NATIVE_IOS_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Hotwire Native iOS/1.0 bridge-components: [title]"
+  MOBILE_WEB_IOS_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"
+  DESKTOP_WEB_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+  NATIVE_WITHOUT_COMPONENTS_UA = "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Hotwire Native Android/1.0"
+
+  test "bridge_name returns android for native android user agents" do
+    assert_equal :android, platform_for(NATIVE_ANDROID_UA).bridge_name
+  end
+
+  test "bridge_name returns ios for native ios user agents" do
+    assert_equal :ios, platform_for(NATIVE_IOS_UA).bridge_name
+  end
+
+  test "bridge_name is nil for non-native user agents" do
+    assert_nil platform_for(MOBILE_WEB_IOS_UA).bridge_name
+    assert_nil platform_for(DESKTOP_WEB_UA).bridge_name
+  end
+
+  test "bridge_components returns extracted components for native user agents" do
+    assert_equal "buttons overflow-menu form", platform_for(NATIVE_ANDROID_UA).bridge_components
+    assert_equal "title", platform_for(NATIVE_IOS_UA).bridge_components
+  end
+
+  test "bridge_components is blank for non-native user agents" do
+    assert_equal "", platform_for(MOBILE_WEB_IOS_UA).bridge_components
+    assert_equal "", platform_for(DESKTOP_WEB_UA).bridge_components
+  end
+
+  test "bridge_components is blank when native user agent does not include bridge-components metadata" do
+    assert_equal "", platform_for(NATIVE_WITHOUT_COMPONENTS_UA).bridge_components
+  end
+
+  private
+    def platform_for(user_agent)
+      ApplicationPlatform.new(user_agent)
+    end
+end

From 29a29094bd36040178a72022deca0c346c020186 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Mon, 16 Mar 2026 12:41:02 -0400
Subject: [PATCH 068/107] Configure Lexxy to add extra spacing between block
 elements

Updating Lexxy to v0.8.5 for the insert-markdown event.
---
 Gemfile                                             |  2 +-
 Gemfile.lock                                        | 11 +++--------
 Gemfile.saas.lock                                   | 11 +++--------
 app/javascript/initializers/index.js                |  1 +
 app/javascript/initializers/lexxy_markdown_paste.js |  3 +++
 5 files changed, 11 insertions(+), 17 deletions(-)
 create mode 100644 app/javascript/initializers/lexxy_markdown_paste.js

diff --git a/Gemfile b/Gemfile
index da66e1473..597899b7d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -27,7 +27,7 @@ gem "geared_pagination", "~> 1.2"
 gem "rqrcode"
 gem "rouge"
 gem "jbuilder"
-gem "lexxy", bc: "lexxy"
+gem "lexxy", "0.8.5.beta"
 gem "image_processing", "~> 1.14"
 gem "platform_agent"
 gem "aws-sdk-s3", require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 8db6817dc..ae84f65f6 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,10 +1,3 @@
-GIT
-  remote: https://github.com/basecamp/lexxy
-  revision: b7f0f1429df5fa425eac043191ae2b65edee7488
-  specs:
-    lexxy (0.7.6.beta)
-      rails (>= 8.0.2)
-
 GIT
   remote: https://github.com/basecamp/useragent
   revision: 433ca320a42db1266c4b89df74d0abdb9a880c5e
@@ -261,6 +254,8 @@ GEM
       logger (~> 1.6)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
+    lexxy (0.8.5.beta)
+      rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
     loofah (2.25.0)
@@ -523,7 +518,7 @@ DEPENDENCIES
   jbuilder
   kamal
   letter_opener
-  lexxy!
+  lexxy (= 0.8.5.beta)
   mission_control-jobs
   mittens
   mocha
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 6f9b0d088..176a5218c 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -21,13 +21,6 @@ GIT
       rails (>= 7.0)
       rainbow
 
-GIT
-  remote: https://github.com/basecamp/lexxy
-  revision: b7f0f1429df5fa425eac043191ae2b65edee7488
-  specs:
-    lexxy (0.7.6.beta)
-      rails (>= 8.0.2)
-
 GIT
   remote: https://github.com/basecamp/queenbee-plugin
   revision: 14312a940471e20617b38cdec7c092a01567d18b
@@ -374,6 +367,8 @@ GEM
       logger (~> 1.6)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
+    lexxy (0.8.5.beta)
+      rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
     loofah (2.25.0)
@@ -729,7 +724,7 @@ DEPENDENCIES
   jbuilder
   kamal
   letter_opener
-  lexxy!
+  lexxy (= 0.8.5.beta)
   mission_control-jobs
   mittens
   mocha
diff --git a/app/javascript/initializers/index.js b/app/javascript/initializers/index.js
index 1d16ef205..d2c20451e 100644
--- a/app/javascript/initializers/index.js
+++ b/app/javascript/initializers/index.js
@@ -1,3 +1,4 @@
 import "initializers/current"
 import "initializers/bridge/bridge_element"
 import "initializers/offline"
+import "initializers/lexxy_markdown_paste"
diff --git a/app/javascript/initializers/lexxy_markdown_paste.js b/app/javascript/initializers/lexxy_markdown_paste.js
new file mode 100644
index 000000000..cf7600306
--- /dev/null
+++ b/app/javascript/initializers/lexxy_markdown_paste.js
@@ -0,0 +1,3 @@
+document.addEventListener("lexxy:insert-markdown", (event) => {
+  event.detail.addBlockSpacing()
+})

From fc18ba8e07de3e23e451be7a0607d77e484fbb13 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Mon, 16 Mar 2026 13:39:12 -0400
Subject: [PATCH 069/107] Add system tests for markdown paste in Lexxy editor

Test that pasting markdown with block separators produces extra spacing
between blocks, and that single line breaks are preserved.
---
 test/system/smoke_test.rb | 40 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/test/system/smoke_test.rb b/test/system/smoke_test.rb
index 31e8f723f..5af13f890 100644
--- a/test/system/smoke_test.rb
+++ b/test/system/smoke_test.rb
@@ -76,6 +76,38 @@ class SmokeTest < ApplicationSystemTestCase
     assert_no_selector "div##{dom_id(notification)}"
   end
 
+  test "markdown paste adds block spacing" do
+    sign_in_as(users(:david))
+
+    visit card_url(cards(:layout))
+    find("lexxy-editor").click
+    paste_markdown("Hello\n\nWorld")
+
+    within("lexxy-editor") do
+      assert_selector "p", text: "Hello"
+      assert_selector "p br", visible: :all
+      assert_selector "p", text: "World"
+    end
+  end
+
+  test "markdown paste preserves line breaks" do
+    sign_in_as(users(:david))
+
+    visit card_url(cards(:layout))
+    find("lexxy-editor").click
+    paste_markdown("Hello\nWorld")
+
+    inner_html = find("lexxy-editor p", text: "Hello").native.property("innerHTML")
+    children = Nokogiri::HTML5.fragment(inner_html).children
+    assert_pattern do
+      children => [
+        { name: "span", inner_html: "Hello" },
+        { name: "br" },
+        { name: "span", inner_html: "World" }
+      ]
+    end
+  end
+
   test "dragging card to a new column" do
     sign_in_as(users(:david))
 
@@ -105,4 +137,12 @@ class SmokeTest < ApplicationSystemTestCase
       editor_element.set with
       page.execute_script("arguments[0].value = '#{with}'", editor_element)
     end
+
+    def paste_markdown(markdown)
+      page.execute_script(<<~JS, markdown)
+        const dt = new DataTransfer();
+        dt.setData("text/plain", arguments[0]);
+        document.activeElement.dispatchEvent(new ClipboardEvent("paste", { clipboardData: dt, bubbles: true }));
+      JS
+    end
 end

From 24446afba7477cdd9e7a632e130ceee8a22d85fe Mon Sep 17 00:00:00 2001
From: Zoltan Hosszu <zoltan@37signals.com>
Date: Tue, 17 Mar 2026 10:39:40 +0100
Subject: [PATCH 070/107] Image gallery size fixes

---
 app/assets/stylesheets/attachments.css |  5 ++---
 app/assets/stylesheets/lexxy.css       | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/app/assets/stylesheets/attachments.css b/app/assets/stylesheets/attachments.css
index 85dc7652d..8e3808ec5 100644
--- a/app/assets/stylesheets/attachments.css
+++ b/app/assets/stylesheets/attachments.css
@@ -3,8 +3,8 @@
     block-size: auto;
     display: block;
     inline-size: fit-content;
-    position: relative;
     max-inline-size: 100%;
+    position: relative;
 
     progress {
       inline-size: 100%;
@@ -35,8 +35,7 @@
 
       @supports (field-sizing: content) {
         field-sizing: content;
-        inline-size: auto;
-        min-inline-size: 20ch;
+        inline-size: 100%;
       }
     }
   }
diff --git a/app/assets/stylesheets/lexxy.css b/app/assets/stylesheets/lexxy.css
index 8fb7658ee..aaf634710 100644
--- a/app/assets/stylesheets/lexxy.css
+++ b/app/assets/stylesheets/lexxy.css
@@ -188,4 +188,18 @@
   .attachment {
     margin-inline: 0;
   }
+
+  .attachment-gallery {
+    .attachment {
+      display: inline-block;
+      inline-size: calc(33.333% - 0.8ch);
+    }
+
+    &.attachment-gallery--2,
+    &.attachment-gallery--4 {
+      .attachment {
+        inline-size: calc(50% - 0.8ch);
+      }
+    }
+  }
 }

From ea871757f210bbb1a35e0abb5afb76db3c6046f8 Mon Sep 17 00:00:00 2001
From: Zoltan Hosszu <zoltan@37signals.com>
Date: Tue, 17 Mar 2026 10:39:48 +0100
Subject: [PATCH 071/107] Mention delete button fix

---
 app/assets/stylesheets/lexxy.css | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/app/assets/stylesheets/lexxy.css b/app/assets/stylesheets/lexxy.css
index aaf634710..1ae710da9 100644
--- a/app/assets/stylesheets/lexxy.css
+++ b/app/assets/stylesheets/lexxy.css
@@ -202,4 +202,15 @@
       }
     }
   }
+
+  action-text-attachment[content-type^='application/vnd.actiontext'] {
+    lexxy-node-delete-button {
+      inset-inline-start: -0.25ch;
+
+      .lexxy-floating-controls__group {
+        background-color: oklch(var(--lch-blue-dark));
+        border-radius: 50%;
+      }
+    }
+  }
 }

From 1f24ed662b60a576d09171ac3ebcabaa0a65149a Mon Sep 17 00:00:00 2001
From: Zoltan Hosszu <zoltan@37signals.com>
Date: Tue, 17 Mar 2026 10:45:52 +0100
Subject: [PATCH 072/107] Increase max width for mention prompts

---
 app/assets/stylesheets/lexxy.css | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/assets/stylesheets/lexxy.css b/app/assets/stylesheets/lexxy.css
index 1ae710da9..053f626a9 100644
--- a/app/assets/stylesheets/lexxy.css
+++ b/app/assets/stylesheets/lexxy.css
@@ -120,6 +120,10 @@
     margin-block: 1em;
   }
 
+  .lexxy-prompt-menu {
+    max-inline-size: min(35ch, calc(100% - var(--lexxy-prompt-offset-x)));
+  }
+
   /* Content
   /* ------------------------------------------------------------------------ */
 

From 8920946cb2b885d0a19bdfb3e10f24222de30550 Mon Sep 17 00:00:00 2001
From: Jay Ohms <jay@37signals.com>
Date: Tue, 17 Mar 2026 10:45:37 -0400
Subject: [PATCH 073/107] Update regex and add test coverage for empty/multiple
 lists

---
 app/models/application_platform.rb       |  2 +-
 test/models/application_platform_test.rb | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/app/models/application_platform.rb b/app/models/application_platform.rb
index 388c183eb..6494e37c5 100644
--- a/app/models/application_platform.rb
+++ b/app/models/application_platform.rb
@@ -82,7 +82,7 @@ class ApplicationPlatform < PlatformAgent
   private
     def extract_list_from_native_user_agent(prefix)
       if native?
-        user_agent.to_s.match(/#{prefix}: \[(.+)\]/) { |matches| matches[1] }.to_s
+        user_agent.to_s.match(/#{Regexp.escape(prefix)}: \[(.*?)\]/) { |matches| matches[1] }.to_s
       else
         ""
       end
diff --git a/test/models/application_platform_test.rb b/test/models/application_platform_test.rb
index 597fd714b..560eb320e 100644
--- a/test/models/application_platform_test.rb
+++ b/test/models/application_platform_test.rb
@@ -6,6 +6,8 @@ class ApplicationPlatformTest < ActiveSupport::TestCase
   MOBILE_WEB_IOS_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"
   DESKTOP_WEB_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
   NATIVE_WITHOUT_COMPONENTS_UA = "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Hotwire Native Android/1.0"
+  NATIVE_WITH_EMPTY_COMPONENTS_UA = "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Hotwire Native Android/1.0 bridge-components: []"
+  NATIVE_WITH_MULTIPLE_LISTS_UA = "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Hotwire Native Android/1.0 bridge-components: [buttons] metadata: [ignored]"
 
   test "bridge_name returns android for native android user agents" do
     assert_equal :android, platform_for(NATIVE_ANDROID_UA).bridge_name
@@ -34,6 +36,14 @@ class ApplicationPlatformTest < ActiveSupport::TestCase
     assert_equal "", platform_for(NATIVE_WITHOUT_COMPONENTS_UA).bridge_components
   end
 
+  test "bridge_components supports empty lists" do
+    assert_equal "", platform_for(NATIVE_WITH_EMPTY_COMPONENTS_UA).bridge_components
+  end
+
+  test "bridge_components only matches through the first closing bracket" do
+    assert_equal "buttons", platform_for(NATIVE_WITH_MULTIPLE_LISTS_UA).bridge_components
+  end
+
   private
     def platform_for(user_agent)
       ApplicationPlatform.new(user_agent)

From 4d2866dec6a33e8883984ecc6a7b1fe385c70ab6 Mon Sep 17 00:00:00 2001
From: Jay Ohms <jay@37signals.com>
Date: Tue, 17 Mar 2026 11:04:39 -0400
Subject: [PATCH 074/107] Update additional tests to ensure that the body
 element contains the correct bridge attributes

---
 test/controllers/concerns/set_platform_test.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/controllers/concerns/set_platform_test.rb b/test/controllers/concerns/set_platform_test.rb
index 26ce9d66a..eb3dc73ec 100644
--- a/test/controllers/concerns/set_platform_test.rb
+++ b/test/controllers/concerns/set_platform_test.rb
@@ -2,13 +2,13 @@ require "test_helper"
 
 class SetPlatformTest < ActionDispatch::IntegrationTest
   DESKTOP_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
-  NATIVE_IOS_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Hotwire Native iOS/1.0"
+  NATIVE_IOS_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Hotwire Native iOS/1.0 bridge-components: [buttons overflow-menu]"
 
   test "uses the request user agent by default" do
     sign_in_as :david
 
     get board_path(boards(:writebook)), headers: { "User-Agent" => DESKTOP_UA }
-    assert_match 'data-platform="desktop web"', response.body
+    assert_select "body[data-platform='desktop web'][data-bridge-platform=''][data-bridge-components='']"
   end
 
   test "prefers x_user_agent cookie over request user agent" do
@@ -16,6 +16,6 @@ class SetPlatformTest < ActionDispatch::IntegrationTest
 
     cookies[:x_user_agent] = NATIVE_IOS_UA
     get board_path(boards(:writebook)), headers: { "User-Agent" => DESKTOP_UA }
-    assert_match 'data-platform="native ios"', response.body
+    assert_select "body[data-platform='native ios'][data-bridge-platform='ios'][data-bridge-components='buttons overflow-menu']"
   end
 end

From b5b3d1cd37a1abe850af1890619e94539624a588 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Tue, 17 Mar 2026 11:33:49 -0500
Subject: [PATCH 075/107] Style messages for account limits

---
 app/assets/stylesheets/card-perma.css         |   8 ++
 app/assets/stylesheets/comments.css           | 120 ++++++++++--------
 .../saas/_storage_limit_exceeded.html.erb     |  14 +-
 .../saas/_storage_limit_exceeded.html.erb     |   8 +-
 .../saas/_storage_limit_notice.html.erb       |   5 +-
 5 files changed, 96 insertions(+), 59 deletions(-)

diff --git a/app/assets/stylesheets/card-perma.css b/app/assets/stylesheets/card-perma.css
index 3dc16d5a2..e204547b4 100644
--- a/app/assets/stylesheets/card-perma.css
+++ b/app/assets/stylesheets/card-perma.css
@@ -511,4 +511,12 @@
       }
     }
   }
+
+  .card-perma__account-limit-message {
+    background-color: var(--color-canvas);
+    border: 2px solid var(--color-container);
+    border-radius: 4px;
+    margin-block-start: calc(var(--padding-block) / -2);
+    padding: 1ch 2ch;
+  }
 }
diff --git a/app/assets/stylesheets/comments.css b/app/assets/stylesheets/comments.css
index 2369d62b3..21578572b 100644
--- a/app/assets/stylesheets/comments.css
+++ b/app/assets/stylesheets/comments.css
@@ -1,4 +1,7 @@
 @layer components {
+  /* List
+  /* ------------------------------------------------------------------------ */
+
   .comments {
     --avatar-size: 2.33em;
     --comment-padding-block: var(--block-space-half);
@@ -21,10 +24,8 @@
     }
   }
 
-  .comments__subscribers {
-    max-inline-size: var(--comment-max);
-    padding-inline: calc(var(--comment-padding-block) + var(--inline-space-double));
-  }
+  /* Comment
+  /* ------------------------------------------------------------------------ */
 
   .comment {
     /* Distinguish from the .comment class used for code formatting without extra specificity */
@@ -35,52 +36,6 @@
       position: relative;
     }
 
-    .comment-by-system & {
-      --comment-padding-block: var(--block-space-half);
-
-      text-align: center;
-
-      &::before {
-        /* Make up space for lack of avatar */
-        content: "";
-        display: flex;
-        inline-size: calc(var(--comment-padding-inline) * 0.9);
-      }
-
-      .comment__avatar {
-        display: none;
-      }
-
-      .comment__author {
-        a { margin: 0 auto; }
-        h3 { margin-inline: auto; }
-        strong { display: none; }
-      }
-
-      .comment__body {
-        padding: 0;
-        text-align: center;
-      }
-
-      .comment__content {
-        --stripe-color: var(--color-ink-lightest);
-
-        background-image: repeating-linear-gradient(
-          45deg in srgb,
-          var(--color-canvas) 0 1px,
-          var(--stripe-color) 1px 10px);
-        padding-inline: var(--comment-padding-inline);
-
-        .comments--system-expanded .comment-by-system & {
-          --stripe-color: color-mix(in srgb, var(--card-color) 10%, var(--color-canvas));
-        }
-      }
-
-      .reactions {
-        display: none !important;
-      }
-    }
-
     .reactions {
       margin-block-start: var(--block-space-half);
       margin-inline: calc(var(--column-gap) / -1);
@@ -195,7 +150,12 @@
     }
   }
 
+  /* System comment
+  /* ------------------------------------------------------------------------ */
+
   .comment-by-system {
+    --stripe-color: var(--color-ink-lightest);
+
     display: none;
     transition: var(--dialog-duration) allow-discrete;
     transition-property: display;
@@ -203,6 +163,50 @@
     .comments--system-expanded & {
       display: contents;
     }
+
+    .comment {
+      --comment-padding-block: var(--block-space-half);
+
+      text-align: center;
+
+      &::before {
+        /* Make up space for lack of avatar */
+        content: "";
+        display: flex;
+        inline-size: calc(var(--comment-padding-inline) * 0.9);
+      }
+    }
+
+    .comment__avatar {
+      display: none;
+    }
+
+    .comment__author {
+      a { margin: 0 auto; }
+      h3 { margin-inline: auto; }
+      strong { display: none; }
+    }
+
+    .comment__body {
+      padding: 0;
+      text-align: center;
+    }
+
+    .comment__content {
+      background-image: repeating-linear-gradient(
+        45deg in srgb,
+        var(--color-canvas) 0 1px,
+        var(--stripe-color) 1px 10px);
+      padding-inline: var(--comment-padding-inline);
+
+      .comments--system-expanded .comment-by-system & {
+        --stripe-color: color-mix(in srgb, var(--card-color) 10%, var(--color-canvas));
+      }
+    }
+
+    .reactions {
+      display: none !important;
+    }
   }
 
   /* Show the last system comment */
@@ -220,4 +224,20 @@
       display: none;
     }
   }
+
+  .comment-by-system--account-limit {
+    --stripe-color: oklch(var(--lch-blue-lightest));
+
+    .comment__content {
+      padding: 3ch;
+    }
+  }
+
+  /* Subscribers
+  /* ------------------------------------------------------------------------ */
+
+  .comments__subscribers {
+    max-inline-size: var(--comment-max);
+    padding-inline: calc(var(--comment-padding-block) + var(--inline-space-double));
+  }
 }
diff --git a/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
index 6be5fb587..82ab7f25e 100644
--- a/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
+++ b/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
@@ -1,4 +1,12 @@
-<div class="full-width pad-inline center margin-block txt-small txt-ink-medium">
-  <strong>This account has used all <%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %> of free storage.</strong>
-  <%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.
+<div class="comment-by-system comment-by-system--account-limit">
+  <div class="comment align-start full-width">
+    <div class="comment__content flex flex-column flex-item-grow full-width">
+      <div class="comment__body lexxy-content">
+        <div class="action-text-content">
+          <strong>This account has used all the included free storage (<%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %>).</strong>
+          <div><%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.</div>
+        </div>
+      </div>
+    </div>
+  </div>
 </div>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
index 6fb95be11..ca0dc9be0 100644
--- a/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
+++ b/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
@@ -1,7 +1,7 @@
-<div class="card-perma__notch card-perma__notch--bottom flex-column center">
-  <div class="pad-inline pad-block-half">
-    <strong>This account has used all <%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %> of free storage.</strong>
-    <div class="margin-block-start-quarter txt-small">
+<div class="card-perma__notch card-perma__notch--bottom">
+  <div class="card-perma__account-limit-message">
+    <strong>This account has used all the included free storage (<%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %>).</strong>
+    <div>
       <%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.
     </div>
   </div>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
index 942041fb4..41bb987f0 100644
--- a/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
+++ b/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
@@ -1,5 +1,6 @@
 <% if Current.account.nearing_storage_limit? %>
-  <div class="full-width pad-inline center margin-block-half txt-small txt-ink-medium">
-    This account has used <%= number_to_human_size(Current.account.bytes_used) %> of <%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %> storage.
+  <div class="txt-small">
+    This account has used <strong><%= number_to_human_size(Current.account.bytes_used) %></strong> of <strong><%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %></strong> storage.
+    <div><%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", class: "txt-current txt-underline", target: "_blank" %> for unlimited storage.</div>
   </div>
 <% end %>

From 0be8041953c808ca557178b153cc1215654973ff Mon Sep 17 00:00:00 2001
From: Jorge Manrubia <jorge.manrubia@gmail.com>
Date: Tue, 17 Mar 2026 17:51:07 +0100
Subject: [PATCH 076/107] Revert "Add 1GB storage cap with self-host notice"

---
 app/assets/stylesheets/card-perma.css         |   8 --
 app/assets/stylesheets/comments.css           | 120 ++++++++----------
 app/views/cards/_messages.html.erb            |   6 +-
 .../cards/container/footer/_create.html.erb   |   2 -
 app/views/cards/drafts/_container.html.erb    |   6 +-
 .../concerns/card/storage_limited.rb          |   8 --
 .../card/storage_limited/commenting.rb        |   9 --
 .../concerns/card/storage_limited/creation.rb |   9 --
 .../card/storage_limited/publishing.rb        |   9 --
 saas/app/models/account/storage_limited.rb    |  14 --
 .../views/cards/comments/saas/_new.html.erb   |   5 -
 .../saas/_storage_limit_exceeded.html.erb     |  12 --
 .../container/footer/saas/_create.html.erb    |   5 -
 .../saas/_storage_limit_exceeded.html.erb     |   8 --
 .../saas/_storage_limit_notice.html.erb       |   6 -
 saas/lib/fizzy/saas/engine.rb                 |   4 -
 .../card/storage_limited/commenting_test.rb   |  29 -----
 .../card/storage_limited/creation_test.rb     |  47 -------
 .../card/storage_limited/publishing_test.rb   |  23 ----
 .../controllers/card/storage_limited_test.rb  |  27 ----
 .../comment/storage_limited_test.rb           |  25 ----
 .../models/account/storage_limited_test.rb    |  39 ------
 22 files changed, 52 insertions(+), 369 deletions(-)
 delete mode 100644 saas/app/controllers/concerns/card/storage_limited.rb
 delete mode 100644 saas/app/controllers/concerns/card/storage_limited/commenting.rb
 delete mode 100644 saas/app/controllers/concerns/card/storage_limited/creation.rb
 delete mode 100644 saas/app/controllers/concerns/card/storage_limited/publishing.rb
 delete mode 100644 saas/app/models/account/storage_limited.rb
 delete mode 100644 saas/app/views/cards/comments/saas/_new.html.erb
 delete mode 100644 saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/_create.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
 delete mode 100644 saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
 delete mode 100644 saas/test/controllers/card/storage_limited/commenting_test.rb
 delete mode 100644 saas/test/controllers/card/storage_limited/creation_test.rb
 delete mode 100644 saas/test/controllers/card/storage_limited/publishing_test.rb
 delete mode 100644 saas/test/controllers/card/storage_limited_test.rb
 delete mode 100644 saas/test/controllers/comment/storage_limited_test.rb
 delete mode 100644 saas/test/models/account/storage_limited_test.rb

diff --git a/app/assets/stylesheets/card-perma.css b/app/assets/stylesheets/card-perma.css
index 407b1beac..6d966d0ae 100644
--- a/app/assets/stylesheets/card-perma.css
+++ b/app/assets/stylesheets/card-perma.css
@@ -543,12 +543,4 @@
       }
     }
   }
-
-  .card-perma__account-limit-message {
-    background-color: var(--color-canvas);
-    border: 2px solid var(--color-container);
-    border-radius: 4px;
-    margin-block-start: calc(var(--padding-block) / -2);
-    padding: 1ch 2ch;
-  }
 }
diff --git a/app/assets/stylesheets/comments.css b/app/assets/stylesheets/comments.css
index 21578572b..2369d62b3 100644
--- a/app/assets/stylesheets/comments.css
+++ b/app/assets/stylesheets/comments.css
@@ -1,7 +1,4 @@
 @layer components {
-  /* List
-  /* ------------------------------------------------------------------------ */
-
   .comments {
     --avatar-size: 2.33em;
     --comment-padding-block: var(--block-space-half);
@@ -24,8 +21,10 @@
     }
   }
 
-  /* Comment
-  /* ------------------------------------------------------------------------ */
+  .comments__subscribers {
+    max-inline-size: var(--comment-max);
+    padding-inline: calc(var(--comment-padding-block) + var(--inline-space-double));
+  }
 
   .comment {
     /* Distinguish from the .comment class used for code formatting without extra specificity */
@@ -36,6 +35,52 @@
       position: relative;
     }
 
+    .comment-by-system & {
+      --comment-padding-block: var(--block-space-half);
+
+      text-align: center;
+
+      &::before {
+        /* Make up space for lack of avatar */
+        content: "";
+        display: flex;
+        inline-size: calc(var(--comment-padding-inline) * 0.9);
+      }
+
+      .comment__avatar {
+        display: none;
+      }
+
+      .comment__author {
+        a { margin: 0 auto; }
+        h3 { margin-inline: auto; }
+        strong { display: none; }
+      }
+
+      .comment__body {
+        padding: 0;
+        text-align: center;
+      }
+
+      .comment__content {
+        --stripe-color: var(--color-ink-lightest);
+
+        background-image: repeating-linear-gradient(
+          45deg in srgb,
+          var(--color-canvas) 0 1px,
+          var(--stripe-color) 1px 10px);
+        padding-inline: var(--comment-padding-inline);
+
+        .comments--system-expanded .comment-by-system & {
+          --stripe-color: color-mix(in srgb, var(--card-color) 10%, var(--color-canvas));
+        }
+      }
+
+      .reactions {
+        display: none !important;
+      }
+    }
+
     .reactions {
       margin-block-start: var(--block-space-half);
       margin-inline: calc(var(--column-gap) / -1);
@@ -150,12 +195,7 @@
     }
   }
 
-  /* System comment
-  /* ------------------------------------------------------------------------ */
-
   .comment-by-system {
-    --stripe-color: var(--color-ink-lightest);
-
     display: none;
     transition: var(--dialog-duration) allow-discrete;
     transition-property: display;
@@ -163,50 +203,6 @@
     .comments--system-expanded & {
       display: contents;
     }
-
-    .comment {
-      --comment-padding-block: var(--block-space-half);
-
-      text-align: center;
-
-      &::before {
-        /* Make up space for lack of avatar */
-        content: "";
-        display: flex;
-        inline-size: calc(var(--comment-padding-inline) * 0.9);
-      }
-    }
-
-    .comment__avatar {
-      display: none;
-    }
-
-    .comment__author {
-      a { margin: 0 auto; }
-      h3 { margin-inline: auto; }
-      strong { display: none; }
-    }
-
-    .comment__body {
-      padding: 0;
-      text-align: center;
-    }
-
-    .comment__content {
-      background-image: repeating-linear-gradient(
-        45deg in srgb,
-        var(--color-canvas) 0 1px,
-        var(--stripe-color) 1px 10px);
-      padding-inline: var(--comment-padding-inline);
-
-      .comments--system-expanded .comment-by-system & {
-        --stripe-color: color-mix(in srgb, var(--card-color) 10%, var(--color-canvas));
-      }
-    }
-
-    .reactions {
-      display: none !important;
-    }
   }
 
   /* Show the last system comment */
@@ -224,20 +220,4 @@
       display: none;
     }
   }
-
-  .comment-by-system--account-limit {
-    --stripe-color: oklch(var(--lch-blue-lightest));
-
-    .comment__content {
-      padding: 3ch;
-    }
-  }
-
-  /* Subscribers
-  /* ------------------------------------------------------------------------ */
-
-  .comments__subscribers {
-    max-inline-size: var(--comment-max);
-    padding-inline: calc(var(--comment-padding-block) + var(--inline-space-double));
-  }
 }
diff --git a/app/views/cards/_messages.html.erb b/app/views/cards/_messages.html.erb
index c51ab6d8b..a2784e72a 100644
--- a/app/views/cards/_messages.html.erb
+++ b/app/views/cards/_messages.html.erb
@@ -1,11 +1,7 @@
 <%= messages_tag(card) do %>
   <% if card.published? %>
     <%= render partial: "cards/comments/comment", collection: card.comments.preloaded.chronologically, cached: true %>
-    <% if Fizzy.saas? %>
-      <%= render "cards/comments/saas/new", card: card %>
-    <% else %>
-      <%= render "cards/comments/new", card: card %>
-    <% end %>
+    <%= render "cards/comments/new", card: card %>
 
     <%= render "cards/comments/watchers", card: card %>
   <% end %>
diff --git a/app/views/cards/container/footer/_create.html.erb b/app/views/cards/container/footer/_create.html.erb
index 4e5a83e20..648beffd1 100644
--- a/app/views/cards/container/footer/_create.html.erb
+++ b/app/views/cards/container/footer/_create.html.erb
@@ -13,7 +13,5 @@
       <span>Create and add another</span>
     <% end %>
   </div>
-
-  <%= render "cards/container/footer/saas/storage_limit_notice" if Fizzy.saas? %>
 </div>
 
diff --git a/app/views/cards/drafts/_container.html.erb b/app/views/cards/drafts/_container.html.erb
index fa7134b55..9ffc04711 100644
--- a/app/views/cards/drafts/_container.html.erb
+++ b/app/views/cards/drafts/_container.html.erb
@@ -26,9 +26,5 @@
     </div>
   <% end %>
 
-  <% if Fizzy.saas? %>
-    <%= render "cards/container/footer/saas/create", card: card %>
-  <% else %>
-    <%= render "cards/container/footer/create", card: card %>
-  <% end %>
+  <%= render "cards/container/footer/create", card: card %>
 </section>
diff --git a/saas/app/controllers/concerns/card/storage_limited.rb b/saas/app/controllers/concerns/card/storage_limited.rb
deleted file mode 100644
index 05357f43f..000000000
--- a/saas/app/controllers/concerns/card/storage_limited.rb
+++ /dev/null
@@ -1,8 +0,0 @@
-module Card::StorageLimited
-  extend ActiveSupport::Concern
-
-  private
-    def ensure_within_storage_limit
-      head :forbidden if Current.account.exceeding_storage_limit?
-    end
-end
diff --git a/saas/app/controllers/concerns/card/storage_limited/commenting.rb b/saas/app/controllers/concerns/card/storage_limited/commenting.rb
deleted file mode 100644
index a4b7e3307..000000000
--- a/saas/app/controllers/concerns/card/storage_limited/commenting.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-module Card::StorageLimited::Commenting
-  extend ActiveSupport::Concern
-
-  included do
-    include Card::StorageLimited
-
-    before_action :ensure_within_storage_limit, only: :create
-  end
-end
diff --git a/saas/app/controllers/concerns/card/storage_limited/creation.rb b/saas/app/controllers/concerns/card/storage_limited/creation.rb
deleted file mode 100644
index 9d894779d..000000000
--- a/saas/app/controllers/concerns/card/storage_limited/creation.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-module Card::StorageLimited::Creation
-  extend ActiveSupport::Concern
-
-  included do
-    include Card::StorageLimited
-
-    before_action :ensure_within_storage_limit, only: :create, if: -> { request.format.json? }
-  end
-end
diff --git a/saas/app/controllers/concerns/card/storage_limited/publishing.rb b/saas/app/controllers/concerns/card/storage_limited/publishing.rb
deleted file mode 100644
index abf7731a4..000000000
--- a/saas/app/controllers/concerns/card/storage_limited/publishing.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-module Card::StorageLimited::Publishing
-  extend ActiveSupport::Concern
-
-  included do
-    include Card::StorageLimited
-
-    before_action :ensure_within_storage_limit, only: :create
-  end
-end
diff --git a/saas/app/models/account/storage_limited.rb b/saas/app/models/account/storage_limited.rb
deleted file mode 100644
index dbab32b5d..000000000
--- a/saas/app/models/account/storage_limited.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-module Account::StorageLimited
-  extend ActiveSupport::Concern
-
-  STORAGE_LIMIT = 1.gigabyte
-  NEAR_STORAGE_LIMIT_THRESHOLD = 500.megabytes
-
-  def exceeding_storage_limit?
-    bytes_used > STORAGE_LIMIT
-  end
-
-  def nearing_storage_limit?
-    !exceeding_storage_limit? && bytes_used > STORAGE_LIMIT - NEAR_STORAGE_LIMIT_THRESHOLD
-  end
-end
diff --git a/saas/app/views/cards/comments/saas/_new.html.erb b/saas/app/views/cards/comments/saas/_new.html.erb
deleted file mode 100644
index 74cb6dd43..000000000
--- a/saas/app/views/cards/comments/saas/_new.html.erb
+++ /dev/null
@@ -1,5 +0,0 @@
-<% if Current.account.exceeding_storage_limit? %>
-  <%= render "cards/comments/saas/storage_limit_exceeded" %>
-<% else %>
-  <%= render "cards/comments/new", card: card %>
-<% end %>
diff --git a/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
deleted file mode 100644
index 82ab7f25e..000000000
--- a/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
+++ /dev/null
@@ -1,12 +0,0 @@
-<div class="comment-by-system comment-by-system--account-limit">
-  <div class="comment align-start full-width">
-    <div class="comment__content flex flex-column flex-item-grow full-width">
-      <div class="comment__body lexxy-content">
-        <div class="action-text-content">
-          <strong>This account has used all the included free storage (<%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %>).</strong>
-          <div><%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.</div>
-        </div>
-      </div>
-    </div>
-  </div>
-</div>
diff --git a/saas/app/views/cards/container/footer/saas/_create.html.erb b/saas/app/views/cards/container/footer/saas/_create.html.erb
deleted file mode 100644
index e5544e576..000000000
--- a/saas/app/views/cards/container/footer/saas/_create.html.erb
+++ /dev/null
@@ -1,5 +0,0 @@
-<% if Current.account.exceeding_storage_limit? %>
-  <%= render "cards/container/footer/saas/storage_limit_exceeded" %>
-<% else %>
-  <%= render "cards/container/footer/create", card: card %>
-<% end %>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
deleted file mode 100644
index ca0dc9be0..000000000
--- a/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
+++ /dev/null
@@ -1,8 +0,0 @@
-<div class="card-perma__notch card-perma__notch--bottom">
-  <div class="card-perma__account-limit-message">
-    <strong>This account has used all the included free storage (<%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %>).</strong>
-    <div>
-      <%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.
-    </div>
-  </div>
-</div>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
deleted file mode 100644
index 41bb987f0..000000000
--- a/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
+++ /dev/null
@@ -1,6 +0,0 @@
-<% if Current.account.nearing_storage_limit? %>
-  <div class="txt-small">
-    This account has used <strong><%= number_to_human_size(Current.account.bytes_used) %></strong> of <strong><%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %></strong> storage.
-    <div><%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", class: "txt-current txt-underline", target: "_blank" %> for unlimited storage.</div>
-  </div>
-<% end %>
diff --git a/saas/lib/fizzy/saas/engine.rb b/saas/lib/fizzy/saas/engine.rb
index 673be1147..dea321cfc 100644
--- a/saas/lib/fizzy/saas/engine.rb
+++ b/saas/lib/fizzy/saas/engine.rb
@@ -133,14 +133,10 @@ module Fizzy
       end
 
       config.to_prepare do
-        ::Account.include Account::StorageLimited
         ::Identity.include Authorization::Identity, Identity::Devices
         ::Session.include Session::Devices
         ::Signup.prepend Signup
         ApplicationController.include Authorization::Controller
-        CardsController.include(Card::StorageLimited::Creation)
-        Cards::CommentsController.include(Card::StorageLimited::Commenting)
-        Cards::PublishesController.include(Card::StorageLimited::Publishing)
 
         Notification.register_push_target(:native)
 
diff --git a/saas/test/controllers/card/storage_limited/commenting_test.rb b/saas/test/controllers/card/storage_limited/commenting_test.rb
deleted file mode 100644
index e32015130..000000000
--- a/saas/test/controllers/card/storage_limited/commenting_test.rb
+++ /dev/null
@@ -1,29 +0,0 @@
-require "test_helper"
-
-class Card::StorageLimited::CommentingTest < ActionDispatch::IntegrationTest
-  test "cannot create comments when storage limit exceeded" do
-    sign_in_as :david
-
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-
-    assert_no_difference -> { Comment.count } do
-      post card_comments_path(cards(:logo), script_name: accounts(:"37s").slug),
-        params: { comment: { body: "Blocked comment" } },
-        as: :turbo_stream
-    end
-
-    assert_response :forbidden
-  end
-
-  test "can create comments when under storage limit" do
-    sign_in_as :david
-
-    assert_difference -> { Comment.count } do
-      post card_comments_path(cards(:logo), script_name: accounts(:"37s").slug),
-        params: { comment: { body: "Allowed comment" } },
-        as: :turbo_stream
-    end
-
-    assert_response :success
-  end
-end
diff --git a/saas/test/controllers/card/storage_limited/creation_test.rb b/saas/test/controllers/card/storage_limited/creation_test.rb
deleted file mode 100644
index ab04774fe..000000000
--- a/saas/test/controllers/card/storage_limited/creation_test.rb
+++ /dev/null
@@ -1,47 +0,0 @@
-require "test_helper"
-
-class Card::StorageLimited::CreationTest < ActionDispatch::IntegrationTest
-  test "cannot create cards via JSON when storage limit exceeded" do
-    sign_in_as :mike
-
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-
-    assert_no_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug),
-        params: { card: { title: "Blocked card" } },
-        as: :json
-    end
-
-    assert_response :forbidden
-  end
-
-  test "can create cards via HTML when storage limit exceeded since they become drafts" do
-    sign_in_as :mike
-
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-    accounts(:initech).update_column(:cards_count, 100)
-    boards(:miltons_wish_list).cards.drafted.where(creator: users(:mike)).destroy_all
-
-    assert_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug)
-    end
-
-    assert_response :redirect
-    assert Card.last.drafted?
-  end
-
-  test "can create cards via JSON when under storage limit" do
-    sign_in_as :mike
-
-    Account.any_instance.stubs(:bytes_used).returns(500.megabytes)
-    accounts(:initech).update_column(:cards_count, 100)
-
-    assert_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug),
-        params: { card: { title: "Allowed card" } },
-        as: :json
-    end
-
-    assert_response :created
-  end
-end
diff --git a/saas/test/controllers/card/storage_limited/publishing_test.rb b/saas/test/controllers/card/storage_limited/publishing_test.rb
deleted file mode 100644
index 94e9b8e4f..000000000
--- a/saas/test/controllers/card/storage_limited/publishing_test.rb
+++ /dev/null
@@ -1,23 +0,0 @@
-require "test_helper"
-
-class Card::StorageLimited::PublishingTest < ActionDispatch::IntegrationTest
-  test "cannot publish cards when storage limit exceeded" do
-    sign_in_as :mike
-
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-
-    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :forbidden
-    assert cards(:unfinished_thoughts).reload.drafted?
-  end
-
-  test "can publish cards when under storage limit" do
-    sign_in_as :mike
-
-    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :redirect
-    assert cards(:unfinished_thoughts).reload.published?
-  end
-end
diff --git a/saas/test/controllers/card/storage_limited_test.rb b/saas/test/controllers/card/storage_limited_test.rb
deleted file mode 100644
index 69790c363..000000000
--- a/saas/test/controllers/card/storage_limited_test.rb
+++ /dev/null
@@ -1,27 +0,0 @@
-require "test_helper"
-
-class Card::StorageLimitedTest < ActionDispatch::IntegrationTest
-  test "draft card shows storage limit notice instead of create buttons when limit exceeded" do
-    sign_in_as :mike
-
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-
-    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_select ".card-perma__notch" do
-      assert_select "strong", text: /used all/
-      assert_select "a[href='https://github.com/basecamp/fizzy']", text: "Self-host Fizzy"
-    end
-    assert_select ".card-perma__notch-new-card-buttons", count: 0
-  end
-
-  test "draft card shows create buttons when under storage limit" do
-    sign_in_as :mike
-
-    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
-
-    assert_response :success
-    assert_select ".card-perma__notch-new-card-buttons"
-  end
-end
diff --git a/saas/test/controllers/comment/storage_limited_test.rb b/saas/test/controllers/comment/storage_limited_test.rb
deleted file mode 100644
index 4137971b1..000000000
--- a/saas/test/controllers/comment/storage_limited_test.rb
+++ /dev/null
@@ -1,25 +0,0 @@
-require "test_helper"
-
-class Comment::StorageLimitedTest < ActionDispatch::IntegrationTest
-  test "published card shows storage limit notice instead of comment form when limit exceeded" do
-    sign_in_as :david
-
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-
-    get card_path(cards(:logo), script_name: accounts(:"37s").slug)
-
-    assert_response :success
-    assert_select "strong", text: /used all/
-    assert_select "a[href='https://github.com/basecamp/fizzy']", text: "Self-host Fizzy"
-    assert_select "##{dom_id(cards(:logo), :new_comment)}", count: 0
-  end
-
-  test "published card shows comment form when under storage limit" do
-    sign_in_as :david
-
-    get card_path(cards(:logo), script_name: accounts(:"37s").slug)
-
-    assert_response :success
-    assert_select "##{dom_id(cards(:logo), :new_comment)}"
-  end
-end
diff --git a/saas/test/models/account/storage_limited_test.rb b/saas/test/models/account/storage_limited_test.rb
deleted file mode 100644
index f587d9ef1..000000000
--- a/saas/test/models/account/storage_limited_test.rb
+++ /dev/null
@@ -1,39 +0,0 @@
-require "test_helper"
-
-class Account::StorageLimitedTest < ActiveSupport::TestCase
-  test "exceeding storage limit when bytes used exceeds 1 GB" do
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-
-    assert accounts(:initech).exceeding_storage_limit?
-  end
-
-  test "not exceeding storage limit when bytes used equals 1 GB" do
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte)
-
-    assert_not accounts(:initech).exceeding_storage_limit?
-  end
-
-  test "not exceeding storage limit when under 1 GB" do
-    Account.any_instance.stubs(:bytes_used).returns(500.megabytes)
-
-    assert_not accounts(:initech).exceeding_storage_limit?
-  end
-
-  test "nearing storage limit when within 500 MB of the limit" do
-    Account.any_instance.stubs(:bytes_used).returns(600.megabytes)
-
-    assert accounts(:initech).nearing_storage_limit?
-  end
-
-  test "not nearing storage limit when well under the threshold" do
-    Account.any_instance.stubs(:bytes_used).returns(400.megabytes)
-
-    assert_not accounts(:initech).nearing_storage_limit?
-  end
-
-  test "not nearing storage limit when already exceeding it" do
-    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
-
-    assert_not accounts(:initech).nearing_storage_limit?
-  end
-end

From 7f65f4aabd87780eae371b8d88eccacd723722dd Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 14:43:05 -0400
Subject: [PATCH 077/107] Fix card view "M" hotkey using stale user from
 fragment cache

The hidden "Assign to me" button on the card detail view baked
Current.user.id into the form action at render time. When served from
fragment cache, a stale user ID could be embedded, assigning cards to
the wrong person.

Switch to card_self_assignment_path which resolves the current user at
request time via SelfAssignmentsController, matching the fix already
applied to the board view in 2527f073.

ref: https://app.fizzy.do/5986089/cards/3722
---
 app/views/cards/display/common/_assignees.html.erb | 4 ++--
 test/controllers/cards_controller_test.rb          | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/app/views/cards/display/common/_assignees.html.erb b/app/views/cards/display/common/_assignees.html.erb
index 73bddd901..75ebe4611 100644
--- a/app/views/cards/display/common/_assignees.html.erb
+++ b/app/views/cards/display/common/_assignees.html.erb
@@ -12,8 +12,8 @@
     </span>
   </button>
 
-  <% if Current.user && !local_assigns[:preview] %>
-    <%= button_to "Assign to me", card_assignments_path(card, params: { assignee_id: Current.user.id }), method: :post, data: {controller: "hotkey", action: "keydown.m@document->hotkey#click" }, hidden: true %>
+  <% unless local_assigns[:preview] %>
+    <%= button_to "Assign to me", card_self_assignment_path(card), method: :post, data: {controller: "hotkey", action: "keydown.m@document->hotkey#click" }, hidden: true %>
   <% end %>
 
   <dialog class="popup panel flex-column align-start gap-half fill-white shadow" data-dialog-target="dialog" data-action="turbo:before-morph-attribute->dialog#preventCloseOnMorphing turbo:submit-end->dialog#close">
diff --git a/test/controllers/cards_controller_test.rb b/test/controllers/cards_controller_test.rb
index 901a584f9..f582aa9c0 100644
--- a/test/controllers/cards_controller_test.rb
+++ b/test/controllers/cards_controller_test.rb
@@ -42,6 +42,15 @@ class CardsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to card_draft_path(card)
   end
 
+  test "show renders assign-to-me hotkey using self assignment path" do
+    card = cards(:logo)
+
+    get card_path(card)
+    assert_response :success
+
+    assert_select "form[action=?] button[hidden]", card_self_assignment_path(card), text: "Assign to me"
+  end
+
   test "show renders inline code in title" do
     card = cards(:logo)
     card.update_column :title, "Fix the `bug` in production"

From 463f28907267797427a544ac0c88a017d348b6da Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Mon, 2 Mar 2026 10:55:32 -0500
Subject: [PATCH 078/107] ci: pin github actions

using `pinact`
---
 .github/workflows/ci-checks.yml               | 12 +++++------
 .../dependabot-sync-saas-lockfile.yml         |  4 ++--
 .github/workflows/publish-image.yml           | 20 +++++++++----------
 .github/workflows/test.yml                    |  4 ++--
 4 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index 773674233..68853faf1 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -12,8 +12,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -26,8 +26,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -47,8 +47,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
diff --git a/.github/workflows/dependabot-sync-saas-lockfile.yml b/.github/workflows/dependabot-sync-saas-lockfile.yml
index 5afe97244..92313608a 100644
--- a/.github/workflows/dependabot-sync-saas-lockfile.yml
+++ b/.github/workflows/dependabot-sync-saas-lockfile.yml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
 
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 9d80d143d..6767a5400 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -42,13 +42,13 @@ jobs:
       IMAGE_NAME: ${{ github.repository }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.12.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3.7.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -65,7 +65,7 @@ jobs:
 
       - name: Extract Docker metadata (tags, labels) with arch suffix
         id: meta
-        uses: docker/metadata-action@v5.10.0
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ steps.vars.outputs.canonical }}
           tags: |
@@ -83,7 +83,7 @@ jobs:
 
       - name: Build and push (${{ matrix.platform }})
         id: build
-        uses: docker/build-push-action@v6.19.2
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: Dockerfile
@@ -101,7 +101,7 @@ jobs:
 
       - name: Attest image provenance (per-arch)
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v4.1.0
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-name: ${{ steps.vars.outputs.canonical }}
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -118,10 +118,10 @@ jobs:
       IMAGE_NAME: ${{ github.repository }}
     steps:
       - name: Set up Docker Buildx (for imagetools)
-        uses: docker/setup-buildx-action@v3.12.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3.7.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -138,7 +138,7 @@ jobs:
 
       - name: Compute base tags (no suffix)
         id: meta
-        uses: docker/metadata-action@v5.10.0
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ steps.vars.outputs.canonical }}
           tags: |
@@ -184,7 +184,7 @@ jobs:
           done <<< "$tags"
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.0.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Cosign sign all tags (keyless OIDC)
         shell: bash
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 777471774..274bb48ee 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -56,9 +56,9 @@ jobs:
       - name: Install system packages
         run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true

From 99e683125b18362e81cd3d9ccbd931cc94584bde Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:39:14 -0400
Subject: [PATCH 079/107] ci: batch github actions dependabot updates into a
 single PR

---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1efb99ec1..98fbe1973 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,6 +25,10 @@ updates:
       semver-major-days: 14
   - package-ecosystem: github-actions
     directory: "/"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
     schedule:
       interval: weekly
     open-pull-requests-limit: 10

From b6e00b77e3104fe900aa82e77d81b59e27c067e4 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:24:39 -0400
Subject: [PATCH 080/107] ci: scope permissions to jobs in publish-image
 workflow

---
 .github/workflows/publish-image.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 6767a5400..2b91f564b 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -12,12 +12,6 @@ concurrency:
   group: publish-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-  attestations: write
-
 env:
   IMAGE_DESCRIPTION: Fizzy is Kanban as it should be. Not as it has been.
   SOURCE_URL: https://github.com/${{ github.repository }}
@@ -27,6 +21,11 @@ jobs:
     name: Build and push image (${{ matrix.arch }})
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     strategy:
       fail-fast: false
       matrix:
@@ -113,6 +112,9 @@ jobs:
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      packages: write
+      id-token: write
     env:
       REGISTRY: ghcr.io
       IMAGE_NAME: ${{ github.repository }}

From 310e271908a90ed336e3178434b6833448a5a5b9 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:25:16 -0400
Subject: [PATCH 081/107] ci: suppress zizmor secrets-outside-env in test
 workflow

---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 274bb48ee..bd3cd4a19 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -50,7 +50,7 @@ jobs:
       MYSQL_USER: root
       FIZZY_DB_HOST: 127.0.0.1
       FIZZY_DB_PORT: 3306
-      BUNDLE_GITHUB__COM: ${{ inputs.saas && format('x-access-token:{0}', secrets.FIZZY_GH_TOKEN) || '' }}
+      BUNDLE_GITHUB__COM: ${{ inputs.saas && format('x-access-token:{0}', secrets.FIZZY_GH_TOKEN) || '' }} # zizmor: ignore[secrets-outside-env]
 
     steps:
       - name: Install system packages

From bc6703b0df142cdf514cb962b475a59bf5a27f50 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:31:08 -0400
Subject: [PATCH 082/107] ci: disable credential persistence after checkout

suppress artipacked warning in dependabot lockfile sync workflow
---
 .github/workflows/ci-checks.yml                     | 6 ++++++
 .github/workflows/dependabot-sync-saas-lockfile.yml | 2 +-
 .github/workflows/publish-image.yml                 | 2 ++
 .github/workflows/test.yml                          | 2 ++
 4 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index 68853faf1..d77d763df 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -13,6 +13,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
@@ -27,6 +29,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
@@ -48,6 +52,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
           ruby-version: .ruby-version
diff --git a/.github/workflows/dependabot-sync-saas-lockfile.yml b/.github/workflows/dependabot-sync-saas-lockfile.yml
index 92313608a..e6430d53c 100644
--- a/.github/workflows/dependabot-sync-saas-lockfile.yml
+++ b/.github/workflows/dependabot-sync-saas-lockfile.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] -- credentials needed for git push
 
       - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 2b91f564b..255ea2c27 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -42,6 +42,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bd3cd4a19..c88b15292 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -57,6 +57,8 @@ jobs:
         run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
         with:

From dd7f7005b2f3b32d9bee824c149251b180c66d20 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:35:38 -0400
Subject: [PATCH 083/107] ci: fix template injection by passing tags through
 env vars

---
 .github/workflows/publish-image.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 255ea2c27..a2c67a1e9 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -160,9 +160,11 @@ jobs:
 
       - name: Create multi-arch manifests
         shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
           echo "Creating manifests for tags:"
           printf '%s\n' "$tags"
           while IFS= read -r tag; do
@@ -192,9 +194,11 @@ jobs:
 
       - name: Cosign sign all tags (keyless OIDC)
         shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
           printf '%s\n' "$tags"
           while IFS= read -r tag; do
             [ -z "$tag" ] && continue

From 58f94b0cc1c7bcbd9fc50e40f1d3d212028c3b95 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:37:41 -0400
Subject: [PATCH 084/107] ci: add job to lint github actions

using zizmor
---
 .github/workflows/ci-checks.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index d77d763df..220b1763b 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -45,7 +45,6 @@ jobs:
       - name: Brakeman audit
         run: bin/brakeman --quiet --no-pager --exit-on-warn --exit-on-error
 
-
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -61,3 +60,17 @@ jobs:
 
       - name: Lint code for consistent style
         run: bin/rubocop
+
+  zizmor:
+    name: GitHub Actions audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        with:
+          advanced-security: false

From fa12aca3876827985f776cc75eed34ec7e97f9b3 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:56:36 -0400
Subject: [PATCH 085/107] ci: update pinned github versions (minor bump)

---
 .github/workflows/ci-checks.yml                     | 6 +++---
 .github/workflows/dependabot-sync-saas-lockfile.yml | 2 +-
 .github/workflows/publish-image.yml                 | 2 +-
 .github/workflows/test.yml                          | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index 220b1763b..c410061c9 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+      - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+      - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+      - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
diff --git a/.github/workflows/dependabot-sync-saas-lockfile.yml b/.github/workflows/dependabot-sync-saas-lockfile.yml
index e6430d53c..4191cd684 100644
--- a/.github/workflows/dependabot-sync-saas-lockfile.yml
+++ b/.github/workflows/dependabot-sync-saas-lockfile.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] -- credentials needed for git push
 
-      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+      - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
           ruby-version: .ruby-version
 
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index a2c67a1e9..ee234bfb6 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -190,7 +190,7 @@ jobs:
           done <<< "$tags"
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Cosign sign all tags (keyless OIDC)
         shell: bash
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c88b15292..e09deacfb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -60,7 +60,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+      - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true

From e518d638f26a19b69198e9f4e6c1ac6cca3c29fd Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 18:27:45 -0400
Subject: [PATCH 086/107] ci: suppress dependabot-execution warning in
 dependabot config

---
 .github/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 98fbe1973..e6ce4f9b0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,7 +12,7 @@ updates:
     registries:
       - github-basecamp
     directory: "/"
-    insecure-external-code-execution: allow
+    insecure-external-code-execution: allow # zizmor: ignore[dependabot-execution] -- required for Bundler to resolve gems from the private github-basecamp registry
     open-pull-requests-limit: 10
     vendor: false
     groups:

From 66c22f4636930a8a19b6319911200863b9cd0bbf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 18 Mar 2026 01:45:09 +0000
Subject: [PATCH 087/107] Bump the github-actions group with 4 updates

Bumps the github-actions group with 4 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/login-action](https://github.com/docker/login-action), [docker/metadata-action](https://github.com/docker/metadata-action) and [docker/build-push-action](https://github.com/docker/build-push-action).


Updates `docker/setup-buildx-action` from 3.12.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd)

Updates `docker/login-action` from 3.7.0 to 4.0.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2)

Updates `docker/metadata-action` from 5.10.0 to 6.0.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/c299e40c65443455700f0fdfc63efafe5b349051...030e881283bb7a6894de51c315a6bfe6a94e05cf)

Updates `docker/build-push-action` from 6.19.2 to 7.0.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/10e90e3645eae34f1e60eeb005ba3a3d33f178e8...d08e5c354a6adb9ed34480a06d141179aa583294)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/publish-image.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index ee234bfb6..dfbb70246 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -46,10 +46,10 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -66,7 +66,7 @@ jobs:
 
       - name: Extract Docker metadata (tags, labels) with arch suffix
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ steps.vars.outputs.canonical }}
           tags: |
@@ -84,7 +84,7 @@ jobs:
 
       - name: Build and push (${{ matrix.platform }})
         id: build
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           context: .
           file: Dockerfile
@@ -122,10 +122,10 @@ jobs:
       IMAGE_NAME: ${{ github.repository }}
     steps:
       - name: Set up Docker Buildx (for imagetools)
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -142,7 +142,7 @@ jobs:
 
       - name: Compute base tags (no suffix)
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ steps.vars.outputs.canonical }}
           tags: |

From c62be7afde3d2d0a1a6d1061d8471cbff64391be Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 21:59:09 -0400
Subject: [PATCH 088/107] dep: update sqlite3 to 2.9.2

---
 Gemfile.lock      | 16 ++++++++--------
 Gemfile.saas.lock | 16 ++++++++--------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index e27a0140f..fa90e7c24 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -436,14 +436,14 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
-    sqlite3 (2.9.0-aarch64-linux-gnu)
-    sqlite3 (2.9.0-aarch64-linux-musl)
-    sqlite3 (2.9.0-arm-linux-gnu)
-    sqlite3 (2.9.0-arm-linux-musl)
-    sqlite3 (2.9.0-arm64-darwin)
-    sqlite3 (2.9.0-x86_64-darwin)
-    sqlite3 (2.9.0-x86_64-linux-gnu)
-    sqlite3 (2.9.0-x86_64-linux-musl)
+    sqlite3 (2.9.2-aarch64-linux-gnu)
+    sqlite3 (2.9.2-aarch64-linux-musl)
+    sqlite3 (2.9.2-arm-linux-gnu)
+    sqlite3 (2.9.2-arm-linux-musl)
+    sqlite3 (2.9.2-arm64-darwin)
+    sqlite3 (2.9.2-x86_64-darwin)
+    sqlite3 (2.9.2-x86_64-linux-gnu)
+    sqlite3 (2.9.2-x86_64-linux-musl)
     sshkit (1.25.0)
       base64
       logger
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 27c5d8b1a..5e35a2360 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -607,14 +607,14 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
-    sqlite3 (2.9.0-aarch64-linux-gnu)
-    sqlite3 (2.9.0-aarch64-linux-musl)
-    sqlite3 (2.9.0-arm-linux-gnu)
-    sqlite3 (2.9.0-arm-linux-musl)
-    sqlite3 (2.9.0-arm64-darwin)
-    sqlite3 (2.9.0-x86_64-darwin)
-    sqlite3 (2.9.0-x86_64-linux-gnu)
-    sqlite3 (2.9.0-x86_64-linux-musl)
+    sqlite3 (2.9.2-aarch64-linux-gnu)
+    sqlite3 (2.9.2-aarch64-linux-musl)
+    sqlite3 (2.9.2-arm-linux-gnu)
+    sqlite3 (2.9.2-arm-linux-musl)
+    sqlite3 (2.9.2-arm64-darwin)
+    sqlite3 (2.9.2-x86_64-darwin)
+    sqlite3 (2.9.2-x86_64-linux-gnu)
+    sqlite3 (2.9.2-x86_64-linux-musl)
     sshkit (1.25.0)
       base64
       logger

From 06735bb991f01bc9ab579dd1fcbd3255611d7da4 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 22:09:48 -0400
Subject: [PATCH 089/107] dep: fix Gemfile.saas gemfile drift

---
 Gemfile.saas.lock | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 6d71bfb2b..cf0de1423 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -237,7 +237,7 @@ GEM
       aws-sdk-core (~> 3, >= 3.241.4)
       aws-sigv4 (~> 1.5)
     aws-sdk-s3 (1.215.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+      aws-sdk-core (~> 3, >= 3.243.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
@@ -628,10 +628,10 @@ GEM
     stringio (3.2.0)
     thor (1.5.0)
     thruster (0.1.19)
-    thruster (0.1.18-aarch64-linux)
-    thruster (0.1.18-arm64-darwin)
-    thruster (0.1.18-x86_64-darwin)
-    thruster (0.1.18-x86_64-linux)
+    thruster (0.1.19-aarch64-linux)
+    thruster (0.1.19-arm64-darwin)
+    thruster (0.1.19-x86_64-darwin)
+    thruster (0.1.19-x86_64-linux)
     timeout (0.6.0)
     trilogy (2.10.0)
       bigdecimal

From ba6fc495da7d807fe9bffb299bf81376b2e427c0 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 22:29:47 -0400
Subject: [PATCH 090/107] ci: fix `bin/bundle-drift forward` to support native
 gems (#2723)

See #2704 where only the ruby platform gem for thruster was replaced.
---
 bin/bundle-drift | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bin/bundle-drift b/bin/bundle-drift
index b208d0c9c..08ea3713d 100755
--- a/bin/bundle-drift
+++ b/bin/bundle-drift
@@ -130,10 +130,10 @@ class GemfileDriftForwarder
     patched_content = original_content.dup
 
     drift.each do |d|
-      old_entry = "#{d[:name]} (#{d[:saas]})"
-      new_entry = "#{d[:name]} (#{d[:oss]})"
-      puts "  #{old_entry} → #{new_entry}"
-      patched_content.gsub!(old_entry, new_entry)
+      puts "  #{d[:name]} (#{d[:saas]}) → #{d[:name]} (#{d[:oss]})"
+      patched_content.gsub!(/#{Regexp.escape(d[:name])} \(#{Regexp.escape(d[:saas])}([^)]*)\)/) do
+        "#{d[:name]} (#{d[:oss]}#{$1})"
+      end
     end
 
     File.write(GEMFILE_SAAS_LOCK, patched_content)

From 4bb0a2929ccd99feacc1716a27b280e62e892615 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Wed, 4 Feb 2026 12:39:50 +0100
Subject: [PATCH 091/107] Implement WebAuthn protocol

- Add a CBOR decoder
- Add public key credential options
- Add COSE key decoder
- Add authenticator attestation and assertion
- Add credentials
- Add exclude_credentials
---
 lib/action_pack/web_authn.rb                  |   7 +
 .../authenticator/assertion_response.rb       |  80 +++++
 .../web_authn/authenticator/attestation.rb    |  58 ++++
 .../authenticator/attestation_response.rb     |  58 ++++
 .../web_authn/authenticator/data.rb           | 142 +++++++++
 .../web_authn/authenticator/response.rb       | 117 +++++++
 lib/action_pack/web_authn/cbor_decoder.rb     | 262 +++++++++++++++
 lib/action_pack/web_authn/cose_key.rb         | 141 +++++++++
 lib/action_pack/web_authn/current.rb          |   3 +
 .../web_authn/public_key_credential.rb        |  41 +++
 .../public_key_credential/creation_options.rb | 115 +++++++
 .../public_key_credential/options.rb          |  27 ++
 .../public_key_credential/request_options.rb  |  61 ++++
 lib/action_pack/web_authn/relying_party.rb    |  50 +++
 .../authenticator/assertion_response_test.rb  | 158 ++++++++++
 .../attestation_response_test.rb              | 195 ++++++++++++
 .../authenticator/attestation_test.rb         | 135 ++++++++
 .../web_authn/authenticator/data_test.rb      | 174 ++++++++++
 .../web_authn/authenticator/response_test.rb  | 141 +++++++++
 .../web_authn/cbor_decoder_test.rb            | 297 ++++++++++++++++++
 .../action_pack/web_authn/cose_key_test.rb    | 161 ++++++++++
 .../creation_options_test.rb                  | 101 ++++++
 .../request_options_test.rb                   |  72 +++++
 .../web_authn/relying_party_test.rb           |  30 ++
 24 files changed, 2626 insertions(+)
 create mode 100644 lib/action_pack/web_authn.rb
 create mode 100644 lib/action_pack/web_authn/authenticator/assertion_response.rb
 create mode 100644 lib/action_pack/web_authn/authenticator/attestation.rb
 create mode 100644 lib/action_pack/web_authn/authenticator/attestation_response.rb
 create mode 100644 lib/action_pack/web_authn/authenticator/data.rb
 create mode 100644 lib/action_pack/web_authn/authenticator/response.rb
 create mode 100644 lib/action_pack/web_authn/cbor_decoder.rb
 create mode 100644 lib/action_pack/web_authn/cose_key.rb
 create mode 100644 lib/action_pack/web_authn/current.rb
 create mode 100644 lib/action_pack/web_authn/public_key_credential.rb
 create mode 100644 lib/action_pack/web_authn/public_key_credential/creation_options.rb
 create mode 100644 lib/action_pack/web_authn/public_key_credential/options.rb
 create mode 100644 lib/action_pack/web_authn/public_key_credential/request_options.rb
 create mode 100644 lib/action_pack/web_authn/relying_party.rb
 create mode 100644 test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb
 create mode 100644 test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
 create mode 100644 test/lib/action_pack/web_authn/authenticator/attestation_test.rb
 create mode 100644 test/lib/action_pack/web_authn/authenticator/data_test.rb
 create mode 100644 test/lib/action_pack/web_authn/authenticator/response_test.rb
 create mode 100644 test/lib/action_pack/web_authn/cbor_decoder_test.rb
 create mode 100644 test/lib/action_pack/web_authn/cose_key_test.rb
 create mode 100644 test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
 create mode 100644 test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
 create mode 100644 test/lib/action_pack/web_authn/relying_party_test.rb

diff --git a/lib/action_pack/web_authn.rb b/lib/action_pack/web_authn.rb
new file mode 100644
index 000000000..8ee72e6cb
--- /dev/null
+++ b/lib/action_pack/web_authn.rb
@@ -0,0 +1,7 @@
+module ActionPack::WebAuthn
+  class << self
+    def relying_party
+      RelyingParty.new
+    end
+  end
+end
diff --git a/lib/action_pack/web_authn/authenticator/assertion_response.rb b/lib/action_pack/web_authn/authenticator/assertion_response.rb
new file mode 100644
index 000000000..fa6aafcfd
--- /dev/null
+++ b/lib/action_pack/web_authn/authenticator/assertion_response.rb
@@ -0,0 +1,80 @@
+# = Action Pack WebAuthn Assertion Response
+#
+# Handles the authenticator response from a WebAuthn authentication ceremony.
+# When a user authenticates with an existing credential, the authenticator
+# returns an assertion response containing a signature that proves possession
+# of the private key.
+#
+# == Usage
+#
+#   # Look up the credential by ID
+#   credential = user.credentials.find_by!(
+#     credentail_id: params[:id]
+#   )
+#
+#   response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+#     client_data_json: params[:response][:clientDataJSON],
+#     authenticator_data: params[:response][:authenticatorData],
+#     signature: params[:response][:signature],
+#     credential: credential.to_public_key_credential
+#   )
+#
+#   response.validate!(
+#     challenge: session[:authentication_challenge],
+#     origin: "https://example.com"
+#   )
+#
+# == Validation
+#
+# In addition to the base Response validations, this class verifies:
+#
+# * The client data type is "webauthn.get"
+# * The signature is valid for the credential's public key
+#
+class ActionPack::WebAuthn::Authenticator::AssertionResponse < ActionPack::WebAuthn::Authenticator::Response
+  attr_reader :credential, :authenticator_data, :signature
+
+  def initialize(credential:, authenticator_data:, signature:, **attributes)
+    super(**attributes)
+    @credential = credential
+    @signature = signature
+    @authenticator_data = ActionPack::WebAuthn::Authenticator::Data.wrap(authenticator_data)
+  end
+
+  def validate!(**args)
+    super(**args)
+
+    unless client_data["type"] == "webauthn.get"
+      raise InvalidResponseError, "Client data type is not webauthn.get"
+    end
+
+    unless valid_signature?
+      raise InvalidResponseError, "Invalid signature"
+    end
+
+    unless sign_count_increased?
+      raise InvalidResponseError, "Sign count did not increase"
+    end
+  end
+
+  private
+    def valid_signature?
+      client_data_hash = Digest::SHA256.digest(client_data_json)
+      signed_data = authenticator_data.bytes.pack("C*") + client_data_hash
+
+      credential.public_key.verify("SHA256", signature, signed_data)
+    rescue OpenSSL::PKey::PKeyError
+      false
+    end
+
+    def sign_count_increased?
+      if authenticator_data.sign_count.zero? && credential.sign_count.zero?
+        # Some authenticators always return 0 for the sign count, even after multiple authentications.
+        # In that case, we have to check that both the stored and returned sign counts are 0,
+        # which indicates that the authenticator is likely not updating the sign count.
+        true
+      else
+        authenticator_data.sign_count > credential.sign_count
+      end
+    end
+end
diff --git a/lib/action_pack/web_authn/authenticator/attestation.rb b/lib/action_pack/web_authn/authenticator/attestation.rb
new file mode 100644
index 000000000..66714fd6c
--- /dev/null
+++ b/lib/action_pack/web_authn/authenticator/attestation.rb
@@ -0,0 +1,58 @@
+# = Action Pack WebAuthn Attestation
+#
+# Decodes and represents the attestation object returned by an authenticator
+# during registration. The attestation object is CBOR-encoded and contains
+# the authenticator data along with an optional attestation statement.
+#
+# == Usage
+#
+#   attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(
+#     attestation_object_bytes
+#   )
+#
+#   attestation.credential_id  # => "abc123..."
+#   attestation.public_key     # => OpenSSL::PKey::EC
+#   attestation.sign_count     # => 0
+#
+# == Attributes
+#
+# [+authenticator_data+]
+#   The parsed Data containing credential information.
+#
+# [+format+]
+#   The attestation statement format (e.g., "none", "packed", "fido-u2f").
+#
+# [+attestation_statement+]
+#   The attestation statement, which may contain a signature from the
+#   authenticator manufacturer. Empty for "none" format.
+#
+# == Delegated Methods
+#
+# The following methods are delegated to +authenticator_data+:
+#
+# * +credential_id+ - Base64URL-encoded credential identifier
+# * +public_key+ - OpenSSL public key object
+# * +public_key_bytes+ - Raw COSE key bytes
+# * +sign_count+ - Signature counter for replay detection
+#
+class ActionPack::WebAuthn::Authenticator::Attestation
+  attr_reader :authenticator_data, :format, :attestation_statement
+
+  delegate :credential_id, :public_key, :public_key_bytes, :sign_count, to: :authenticator_data
+
+  def self.decode(bytes)
+    cbor = ActionPack::WebAuthn::CborDecoder.decode(bytes)
+
+    new(
+      authenticator_data: ActionPack::WebAuthn::Authenticator::Data.decode(cbor["authData"]),
+      format: cbor["fmt"],
+      attestation_statement: cbor["attStmt"]
+    )
+  end
+
+  def initialize(authenticator_data:, format:, attestation_statement:)
+    @authenticator_data = authenticator_data
+    @format = format
+    @attestation_statement = attestation_statement
+  end
+end
diff --git a/lib/action_pack/web_authn/authenticator/attestation_response.rb b/lib/action_pack/web_authn/authenticator/attestation_response.rb
new file mode 100644
index 000000000..e20b4d7f7
--- /dev/null
+++ b/lib/action_pack/web_authn/authenticator/attestation_response.rb
@@ -0,0 +1,58 @@
+# = Action Pack WebAuthn Attestation Response
+#
+# Handles the authenticator response from a WebAuthn registration ceremony.
+# When a user registers a new credential, the authenticator returns an
+# attestation response containing the new public key and credential ID.
+#
+# == Usage
+#
+#   response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+#     client_data_json: params[:response][:clientDataJSON],
+#     attestation_object: params[:response][:attestationObject]
+#   )
+#
+#   response.validate!(
+#     challenge: session[:registration_challenge],
+#     origin: "https://example.com"
+#   )
+#
+#   # Store the credential
+#   credential_id = response.attestation.credential_id
+#   public_key = response.attestation.public_key
+#
+# == Validation
+#
+# In addition to the base Response validations, this class verifies:
+#
+# * The client data type is "webauthn.create"
+# * The attestation format is "none" (other formats require certificate verification)
+#
+class ActionPack::WebAuthn::Authenticator::AttestationResponse < ActionPack::WebAuthn::Authenticator::Response
+  SUPPORTED_ATTESTATION_FORMATS = %w[ none ].freeze
+  attr_reader :attestation_object
+
+  def initialize(attestation_object:, **attributes)
+    super(**attributes)
+    @attestation_object = attestation_object
+  end
+
+  def validate!(**args)
+    super(**args)
+
+    unless client_data["type"] == "webauthn.create"
+      raise InvalidResponseError, "Client data type is not webauthn.create"
+    end
+
+    unless SUPPORTED_ATTESTATION_FORMATS.include?(attestation.format)
+      raise InvalidResponseError, "Unsupported attestation format: #{attestation.format}"
+    end
+  end
+
+  def attestation
+    @attestation ||= ActionPack::WebAuthn::Authenticator::Attestation.decode(attestation_object)
+  end
+
+  def authenticator_data
+    attestation.authenticator_data
+  end
+end
diff --git a/lib/action_pack/web_authn/authenticator/data.rb b/lib/action_pack/web_authn/authenticator/data.rb
new file mode 100644
index 000000000..a088179ef
--- /dev/null
+++ b/lib/action_pack/web_authn/authenticator/data.rb
@@ -0,0 +1,142 @@
+# = Action Pack WebAuthn Authenticator Data
+#
+# Decodes and represents the authenticator data structure from WebAuthn
+# responses. This binary format contains information about the authenticator
+# and, during registration, the newly created credential.
+#
+# == Structure
+#
+# The authenticator data consists of:
+#
+# * RP ID Hash (32 bytes) - SHA-256 hash of the relying party ID
+# * Flags (1 byte) - Bit flags for user presence, verification, etc.
+# * Sign Count (4 bytes) - Signature counter for replay detection
+# * Attested Credential Data (variable) - Present only during registration
+#
+# == Usage
+#
+#   data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
+#
+#   data.user_present?   # => true
+#   data.user_verified?  # => true
+#   data.sign_count      # => 42
+#   data.credential_id   # => "abc123..." (registration only)
+#   data.public_key      # => OpenSSL::PKey::EC (registration only)
+#
+# == Flags
+#
+# [+user_present?+]
+#   Returns true if the user performed a test of user presence (e.g., touched
+#   the authenticator).
+#
+# [+user_verified?+]
+#   Returns true if the user was verified through biometrics, PIN, or other
+#   method. This is stronger than mere presence.
+#
+# [+backup_eligible?+]
+#   Returns true if the credential can be backed up (e.g., synced passkeys
+#   from Apple, Google, or Microsoft). Indicates multi-device credential support.
+#
+# [+backed_up?+]
+#   Returns true if the credential is currently backed up to cloud storage.
+#   Useful for risk assessment—backed-up credentials may be accessible from
+#   multiple devices.
+#
+class ActionPack::WebAuthn::Authenticator::Data
+  # Segment lengths
+  RELYING_PARTY_ID_HASH_LENGTH = 32
+  FLAGS_LENGTH = 1
+  SIGN_COUNT_LENGTH = 4
+  AAGUID_LENGTH = 16
+  CREDENTIAL_ID_LENGTH_BYTES = 2
+
+  # Flags
+  USER_PRESENT_FLAG = 0x01
+  USER_VERIFIED_FLAG = 0x04
+  BACKUP_ELIGIBLE_FLAG = 0x08
+  BACKUP_STATE_FLAG = 0x10
+  ATTESTED_CREDENTIAL_DATA_FLAG = 0x40
+
+  attr_reader :bytes, :relying_party_id_hash, :flags, :sign_count, :credential_id, :public_key_bytes
+
+  class << self
+    def wrap(data)
+      if data.is_a?(self)
+        data
+      else
+        decode(data)
+      end
+    end
+
+    def decode(bytes)
+      bytes = bytes.bytes if bytes.is_a?(String)
+      position = 0
+
+      relying_party_id_hash = bytes[position, RELYING_PARTY_ID_HASH_LENGTH].pack("C*")
+      position += RELYING_PARTY_ID_HASH_LENGTH
+
+      flags = bytes[position]
+      position += FLAGS_LENGTH
+
+      sign_count = bytes[position, SIGN_COUNT_LENGTH].pack("C*").unpack1("N")
+      position += SIGN_COUNT_LENGTH
+
+      credential_id = nil
+      public_key_bytes = nil
+
+      if flags & ATTESTED_CREDENTIAL_DATA_FLAG != 0
+        position += AAGUID_LENGTH
+
+        credential_id_length = bytes[position, CREDENTIAL_ID_LENGTH_BYTES].pack("C*").unpack1("n")
+        position += CREDENTIAL_ID_LENGTH_BYTES
+
+        credential_id = Base64.urlsafe_encode64(bytes[position, credential_id_length].pack("C*"), padding: false)
+        position += credential_id_length
+
+        public_key_bytes = bytes[position..].pack("C*")
+      end
+
+      new(
+        bytes: bytes,
+        relying_party_id_hash: relying_party_id_hash,
+        flags: flags,
+        sign_count: sign_count,
+        credential_id: credential_id,
+        public_key_bytes: public_key_bytes
+      )
+    end
+  end
+
+  def initialize(bytes:, relying_party_id_hash:, flags:, sign_count:, credential_id:, public_key_bytes:)
+    @bytes = bytes
+    @relying_party_id_hash = relying_party_id_hash
+    @flags = flags
+    @sign_count = sign_count
+    @credential_id = credential_id
+    @public_key_bytes = public_key_bytes
+  end
+
+  def user_present?
+    flags & USER_PRESENT_FLAG != 0
+  end
+
+  def user_verified?
+    flags & USER_VERIFIED_FLAG != 0
+  end
+
+  # Returns true if the credential is eligible for backup (e.g., synced passkey).
+  # This indicates the authenticator supports multi-device credentials.
+  def backup_eligible?
+    flags & BACKUP_ELIGIBLE_FLAG != 0
+  end
+
+  # Returns true if the credential is currently backed up to cloud storage.
+  # Only meaningful when +backup_eligible?+ is true.
+  def backed_up?
+    flags & BACKUP_STATE_FLAG != 0
+  end
+
+  def public_key
+    @public_key ||= ActionPack::WebAuthn::CoseKey.decode(public_key_bytes).to_openssl_key if public_key_bytes
+  end
+end
diff --git a/lib/action_pack/web_authn/authenticator/response.rb b/lib/action_pack/web_authn/authenticator/response.rb
new file mode 100644
index 000000000..cdedc8411
--- /dev/null
+++ b/lib/action_pack/web_authn/authenticator/response.rb
@@ -0,0 +1,117 @@
+# = Action Pack WebAuthn Authenticator Response
+#
+# Abstract base class for WebAuthn authenticator responses. Provides common
+# validation logic for both registration (attestation) and authentication
+# (assertion) ceremonies.
+#
+# This class should not be instantiated directly. Use AttestationResponse for
+# registration or AssertionResponse for authentication.
+#
+# == Validation
+#
+# The +validate!+ method performs security checks required by the WebAuthn
+# specification:
+#
+# * Challenge verification - ensures the response matches the server-generated challenge
+# * Origin verification - ensures the response comes from the expected origin
+# * User verification - optionally requires biometric or PIN verification
+#
+# == Example
+#
+#   response.validate!(
+#     challenge: session[:webauthn_challenge],
+#     origin: "https://example.com",
+#     user_verification: :required
+#   )
+#
+class ActionPack::WebAuthn::Authenticator::Response
+  # Raised when response validation fails.
+  class InvalidResponseError < StandardError; end
+
+  attr_reader :client_data_json
+
+  def initialize(client_data_json:)
+    @client_data_json = client_data_json
+  end
+
+  def valid?(**args)
+    validate!(**args)
+    true
+  rescue InvalidResponseError
+    false
+  end
+
+  def validate!(challenge:, origin:, user_verification: :preferred)
+    unless challenge_matches?(challenge)
+      raise InvalidResponseError, "Challenge does not match"
+    end
+
+    unless origin_matches?(origin)
+      raise InvalidResponseError, "Origin does not match"
+    end
+
+    if cross_origin?
+      raise InvalidResponseError, "Cross-origin requests are not supported"
+    end
+
+    if token_binding_present?
+      raise InvalidResponseError, "Token binding is not supported"
+    end
+
+    unless relying_party_id_matches?
+      raise InvalidResponseError, "Relying party ID does not match"
+    end
+
+    unless user_present?
+      raise InvalidResponseError, "User presence is required"
+    end
+
+    if user_verification == :required && !user_verified?
+      raise InvalidResponseError, "User verification is required"
+    end
+  end
+
+  def relying_party
+    ActionPack::WebAuthn.relying_party
+  end
+
+  def client_data
+    @client_data ||= JSON.parse(client_data_json)
+  end
+
+  def authenticator_data
+    nil
+  end
+
+  private
+    def challenge_matches?(expected_challenge)
+      ActiveSupport::SecurityUtils.secure_compare(expected_challenge, client_data["challenge"])
+    end
+
+    def origin_matches?(expected_origin)
+      ActiveSupport::SecurityUtils.secure_compare(expected_origin, client_data["origin"])
+    end
+
+    def relying_party_id_matches?
+      ActiveSupport::SecurityUtils.secure_compare(
+        Digest::SHA256.digest(relying_party.id),
+        authenticator_data&.relying_party_id_hash || ""
+      )
+    end
+
+    def cross_origin?
+      client_data["crossOrigin"] == true
+    end
+
+    def token_binding_present?
+      client_data.dig("tokenBinding", "status") == "present"
+    end
+
+    def user_present?
+      authenticator_data&.user_present?
+    end
+
+    def user_verified?
+      authenticator_data&.user_verified?
+    end
+end
diff --git a/lib/action_pack/web_authn/cbor_decoder.rb b/lib/action_pack/web_authn/cbor_decoder.rb
new file mode 100644
index 000000000..af8e284f7
--- /dev/null
+++ b/lib/action_pack/web_authn/cbor_decoder.rb
@@ -0,0 +1,262 @@
+# = Action Pack WebAuthn CBOR Decoder
+#
+# Decodes Concise Binary Object Representation (CBOR) data as specified in
+# RFC 8949[https://tools.ietf.org/html/rfc8949]. CBOR is a binary data format
+# used by WebAuthn for encoding authenticator data and attestation objects.
+#
+# == Usage
+#
+# The decoder accepts either a binary string or an array of bytes:
+#
+#   # From binary string
+#   ActionPack::WebAuthn::CborDecoder.decode("\x83\x01\x02\x03")
+#   # => [1, 2, 3]
+#
+#   # From byte array
+#   ActionPack::WebAuthn::CborDecoder.decode([0x83, 0x01, 0x02, 0x03])
+#   # => [1, 2, 3]
+#
+# == Supported Types
+#
+# The decoder supports the following CBOR types:
+#
+# [Integers]
+#   Unsigned (major type 0) and negative (major type 1) integers of any size.
+#
+# [Byte strings]
+#   Binary data (major type 2), returned as ASCII-8BIT encoded strings.
+#
+# [Text strings]
+#   UTF-8 text (major type 3), returned as UTF-8 encoded strings.
+#
+# [Arrays]
+#   Ordered collections (major type 4) of any CBOR values.
+#
+# [Maps]
+#   Key-value pairs (major type 5) with any CBOR values as keys and values.
+#
+# [Floats]
+#   IEEE 754 half (16-bit), single (32-bit), and double (64-bit) precision.
+#
+# [Simple values]
+#   +false+, +true+, +null+, and +undefined+ (both decoded as +nil+).
+#
+# [Indefinite length]
+#   Streaming byte strings, text strings, arrays, and maps.
+#
+# Tags (major type 6) are recognized but their semantic meaning is ignored;
+# the tagged value is returned directly.
+#
+# == Errors
+#
+# Raises +DecodeError+ when encountering malformed or unsupported CBOR data.
+class ActionPack::WebAuthn::CborDecoder
+  # Raised when the decoder encounters invalid or unsupported CBOR data.
+  class DecodeError < StandardError; end
+
+  # Major types
+  UNSIGNED_INTEGER_TYPE = 0
+  NEGATIVE_INTEGER_TYPE = 1
+  BYTE_STRING_TYPE = 2
+  TEXT_STRING_TYPE = 3
+  ARRAY_TYPE = 4
+  MAP_TYPE = 5
+  TAG_TYPE = 6
+  FLOAT_OR_SIMPLE_TYPE = 7
+
+  # Additional information values
+  SIMPLE_VALUE_RANGE = 0..23
+  SINGLE_BYTE_VALUE_FOLLOWS = 24
+  TWO_BYTE_VALUE_FOLLOWS = 25
+  FOUR_BYTE_VALUE_FOLLOWS = 26
+  EIGHT_BYTE_VALUE_FOLLOWS = 27
+  RESERVED_VALUE_RANGE = 28..30
+  INDEFINITE_LENGTH_MAJOR_TYPE = 31
+
+  # Simple values
+  SIMPLE_FALSE_VALUE = 20
+  SIMPLE_TRUE_VALUE = 21
+  SIMPLE_NULL_VALUE = 22
+  SIMPLE_UNDEFINED_VALUE = 23
+
+  # Flow control
+  BREAK_CODE = 0xFF
+
+  # Limits
+  MAX_DEPTH = 16
+  MAX_SIZE = 10.megabytes
+
+  class << self
+    # Decodes a CBOR-encoded byte sequence into a Ruby object.
+    #
+    #   ActionPack::WebAuthn::CborDecoder.decode("\xa2\x61a\x01\x61b\x02")
+    #   # => {"a" => 1, "b" => 2}
+    def decode(bytes, **args)
+      bytes = bytes.bytes if bytes.respond_to?(:bytes)
+      new(bytes, **args).decode
+    end
+  end
+
+  def initialize(bytes, max_depth: MAX_DEPTH, max_size: MAX_SIZE) # :nodoc:
+    raise DecodeError, "Input exceeds maximum size" if bytes.length > max_size
+
+    @bytes = bytes
+    @max_depth = max_depth
+    @position = 0
+    @depth = 0
+  end
+
+  # Decodes the next CBOR data item from the byte sequence.
+  def decode
+    raise DecodeError, "Unexpected end of input" if @position >= @bytes.length
+    raise DecodeError, "Maximum nesting depth exceeded" if @depth > @max_depth
+
+    @depth += 1
+
+    result = case major_type
+    when UNSIGNED_INTEGER_TYPE then decode_unsigned_integer
+    when NEGATIVE_INTEGER_TYPE then decode_negative_integer
+    when BYTE_STRING_TYPE then decode_byte_string
+    when TEXT_STRING_TYPE then decode_text_string
+    when ARRAY_TYPE then decode_array
+    when MAP_TYPE then decode_map
+    when TAG_TYPE then decode_tag
+    when FLOAT_OR_SIMPLE_TYPE then decode_float_or_simple
+    end
+
+    @depth -= 1
+    result
+  end
+
+  private
+    def major_type
+      peek >> 5
+    end
+
+    def peek
+      @bytes[@position]
+    end
+
+    def decode_unsigned_integer
+      read_argument
+    end
+
+    def decode_negative_integer
+      -1 - read_argument
+    end
+
+    def decode_byte_string
+      if indefinite_length?
+        String.new(encoding: Encoding::ASCII_8BIT).tap { |str| str << decode_byte_string until break_code? }
+      else
+        read_bytes(read_argument).pack("C*")
+      end
+    end
+
+    def decode_text_string
+      if indefinite_length?
+        String.new(encoding: Encoding::UTF_8).tap { |str| str << decode_text_string until break_code? }
+      else
+        read_bytes(read_argument).pack("C*").force_encoding(Encoding::UTF_8)
+      end
+    end
+
+    def decode_array
+      if indefinite_length?
+        Array.new.tap { |arr| arr << decode until break_code? }
+      else
+        Array.new(read_argument) { decode }
+      end
+    end
+
+    def decode_map
+      if indefinite_length?
+        Hash.new.tap { |hash| hash[decode] = decode until break_code? }
+      else
+        Hash.new.tap do |hash|
+          read_argument.times do
+            hash[decode] = decode
+          end
+        end
+      end
+    end
+
+    def decode_float_or_simple
+      case info = additional_info
+      when SIMPLE_FALSE_VALUE then false
+      when SIMPLE_TRUE_VALUE then true
+      when SIMPLE_NULL_VALUE, SIMPLE_UNDEFINED_VALUE then nil
+      when TWO_BYTE_VALUE_FOLLOWS then decode_half_float
+      when FOUR_BYTE_VALUE_FOLLOWS then read_bytes(4).pack("C*").unpack1("g")
+      when EIGHT_BYTE_VALUE_FOLLOWS then read_bytes(8).pack("C*").unpack1("G")
+      else
+        raise DecodeError, "Invalid simple value: #{info}"
+      end
+    end
+
+    def decode_tag
+      read_argument
+      decode
+    end
+
+    def decode_half_float
+      half = read_bytes(2).pack("C*").unpack1("n")
+
+      sign = (half >> 15) & 0x1
+      exponent = (half >> 10) & 0x1F
+      mantissa = half & 0x3FF
+
+      value = if exponent == 0
+        Math.ldexp(mantissa, -24)
+      elsif exponent == 31
+        mantissa == 0 ? Float::INFINITY : Float::NAN
+      else
+        Math.ldexp(mantissa + 1024, exponent - 25)
+      end
+
+      sign == 1 ? -value : value
+    end
+
+    def read_argument
+      case info = additional_info
+      when SIMPLE_VALUE_RANGE then info
+      when SINGLE_BYTE_VALUE_FOLLOWS then read_byte
+      when TWO_BYTE_VALUE_FOLLOWS then read_bytes(2).pack("C*").unpack1("n")
+      when FOUR_BYTE_VALUE_FOLLOWS then read_bytes(4).pack("C*").unpack1("N")
+      when EIGHT_BYTE_VALUE_FOLLOWS then read_bytes(8).pack("C*").unpack1("Q>")
+      when RESERVED_VALUE_RANGE
+        raise DecodeError, "Reserved additional info: #{info}"
+      else
+        raise DecodeError, "Invalid additional info: #{info}"
+      end
+    end
+
+    def additional_info(consume: true)
+      byte = consume ? read_byte : peek
+      byte & 0b00011111
+    end
+
+    def indefinite_length?
+      read_byte if additional_info(consume: false) == INDEFINITE_LENGTH_MAJOR_TYPE
+    end
+
+    def break_code?
+      read_byte if peek == BREAK_CODE
+    end
+
+    def read_bytes(length)
+      raise DecodeError, "Unexpected end of input" if @position + length > @bytes.length
+
+      bytes = @bytes[@position, length]
+      @position += length
+      bytes
+    end
+
+    def read_byte
+      raise DecodeError, "Unexpected end of input" if @position >= @bytes.length
+
+      byte = @bytes[@position]
+      @position += 1
+      byte
+    end
+end
diff --git a/lib/action_pack/web_authn/cose_key.rb b/lib/action_pack/web_authn/cose_key.rb
new file mode 100644
index 000000000..53ef3037c
--- /dev/null
+++ b/lib/action_pack/web_authn/cose_key.rb
@@ -0,0 +1,141 @@
+# = Action Pack WebAuthn COSE Key
+#
+# Parses COSE (CBOR Object Signing and Encryption) public keys as specified in
+# RFC 9053[https://datatracker.ietf.org/doc/html/rfc9053]. WebAuthn authenticators
+# return public keys in COSE format, which must be converted to a standard format
+# for signature verification.
+#
+# == Usage
+#
+#   # Decode a COSE key from CBOR bytes (e.g., from authenticator data)
+#   cose_key = ActionPack::WebAuthn::CoseKey.decode(cbor_bytes)
+#
+#   # Convert to OpenSSL key for signature verification
+#   openssl_key = cose_key.to_openssl_key
+#   openssl_key.verify("SHA256", signature, signed_data)
+#
+# == Supported Algorithms
+#
+# [ES256]
+#   ECDSA with P-256 curve and SHA-256. The most common algorithm for WebAuthn.
+#
+# [RS256]
+#   RSASSA-PKCS1-v1_5 with SHA-256. Used by some security keys and platforms.
+#
+# == Attributes
+#
+# [+key_type+]
+#   The COSE key type (2 for EC2, 3 for RSA).
+#
+# [+algorithm+]
+#   The COSE algorithm identifier (-7 for ES256, -257 for RS256).
+#
+# [+parameters+]
+#   The full COSE key parameters map, including curve and coordinate data.
+class ActionPack::WebAuthn::CoseKey
+  # Raised when the key type, algorithm, or curve is not supported.
+  class UnsupportedKeyTypeError < StandardError; end
+
+  # COSE key labels
+  KEY_TYPE_LABEL = 1
+  ALGORITHM_LABEL = 3
+  EC2_CURVE_LABEL = -1
+  EC2_X_LABEL = -2
+  EC2_Y_LABEL = -3
+  RSA_N_LABEL = -1
+  RSA_E_LABEL = -2
+
+  # COSE key types
+  EC2 = 2
+  RSA = 3
+
+  # COSE algorithms
+  ES256 = -7
+  RS256 = -257
+
+  # COSE EC2 curves
+  P256 = 1
+
+  # OpenSSL types
+  UNCOMPRESSED_POINT_MARKER = 0x04
+
+  attr_reader :key_type, :algorithm, :parameters
+
+  class << self
+    # Decodes a COSE key from CBOR-encoded bytes.
+    #
+    #   cose_key = ActionPack::WebAuthn::CoseKey.decode(cbor_bytes)
+    #   cose_key.algorithm # => -7 (ES256)
+    def decode(bytes)
+      data = ActionPack::WebAuthn::CborDecoder.decode(bytes)
+      new(
+        key_type: data[KEY_TYPE_LABEL],
+        algorithm: data[ALGORITHM_LABEL],
+        parameters: data
+      )
+    end
+  end
+
+  def initialize(key_type:, algorithm:, parameters:) # :nodoc:
+    @key_type = key_type
+    @algorithm = algorithm
+    @parameters = parameters
+  end
+
+  # Converts the COSE key to an OpenSSL public key object.
+  #
+  # Returns an +OpenSSL::PKey::EC+ for EC2 keys or +OpenSSL::PKey::RSA+ for
+  # RSA keys, suitable for use with +OpenSSL::PKey#verify+.
+  #
+  # Raises +UnsupportedKeyTypeError+ if the key type, algorithm, or curve
+  # is not supported.
+  def to_openssl_key
+    case [ key_type, algorithm ]
+    when [ EC2, ES256 ] then build_ec2_es256_key
+    when [ RSA, RS256 ] then build_rsa_rs256_key
+    else raise UnsupportedKeyTypeError, "Unsupported COSE key type/algorithm: #{key_type}/#{algorithm}"
+    end
+  end
+
+  private
+    def build_ec2_es256_key
+      curve = parameters[EC2_CURVE_LABEL]
+      raise UnsupportedKeyTypeError, "Unsupported EC curve: #{curve}" unless curve == P256
+
+      x = parameters[EC2_X_LABEL]
+      y = parameters[EC2_Y_LABEL]
+
+      # Uncompressed point format: 0x04 || x || y
+      public_key_bytes = [ UNCOMPRESSED_POINT_MARKER, *x.bytes, *y.bytes ].pack("C*")
+
+      asn1 = OpenSSL::ASN1::Sequence([
+        OpenSSL::ASN1::Sequence([
+          OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
+          OpenSSL::ASN1::ObjectId("prime256v1")
+        ]),
+        OpenSSL::ASN1::BitString(public_key_bytes)
+      ])
+
+      OpenSSL::PKey::EC.new(asn1.to_der)
+    end
+
+    def build_rsa_rs256_key
+      n = OpenSSL::BN.new(parameters[RSA_N_LABEL], 2)
+      e = OpenSSL::BN.new(parameters[RSA_E_LABEL], 2)
+
+      asn1 = OpenSSL::ASN1::Sequence([
+        OpenSSL::ASN1::Sequence([
+          OpenSSL::ASN1::ObjectId("rsaEncryption"),
+          OpenSSL::ASN1::Null.new(nil)
+        ]),
+        OpenSSL::ASN1::BitString(
+          OpenSSL::ASN1::Sequence([
+            OpenSSL::ASN1::Integer(n),
+            OpenSSL::ASN1::Integer(e)
+          ]).to_der
+        )
+      ])
+
+      OpenSSL::PKey::RSA.new(asn1.to_der)
+    end
+end
diff --git a/lib/action_pack/web_authn/current.rb b/lib/action_pack/web_authn/current.rb
new file mode 100644
index 000000000..ab9038a80
--- /dev/null
+++ b/lib/action_pack/web_authn/current.rb
@@ -0,0 +1,3 @@
+class ActionPack::WebAuthn::Current < ActiveSupport::CurrentAttributes
+  attribute :host
+end
diff --git a/lib/action_pack/web_authn/public_key_credential.rb b/lib/action_pack/web_authn/public_key_credential.rb
new file mode 100644
index 000000000..1e00b74fb
--- /dev/null
+++ b/lib/action_pack/web_authn/public_key_credential.rb
@@ -0,0 +1,41 @@
+class ActionPack::WebAuthn::PublicKeyCredential
+  attr_reader :id, :public_key, :sign_count, :owner
+
+  class << self
+    def create(client_data_json:, attestation_object:, challenge:, origin:, owner: nil)
+      response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+        client_data_json: client_data_json,
+        attestation_object: attestation_object
+      )
+
+      response.validate!(challenge: challenge, origin: origin)
+
+      new(
+        id: response.attestation.credential_id,
+        public_key: response.attestation.public_key,
+        sign_count: response.attestation.sign_count,
+        owner: owner
+      )
+    end
+  end
+
+  def initialize(id:, public_key:, sign_count:, owner: nil)
+    @id = id
+    @public_key = public_key
+    @sign_count = sign_count
+    @owner = owner
+  end
+
+  def authenticate(client_data_json:, authenticator_data:, signature:, challenge:, origin:)
+    response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+      client_data_json: client_data_json,
+      authenticator_data: authenticator_data,
+      signature: signature,
+      credential: self
+    )
+
+    response.validate!(challenge: challenge, origin: origin)
+
+    @sign_count = response.authenticator_data.sign_count
+  end
+end
diff --git a/lib/action_pack/web_authn/public_key_credential/creation_options.rb b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
new file mode 100644
index 000000000..0497a2bad
--- /dev/null
+++ b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
@@ -0,0 +1,115 @@
+# = Action Pack WebAuthn Public Key Credential Creation Options
+#
+# Generates options for the WebAuthn registration ceremony (creating a new
+# credential). These options are passed to +navigator.credentials.create()+ in
+# the browser to prompt the user to register an authenticator.
+#
+# == Usage
+#
+#   options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+#     id: current_user.id,
+#     name: current_user.email,
+#     display_name: current_user.name
+#   )
+#
+#   # In your controller, return as JSON for the JavaScript WebAuthn API
+#   render json: { publicKey: options.as_json }
+#
+# == Attributes
+#
+# [+id+]
+#   A unique identifier for the user account. Will be Base64URL-encoded in the
+#   output. This should be an opaque identifier (like a primary key), not
+#   personally identifiable information.
+#
+# [+name+]
+#   A human-readable identifier for the user account, typically an email
+#   address or username. Displayed by the authenticator.
+#
+# [+display_name+]
+#   A human-friendly name for the user, typically their full name. Displayed
+#   by the authenticator during registration.
+#
+# [+relying_party+]
+#   The relying party (your application) configuration. Defaults to
+#   +ActionPack::WebAuthn.relying_party+.
+#
+# == Supported Algorithms
+#
+# By default, supports ES256 (ECDSA with P-256 and SHA-256) and RS256
+# (RSASSA-PKCS1-v1_5 with SHA-256), which cover the vast majority of
+# authenticators.
+class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::WebAuthn::PublicKeyCredential::Options
+  ES256 = { type: "public-key", alg: -7 }.freeze
+  RS256 = { type: "public-key", alg: -257 }.freeze
+
+  attr_reader :id, :name, :display_name
+
+  # Creates a new set of credential creation options.
+  #
+  # ==== Options
+  #
+  # [+:id+]
+  #   Required. The user's unique identifier.
+  #
+  # [+:name+]
+  #   Required. The user's account name (e.g., email).
+  #
+  # [+:display_name+]
+  #   Required. The user's display name.
+  #
+  # [+:relying_party+]
+  #   Optional. The relying party configuration.
+  #
+  # [+:resident_key+]
+  #   Optional. Resident key requirement. One of +:preferred+, +:required+,
+  #   or +:discouraged+. Defaults to +:preferred+.
+  #
+  # [+:exclude_credentials+]
+  #   Optional. Existing credentials to exclude from registration. Each must
+  #   respond to +id+ and +transports+.
+  def initialize(id:, name:, display_name:, resident_key: :preferred, exclude_credentials: [], **attrs)
+    super(**attrs)
+
+    @id = id
+    @name = name
+    @display_name = display_name
+    @resident_key = resident_key
+    @exclude_credentials = exclude_credentials
+  end
+
+  # Returns a Hash suitable for JSON serialization and passing to the
+  # WebAuthn JavaScript API.
+  def as_json(*)
+    json = {
+      challenge: challenge,
+      rp: relying_party.as_json,
+      user: {
+        id: Base64.urlsafe_encode64(id.to_s, padding: false),
+        name: name,
+        displayName: display_name
+      },
+      pubKeyCredParams: [
+        ES256,
+        RS256
+      ],
+      authenticatorSelection: {
+        residentKey: @resident_key.to_s,
+        userVerification: user_verification.to_s
+      }
+    }
+
+    if @exclude_credentials.any?
+      json[:excludeCredentials] = @exclude_credentials.map { |credential| exclude_credential_json(credential) }
+    end
+
+    json
+  end
+
+  private
+    def exclude_credential_json(credential)
+      hash = { type: "public-key", id: credential.id }
+      hash[:transports] = credential.transports if credential.transports.any?
+      hash
+    end
+end
diff --git a/lib/action_pack/web_authn/public_key_credential/options.rb b/lib/action_pack/web_authn/public_key_credential/options.rb
new file mode 100644
index 000000000..24c0fc29b
--- /dev/null
+++ b/lib/action_pack/web_authn/public_key_credential/options.rb
@@ -0,0 +1,27 @@
+class ActionPack::WebAuthn::PublicKeyCredential::Options
+  CHALLENGE_LENGTH = 32
+  USER_VERIFICATION_OPTIONS = [ :required, :preferred, :discouraged ].freeze
+
+  attr_reader :user_verification, :relying_party
+
+  def initialize(user_verification: :preferred, relying_party: ActionPack::WebAuthn.relying_party)
+    @user_verification = user_verification.to_sym
+    @relying_party = relying_party
+
+    unless USER_VERIFICATION_OPTIONS.include?(user_verification)
+      raise ArgumentError, "Invalid user verification option: #{user_verification.inspect}"
+    end
+  end
+
+  # Returns a Base64URL-encoded random challenge. The challenge is generated
+  # once and memoized for the lifetime of this object.
+  #
+  # The challenge must be stored server-side and verified when the client
+  # responds, to prevent replay attacks.
+  def challenge
+    @challenge ||= Base64.urlsafe_encode64(
+      SecureRandom.random_bytes(CHALLENGE_LENGTH),
+      padding: false
+    )
+  end
+end
diff --git a/lib/action_pack/web_authn/public_key_credential/request_options.rb b/lib/action_pack/web_authn/public_key_credential/request_options.rb
new file mode 100644
index 000000000..0b62ad532
--- /dev/null
+++ b/lib/action_pack/web_authn/public_key_credential/request_options.rb
@@ -0,0 +1,61 @@
+# = Action Pack WebAuthn Public Key Credential Request Options
+#
+# Generates options for the WebAuthn authentication ceremony (using an existing
+# credential). These options are passed to +navigator.credentials.get()+ in
+# the browser to prompt the user to authenticate with a registered authenticator.
+#
+# == Usage
+#
+#   options = ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(
+#     credentials: current_user.webauthn_credentials
+#   )
+#
+#   # In your controller, return as JSON for the JavaScript WebAuthn API
+#   render json: { publicKey: options.as_json }
+#
+# == Attributes
+#
+# [+credentials+]
+#   A collection of credential records for the user. Each credential must
+#   respond to +id+ returning the Base64URL-encoded credential ID, and
+#   +transports+ returning an array of transport strings.
+#
+# [+relying_party+]
+#   The relying party (your application) configuration. Defaults to
+#   +ActionPack::WebAuthn.relying_party+.
+class ActionPack::WebAuthn::PublicKeyCredential::RequestOptions < ActionPack::WebAuthn::PublicKeyCredential::Options
+  attr_reader :credentials
+
+  # Creates a new set of credential request options.
+  #
+  # ==== Options
+  #
+  # [+:credentials+]
+  #   Required. The user's registered WebAuthn credentials.
+  #
+  # [+:relying_party+]
+  #   Optional. The relying party configuration.
+  def initialize(credentials:, **attrs)
+    super(**attrs)
+
+    @credentials = credentials
+  end
+
+  # Returns a Hash suitable for JSON serialization and passing to the
+  # WebAuthn JavaScript API.
+  def as_json(*)
+    {
+      challenge: challenge,
+      rpId: relying_party.id,
+      allowCredentials: credentials.map { |credential| allow_credential_json(credential) },
+      userVerification: user_verification.to_s
+    }
+  end
+
+  private
+    def allow_credential_json(credential)
+      hash = { type: "public-key", id: credential.id }
+      hash[:transports] = credential.transports if credential.transports.any?
+      hash
+    end
+end
diff --git a/lib/action_pack/web_authn/relying_party.rb b/lib/action_pack/web_authn/relying_party.rb
new file mode 100644
index 000000000..08dba0d36
--- /dev/null
+++ b/lib/action_pack/web_authn/relying_party.rb
@@ -0,0 +1,50 @@
+# = Action Pack WebAuthn Relying Party
+#
+# Represents the relying party (your application) in WebAuthn ceremonies. The
+# relying party identity is sent to authenticators during registration and
+# authentication to scope credentials to your application.
+#
+# == Usage
+#
+#   # Using defaults (host from Current, name from Rails application)
+#   relying_party = ActionPack::WebAuthn::RelyingParty.new
+#
+#   # With explicit values
+#   relying_party = ActionPack::WebAuthn::RelyingParty.new(
+#     id: "example.com",
+#     name: "Example Application"
+#   )
+#
+# == Attributes
+#
+# [+id+]
+#   The relying party identifier, typically the application's domain name
+#   (e.g., "example.com"). This must match the origin's effective domain
+#   or be a registrable domain suffix of it. Credentials are scoped to this
+#   identifier. Defaults to +ActionPack::WebAuthn::Current.host+.
+#
+# [+name+]
+#   A human-readable name for your application, displayed by authenticators
+#   during ceremonies. Defaults to +Rails.application.name+.
+class ActionPack::WebAuthn::RelyingParty
+  attr_reader :id, :name
+
+  # Creates a new relying party configuration.
+  #
+  # ==== Options
+  #
+  # [+:id+]
+  #   Optional. The relying party identifier (domain).
+  #
+  # [+:name+]
+  #   Optional. The application display name.
+  def initialize(id: ActionPack::WebAuthn::Current.host, name: Rails.application.name)
+    @id = id
+    @name = name
+  end
+
+  # Returns a Hash suitable for JSON serialization.
+  def as_json(*)
+    { id: id, name: name }
+  end
+end
diff --git a/test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb b/test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb
new file mode 100644
index 000000000..68abaf2df
--- /dev/null
+++ b/test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb
@@ -0,0 +1,158 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport::TestCase
+  setup do
+    ActionPack::WebAuthn::Current.host = "example.com"
+
+    @challenge = "test-challenge-123"
+    @origin = "https://example.com"
+    @client_data_json = {
+      challenge: @challenge,
+      origin: @origin,
+      type: "webauthn.get"
+    }.to_json
+
+    # Generate a real key pair for signature verification
+    @private_key = OpenSSL::PKey::EC.generate("prime256v1")
+    @public_key = @private_key
+    @credential = Struct.new(:public_key, :sign_count).new(@public_key, 0)
+
+    @authenticator_data = build_authenticator_data(user_verified: true)
+    @signature = sign(@authenticator_data, @client_data_json)
+
+    @response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+      client_data_json: @client_data_json,
+      authenticator_data: @authenticator_data,
+      signature: @signature,
+      credential: @credential
+    )
+  end
+
+  test "initializes with credential, authenticator data, and signature" do
+    assert_equal @credential, @response.credential
+    assert_instance_of ActionPack::WebAuthn::Authenticator::Data, @response.authenticator_data
+    assert_equal @signature, @response.signature
+  end
+
+  test "validate! succeeds with valid challenge, origin, type, and signature" do
+    assert_nothing_raised do
+      @response.validate!(challenge: @challenge, origin: @origin)
+    end
+  end
+
+  test "validate! raises when type is not webauthn.get" do
+    client_data_json = {
+      challenge: @challenge,
+      origin: @origin,
+      type: "webauthn.create"
+    }.to_json
+
+    response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+      client_data_json: client_data_json,
+      authenticator_data: @authenticator_data,
+      signature: sign(@authenticator_data, client_data_json),
+      credential: @credential
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin)
+    end
+
+    assert_equal "Client data type is not webauthn.get", error.message
+  end
+
+  test "validate! raises when signature is invalid" do
+    response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+      client_data_json: @client_data_json,
+      authenticator_data: @authenticator_data,
+      signature: "invalid-signature",
+      credential: @credential
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin)
+    end
+
+    assert_equal "Invalid signature", error.message
+  end
+
+  test "validate! raises when challenge does not match" do
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      @response.validate!(challenge: "wrong-challenge", origin: @origin)
+    end
+
+    assert_equal "Challenge does not match", error.message
+  end
+
+  test "validate! raises when origin does not match" do
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      @response.validate!(challenge: @challenge, origin: "https://evil.com")
+    end
+
+    assert_equal "Origin does not match", error.message
+  end
+
+  test "validate! succeeds with user_verification preferred when not verified" do
+    authenticator_data = build_authenticator_data(user_verified: false)
+    response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+      client_data_json: @client_data_json,
+      authenticator_data: authenticator_data,
+      signature: sign(authenticator_data, @client_data_json),
+      credential: @credential
+    )
+
+    assert_nothing_raised do
+      response.validate!(challenge: @challenge, origin: @origin, user_verification: :preferred)
+    end
+  end
+
+  test "validate! succeeds with user_verification required when verified" do
+    authenticator_data = build_authenticator_data(user_verified: true)
+    response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+      client_data_json: @client_data_json,
+      authenticator_data: authenticator_data,
+      signature: sign(authenticator_data, @client_data_json),
+      credential: @credential
+    )
+
+    assert_nothing_raised do
+      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+    end
+  end
+
+  test "validate! raises with user_verification required when not verified" do
+    authenticator_data = build_authenticator_data(user_verified: false)
+    response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+      client_data_json: @client_data_json,
+      authenticator_data: authenticator_data,
+      signature: sign(authenticator_data, @client_data_json),
+      credential: @credential
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+    end
+
+    assert_equal "User verification is required", error.message
+  end
+
+  private
+    def build_authenticator_data(user_verified:)
+      rp_id_hash = Digest::SHA256.digest("example.com")
+      flags = 0x01 # user present
+      flags |= 0x04 if user_verified
+      sign_count = 0
+
+      bytes = []
+      bytes.concat(rp_id_hash.bytes)
+      bytes << flags
+      bytes.concat([sign_count].pack("N").bytes)
+      bytes.pack("C*")
+    end
+
+    def sign(authenticator_data, client_data_json)
+      client_data_hash = Digest::SHA256.digest(client_data_json)
+      signed_data = authenticator_data + client_data_hash
+      @private_key.sign("SHA256", signed_data)
+    end
+end
diff --git a/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb b/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
new file mode 100644
index 000000000..5d58a3ff4
--- /dev/null
+++ b/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
@@ -0,0 +1,195 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSupport::TestCase
+  setup do
+    ActionPack::WebAuthn::Current.host = "example.com"
+
+    @challenge = "test-challenge-123"
+    @origin = "https://example.com"
+    @client_data_json = {
+      challenge: @challenge,
+      origin: @origin,
+      type: "webauthn.create"
+    }.to_json
+
+    @response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+      client_data_json: @client_data_json,
+      attestation_object: build_attestation_object(user_verified: true)
+    )
+  end
+
+  test "initializes with attestation object" do
+    assert_not_nil @response.attestation_object
+  end
+
+  test "validate! succeeds with valid challenge, origin, and type" do
+    assert_nothing_raised do
+      @response.validate!(challenge: @challenge, origin: @origin)
+    end
+  end
+
+  test "validate! succeeds with user_verification preferred when not verified" do
+    response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+      client_data_json: @client_data_json,
+      attestation_object: build_attestation_object(user_verified: false)
+    )
+
+    assert_nothing_raised do
+      response.validate!(challenge: @challenge, origin: @origin, user_verification: :preferred)
+    end
+  end
+
+  test "validate! succeeds with user_verification required when verified" do
+    response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+      client_data_json: @client_data_json,
+      attestation_object: build_attestation_object(user_verified: true)
+    )
+
+    assert_nothing_raised do
+      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+    end
+  end
+
+  test "validate! raises with user_verification required when not verified" do
+    response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+      client_data_json: @client_data_json,
+      attestation_object: build_attestation_object(user_verified: false)
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+    end
+
+    assert_equal "User verification is required", error.message
+  end
+
+  test "validate! raises when type is not webauthn.create" do
+    client_data_json = {
+      challenge: @challenge,
+      origin: @origin,
+      type: "webauthn.get"
+    }.to_json
+
+    response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+      client_data_json: client_data_json,
+      attestation_object: build_attestation_object(user_verified: true)
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin)
+    end
+
+    assert_equal "Client data type is not webauthn.create", error.message
+  end
+
+  test "validate! raises when challenge does not match" do
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      @response.validate!(challenge: "wrong-challenge", origin: @origin)
+    end
+
+    assert_equal "Challenge does not match", error.message
+  end
+
+  test "validate! raises when origin does not match" do
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      @response.validate!(challenge: @challenge, origin: "https://evil.com")
+    end
+
+    assert_equal "Origin does not match", error.message
+  end
+
+  test "validate! raises when attestation format is not supported" do
+    response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+      client_data_json: @client_data_json,
+      attestation_object: build_attestation_object(user_verified: true, format: "packed")
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin)
+    end
+
+    assert_equal "Unsupported attestation format: packed", error.message
+  end
+
+  private
+    def build_attestation_object(user_verified:, format: "none")
+      auth_data = build_authenticator_data(user_verified: user_verified)
+      encode_cbor_attestation_object(auth_data, format: format)
+    end
+
+    def build_authenticator_data(user_verified:)
+      rp_id_hash = Digest::SHA256.digest("example.com")
+      flags = 0x41 # user present + attested credential
+      flags |= 0x04 if user_verified
+      sign_count = 0
+      aaguid = SecureRandom.random_bytes(16)
+      credential_id = SecureRandom.random_bytes(32)
+      cose_key = build_cose_key
+
+      bytes = []
+      bytes.concat(rp_id_hash.bytes)
+      bytes << flags
+      bytes.concat([sign_count].pack("N").bytes)
+      bytes.concat(aaguid.bytes)
+      bytes.concat([credential_id.bytesize].pack("n").bytes)
+      bytes.concat(credential_id.bytes)
+      bytes.concat(cose_key.bytes)
+      bytes.pack("C*")
+    end
+
+    def build_cose_key
+      ec_key = OpenSSL::PKey::EC.generate("prime256v1")
+      public_key_bn = ec_key.public_key.to_bn
+      public_key_point = public_key_bn.to_s(2)
+      x = public_key_point[1, 32]
+      y = public_key_point[33, 32]
+
+      params = { 1 => 2, 3 => -7, -1 => 1, -2 => x, -3 => y }
+      encode_cbor_map(params)
+    end
+
+    def encode_cbor_attestation_object(auth_data, format:)
+      bytes = [0xa3]
+      bytes.concat([0x63, *"fmt".bytes])
+      bytes.concat([0x40 + format.bytesize, *format.bytes])
+      bytes.concat([0x67, *"attStmt".bytes])
+      bytes << 0xa0
+      bytes.concat([0x68, *"authData".bytes])
+      if auth_data.bytesize <= 255
+        bytes.concat([0x58, auth_data.bytesize])
+      else
+        bytes.concat([0x59, (auth_data.bytesize >> 8) & 0xff, auth_data.bytesize & 0xff])
+      end
+      bytes.concat(auth_data.bytes)
+      bytes.pack("C*")
+    end
+
+    def encode_cbor_map(hash)
+      bytes = [0xa0 + hash.size]
+      hash.each do |key, value|
+        bytes.concat(encode_cbor_integer(key))
+        bytes.concat(encode_cbor_value(value))
+      end
+      bytes.pack("C*")
+    end
+
+    def encode_cbor_integer(int)
+      if int >= 0 && int <= 23
+        [int]
+      elsif int >= -24 && int < 0
+        [0x20 - int - 1]
+      else
+        raise "Integer encoding not implemented for #{int}"
+      end
+    end
+
+    def encode_cbor_value(value)
+      case value
+      when Integer
+        encode_cbor_integer(value)
+      when String
+        length = value.bytesize
+        length <= 23 ? [0x40 + length, *value.bytes] : [0x58, length, *value.bytes]
+      end
+    end
+end
diff --git a/test/lib/action_pack/web_authn/authenticator/attestation_test.rb b/test/lib/action_pack/web_authn/authenticator/attestation_test.rb
new file mode 100644
index 000000000..4531039e0
--- /dev/null
+++ b/test/lib/action_pack/web_authn/authenticator/attestation_test.rb
@@ -0,0 +1,135 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::Authenticator::AttestationTest < ActiveSupport::TestCase
+  setup do
+    @rp_id_hash = Digest::SHA256.digest("example.com")
+    @sign_count = 42
+    @aaguid = SecureRandom.random_bytes(16)
+    @credential_id = SecureRandom.random_bytes(32)
+
+    # Generate a real EC key
+    ec_key = OpenSSL::PKey::EC.generate("prime256v1")
+    public_key_bn = ec_key.public_key.to_bn
+    public_key_point = public_key_bn.to_s(2)
+    x_coord = public_key_point[1, 32]
+    y_coord = public_key_point[33, 32]
+
+    @cose_key = build_cose_key(x_coord, y_coord)
+    @auth_data = build_authenticator_data
+    @attestation_object = build_attestation_object
+  end
+
+  test "decodes attestation object" do
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+
+    assert_equal "none", attestation.format
+    assert_equal({}, attestation.attestation_statement)
+    assert_instance_of ActionPack::WebAuthn::Authenticator::Data, attestation.authenticator_data
+  end
+
+  test "delegates credential_id to authenticator_data" do
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+
+    assert_equal Base64.urlsafe_encode64(@credential_id, padding: false), attestation.credential_id
+  end
+
+  test "delegates sign_count to authenticator_data" do
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+
+    assert_equal @sign_count, attestation.sign_count
+  end
+
+  test "delegates public_key to authenticator_data" do
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+
+    assert_instance_of OpenSSL::PKey::EC, attestation.public_key
+  end
+
+  private
+    def build_authenticator_data
+      bytes = []
+      bytes.concat(@rp_id_hash.bytes)
+      bytes << 0x41 # flags: user present + attested credential
+      bytes.concat([@sign_count].pack("N").bytes)
+      bytes.concat(@aaguid.bytes)
+      bytes.concat([@credential_id.bytesize].pack("n").bytes)
+      bytes.concat(@credential_id.bytes)
+      bytes.concat(@cose_key.bytes)
+      bytes.pack("C*")
+    end
+
+    def build_attestation_object
+      # CBOR map: { "fmt": "none", "attStmt": {}, "authData": <bytes> }
+      encode_cbor_attestation_object
+    end
+
+    def encode_cbor_attestation_object
+      bytes = [0xa3] # map with 3 items
+
+      # "fmt" => "none"
+      bytes.concat([0x63, *"fmt".bytes]) # text string "fmt"
+      bytes.concat([0x64, *"none".bytes]) # text string "none"
+
+      # "attStmt" => {}
+      bytes.concat([0x67, *"attStmt".bytes]) # text string "attStmt"
+      bytes << 0xa0 # empty map
+
+      # "authData" => <bytes>
+      bytes.concat([0x68, *"authData".bytes]) # text string "authData"
+      auth_data_length = @auth_data.bytesize
+      if auth_data_length <= 23
+        bytes << (0x40 + auth_data_length)
+      elsif auth_data_length <= 255
+        bytes.concat([0x58, auth_data_length])
+      else
+        bytes.concat([0x59, (auth_data_length >> 8) & 0xff, auth_data_length & 0xff])
+      end
+      bytes.concat(@auth_data.bytes)
+
+      bytes.pack("C*")
+    end
+
+    def build_cose_key(x, y)
+      params = {
+        1 => 2,    # kty: EC2
+        3 => -7,   # alg: ES256
+        -1 => 1,   # crv: P-256
+        -2 => x,
+        -3 => y
+      }
+      encode_cbor_map(params)
+    end
+
+    def encode_cbor_map(hash)
+      bytes = [0xa0 + hash.size]
+      hash.each do |key, value|
+        bytes.concat(encode_cbor_integer(key))
+        bytes.concat(encode_cbor_value(value))
+      end
+      bytes.pack("C*")
+    end
+
+    def encode_cbor_integer(int)
+      if int >= 0 && int <= 23
+        [int]
+      elsif int >= -24 && int < 0
+        [0x20 - int - 1]
+      else
+        raise "Integer encoding not implemented for #{int}"
+      end
+    end
+
+    def encode_cbor_value(value)
+      case value
+      when Integer
+        encode_cbor_integer(value)
+      when String
+        length = value.bytesize
+        if length <= 23
+          [0x40 + length, *value.bytes]
+        else
+          [0x58, length, *value.bytes]
+        end
+      end
+    end
+end
diff --git a/test/lib/action_pack/web_authn/authenticator/data_test.rb b/test/lib/action_pack/web_authn/authenticator/data_test.rb
new file mode 100644
index 000000000..3291585cc
--- /dev/null
+++ b/test/lib/action_pack/web_authn/authenticator/data_test.rb
@@ -0,0 +1,174 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::Authenticator::DataTest < ActiveSupport::TestCase
+  setup do
+    @rp_id_hash = Digest::SHA256.digest("example.com")
+    @sign_count = 42
+    @aaguid = SecureRandom.random_bytes(16)
+    @credential_id = SecureRandom.random_bytes(32)
+
+    # Generate a real EC key for COSE encoding
+    ec_key = OpenSSL::PKey::EC.generate("prime256v1")
+    public_key_bn = ec_key.public_key.to_bn
+    public_key_point = public_key_bn.to_s(2)
+    x_coord = public_key_point[1, 32]
+    y_coord = public_key_point[33, 32]
+
+    @cose_key = build_cose_key(x_coord, y_coord)
+  end
+
+  test "decodes authenticator data without attested credential" do
+    flags = 0x01 # user present only
+    bytes = build_authenticator_data(flags: flags, include_credential: false)
+
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
+
+    assert_equal @rp_id_hash, data.relying_party_id_hash
+    assert_equal flags, data.flags
+    assert_equal @sign_count, data.sign_count
+    assert_nil data.credential_id
+    assert_nil data.public_key_bytes
+  end
+
+  test "decodes authenticator data with attested credential" do
+    flags = 0x41 # user present + attested credential data
+    bytes = build_authenticator_data(flags: flags, include_credential: true)
+
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
+
+    assert_equal @rp_id_hash, data.relying_party_id_hash
+    assert_equal flags, data.flags
+    assert_equal @sign_count, data.sign_count
+    assert_equal Base64.urlsafe_encode64(@credential_id, padding: false), data.credential_id
+    assert_equal @cose_key, data.public_key_bytes
+  end
+
+  test "user_present? returns true when flag is set" do
+    data = build_data_with_flags(0x01)
+    assert data.user_present?
+  end
+
+  test "user_present? returns false when flag is not set" do
+    data = build_data_with_flags(0x00)
+    assert_not data.user_present?
+  end
+
+  test "user_verified? returns true when flag is set" do
+    data = build_data_with_flags(0x04)
+    assert data.user_verified?
+  end
+
+  test "user_verified? returns false when flag is not set" do
+    data = build_data_with_flags(0x00)
+    assert_not data.user_verified?
+  end
+
+  test "backup_eligible? returns true when flag is set" do
+    data = build_data_with_flags(0x08)
+    assert data.backup_eligible?
+  end
+
+  test "backup_eligible? returns false when flag is not set" do
+    data = build_data_with_flags(0x00)
+    assert_not data.backup_eligible?
+  end
+
+  test "backed_up? returns true when flag is set" do
+    data = build_data_with_flags(0x10)
+    assert data.backed_up?
+  end
+
+  test "backed_up? returns false when flag is not set" do
+    data = build_data_with_flags(0x00)
+    assert_not data.backed_up?
+  end
+
+  test "public_key returns OpenSSL key when public_key_bytes present" do
+    flags = 0x41
+    bytes = build_authenticator_data(flags: flags, include_credential: true)
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
+
+    assert_instance_of OpenSSL::PKey::EC, data.public_key
+  end
+
+  test "public_key returns nil when public_key_bytes not present" do
+    flags = 0x01
+    bytes = build_authenticator_data(flags: flags, include_credential: false)
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
+
+    assert_nil data.public_key
+  end
+
+  private
+    def build_authenticator_data(flags:, include_credential:)
+      bytes = []
+      bytes.concat(@rp_id_hash.bytes)
+      bytes << flags
+      bytes.concat([ @sign_count ].pack("N").bytes)
+
+      if include_credential
+        bytes.concat(@aaguid.bytes)
+        bytes.concat([ @credential_id.bytesize ].pack("n").bytes)
+        bytes.concat(@credential_id.bytes)
+        bytes.concat(@cose_key.bytes)
+      end
+
+      bytes.pack("C*")
+    end
+
+    def build_data_with_flags(flags)
+      ActionPack::WebAuthn::Authenticator::Data.new(
+        bytes: [],
+        relying_party_id_hash: @rp_id_hash,
+        flags: flags,
+        sign_count: 0,
+        credential_id: nil,
+        public_key_bytes: nil
+      )
+    end
+
+    def build_cose_key(x, y)
+      # Simple CBOR map for EC2 key
+      params = {
+        1 => 2,    # kty: EC2
+        3 => -7,   # alg: ES256
+        -1 => 1,   # crv: P-256
+        -2 => x,
+        -3 => y
+      }
+      encode_cbor_map(params)
+    end
+
+    def encode_cbor_map(hash)
+      bytes = [ 0xa0 + hash.size ]
+      hash.each do |key, value|
+        bytes.concat(encode_cbor_integer(key))
+        bytes.concat(encode_cbor_value(value))
+      end
+      bytes.pack("C*")
+    end
+
+    def encode_cbor_integer(int)
+      if int >= 0 && int <= 23
+        [ int ]
+      elsif int >= -24 && int < 0
+        [ 0x20 - int - 1 ]
+      else
+        raise "Integer encoding not implemented for #{int}"
+      end
+    end
+
+    def encode_cbor_value(value)
+      case value
+      when Integer
+        encode_cbor_integer(value)
+      when String
+        length = value.bytesize
+        if length <= 23
+          [ 0x40 + length, *value.bytes ]
+        else
+          [ 0x58, length, *value.bytes ]
+        end
+      end
+    end
+end
diff --git a/test/lib/action_pack/web_authn/authenticator/response_test.rb b/test/lib/action_pack/web_authn/authenticator/response_test.rb
new file mode 100644
index 000000000..8a172e561
--- /dev/null
+++ b/test/lib/action_pack/web_authn/authenticator/response_test.rb
@@ -0,0 +1,141 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCase
+  setup do
+    ActionPack::WebAuthn::Current.host = "example.com"
+
+    @challenge = "test-challenge-123"
+    @origin = "https://example.com"
+    @client_data_json = {
+      challenge: @challenge,
+      origin: @origin,
+      type: "webauthn.create"
+    }.to_json
+
+    @authenticator_data = build_authenticator_data
+    @response = TestableResponse.new(
+      client_data_json: @client_data_json,
+      authenticator_data: @authenticator_data
+    )
+  end
+
+  class TestableResponse < ActionPack::WebAuthn::Authenticator::Response
+    attr_reader :authenticator_data
+
+    def initialize(authenticator_data:, **attrs)
+      super(**attrs)
+      @authenticator_data = authenticator_data
+    end
+  end
+
+  test "parses client data JSON" do
+    assert_equal @challenge, @response.client_data["challenge"]
+    assert_equal @origin, @response.client_data["origin"]
+  end
+
+  test "valid? returns true when challenge and origin match" do
+    assert @response.valid?(challenge: @challenge, origin: @origin)
+  end
+
+  test "valid? returns false when challenge does not match" do
+    assert_not @response.valid?(challenge: "wrong-challenge", origin: @origin)
+  end
+
+  test "valid? returns false when origin does not match" do
+    assert_not @response.valid?(challenge: @challenge, origin: "https://evil.com")
+  end
+
+  test "validate! raises when challenge does not match" do
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      @response.validate!(challenge: "wrong-challenge", origin: @origin)
+    end
+
+    assert_equal "Challenge does not match", error.message
+  end
+
+  test "validate! raises when origin does not match" do
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      @response.validate!(challenge: @challenge, origin: "https://evil.com")
+    end
+
+    assert_equal "Origin does not match", error.message
+  end
+
+  test "validate! raises when crossOrigin is true" do
+    client_data_json = {
+      challenge: @challenge,
+      origin: @origin,
+      type: "webauthn.create",
+      crossOrigin: true
+    }.to_json
+
+    response = TestableResponse.new(
+      client_data_json: client_data_json,
+      authenticator_data: @authenticator_data
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin)
+    end
+
+    assert_equal "Cross-origin requests are not supported", error.message
+  end
+
+  test "validate! raises when relying party ID does not match" do
+    rp_id_hash = Digest::SHA256.digest("evil.com")
+    flags = 0x05
+    sign_count = 0
+
+    bytes = []
+    bytes.concat(rp_id_hash.bytes)
+    bytes << flags
+    bytes.concat([sign_count].pack("N").bytes)
+
+    wrong_rp_data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes.pack("C*"))
+
+    response = TestableResponse.new(
+      client_data_json: @client_data_json,
+      authenticator_data: wrong_rp_data
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin)
+    end
+
+    assert_equal "Relying party ID does not match", error.message
+  end
+
+  test "validate! raises when tokenBinding status is present" do
+    client_data_json = {
+      challenge: @challenge,
+      origin: @origin,
+      type: "webauthn.create",
+      tokenBinding: { status: "present", id: "some-id" }
+    }.to_json
+
+    response = TestableResponse.new(
+      client_data_json: client_data_json,
+      authenticator_data: @authenticator_data
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      response.validate!(challenge: @challenge, origin: @origin)
+    end
+
+    assert_equal "Token binding is not supported", error.message
+  end
+
+  private
+    def build_authenticator_data
+      rp_id_hash = Digest::SHA256.digest("example.com")
+      flags = 0x05 # user present + user verified
+      sign_count = 0
+
+      bytes = []
+      bytes.concat(rp_id_hash.bytes)
+      bytes << flags
+      bytes.concat([sign_count].pack("N").bytes)
+
+      ActionPack::WebAuthn::Authenticator::Data.decode(bytes.pack("C*"))
+    end
+end
diff --git a/test/lib/action_pack/web_authn/cbor_decoder_test.rb b/test/lib/action_pack/web_authn/cbor_decoder_test.rb
new file mode 100644
index 000000000..ea4a12984
--- /dev/null
+++ b/test/lib/action_pack/web_authn/cbor_decoder_test.rb
@@ -0,0 +1,297 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::CborDecoderTest < ActiveSupport::TestCase
+  test "decodes unsigned integer 0" do
+    assert_equal 0, decode("00")
+  end
+
+  test "decodes unsigned integer 1" do
+    assert_equal 1, decode("01")
+  end
+
+  test "decodes unsigned integer 10" do
+    assert_equal 10, decode("0a")
+  end
+
+  test "decodes unsigned integer 23" do
+    assert_equal 23, decode("17")
+  end
+
+  test "decodes unsigned integer 24 (single byte follows)" do
+    assert_equal 24, decode("1818")
+  end
+
+  test "decodes unsigned integer 25" do
+    assert_equal 25, decode("1819")
+  end
+
+  test "decodes unsigned integer 100" do
+    assert_equal 100, decode("1864")
+  end
+
+  test "decodes unsigned integer 1000 (two bytes follow)" do
+    assert_equal 1000, decode("1903e8")
+  end
+
+  test "decodes unsigned integer 1000000 (four bytes follow)" do
+    assert_equal 1000000, decode("1a000f4240")
+  end
+
+  test "decodes unsigned integer 1000000000000 (eight bytes follow)" do
+    assert_equal 1000000000000, decode("1b000000e8d4a51000")
+  end
+
+  test "decodes negative integer -1" do
+    assert_equal(-1, decode("20"))
+  end
+
+  test "decodes negative integer -10" do
+    assert_equal(-10, decode("29"))
+  end
+
+  test "decodes negative integer -100" do
+    assert_equal(-100, decode("3863"))
+  end
+
+  test "decodes negative integer -1000" do
+    assert_equal(-1000, decode("3903e7"))
+  end
+
+  test "decodes empty byte string" do
+    assert_equal "", decode("40")
+  end
+
+  test "decodes byte string with 4 bytes" do
+    assert_equal "\x01\x02\x03\x04".b, decode("4401020304")
+  end
+
+  test "decodes empty text string" do
+    result = decode("60")
+    assert_equal "", result
+    assert_equal Encoding::UTF_8, result.encoding
+  end
+
+  test "decodes text string 'a'" do
+    result = decode("6161")
+    assert_equal "a", result
+    assert_equal Encoding::UTF_8, result.encoding
+  end
+
+  test "decodes text string 'IETF'" do
+    result = decode("6449455446")
+    assert_equal "IETF", result
+    assert_equal Encoding::UTF_8, result.encoding
+  end
+
+  test "decodes text string with unicode" do
+    result = decode("62c3bc")
+    assert_equal "ü", result
+    assert_equal Encoding::UTF_8, result.encoding
+  end
+
+  test "decodes empty array" do
+    assert_equal [], decode("80")
+  end
+
+  test "decodes array [1, 2, 3]" do
+    assert_equal [ 1, 2, 3 ], decode("83010203")
+  end
+
+  test "decodes nested array [1, [2, 3], [4, 5]]" do
+    assert_equal [ 1, [ 2, 3 ], [ 4, 5 ] ], decode("8301820203820405")
+  end
+
+  test "decodes array with 25 elements" do
+    expected = (1..25).to_a
+    # 0x9819 = array with 25 elements (0x98 = type 4 + additional 24, 0x19 = 25)
+    # integers 1-23 encode as single bytes, 24 = 0x1818, 25 = 0x1819
+    elements = (1..23).map { |n| format("%02x", n) }.join + "18181819"
+    assert_equal expected, decode("9819" + elements)
+  end
+
+  test "decodes empty map" do
+    assert_equal({}, decode("a0"))
+  end
+
+  test "decodes map {1: 2, 3: 4}" do
+    assert_equal({ 1 => 2, 3 => 4 }, decode("a201020304"))
+  end
+
+  test "decodes map with string keys" do
+    assert_equal({ "a" => 1, "b" => 2 }, decode("a2616101616202"))
+  end
+
+  test "decodes nested map" do
+    assert_equal({ "a" => { "b" => 1 } }, decode("a16161a1616201"))
+  end
+
+  test "decodes false" do
+    assert_equal false, decode("f4")
+  end
+
+  test "decodes true" do
+    assert_equal true, decode("f5")
+  end
+
+  test "decodes null" do
+    assert_nil decode("f6")
+  end
+
+  test "decodes undefined as nil" do
+    assert_nil decode("f7")
+  end
+
+  test "decodes tagged value, ignoring tag" do
+    # 0xc0 = tag 0 (date/time string), followed by text "2013-03-21T20:04:00Z"
+    assert_equal "2013-03-21T20:04:00Z", decode("c074323031332d30332d32315432303a30343a30305a")
+  end
+
+  test "decodes tagged integer" do
+    # 0xc1 = tag 1 (epoch time), followed by integer 1363896240
+    assert_equal 1363896240, decode("c11a514b67b0")
+  end
+
+  test "raises error for reserved additional info values" do
+    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      decode("1c")
+    end
+  end
+
+  test "decodes indefinite length array" do
+    assert_equal [ 1, 2, 3 ], decode("9f010203ff")
+  end
+
+  test "decodes empty indefinite length array" do
+    assert_equal [], decode("9fff")
+  end
+
+  test "decodes indefinite length map" do
+    assert_equal({ "a" => 1, "b" => 2 }, decode("bf616101616202ff"))
+  end
+
+  test "decodes indefinite length byte string" do
+    assert_equal "\x01\x02\x03".b, decode("5f4201024103ff")
+  end
+
+  test "decodes indefinite length text string" do
+    result = decode("7f657374726561646d696e67ff")
+    assert_equal "streaming", result
+    assert_equal Encoding::UTF_8, result.encoding
+  end
+
+  test "decodes half-precision float 0.0" do
+    assert_equal 0.0, decode("f90000")
+  end
+
+  test "decodes half-precision float 1.0" do
+    assert_equal 1.0, decode("f93c00")
+  end
+
+  test "decodes half-precision float 1.5" do
+    assert_equal 1.5, decode("f93e00")
+  end
+
+  test "decodes half-precision float -4.0" do
+    assert_equal(-4.0, decode("f9c400"))
+  end
+
+  test "decodes half-precision positive infinity" do
+    assert_equal Float::INFINITY, decode("f97c00")
+  end
+
+  test "decodes half-precision NaN" do
+    assert_predicate decode("f97e00"), :nan?
+  end
+
+  test "decodes single-precision float 100000.0" do
+    assert_equal 100000.0, decode("fa47c35000")
+  end
+
+  test "decodes single-precision positive infinity" do
+    assert_equal Float::INFINITY, decode("fa7f800000")
+  end
+
+  test "decodes double-precision float 1.1" do
+    assert_in_delta 1.1, decode("fb3ff199999999999a"), 0.0001
+  end
+
+  test "decodes double-precision float -4.1" do
+    assert_in_delta(-4.1, decode("fbc010666666666666"), 0.0001)
+  end
+
+  test "decodes double-precision positive infinity" do
+    assert_equal Float::INFINITY, decode("fb7ff0000000000000")
+  end
+
+  test "decodes double-precision negative infinity" do
+    assert_equal(-Float::INFINITY, decode("fbfff0000000000000"))
+  end
+
+  test "raises error for unsupported simple value" do
+    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      decode("e0")
+    end
+  end
+
+  test "decode accepts string input" do
+    bytes = [ 0x01 ].pack("C*")
+    assert_equal 1, ActionPack::WebAuthn::CborDecoder.decode(bytes)
+  end
+
+  test "decode accepts array input" do
+    assert_equal 1, ActionPack::WebAuthn::CborDecoder.decode([ 0x01 ])
+  end
+
+  test "raises error for empty input" do
+    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      ActionPack::WebAuthn::CborDecoder.decode([])
+    end
+  end
+
+  test "raises error for truncated byte string" do
+    # 0x44 = byte string of length 4, but only 2 bytes follow
+    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      decode("440102")
+    end
+  end
+
+  test "raises error for truncated integer" do
+    # 0x19 = 2-byte integer follows, but only 1 byte provided
+    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      decode("19ff")
+    end
+  end
+
+  test "raises error for truncated array" do
+    # 0x82 = array of 2 items, but only 1 provided
+    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      decode("8201")
+    end
+  end
+
+  test "raises error for deeply nested structure" do
+    # Build array nested 20 levels deep: [[[[...]]]]
+    # 0x81 = array of 1 item
+    deeply_nested = "81" * 20 + "01"
+
+    error = assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      decode(deeply_nested)
+    end
+
+    assert_equal "Maximum nesting depth exceeded", error.message
+  end
+
+  test "raises error for input exceeding max size" do
+    error = assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+      ActionPack::WebAuthn::CborDecoder.decode([ 0x01 ], max_size: 0)
+    end
+
+    assert_equal "Input exceeds maximum size", error.message
+  end
+
+  private
+    def decode(hex)
+      bytes = [ hex ].pack("H*").bytes
+      ActionPack::WebAuthn::CborDecoder.decode(bytes)
+    end
+end
diff --git a/test/lib/action_pack/web_authn/cose_key_test.rb b/test/lib/action_pack/web_authn/cose_key_test.rb
new file mode 100644
index 000000000..a3f9a33e9
--- /dev/null
+++ b/test/lib/action_pack/web_authn/cose_key_test.rb
@@ -0,0 +1,161 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::CoseKeyTest < ActiveSupport::TestCase
+  setup do
+    # Generate a real EC key for valid test data
+    ec_key = OpenSSL::PKey::EC.generate("prime256v1")
+    public_key_bn = ec_key.public_key.to_bn
+    public_key_bytes = public_key_bn.to_s(2)
+    # Skip the 0x04 uncompressed point prefix
+    @ec2_x = public_key_bytes[1, 32]
+    @ec2_y = public_key_bytes[33, 32]
+
+    @ec2_parameters = {
+      1 => 2,    # kty: EC2
+      3 => -7,   # alg: ES256
+      -1 => 1,   # crv: P-256
+      -2 => @ec2_x,
+      -3 => @ec2_y
+    }
+
+    # Generate a real RSA key for valid test data
+    rsa_key = OpenSSL::PKey::RSA.new(2048)
+    @rsa_n = rsa_key.n.to_s(2)
+    @rsa_e = rsa_key.e.to_s(2)
+
+    @rsa_parameters = {
+      1 => 3,     # kty: RSA
+      3 => -257,  # alg: RS256
+      -1 => @rsa_n,
+      -2 => @rsa_e
+    }
+  end
+
+  test "initializes with key type, algorithm, and parameters" do
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 2,
+      algorithm: -7,
+      parameters: @ec2_parameters
+    )
+
+    assert_equal 2, key.key_type
+    assert_equal(-7, key.algorithm)
+    assert_equal @ec2_parameters, key.parameters
+  end
+
+  test "decodes EC2/ES256 key from CBOR" do
+    cbor = encode_cbor(@ec2_parameters)
+    key = ActionPack::WebAuthn::CoseKey.decode(cbor)
+
+    assert_equal 2, key.key_type
+    assert_equal(-7, key.algorithm)
+  end
+
+  test "decodes RSA/RS256 key from CBOR" do
+    cbor = encode_cbor(@rsa_parameters)
+    key = ActionPack::WebAuthn::CoseKey.decode(cbor)
+
+    assert_equal 3, key.key_type
+    assert_equal(-257, key.algorithm)
+  end
+
+  test "converts EC2/ES256 key to OpenSSL EC key" do
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 2,
+      algorithm: -7,
+      parameters: @ec2_parameters
+    )
+
+    openssl_key = key.to_openssl_key
+
+    assert_instance_of OpenSSL::PKey::EC, openssl_key
+    assert_equal "prime256v1", openssl_key.group.curve_name
+  end
+
+  test "converts RSA/RS256 key to OpenSSL RSA key" do
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 3,
+      algorithm: -257,
+      parameters: @rsa_parameters
+    )
+
+    openssl_key = key.to_openssl_key
+
+    assert_instance_of OpenSSL::PKey::RSA, openssl_key
+    assert_equal 65537, openssl_key.e.to_i
+  end
+
+  test "raises error for unsupported key type/algorithm combination" do
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 99,
+      algorithm: -7,
+      parameters: {}
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::CoseKey::UnsupportedKeyTypeError) do
+      key.to_openssl_key
+    end
+
+    assert_match(/99\/-7/, error.message)
+  end
+
+  test "raises error for unsupported EC curve" do
+    parameters = @ec2_parameters.merge(-1 => 2) # P-384 instead of P-256
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 2,
+      algorithm: -7,
+      parameters: parameters
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::CoseKey::UnsupportedKeyTypeError) do
+      key.to_openssl_key
+    end
+
+    assert_match(/curve/, error.message.downcase)
+  end
+
+  private
+    def encode_cbor(hash)
+      # CBOR map encoding
+      bytes = [ 0xa0 + hash.size ] # map with n items
+
+      hash.each do |key, value|
+        bytes.concat(encode_cbor_integer(key))
+        bytes.concat(encode_cbor_value(value))
+      end
+
+      bytes.pack("C*")
+    end
+
+    def encode_cbor_integer(int)
+      if int >= 0 && int <= 23
+        [ int ]
+      elsif int >= 0 && int <= 255
+        [ 0x18, int ]
+      elsif int >= -24 && int < 0
+        [ 0x20 - int - 1 ]
+      elsif int >= -256 && int < -24
+        [ 0x38, -int - 1 ]
+      else
+        # 16-bit negative integer
+        val = -int - 1
+        [ 0x39, (val >> 8) & 0xff, val & 0xff ]
+      end
+    end
+
+    def encode_cbor_value(value)
+      case value
+      when Integer
+        encode_cbor_integer(value)
+      when String
+        length = value.bytesize
+        if length <= 23
+          [ 0x40 + length, *value.bytes ]
+        elsif length <= 255
+          [ 0x58, length, *value.bytes ]
+        else
+          [ 0x59, (length >> 8) & 0xff, length & 0xff, *value.bytes ]
+        end
+      end
+    end
+end
diff --git a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
new file mode 100644
index 000000000..e4bd049c1
--- /dev/null
+++ b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
@@ -0,0 +1,101 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSupport::TestCase
+  setup do
+    @relying_party = ActionPack::WebAuthn::RelyingParty.new(id: "example.com", name: "Example App")
+    @options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+      id: "user-123",
+      name: "user@example.com",
+      display_name: "Test User",
+      relying_party: @relying_party
+    )
+  end
+
+  test "initializes with required parameters" do
+    assert_equal "user-123", @options.id
+    assert_equal "user@example.com", @options.name
+    assert_equal "Test User", @options.display_name
+    assert_equal @relying_party, @options.relying_party
+  end
+
+  test "generates base64url encoded challenge" do
+    assert_match(/\A[A-Za-z0-9_-]+\z/, @options.challenge)
+  end
+
+  test "generates challenge of correct length" do
+    decoded = Base64.urlsafe_decode64(@options.challenge)
+    assert_equal 32, decoded.bytesize
+  end
+
+  test "as_json" do
+    assert_equal @options.challenge, @options.as_json[:challenge]
+
+    assert_equal({ id: "example.com", name: "Example App" }, @options.as_json[:rp])
+
+    user = @options.as_json[:user]
+    assert_equal Base64.urlsafe_encode64("user-123", padding: false), user[:id]
+    assert_equal "user@example.com", user[:name]
+    assert_equal "Test User", user[:displayName]
+
+    assert_equal [
+      { type: "public-key", alg: -7 },
+      { type: "public-key", alg: -257 }
+    ], @options.as_json[:pubKeyCredParams]
+
+    assert_equal "preferred", @options.as_json[:authenticatorSelection][:residentKey]
+    assert_equal "preferred", @options.as_json[:authenticatorSelection][:userVerification]
+  end
+
+  test "as_json includes residentKey in authenticatorSelection" do
+    options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+      id: "user-123",
+      name: "user@example.com",
+      display_name: "Test User",
+      resident_key: :required,
+      relying_party: @relying_party
+    )
+
+    assert_equal "required", options.as_json[:authenticatorSelection][:residentKey]
+  end
+
+  test "as_json excludes excludeCredentials when empty" do
+    assert_nil @options.as_json[:excludeCredentials]
+  end
+
+  test "as_json includes excludeCredentials" do
+    credential = Struct.new(:id, :transports)
+    credentials = [
+      credential.new("cred-1", [ "usb", "nfc" ]),
+      credential.new("cred-2", [ "internal" ])
+    ]
+
+    options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+      id: "user-123",
+      name: "user@example.com",
+      display_name: "Test User",
+      exclude_credentials: credentials,
+      relying_party: @relying_party
+    )
+
+    assert_equal [
+      { type: "public-key", id: "cred-1", transports: [ "usb", "nfc" ] },
+      { type: "public-key", id: "cred-2", transports: [ "internal" ] }
+    ], options.as_json[:excludeCredentials]
+  end
+
+  test "as_json excludeCredentials omits transports when empty" do
+    credential = Struct.new(:id, :transports).new("cred-1", [])
+
+    options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+      id: "user-123",
+      name: "user@example.com",
+      display_name: "Test User",
+      exclude_credentials: [ credential ],
+      relying_party: @relying_party
+    )
+
+    assert_equal [
+      { type: "public-key", id: "cred-1" }
+    ], options.as_json[:excludeCredentials]
+  end
+end
diff --git a/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
new file mode 100644
index 000000000..4c6ee3baa
--- /dev/null
+++ b/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
@@ -0,0 +1,72 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::PublicKeyCredential::RequestOptionsTest < ActiveSupport::TestCase
+  setup do
+    @relying_party = ActionPack::WebAuthn::RelyingParty.new(id: "example.com", name: "Example App")
+    credential = Struct.new(:id, :transports)
+    @credentials = [
+      credential.new("credential-1", []),
+      credential.new("credential-2", [])
+    ]
+    @options = ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(
+      credentials: @credentials,
+      relying_party: @relying_party
+    )
+  end
+
+  test "initializes with required parameters" do
+    assert_equal @credentials, @options.credentials
+    assert_equal @relying_party, @options.relying_party
+  end
+
+  test "generates base64url encoded challenge" do
+    assert_match(/\A[A-Za-z0-9_-]+\z/, @options.challenge)
+  end
+
+  test "generates challenge of correct length" do
+    decoded = Base64.urlsafe_decode64(@options.challenge)
+    assert_equal 32, decoded.bytesize
+  end
+
+  test "as_json" do
+    assert_equal @options.challenge, @options.as_json[:challenge]
+    assert_equal "example.com", @options.as_json[:rpId]
+    assert_equal [
+      { type: "public-key", id: "credential-1" },
+      { type: "public-key", id: "credential-2" }
+    ], @options.as_json[:allowCredentials]
+    assert_equal "preferred", @options.as_json[:userVerification]
+  end
+
+  test "as_json includes transports when present" do
+    credential = Struct.new(:id, :transports)
+    credentials = [
+      credential.new("cred-1", [ "usb", "nfc" ]),
+      credential.new("cred-2", [ "internal" ])
+    ]
+
+    options = ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(
+      credentials: credentials,
+      relying_party: @relying_party
+    )
+
+    assert_equal [
+      { type: "public-key", id: "cred-1", transports: [ "usb", "nfc" ] },
+      { type: "public-key", id: "cred-2", transports: [ "internal" ] }
+    ], options.as_json[:allowCredentials]
+  end
+
+  test "as_json omits transports when empty" do
+    credential = Struct.new(:id, :transports)
+    credentials = [ credential.new("cred-1", []) ]
+
+    options = ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(
+      credentials: credentials,
+      relying_party: @relying_party
+    )
+
+    assert_equal [
+      { type: "public-key", id: "cred-1" }
+    ], options.as_json[:allowCredentials]
+  end
+end
diff --git a/test/lib/action_pack/web_authn/relying_party_test.rb b/test/lib/action_pack/web_authn/relying_party_test.rb
new file mode 100644
index 000000000..1ea06c425
--- /dev/null
+++ b/test/lib/action_pack/web_authn/relying_party_test.rb
@@ -0,0 +1,30 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::RelyingPartyTest < ActiveSupport::TestCase
+  test "initializes with explicit id and name" do
+    relying_party = ActionPack::WebAuthn::RelyingParty.new(id: "example.com", name: "Example App")
+
+    assert_equal "example.com", relying_party.id
+    assert_equal "Example App", relying_party.name
+  end
+
+  test "initializes with default id from Current.host" do
+    ActionPack::WebAuthn::Current.set(host: "default.example.com") do
+      relying_party = ActionPack::WebAuthn::RelyingParty.new(name: "Example App")
+
+      assert_equal "default.example.com", relying_party.id
+    end
+  end
+
+  test "initializes with default name from Rails application" do
+    relying_party = ActionPack::WebAuthn::RelyingParty.new(id: "example.com")
+
+    assert_equal Rails.application.name, relying_party.name
+  end
+
+  test "as_json returns id and name" do
+    relying_party = ActionPack::WebAuthn::RelyingParty.new(id: "example.com", name: "Example App")
+
+    assert_equal({ id: "example.com", name: "Example App" }, relying_party.as_json)
+  end
+end

From 6c58fd9bdd9d12445e1696cd6f2e2d0cefee1a6a Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Fri, 13 Feb 2026 16:58:06 +0100
Subject: [PATCH 092/107] Implement Passkey registration

- Create Identity credentials
- Add management UI and registration flow
---
 .../users/credentials_controller.rb           | 71 +++++++++++++++++++
 .../controllers/credential_controller.js      | 60 ++++++++++++++++
 .../controllers/passkey_controller.js         | 36 ++++++++++
 app/models/identity.rb                        |  1 +
 app/models/identity/credential.rb             | 13 ++++
 app/views/sessions/new.html.erb               |  4 +-
 .../users/credentials/_credential.html.erb    | 12 ++++
 app/views/users/credentials/index.html.erb    | 34 +++++++++
 app/views/users/credentials/new.html.erb      | 32 +++++++++
 app/views/users/show.html.erb                 |  5 ++
 config/routes.rb                              |  1 +
 ...60213154740_create_identity_credentials.rb | 17 +++++
 db/schema.rb                                  | 13 ++++
 .../web_authn/public_key_credential.rb        |  8 ++-
 .../creation_options_test.rb                  | 19 +++--
 .../request_options_test.rb                   | 23 +++---
 16 files changed, 330 insertions(+), 19 deletions(-)
 create mode 100644 app/controllers/users/credentials_controller.rb
 create mode 100644 app/javascript/controllers/credential_controller.js
 create mode 100644 app/javascript/controllers/passkey_controller.js
 create mode 100644 app/models/identity/credential.rb
 create mode 100644 app/views/users/credentials/_credential.html.erb
 create mode 100644 app/views/users/credentials/index.html.erb
 create mode 100644 app/views/users/credentials/new.html.erb
 create mode 100644 db/migrate/20260213154740_create_identity_credentials.rb

diff --git a/app/controllers/users/credentials_controller.rb b/app/controllers/users/credentials_controller.rb
new file mode 100644
index 000000000..63c623253
--- /dev/null
+++ b/app/controllers/users/credentials_controller.rb
@@ -0,0 +1,71 @@
+class Users::CredentialsController < ApplicationController
+  before_action :set_user
+  before_action :set_webauthn_host
+
+  def index
+    @credentials = identity.credentials.order(created_at: :desc)
+  end
+
+  def new
+    @creation_options = creation_options
+    session[:webauthn_challenge] = @creation_options.challenge
+  end
+
+  def create
+    public_key_credential = ActionPack::WebAuthn::PublicKeyCredential.create(
+      client_data_json: decode64(credential_response[:client_data_json]),
+      attestation_object: decode64(credential_response[:attestation_object]),
+      challenge: session.delete(:webauthn_challenge),
+      origin: request.base_url,
+      transports: Array(credential_response[:transports])
+    )
+
+    identity.credentials.create!(
+      name: params.dig(:credential, :name),
+      credential_id: public_key_credential.id,
+      public_key: public_key_credential.public_key.to_der,
+      sign_count: public_key_credential.sign_count,
+      transports: public_key_credential.transports
+    )
+
+    redirect_to user_credentials_path(@user)
+  end
+
+  def destroy
+    identity.credentials.find(params[:id]).destroy!
+    redirect_to user_credentials_path(@user)
+  end
+
+  private
+    def set_user
+      @user = Current.identity.users.find(params[:user_id])
+    end
+
+    def set_webauthn_host
+      ActionPack::WebAuthn::Current.host = request.host
+    end
+
+    def identity
+      @user.identity
+    end
+
+    def creation_options
+      ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+        id: identity.id,
+        name: identity.email_address,
+        display_name: @user.name,
+        resident_key: :required,
+        exclude_credentials: identity.credentials.map { |c| ExcludeCredential.new(c.credential_id, c.transports) }
+      )
+    end
+
+    def credential_response
+      params.expect(credential: { response: [ :client_data_json, :attestation_object, transports: [] ] })[:response]
+    end
+
+    def decode64(value)
+      Base64.urlsafe_decode64(value)
+    end
+
+    ExcludeCredential = Struct.new(:id, :transports)
+end
diff --git a/app/javascript/controllers/credential_controller.js b/app/javascript/controllers/credential_controller.js
new file mode 100644
index 000000000..1b882d05e
--- /dev/null
+++ b/app/javascript/controllers/credential_controller.js
@@ -0,0 +1,60 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static values = { publicKey: Object }
+  static targets = ["clientDataJSON", "attestationObject"]
+
+  async create(event) {
+    event.preventDefault()
+
+    try {
+      const publicKey = this.prepareOptions(this.publicKeyValue)
+      const credential = await navigator.credentials.create({ publicKey })
+      this.submitCredential(credential)
+    } catch (error) {
+      if (error.name !== "AbortError" && error.name !== "NotAllowedError") {
+        console.error("Registration failed:", error)
+      }
+    }
+  }
+
+  submitCredential(credential) {
+    this.clientDataJSONTarget.value = this.bufferToBase64url(credential.response.clientDataJSON)
+    this.attestationObjectTarget.value = this.bufferToBase64url(credential.response.attestationObject)
+
+    for (const transport of credential.response.getTransports?.() || []) {
+      const input = document.createElement("input")
+      input.type = "hidden"
+      input.name = "credential[response][transports][]"
+      input.value = transport
+      this.element.appendChild(input)
+    }
+
+    this.element.requestSubmit()
+  }
+
+  prepareOptions(options) {
+    return {
+      ...options,
+      challenge: this.base64urlToBuffer(options.challenge),
+      user: { ...options.user, id: this.base64urlToBuffer(options.user.id) },
+      excludeCredentials: (options.excludeCredentials || []).map(cred => ({
+        ...cred,
+        id: this.base64urlToBuffer(cred.id)
+      }))
+    }
+  }
+
+  base64urlToBuffer(base64url) {
+    const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/")
+    const padding = "=".repeat((4 - base64.length % 4) % 4)
+    const binary = atob(base64 + padding)
+    return Uint8Array.from(binary, c => c.charCodeAt(0)).buffer
+  }
+
+  bufferToBase64url(buffer) {
+    const bytes = new Uint8Array(buffer)
+    const binary = String.fromCharCode(...bytes)
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+  }
+}
diff --git a/app/javascript/controllers/passkey_controller.js b/app/javascript/controllers/passkey_controller.js
new file mode 100644
index 000000000..a652d0c8f
--- /dev/null
+++ b/app/javascript/controllers/passkey_controller.js
@@ -0,0 +1,36 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  connect() {
+    if (window.PublicKeyCredential?.isConditionalMediationAvailable) {
+      this.attemptConditionalMediation()
+    }
+  }
+
+  disconnect() {
+    this.abortController?.abort()
+  }
+
+  async attemptConditionalMediation() {
+    if (!await PublicKeyCredential.isConditionalMediationAvailable()) return
+
+    this.abortController = new AbortController()
+
+    try {
+      const credential = await navigator.credentials.get({
+        publicKey: {
+          challenge: crypto.getRandomValues(new Uint8Array(32)),
+          rpId: window.location.hostname
+        },
+        mediation: "conditional",
+        signal: this.abortController.signal
+      })
+
+      console.log("Passkey selected:", credential)
+    } catch (error) {
+      if (error.name !== "AbortError") {
+        console.error("Passkey error:", error)
+      }
+    }
+  }
+}
diff --git a/app/models/identity.rb b/app/models/identity.rb
index 18f4e3163..8e56ce196 100644
--- a/app/models/identity.rb
+++ b/app/models/identity.rb
@@ -2,6 +2,7 @@ class Identity < ApplicationRecord
   include Joinable, Transferable
 
   has_many :access_tokens, dependent: :destroy
+  has_many :credentials, dependent: :destroy
   has_many :magic_links, dependent: :destroy
   has_many :sessions, dependent: :destroy
   has_many :users, dependent: :nullify
diff --git a/app/models/identity/credential.rb b/app/models/identity/credential.rb
new file mode 100644
index 000000000..14093c943
--- /dev/null
+++ b/app/models/identity/credential.rb
@@ -0,0 +1,13 @@
+class Identity::Credential < ApplicationRecord
+  belongs_to :identity
+
+  serialize :transports, coder: JSON, type: Array, default: []
+
+  def to_public_key_credential
+    ActionPack::WebAuthn::PublicKeyCredential.new(
+      id: credential_id,
+      public_key: public_key,
+      transports: transports
+    )
+  end
+end
diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb
index 4e82c0b70..10293b5a0 100644
--- a/app/views/sessions/new.html.erb
+++ b/app/views/sessions/new.html.erb
@@ -1,12 +1,12 @@
 <% @page_title = "Enter your email" %>
 
-<div class="panel panel--centered flex flex-column gap-half">
+<div class="panel panel--centered flex flex-column gap-half" data-controller="passkey">
   <h1 class="txt-x-large font-weight-black margin-block-end">Get into Fizzy</h1>
 
   <%= form_with url: session_path, class: "flex flex-column gap-half txt-medium" do |form| %>
     <div class="flex align-center gap">
       <label class="flex align-center gap input input--actor">
-        <%= form.email_field :email_address, required: true, class: "input txt-large full-width", autofocus: true, autocomplete: "username", placeholder: "Enter your email address…" %>
+        <%= form.email_field :email_address, required: true, class: "input txt-large full-width", autofocus: true, autocomplete: "username webauthn", placeholder: "Enter your email address…" %>
       </label>
     </div>
 
diff --git a/app/views/users/credentials/_credential.html.erb b/app/views/users/credentials/_credential.html.erb
new file mode 100644
index 000000000..27c2d199f
--- /dev/null
+++ b/app/views/users/credentials/_credential.html.erb
@@ -0,0 +1,12 @@
+<tr style="view-transition-name: <%= dom_id(credential) %>">
+  <td><strong><%= credential.name.presence || "Passkey" %></strong></td>
+  <td><%= local_datetime_tag credential.created_at, style: :datetime %></td>
+  <td>
+    <%= button_to user_credential_path(@user, credential), method: :delete,
+          class: "btn txt-negative btn--circle txt-x-small borderless fill-transparent",
+          data: { turbo_confirm: "Are you sure you want to remove this passkey?" } do %>
+      <%= icon_tag "trash" %>
+      <span class="for-screen-reader">Remove this passkey</span>
+    <% end %>
+  </td>
+</tr>
diff --git a/app/views/users/credentials/index.html.erb b/app/views/users/credentials/index.html.erb
new file mode 100644
index 000000000..a5521f617
--- /dev/null
+++ b/app/views/users/credentials/index.html.erb
@@ -0,0 +1,34 @@
+<% @page_title = "Passkeys" %>
+
+<% content_for :header do %>
+  <div class="header__actions header__actions--start">
+    <%= back_link_to "My profile", user_path(@user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
+  </div>
+
+  <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
+<% end %>
+
+<section class="panel panel--wide shadow center">
+  <% if @credentials.any? %>
+    <p class="margin-none-block-start">Passkeys let you sign in without email codes. They use your device's biometrics, PIN, or security key.</p>
+    <table class="access_tokens_table margin-block-end-double max-width txt-small">
+      <thead>
+        <tr>
+          <th>Passkey</th>
+          <th>Created</th>
+          <th></th>
+        </tr>
+      </thead>
+      <tbody>
+        <%= render partial: "users/credentials/credential", collection: @credentials %>
+      </tbody>
+    </table>
+  <% else %>
+    <p class="margin-none-block-start">Passkeys let you sign in without email codes. They use your device's biometrics, PIN, or security key.</p>
+  <% end %>
+
+  <%= link_to new_user_credential_path(@user), class: "btn btn--link" do %>
+    <%= icon_tag "add" %>
+    <span>Add a passkey</span>
+  <% end %>
+</section>
diff --git a/app/views/users/credentials/new.html.erb b/app/views/users/credentials/new.html.erb
new file mode 100644
index 000000000..3e5e7abc0
--- /dev/null
+++ b/app/views/users/credentials/new.html.erb
@@ -0,0 +1,32 @@
+<% @page_title = "Add a passkey" %>
+
+<% content_for :header do %>
+  <div class="header__actions header__actions--start">
+    <%= back_link_to "Passkeys", user_credentials_path(@user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
+  </div>
+
+  <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
+<% end %>
+
+<article class="panel panel--wide shadow center txt-align-start">
+  <%= form_with url: user_credentials_path(@user),
+        data: { controller: "credential", credential_public_key_value: @creation_options.as_json },
+        html: { class: "flex flex-column gap" } do |form| %>
+    <p>A passkey lets you sign in using your device's biometrics, PIN, or security key — no email code needed.</p>
+
+    <div class="flex flex-column gap-half">
+      <strong><label for="credential_name">Passkey name</label></strong>
+      <input type="text" id="credential_name" name="credential[name]" required autofocus class="input" placeholder="e.g. MacBook Pro, iPhone">
+    </div>
+
+    <input type="hidden" name="credential[response][client_data_json]" data-credential-target="clientDataJSON">
+    <input type="hidden" name="credential[response][attestation_object]" data-credential-target="attestationObject">
+
+    <button type="button" data-action="credential#create" class="btn btn--link center txt-medium">
+      <%= icon_tag "add" %>
+      <span>Register passkey</span>
+    </button>
+  <% end %>
+
+  <%= link_to "Cancel and go back", user_credentials_path(@user), hidden: true %>
+</article>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index eb3e40c64..24e742601 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -5,6 +5,11 @@
   <div class="settings__panel panel shadow txt-align-center">
     <div class="flex flex-column gap position-relative">
       <% if Current.user == @user %>
+        <%= link_to user_credentials_path(@user), class: "user-edit-link btn", style: "inset: 0 auto auto 0", data: { controller: "tooltip" } do %>
+          🔑
+          <span class="for-screen-reader">Manage passkeys</span>
+        <% end %>
+
         <%= link_to edit_user_path(@user), class: "user-edit-link btn", data: { controller: "tooltip" } do %>
           <%= icon_tag "pencil" %>
           <span class="for-screen-reader">Edit profile</span>
diff --git a/config/routes.rb b/config/routes.rb
index 0ca383dda..4e0106d82 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -15,6 +15,7 @@ Rails.application.routes.draw do
       resource :avatar
       resource :role
       resource :events
+      resources :credentials, only: [ :index, :new, :create, :destroy ]
 
       resources :push_subscriptions
 
diff --git a/db/migrate/20260213154740_create_identity_credentials.rb b/db/migrate/20260213154740_create_identity_credentials.rb
new file mode 100644
index 000000000..b7bf70568
--- /dev/null
+++ b/db/migrate/20260213154740_create_identity_credentials.rb
@@ -0,0 +1,17 @@
+class CreateIdentityCredentials < ActiveRecord::Migration[8.2]
+  def change
+    create_table :identity_credentials, id: :uuid do |t|
+      t.uuid :identity_id, null: false
+      t.string :credential_id, null: false
+      t.binary :public_key, null: false
+      t.integer :sign_count, null: false, default: 0
+      t.string :name
+      t.text :transports
+
+      t.timestamps
+
+      t.index :identity_id
+      t.index :credential_id, unique: true
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 20cb0d161..76ab5b9a0 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -344,6 +344,19 @@ ActiveRecord::Schema[8.2].define(version: 2026_02_18_120000) do
     t.index ["identity_id"], name: "index_access_token_on_identity_id"
   end
 
+  create_table "identity_credentials", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.datetime "created_at", null: false
+    t.string "credential_id", null: false
+    t.uuid "identity_id", null: false
+    t.string "name"
+    t.binary "public_key", null: false
+    t.integer "sign_count", default: 0, null: false
+    t.text "transports"
+    t.datetime "updated_at", null: false
+    t.index ["credential_id"], name: "index_identity_credentials_on_credential_id", unique: true
+    t.index ["identity_id"], name: "index_identity_credentials_on_identity_id"
+  end
+
   create_table "magic_links", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "code", null: false
     t.datetime "created_at", null: false
diff --git a/lib/action_pack/web_authn/public_key_credential.rb b/lib/action_pack/web_authn/public_key_credential.rb
index 1e00b74fb..6ca8a99df 100644
--- a/lib/action_pack/web_authn/public_key_credential.rb
+++ b/lib/action_pack/web_authn/public_key_credential.rb
@@ -1,8 +1,8 @@
 class ActionPack::WebAuthn::PublicKeyCredential
-  attr_reader :id, :public_key, :sign_count, :owner
+  attr_reader :id, :public_key, :sign_count, :transports, :owner
 
   class << self
-    def create(client_data_json:, attestation_object:, challenge:, origin:, owner: nil)
+    def create(client_data_json:, attestation_object:, challenge:, origin:, transports: [], owner: nil)
       response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
         client_data_json: client_data_json,
         attestation_object: attestation_object
@@ -14,15 +14,17 @@ class ActionPack::WebAuthn::PublicKeyCredential
         id: response.attestation.credential_id,
         public_key: response.attestation.public_key,
         sign_count: response.attestation.sign_count,
+        transports: transports,
         owner: owner
       )
     end
   end
 
-  def initialize(id:, public_key:, sign_count:, owner: nil)
+  def initialize(id:, public_key:, sign_count:, transports: [], owner: nil)
     @id = id
     @public_key = public_key
     @sign_count = sign_count
+    @transports = transports
     @owner = owner
   end
 
diff --git a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
index e4bd049c1..010dd5464 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
@@ -63,10 +63,9 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
   end
 
   test "as_json includes excludeCredentials" do
-    credential = Struct.new(:id, :transports)
     credentials = [
-      credential.new("cred-1", [ "usb", "nfc" ]),
-      credential.new("cred-2", [ "internal" ])
+      build_credential(id: "cred-1", transports: [ "usb", "nfc" ]),
+      build_credential(id: "cred-2", transports: [ "internal" ])
     ]
 
     options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
@@ -84,13 +83,11 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
   end
 
   test "as_json excludeCredentials omits transports when empty" do
-    credential = Struct.new(:id, :transports).new("cred-1", [])
-
     options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
       id: "user-123",
       name: "user@example.com",
       display_name: "Test User",
-      exclude_credentials: [ credential ],
+      exclude_credentials: [ build_credential(id: "cred-1") ],
       relying_party: @relying_party
     )
 
@@ -98,4 +95,14 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
       { type: "public-key", id: "cred-1" }
     ], options.as_json[:excludeCredentials]
   end
+
+  private
+    def build_credential(id:, transports: [])
+      ActionPack::WebAuthn::PublicKeyCredential.new(
+        id: id,
+        public_key: OpenSSL::PKey::EC.generate("prime256v1"),
+        sign_count: 0,
+        transports: transports
+      )
+    end
 end
diff --git a/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
index 4c6ee3baa..96c064ffc 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
@@ -3,10 +3,9 @@ require "test_helper"
 class ActionPack::WebAuthn::PublicKeyCredential::RequestOptionsTest < ActiveSupport::TestCase
   setup do
     @relying_party = ActionPack::WebAuthn::RelyingParty.new(id: "example.com", name: "Example App")
-    credential = Struct.new(:id, :transports)
     @credentials = [
-      credential.new("credential-1", []),
-      credential.new("credential-2", [])
+      build_credential(id: "credential-1"),
+      build_credential(id: "credential-2")
     ]
     @options = ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(
       credentials: @credentials,
@@ -39,10 +38,9 @@ class ActionPack::WebAuthn::PublicKeyCredential::RequestOptionsTest < ActiveSupp
   end
 
   test "as_json includes transports when present" do
-    credential = Struct.new(:id, :transports)
     credentials = [
-      credential.new("cred-1", [ "usb", "nfc" ]),
-      credential.new("cred-2", [ "internal" ])
+      build_credential(id: "cred-1", transports: [ "usb", "nfc" ]),
+      build_credential(id: "cred-2", transports: [ "internal" ])
     ]
 
     options = ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(
@@ -57,8 +55,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::RequestOptionsTest < ActiveSupp
   end
 
   test "as_json omits transports when empty" do
-    credential = Struct.new(:id, :transports)
-    credentials = [ credential.new("cred-1", []) ]
+    credentials = [ build_credential(id: "cred-1") ]
 
     options = ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(
       credentials: credentials,
@@ -69,4 +66,14 @@ class ActionPack::WebAuthn::PublicKeyCredential::RequestOptionsTest < ActiveSupp
       { type: "public-key", id: "cred-1" }
     ], options.as_json[:allowCredentials]
   end
+
+  private
+    def build_credential(id:, transports: [])
+      ActionPack::WebAuthn::PublicKeyCredential.new(
+        id: id,
+        public_key: OpenSSL::PKey::EC.generate("prime256v1"),
+        sign_count: 0,
+        transports: transports
+      )
+    end
 end

From 70c19e488113bd745d52e5caeb11a7e2c44f5760 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Tue, 17 Feb 2026 15:44:10 -0600
Subject: [PATCH 093/107] Style polish

---
 app/assets/stylesheets/access-tokens.css      | 26 ++++++++++++++-----
 .../users/credentials/_credential.html.erb    |  4 +--
 app/views/users/credentials/index.html.erb    |  9 +++----
 app/views/users/credentials/new.html.erb      |  5 ++--
 4 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/app/assets/stylesheets/access-tokens.css b/app/assets/stylesheets/access-tokens.css
index a0f54f91c..1fcecb52e 100644
--- a/app/assets/stylesheets/access-tokens.css
+++ b/app/assets/stylesheets/access-tokens.css
@@ -1,19 +1,33 @@
-.access_tokens_table {
+.access-tokens {
   border-collapse: collapse;
+  font-size: var(--text-small);
   inline-size: 100%;
+  margin-block-end: 2lh;
 
   td, th {
-    border-block-end: 1px solid var(--color-ink-light);
-    padding-inline: var(--inline-space);
+    border-block-end: 1px solid var(--color-ink-lighter);
     text-align: start;
+
+    &:first-child {
+      inline-size: 100%;
+    }
+
+    &:not(:first-child) {
+      padding-inline-start: var(--inline-space);
+    }
+
+    &:not(:last-child) {
+      padding-inline-end: var(--inline-space);
+    }
   }
 
   th {
+    color: var(--color-ink-dark);
     font-size: var(--text-x-small);
     text-transform: uppercase;
   }
 
-  tr:nth-of-type(even) {
-    background-color: var(--color-ink-lightest);
+  td {
+    padding-block: 8px;
   }
-}
\ No newline at end of file
+}
diff --git a/app/views/users/credentials/_credential.html.erb b/app/views/users/credentials/_credential.html.erb
index 27c2d199f..f532552c3 100644
--- a/app/views/users/credentials/_credential.html.erb
+++ b/app/views/users/credentials/_credential.html.erb
@@ -1,9 +1,9 @@
 <tr style="view-transition-name: <%= dom_id(credential) %>">
   <td><strong><%= credential.name.presence || "Passkey" %></strong></td>
-  <td><%= local_datetime_tag credential.created_at, style: :datetime %></td>
+  <td class="txt-nowrap"><%= local_datetime_tag credential.created_at, style: :datetime %></td>
   <td>
     <%= button_to user_credential_path(@user, credential), method: :delete,
-          class: "btn txt-negative btn--circle txt-x-small borderless fill-transparent",
+          class: "btn btn--circle txt-negative txt-xx-small borderless",
           data: { turbo_confirm: "Are you sure you want to remove this passkey?" } do %>
       <%= icon_tag "trash" %>
       <span class="for-screen-reader">Remove this passkey</span>
diff --git a/app/views/users/credentials/index.html.erb b/app/views/users/credentials/index.html.erb
index a5521f617..28febe77f 100644
--- a/app/views/users/credentials/index.html.erb
+++ b/app/views/users/credentials/index.html.erb
@@ -8,10 +8,11 @@
   <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
 <% end %>
 
-<section class="panel panel--wide shadow center">
+<section class="panel panel--wide shadow center txt-align-start">
+  <p class="margin-none-block-start">Passkeys let you sign in using your device’s biometrics, PIN, or security key&mdash;no email code needed.</p>
+
   <% if @credentials.any? %>
-    <p class="margin-none-block-start">Passkeys let you sign in without email codes. They use your device's biometrics, PIN, or security key.</p>
-    <table class="access_tokens_table margin-block-end-double max-width txt-small">
+    <table class="access-tokens">
       <thead>
         <tr>
           <th>Passkey</th>
@@ -23,8 +24,6 @@
         <%= render partial: "users/credentials/credential", collection: @credentials %>
       </tbody>
     </table>
-  <% else %>
-    <p class="margin-none-block-start">Passkeys let you sign in without email codes. They use your device's biometrics, PIN, or security key.</p>
   <% end %>
 
   <%= link_to new_user_credential_path(@user), class: "btn btn--link" do %>
diff --git a/app/views/users/credentials/new.html.erb b/app/views/users/credentials/new.html.erb
index 3e5e7abc0..722a6f612 100644
--- a/app/views/users/credentials/new.html.erb
+++ b/app/views/users/credentials/new.html.erb
@@ -8,11 +8,10 @@
   <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
 <% end %>
 
-<article class="panel panel--wide shadow center txt-align-start">
+<section class="panel panel--wide shadow center txt-align-start">
   <%= form_with url: user_credentials_path(@user),
         data: { controller: "credential", credential_public_key_value: @creation_options.as_json },
         html: { class: "flex flex-column gap" } do |form| %>
-    <p>A passkey lets you sign in using your device's biometrics, PIN, or security key — no email code needed.</p>
 
     <div class="flex flex-column gap-half">
       <strong><label for="credential_name">Passkey name</label></strong>
@@ -29,4 +28,4 @@
   <% end %>
 
   <%= link_to "Cancel and go back", user_credentials_path(@user), hidden: true %>
-</article>
+</section>

From da690394765eb803c552ac8c858f6eb57afb722d Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Wed, 18 Feb 2026 11:24:10 +0100
Subject: [PATCH 094/107] Implement Passkey authentication

---
 app/assets/images/key.svg                     |   1 +
 app/assets/stylesheets/icons.css              |   1 +
 app/controllers/concerns/current_request.rb   |   2 +
 .../sessions/passkeys_controller.rb           |  54 +++++++
 app/controllers/sessions_controller.rb        |   3 +
 .../users/credentials_controller.rb           |  63 ++------
 .../controllers/credential_controller.js      |   2 +-
 .../controllers/passkey_controller.js         |  82 ++++++++--
 app/models/identity/credential.rb             |  56 ++++++-
 app/views/sessions/new.html.erb               |  14 +-
 .../users/credentials/_credential.html.erb    |   3 +-
 app/views/users/credentials/index.html.erb    |   5 +-
 app/views/users/credentials/new.html.erb      |  10 +-
 app/views/users/show.html.erb                 |   2 +-
 config/routes.rb                              |   1 +
 .../public_key_credential/creation_options.rb |   1 +
 .../sessions/passkeys_controller_test.rb      | 144 ++++++++++++++++++
 .../creation_options_test.rb                  |   2 +
 18 files changed, 368 insertions(+), 78 deletions(-)
 create mode 100644 app/assets/images/key.svg
 create mode 100644 app/controllers/sessions/passkeys_controller.rb
 create mode 100644 test/controllers/sessions/passkeys_controller_test.rb

diff --git a/app/assets/images/key.svg b/app/assets/images/key.svg
new file mode 100644
index 000000000..386e0b501
--- /dev/null
+++ b/app/assets/images/key.svg
@@ -0,0 +1 @@
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="m12.65 10c-.83-2.33-3.05-4-5.65-4-3.31 0-6 2.69-6 6s2.69 6 6 6c2.61 0 4.83-1.67 5.65-4h4.35v4h4v-4h2v-4zm-5.65 4c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2z"/></svg>
\ No newline at end of file
diff --git a/app/assets/stylesheets/icons.css b/app/assets/stylesheets/icons.css
index 42a3a21ec..35680e429 100644
--- a/app/assets/stylesheets/icons.css
+++ b/app/assets/stylesheets/icons.css
@@ -62,6 +62,7 @@
   .icon--history { --svg: url("history.svg "); }
   .icon--home { --svg: url("home.svg "); }
   .icon--install-edge { --svg: url("install-edge.svg "); }
+  .icon--key { --svg: url("key.svg "); }
   .icon--lifebuoy { --svg: url("lifebuoy.svg "); }
   .icon--lock { --svg: url("lock.svg "); }
   .icon--logout { --svg: url("logout.svg "); }
diff --git a/app/controllers/concerns/current_request.rb b/app/controllers/concerns/current_request.rb
index 15f574ab0..193a2713b 100644
--- a/app/controllers/concerns/current_request.rb
+++ b/app/controllers/concerns/current_request.rb
@@ -8,6 +8,8 @@ module CurrentRequest
       Current.user_agent  = request.user_agent
       Current.ip_address  = request.ip
       Current.referrer    = request.referrer
+
+      ActionPack::WebAuthn::Current.host = request.host
     end
   end
 end
diff --git a/app/controllers/sessions/passkeys_controller.rb b/app/controllers/sessions/passkeys_controller.rb
new file mode 100644
index 000000000..5b997260b
--- /dev/null
+++ b/app/controllers/sessions/passkeys_controller.rb
@@ -0,0 +1,54 @@
+class Sessions::PasskeysController < ApplicationController
+  disallow_account_scope
+  require_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: :rate_limit_exceeded
+
+  def create
+    credential = Identity::Credential.authenticate(
+      id: params.expect(:credential_id),
+      client_data_json: response_params[:client_data_json],
+      authenticator_data: response_params[:authenticator_data],
+      signature: response_params[:signature],
+      challenge: session.delete(:webauthn_challenge),
+      origin: request.base_url
+    )
+
+    if credential
+      authentication_succeeded(credential.identity)
+    else
+      authentication_failed
+    end
+  end
+
+  private
+    def response_params
+      params.expect(response: [ :client_data_json, :authenticator_data, :signature ])
+    end
+
+    def authentication_succeeded(identity)
+      start_new_session_for identity
+
+      respond_to do |format|
+        format.html { redirect_to after_authentication_url }
+        format.json { render json: { session_token: session_token } }
+      end
+    end
+
+    def authentication_failed
+      alert_message = "That passkey didn't work. Try again."
+
+      respond_to do |format|
+        format.html { redirect_to new_session_path, alert: alert_message }
+        format.json { render json: { message: alert_message }, status: :unauthorized }
+      end
+    end
+
+    def rate_limit_exceeded
+      rate_limit_exceeded_message = "Try again later."
+
+      respond_to do |format|
+        format.html { redirect_to new_session_path, alert: rate_limit_exceeded_message }
+        format.json { render json: { message: rate_limit_exceeded_message }, status: :too_many_requests }
+      end
+    end
+end
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index cabcfa143..eb7fa8309 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -6,6 +6,8 @@ class SessionsController < ApplicationController
   layout "public"
 
   def new
+    @request_options = Identity::Credential.request_options
+    session[:webauthn_challenge] = @request_options.challenge
   end
 
   def create
@@ -67,4 +69,5 @@ class SessionsController < ApplicationController
         end
       end
     end
+
 end
diff --git a/app/controllers/users/credentials_controller.rb b/app/controllers/users/credentials_controller.rb
index 63c623253..65ebe42ff 100644
--- a/app/controllers/users/credentials_controller.rb
+++ b/app/controllers/users/credentials_controller.rb
@@ -1,71 +1,40 @@
 class Users::CredentialsController < ApplicationController
-  before_action :set_user
-  before_action :set_webauthn_host
+  before_action :set_credential, only: :destroy
 
   def index
-    @credentials = identity.credentials.order(created_at: :desc)
+    @credentials = Current.identity.credentials.order(name: :asc, created_at: :desc)
   end
 
   def new
-    @creation_options = creation_options
+    @creation_options = Identity::Credential.creation_options(identity: Current.identity, display_name: Current.user.name)
     session[:webauthn_challenge] = @creation_options.challenge
   end
 
   def create
-    public_key_credential = ActionPack::WebAuthn::PublicKeyCredential.create(
-      client_data_json: decode64(credential_response[:client_data_json]),
-      attestation_object: decode64(credential_response[:attestation_object]),
+    Identity::Credential.register(
+      identity: Current.identity,
+      name: credential_params[:name],
+      client_data_json: credential_params[:client_data_json],
+      attestation_object: credential_params[:attestation_object],
       challenge: session.delete(:webauthn_challenge),
       origin: request.base_url,
-      transports: Array(credential_response[:transports])
+      transports: Array(credential_params[:transports])
     )
 
-    identity.credentials.create!(
-      name: params.dig(:credential, :name),
-      credential_id: public_key_credential.id,
-      public_key: public_key_credential.public_key.to_der,
-      sign_count: public_key_credential.sign_count,
-      transports: public_key_credential.transports
-    )
-
-    redirect_to user_credentials_path(@user)
+    redirect_to user_credentials_path(Current.user)
   end
 
   def destroy
-    identity.credentials.find(params[:id]).destroy!
-    redirect_to user_credentials_path(@user)
+    @credential.destroy!
+    redirect_to user_credentials_path(Current.user)
   end
 
   private
-    def set_user
-      @user = Current.identity.users.find(params[:user_id])
+    def set_credential
+      @credential = Current.identity.credentials.find(params[:id])
     end
 
-    def set_webauthn_host
-      ActionPack::WebAuthn::Current.host = request.host
+    def credential_params
+      params.expect(credential: [ :name, :client_data_json, :attestation_object, transports: [] ])
     end
-
-    def identity
-      @user.identity
-    end
-
-    def creation_options
-      ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
-        id: identity.id,
-        name: identity.email_address,
-        display_name: @user.name,
-        resident_key: :required,
-        exclude_credentials: identity.credentials.map { |c| ExcludeCredential.new(c.credential_id, c.transports) }
-      )
-    end
-
-    def credential_response
-      params.expect(credential: { response: [ :client_data_json, :attestation_object, transports: [] ] })[:response]
-    end
-
-    def decode64(value)
-      Base64.urlsafe_decode64(value)
-    end
-
-    ExcludeCredential = Struct.new(:id, :transports)
 end
diff --git a/app/javascript/controllers/credential_controller.js b/app/javascript/controllers/credential_controller.js
index 1b882d05e..bd9b0baee 100644
--- a/app/javascript/controllers/credential_controller.js
+++ b/app/javascript/controllers/credential_controller.js
@@ -25,7 +25,7 @@ export default class extends Controller {
     for (const transport of credential.response.getTransports?.() || []) {
       const input = document.createElement("input")
       input.type = "hidden"
-      input.name = "credential[response][transports][]"
+      input.name = "credential[transports][]"
       input.value = transport
       this.element.appendChild(input)
     }
diff --git a/app/javascript/controllers/passkey_controller.js b/app/javascript/controllers/passkey_controller.js
index a652d0c8f..87145db77 100644
--- a/app/javascript/controllers/passkey_controller.js
+++ b/app/javascript/controllers/passkey_controller.js
@@ -1,36 +1,92 @@
 import { Controller } from "@hotwired/stimulus"
 
 export default class extends Controller {
+  static values = { publicKey: Object, url: String, csrfToken: String }
+
+  #abortController
+
   connect() {
-    if (window.PublicKeyCredential?.isConditionalMediationAvailable) {
-      this.attemptConditionalMediation()
-    }
+    this.#attemptConditionalMediation()
   }
 
   disconnect() {
-    this.abortController?.abort()
+    this.#abortController?.abort()
   }
 
-  async attemptConditionalMediation() {
-    if (!await PublicKeyCredential.isConditionalMediationAvailable()) return
+  async #attemptConditionalMediation() {
+    if (!await PublicKeyCredential?.isConditionalMediationAvailable?.()) return
 
-    this.abortController = new AbortController()
+    this.#abortController = new AbortController()
 
     try {
       const credential = await navigator.credentials.get({
-        publicKey: {
-          challenge: crypto.getRandomValues(new Uint8Array(32)),
-          rpId: window.location.hostname
-        },
+        publicKey: this.#prepareOptions(this.publicKeyValue),
         mediation: "conditional",
-        signal: this.abortController.signal
+        signal: this.#abortController.signal
       })
 
-      console.log("Passkey selected:", credential)
+      this.#submitAssertion(credential)
     } catch (error) {
       if (error.name !== "AbortError") {
         console.error("Passkey error:", error)
       }
     }
   }
+
+  #submitAssertion(credential) {
+    const form = document.createElement("form")
+    form.method = "POST"
+    form.action = this.urlValue
+    form.style.display = "none"
+
+    const fields = {
+      authenticity_token: this.csrfTokenValue,
+      credential_id: credential.id,
+      "response[client_data_json]": new TextDecoder().decode(credential.response.clientDataJSON),
+      "response[authenticator_data]": this.#bufferToBase64url(credential.response.authenticatorData),
+      "response[signature]": this.#bufferToBase64url(credential.response.signature)
+    }
+
+    for (const [name, value] of Object.entries(fields)) {
+      const input = document.createElement("input")
+      input.type = "hidden"
+      input.name = name
+      input.value = value
+      form.appendChild(input)
+    }
+
+    document.body.appendChild(form)
+    form.submit()
+  }
+
+  #prepareOptions(options) {
+    const prepared = {
+      ...options,
+      challenge: this.#base64urlToBuffer(options.challenge)
+    }
+
+    if (options.allowCredentials?.length) {
+      prepared.allowCredentials = options.allowCredentials.map(cred => ({
+        ...cred,
+        id: this.#base64urlToBuffer(cred.id)
+      }))
+    } else {
+      delete prepared.allowCredentials
+    }
+
+    return prepared
+  }
+
+  #base64urlToBuffer(base64url) {
+    const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/")
+    const padding = "=".repeat((4 - base64.length % 4) % 4)
+    const binary = atob(base64 + padding)
+    return Uint8Array.from(binary, c => c.charCodeAt(0)).buffer
+  }
+
+  #bufferToBase64url(buffer) {
+    const bytes = new Uint8Array(buffer)
+    const binary = String.fromCharCode(...bytes)
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+  }
 }
diff --git a/app/models/identity/credential.rb b/app/models/identity/credential.rb
index 14093c943..eb03add28 100644
--- a/app/models/identity/credential.rb
+++ b/app/models/identity/credential.rb
@@ -3,10 +3,64 @@ class Identity::Credential < ApplicationRecord
 
   serialize :transports, coder: JSON, type: Array, default: []
 
+  class << self
+    def creation_options(identity:, display_name:)
+      ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+        id: identity.id,
+        name: identity.email_address,
+        display_name: display_name,
+        resident_key: :required,
+        exclude_credentials: identity.credentials.map(&:to_public_key_credential)
+      )
+    end
+
+    def request_options(credentials: [])
+      ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(credentials: credentials.map(&:to_public_key_credential))
+    end
+
+    def authenticate(id:, **params)
+      find_by(credential_id: id)&.authenticate(**params)
+    end
+
+    def register(identity:, name:, client_data_json:, attestation_object:, challenge:, origin:, transports: [])
+      public_key_credential = ActionPack::WebAuthn::PublicKeyCredential.create(
+        client_data_json: Base64.urlsafe_decode64(client_data_json),
+        attestation_object: Base64.urlsafe_decode64(attestation_object),
+        challenge: challenge,
+        origin: origin,
+        transports: transports
+      )
+
+      identity.credentials.create!(
+        name: name,
+        credential_id: public_key_credential.id,
+        public_key: public_key_credential.public_key.to_der,
+        sign_count: public_key_credential.sign_count,
+        transports: public_key_credential.transports
+      )
+    end
+  end
+
+  def authenticate(client_data_json:, authenticator_data:, signature:, challenge:, origin:)
+    pkc = to_public_key_credential
+    pkc.authenticate(
+      client_data_json: client_data_json,
+      authenticator_data: Base64.urlsafe_decode64(authenticator_data),
+      signature: Base64.urlsafe_decode64(signature),
+      challenge: challenge,
+      origin: origin
+    )
+    update!(sign_count: pkc.sign_count)
+    self
+  rescue ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError
+    nil
+  end
+
   def to_public_key_credential
     ActionPack::WebAuthn::PublicKeyCredential.new(
       id: credential_id,
-      public_key: public_key,
+      public_key: OpenSSL::PKey.read(public_key),
+      sign_count: sign_count,
       transports: transports
     )
   end
diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb
index 10293b5a0..553236f1d 100644
--- a/app/views/sessions/new.html.erb
+++ b/app/views/sessions/new.html.erb
@@ -1,26 +1,30 @@
 <% @page_title = "Enter your email" %>
 
-<div class="panel panel--centered flex flex-column gap-half" data-controller="passkey">
+<div class="panel panel--centered flex flex-column gap-half" data-controller="passkey"
+  data-passkey-public-key-value="<%= @request_options.as_json.to_json %>"
+  data-passkey-url-value="<%= session_passkey_path %>"
+  data-passkey-csrf-token-value="<%= form_authenticity_token %>">
   <h1 class="txt-x-large font-weight-black margin-block-end">Get into Fizzy</h1>
 
   <%= form_with url: session_path, class: "flex flex-column gap-half txt-medium" do |form| %>
     <div class="flex align-center gap">
       <label class="flex align-center gap input input--actor">
-        <%= form.email_field :email_address, required: true, class: "input txt-large full-width", autofocus: true, autocomplete: "username webauthn", placeholder: "Enter your email address…" %>
+        <%= form.email_field :email_address, required: true, class: "input txt-large full-width", autofocus: true, autocomplete: "email webauthn", placeholder: "Enter your email address…" %>
       </label>
     </div>
 
     <% if Account.accepting_signups? %>
-      <p><strong>New here?</strong> <%= link_to "Sign up", new_signup_path %> to create an account. <strong>Already have an account?</strong> Enter your email and we’ll get you signed in.</p>
+      <p><strong>New here?</strong> <%= link_to "Sign up", new_signup_path %> to create an account. <strong>Already have an account?</strong> Enter your email and we'll get you signed in.</p>
     <% else %>
-      <p>Enter your email and we’ll get you signed in.</p>
+      <p>Enter your email and we'll get you signed in.</p>
     <% end %>
 
     <button type="submit" id="log_in" class="btn btn--link center txt-medium">
-      <span>Let’s go</span>
+      <span>Let's go</span>
       <%= icon_tag "arrow-right" %>
     </button>
   <% end %>
+
 </div>
 
 <% content_for :footer do %>
diff --git a/app/views/users/credentials/_credential.html.erb b/app/views/users/credentials/_credential.html.erb
index f532552c3..a240fc46f 100644
--- a/app/views/users/credentials/_credential.html.erb
+++ b/app/views/users/credentials/_credential.html.erb
@@ -1,8 +1,7 @@
 <tr style="view-transition-name: <%= dom_id(credential) %>">
   <td><strong><%= credential.name.presence || "Passkey" %></strong></td>
-  <td class="txt-nowrap"><%= local_datetime_tag credential.created_at, style: :datetime %></td>
   <td>
-    <%= button_to user_credential_path(@user, credential), method: :delete,
+    <%= button_to user_credential_path(Current.user, credential), method: :delete,
           class: "btn btn--circle txt-negative txt-xx-small borderless",
           data: { turbo_confirm: "Are you sure you want to remove this passkey?" } do %>
       <%= icon_tag "trash" %>
diff --git a/app/views/users/credentials/index.html.erb b/app/views/users/credentials/index.html.erb
index 28febe77f..3b54e1e9f 100644
--- a/app/views/users/credentials/index.html.erb
+++ b/app/views/users/credentials/index.html.erb
@@ -2,7 +2,7 @@
 
 <% content_for :header do %>
   <div class="header__actions header__actions--start">
-    <%= back_link_to "My profile", user_path(@user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
+    <%= back_link_to "My profile", user_path(Current.user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
   </div>
 
   <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
@@ -16,7 +16,6 @@
       <thead>
         <tr>
           <th>Passkey</th>
-          <th>Created</th>
           <th></th>
         </tr>
       </thead>
@@ -26,7 +25,7 @@
     </table>
   <% end %>
 
-  <%= link_to new_user_credential_path(@user), class: "btn btn--link" do %>
+  <%= link_to new_user_credential_path(Current.user), class: "btn btn--link" do %>
     <%= icon_tag "add" %>
     <span>Add a passkey</span>
   <% end %>
diff --git a/app/views/users/credentials/new.html.erb b/app/views/users/credentials/new.html.erb
index 722a6f612..15ad75378 100644
--- a/app/views/users/credentials/new.html.erb
+++ b/app/views/users/credentials/new.html.erb
@@ -2,14 +2,14 @@
 
 <% content_for :header do %>
   <div class="header__actions header__actions--start">
-    <%= back_link_to "Passkeys", user_credentials_path(@user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
+    <%= back_link_to "Passkeys", user_credentials_path(Current.user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
   </div>
 
   <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
 <% end %>
 
 <section class="panel panel--wide shadow center txt-align-start">
-  <%= form_with url: user_credentials_path(@user),
+  <%= form_with url: user_credentials_path(Current.user),
         data: { controller: "credential", credential_public_key_value: @creation_options.as_json },
         html: { class: "flex flex-column gap" } do |form| %>
 
@@ -18,8 +18,8 @@
       <input type="text" id="credential_name" name="credential[name]" required autofocus class="input" placeholder="e.g. MacBook Pro, iPhone">
     </div>
 
-    <input type="hidden" name="credential[response][client_data_json]" data-credential-target="clientDataJSON">
-    <input type="hidden" name="credential[response][attestation_object]" data-credential-target="attestationObject">
+    <input type="hidden" name="credential[client_data_json]" data-credential-target="clientDataJSON">
+    <input type="hidden" name="credential[attestation_object]" data-credential-target="attestationObject">
 
     <button type="button" data-action="credential#create" class="btn btn--link center txt-medium">
       <%= icon_tag "add" %>
@@ -27,5 +27,5 @@
     </button>
   <% end %>
 
-  <%= link_to "Cancel and go back", user_credentials_path(@user), hidden: true %>
+  <%= link_to "Cancel and go back", user_credentials_path(Current.user), hidden: true %>
 </section>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 24e742601..ad4ba3a59 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -6,7 +6,7 @@
     <div class="flex flex-column gap position-relative">
       <% if Current.user == @user %>
         <%= link_to user_credentials_path(@user), class: "user-edit-link btn", style: "inset: 0 auto auto 0", data: { controller: "tooltip" } do %>
-          🔑
+          <%= icon_tag "key" %>
           <span class="for-screen-reader">Manage passkeys</span>
         <% end %>
 
diff --git a/config/routes.rb b/config/routes.rb
index 4e0106d82..d1ca55416 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -157,6 +157,7 @@ Rails.application.routes.draw do
       resources :transfers
       resource :magic_link
       resource :menu
+      resource :passkey, only: :create
     end
   end
 
diff --git a/lib/action_pack/web_authn/public_key_credential/creation_options.rb b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
index 0497a2bad..46510ad62 100644
--- a/lib/action_pack/web_authn/public_key_credential/creation_options.rb
+++ b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
@@ -95,6 +95,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::W
       ],
       authenticatorSelection: {
         residentKey: @resident_key.to_s,
+        requireResidentKey: @resident_key == :required,
         userVerification: user_verification.to_s
       }
     }
diff --git a/test/controllers/sessions/passkeys_controller_test.rb b/test/controllers/sessions/passkeys_controller_test.rb
new file mode 100644
index 000000000..88512f2df
--- /dev/null
+++ b/test/controllers/sessions/passkeys_controller_test.rb
@@ -0,0 +1,144 @@
+require "test_helper"
+
+class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @identity = identities(:kevin)
+    @private_key = OpenSSL::PKey::EC.generate("prime256v1")
+
+    @credential = @identity.credentials.create!(
+      name: "Test Passkey",
+      credential_id: Base64.urlsafe_encode64(SecureRandom.random_bytes(32), padding: false),
+      public_key: @private_key.public_to_der,
+      sign_count: 0,
+      transports: [ "internal" ]
+    )
+  end
+
+  test "successful authentication" do
+    untenanted do
+      get new_session_url
+      challenge = session[:webauthn_challenge]
+
+      post session_passkey_url, params: assertion_params(challenge: challenge)
+
+      assert_response :redirect
+      assert cookies[:session_token].present?
+      assert_redirected_to landing_path
+    end
+  end
+
+  test "updates sign count" do
+    untenanted do
+      get new_session_url
+      challenge = session[:webauthn_challenge]
+
+      post session_passkey_url, params: assertion_params(challenge: challenge, sign_count: 1)
+
+      assert_equal 1, @credential.reload.sign_count
+    end
+  end
+
+  test "rejects invalid signature" do
+    untenanted do
+      get new_session_url
+      challenge = session[:webauthn_challenge]
+
+      params = assertion_params(challenge: challenge)
+      params[:response][:signature] = Base64.urlsafe_encode64("invalid", padding: false)
+
+      post session_passkey_url, params: params
+
+      assert_redirected_to new_session_path
+      assert_not cookies[:session_token].present?
+      assert_equal "That passkey didn't work. Try again.", flash[:alert]
+    end
+  end
+
+  test "rejects unknown credential" do
+    untenanted do
+      get new_session_url
+
+      post session_passkey_url, params: {
+        credential_id: "nonexistent",
+        response: {
+          client_data_json: Base64.urlsafe_encode64("{}", padding: false),
+          authenticator_data: Base64.urlsafe_encode64("x", padding: false),
+          signature: Base64.urlsafe_encode64("x", padding: false)
+        }
+      }
+
+      assert_redirected_to new_session_path
+      assert_not cookies[:session_token].present?
+    end
+  end
+
+  test "successful authentication via JSON" do
+    untenanted do
+      get new_session_url
+      challenge = session[:webauthn_challenge]
+
+      post session_passkey_url(format: :json), params: assertion_params(challenge: challenge)
+
+      assert_response :success
+      assert @response.parsed_body["session_token"].present?
+    end
+  end
+
+  test "failed authentication via JSON" do
+    untenanted do
+      get new_session_url
+
+      post session_passkey_url(format: :json), params: {
+        credential_id: "nonexistent",
+        response: {
+          client_data_json: Base64.urlsafe_encode64("{}", padding: false),
+          authenticator_data: Base64.urlsafe_encode64("x", padding: false),
+          signature: Base64.urlsafe_encode64("x", padding: false)
+        }
+      }
+
+      assert_response :unauthorized
+      assert_equal "That passkey didn't work. Try again.", @response.parsed_body["message"]
+    end
+  end
+
+  private
+    def assertion_params(challenge:, sign_count: 1)
+      origin = "http://www.example.com"
+
+      client_data_json = {
+        challenge: challenge,
+        origin: origin,
+        type: "webauthn.get"
+      }.to_json
+
+      authenticator_data = build_authenticator_data(sign_count: sign_count)
+      signature = sign(authenticator_data, client_data_json)
+
+      {
+        credential_id: @credential.credential_id,
+        response: {
+          client_data_json: client_data_json,
+          authenticator_data: Base64.urlsafe_encode64(authenticator_data, padding: false),
+          signature: Base64.urlsafe_encode64(signature, padding: false)
+        }
+      }
+    end
+
+    def build_authenticator_data(sign_count:)
+      rp_id_hash = Digest::SHA256.digest("www.example.com")
+      flags = 0x01 | 0x04 # user present + user verified
+
+      bytes = []
+      bytes.concat(rp_id_hash.bytes)
+      bytes << flags
+      bytes.concat([ sign_count ].pack("N").bytes)
+      bytes.pack("C*")
+    end
+
+    def sign(authenticator_data, client_data_json)
+      client_data_hash = Digest::SHA256.digest(client_data_json)
+      signed_data = authenticator_data + client_data_hash
+      @private_key.sign("SHA256", signed_data)
+    end
+end
diff --git a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
index 010dd5464..2fc1acfbc 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
@@ -43,6 +43,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
     ], @options.as_json[:pubKeyCredParams]
 
     assert_equal "preferred", @options.as_json[:authenticatorSelection][:residentKey]
+    assert_equal false, @options.as_json[:authenticatorSelection][:requireResidentKey]
     assert_equal "preferred", @options.as_json[:authenticatorSelection][:userVerification]
   end
 
@@ -56,6 +57,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
     )
 
     assert_equal "required", options.as_json[:authenticatorSelection][:residentKey]
+    assert_equal true, options.as_json[:authenticatorSelection][:requireResidentKey]
   end
 
   test "as_json excludes excludeCredentials when empty" do

From b23660d8974e8260f64ee5b77519f5fe00cd737f Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Thu, 19 Feb 2026 10:34:03 +0100
Subject: [PATCH 095/107] Fix --tailscale not printing hostname

---
 bin/dev | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/dev b/bin/dev
index 24923069d..4c11aa3b0 100755
--- a/bin/dev
+++ b/bin/dev
@@ -41,7 +41,7 @@ if [ "$USE_TAILSCALE" = "1" ]; then
     exit 1
   fi
 
-  TS_STATUS=$(tailscale status --self --json 2>&1)
+  TS_STATUS=$(tailscale status --self --json 2>/dev/null)
   if [ $? -ne 0 ]; then
     echo "Error: tailscale not logged in" >&2
     exit 1

From fbe9252db1741f705bcea541ac6bddfb10ea10bb Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Thu, 19 Feb 2026 10:56:22 +0100
Subject: [PATCH 096/107] Auto-suggest name for new Passkeys

- Use plain client data json everywhere
- Expose AAGUID and backed_up on Credentials
- Make attestation verifiers configurable
- Auto-suggest names for passkeys and show icons
---
 app/assets/images/authentication.svg          |   1 +
 app/assets/images/key.svg                     |   1 -
 app/assets/images/passkeys/1password_dark.svg |   3 +
 .../images/passkeys/1password_light.svg       |   3 +
 .../images/passkeys/apple_passwords_dark.svg  |  38 ++++++
 .../images/passkeys/apple_passwords_light.svg |  38 ++++++
 app/assets/images/passkeys/bitwarden_dark.svg |  11 ++
 .../images/passkeys/bitwarden_light.svg       |  11 ++
 app/assets/images/passkeys/dashlane_dark.svg  |   8 ++
 app/assets/images/passkeys/dashlane_light.svg |   8 ++
 app/assets/images/passkeys/generic_dark.svg   |   1 +
 app/assets/images/passkeys/generic_light.svg  |   1 +
 .../passkeys/google_password_manager_dark.svg |   1 +
 .../google_password_manager_light.svg         |   1 +
 app/assets/images/passkeys/lastpass_dark.svg  |  13 ++
 app/assets/images/passkeys/lastpass_light.svg |  13 ++
 .../images/passkeys/samsung_pass_dark.svg     |   1 +
 .../images/passkeys/samsung_pass_light.svg    |   1 +
 .../images/passkeys/windows_hello_dark.svg    |   1 +
 .../images/passkeys/windows_hello_light.svg   |   1 +
 app/assets/images/passkeys/yubikey_dark.svg   |   1 +
 app/assets/images/passkeys/yubikey_light.svg  |   1 +
 app/assets/stylesheets/credentials.css        |  29 ++++
 app/assets/stylesheets/icons.css              |   2 +-
 app/controllers/concerns/current_request.rb   |   1 +
 .../sessions/passkeys_controller.rb           |  12 +-
 .../users/credentials_controller.rb           |  32 +++--
 .../controllers/credential_controller.js      |  72 +++++-----
 .../controllers/passkey_controller.js         |  26 +---
 app/javascript/helpers/base64url_helpers.js   |  12 ++
 app/models/identity/credential.rb             |  37 +++---
 .../identity/credential/authenticator.rb      |  12 ++
 .../users/credentials/_credential.html.erb    |  21 ++-
 app/views/users/credentials/edit.html.erb     |  33 +++++
 app/views/users/credentials/index.html.erb    |  40 +++---
 app/views/users/credentials/new.html.erb      |  31 -----
 app/views/users/show.html.erb                 |   2 +-
 config/passkey_aaguids.yml                    | 124 ++++++++++++++++++
 config/routes.rb                              |   2 +-
 ...d_and_backed_up_to_identity_credentials.rb |   6 +
 db/schema.rb                                  |   4 +-
 lib/action_pack/web_authn.rb                  |  10 ++
 .../web_authn/authenticator/attestation.rb    |   2 +-
 .../authenticator/attestation_response.rb     |  10 +-
 .../attestation_verifiers/none.rb             |  24 ++++
 .../web_authn/authenticator/data.rb           |   9 +-
 lib/action_pack/web_authn/current.rb          |   2 +-
 .../web_authn/public_key_credential.rb        |   9 +-
 .../public_key_credential/creation_options.rb |  21 ++-
 .../sessions/passkeys_controller_test.rb      |  14 +-
 .../attestation_response_test.rb              |  20 ++-
 .../attestation_verifiers/none_test.rb        |  33 +++++
 .../creation_options_test.rb                  |  28 ++++
 53 files changed, 666 insertions(+), 172 deletions(-)
 create mode 100644 app/assets/images/authentication.svg
 delete mode 100644 app/assets/images/key.svg
 create mode 100644 app/assets/images/passkeys/1password_dark.svg
 create mode 100644 app/assets/images/passkeys/1password_light.svg
 create mode 100644 app/assets/images/passkeys/apple_passwords_dark.svg
 create mode 100644 app/assets/images/passkeys/apple_passwords_light.svg
 create mode 100644 app/assets/images/passkeys/bitwarden_dark.svg
 create mode 100644 app/assets/images/passkeys/bitwarden_light.svg
 create mode 100644 app/assets/images/passkeys/dashlane_dark.svg
 create mode 100644 app/assets/images/passkeys/dashlane_light.svg
 create mode 100644 app/assets/images/passkeys/generic_dark.svg
 create mode 100644 app/assets/images/passkeys/generic_light.svg
 create mode 100644 app/assets/images/passkeys/google_password_manager_dark.svg
 create mode 100644 app/assets/images/passkeys/google_password_manager_light.svg
 create mode 100644 app/assets/images/passkeys/lastpass_dark.svg
 create mode 100644 app/assets/images/passkeys/lastpass_light.svg
 create mode 100644 app/assets/images/passkeys/samsung_pass_dark.svg
 create mode 100644 app/assets/images/passkeys/samsung_pass_light.svg
 create mode 100644 app/assets/images/passkeys/windows_hello_dark.svg
 create mode 100644 app/assets/images/passkeys/windows_hello_light.svg
 create mode 100644 app/assets/images/passkeys/yubikey_dark.svg
 create mode 100644 app/assets/images/passkeys/yubikey_light.svg
 create mode 100644 app/assets/stylesheets/credentials.css
 create mode 100644 app/javascript/helpers/base64url_helpers.js
 create mode 100644 app/models/identity/credential/authenticator.rb
 create mode 100644 app/views/users/credentials/edit.html.erb
 delete mode 100644 app/views/users/credentials/new.html.erb
 create mode 100644 config/passkey_aaguids.yml
 create mode 100644 db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb
 create mode 100644 lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb
 create mode 100644 test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb

diff --git a/app/assets/images/authentication.svg b/app/assets/images/authentication.svg
new file mode 100644
index 000000000..6f02cc18b
--- /dev/null
+++ b/app/assets/images/authentication.svg
@@ -0,0 +1 @@
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><g><path d="m13.5 9 .00000017-.00021827c.00112736-1.46023-.532521-2.87033-1.50014-3.96395v-2.53584c0-1.38071-1.11929-2.5-2.5-2.5s-2.5 1.11929-2.5 2.5v.521l-.00000041.00000003c-3.30165.282474-5.74917 3.18798-5.4667 6.48963.200464 2.34309 1.75126 4.35306 3.96684 5.14137v.641l-.854.853.00000005-.00000005c-.0937141.0939506-.146237.221301-.146.354v.00000072c.0003071.132591.0527482.259742.146.354l.854.854v.586l-.854.854.00000003-.00000003c-.195191.19525-.195191.51175-.00000005.707l.854.853v1.292l.00000001-.00000402c-.00023806.132699.052284.26005.145997.354001l1.5 1.5-.00000004-.00000004c.195015.195509.511597.195909.707106.00089385.0002983-.00029755.00059623-.00059548.00089378-.00089378l1.5-1.5.00000001-.00000001c.0937141-.0939496.146238-.221299.146002-.353997v-7.348l-.00000037.00000013c2.39202-.851706 3.99229-3.11289 4-5.652zm-6-3h-.00000004c.552285-.00000002 1 .447715 1 1 .00000002.552285-.447715 1-1 1-.552285.00000002-1-.447715-1-1v.00000011c-.00000008-.552285.447715-1 1-1h.00000004zm2-5h-.00000007c.828427-.00000004 1.5.671573 1.5 1.5v1.63l-.0000001-.00000007c-.602574-.434703-1.28079-.753463-2-.94v1.81h-1v-2.5.00000023c-.00000013-.828427.671573-1.5 1.5-1.5z"/><path d="m22.354 18.026-5.2-5.2.00000012-.00000024c1.31269-2.70353.401635-5.96153-2.123-7.592-.230921-.151427-.540875-.0869843-.692302.143937-.0946713.144371-.108167.327367-.0356979.484063l-.00000011-.00000024c1.57633 3.39991.38992 7.44157-2.774 9.45l.00000003-.00000002c-.232512.148972-.300235.458226-.151263.690738.0917865.143258.250123.23001.420263.230262h.006-.0000002c.879855-.00837008 1.74719-.209417 2.541-.589l.65.577v1.279.00000008c.00000004.276142.223858.5.5.5h1.286l.214.224v1.276.00000008c.00000004.276142.223858.5.5.5h1.119l.917.864c.0928133.0874048.215509.136054.343.136h2.126-.00000002c.276142.00000001.5-.223858.5-.5v-2.121l.00000001.00010623c0-.132352-.052476-.259306-.145925-.353031z"/></g></svg>
\ No newline at end of file
diff --git a/app/assets/images/key.svg b/app/assets/images/key.svg
deleted file mode 100644
index 386e0b501..000000000
--- a/app/assets/images/key.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="m12.65 10c-.83-2.33-3.05-4-5.65-4-3.31 0-6 2.69-6 6s2.69 6 6 6c2.61 0 4.83-1.67 5.65-4h4.35v4h4v-4h2v-4zm-5.65 4c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2z"/></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/1password_dark.svg b/app/assets/images/passkeys/1password_dark.svg
new file mode 100644
index 000000000..ff3998898
--- /dev/null
+++ b/app/assets/images/passkeys/1password_dark.svg
@@ -0,0 +1,3 @@
+<svg width="240" height="240" viewBox="0 0 240 240" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M239.257 120.417C239.257 54.4193 185.755 0.916504 119.757 0.916504C53.7601 0.916504 0.257324 54.4193 0.257324 120.417C0.257324 186.417 53.7601 239.917 119.757 239.917C185.755 239.917 239.257 186.417 239.257 120.417ZM98.0069 54.0276C97.0674 55.8714 97.0674 58.2851 97.0674 63.1126V90.4729C97.0674 91.6788 97.0674 92.2817 97.2196 92.8392C97.3545 93.3331 97.5763 93.799 97.8746 94.215C98.2113 94.6847 98.6792 95.0648 99.6152 95.8251L106.536 101.447C107.664 102.364 108.228 102.822 108.433 103.374C108.613 103.857 108.613 104.39 108.433 104.873C108.228 105.425 107.664 105.883 106.536 106.8L99.6152 112.422C98.6793 113.182 98.2113 113.562 97.8746 114.032C97.5763 114.448 97.3545 114.914 97.2196 115.408C97.0674 115.965 97.0674 116.568 97.0674 117.774V177.719C97.0674 182.547 97.0674 184.961 98.0069 186.805C98.8333 188.426 100.152 189.745 101.774 190.571C103.618 191.511 106.031 191.511 110.859 191.511H128.656C133.483 191.511 135.897 191.511 137.741 190.571C139.363 189.745 140.681 188.426 141.508 186.805C142.447 184.961 142.447 182.547 142.447 177.719V150.359C142.447 149.153 142.447 148.55 142.295 147.993C142.16 147.499 141.938 147.033 141.64 146.617C141.303 146.147 140.835 145.767 139.899 145.007L132.978 139.385C131.85 138.468 131.286 138.01 131.082 137.459C130.902 136.975 130.902 136.443 131.082 135.959C131.286 135.407 131.85 134.949 132.978 134.033L139.899 128.41C140.835 127.65 141.303 127.27 141.64 126.8C141.938 126.384 142.16 125.918 142.295 125.424C142.447 124.867 142.447 124.264 142.447 123.058V63.1126C142.447 58.2851 142.447 55.8714 141.508 54.0276C140.681 52.4057 139.363 51.087 137.741 50.2606C135.897 49.3211 133.483 49.3211 128.656 49.3211H110.859C106.031 49.3211 103.618 49.3211 101.774 50.2606C100.152 51.087 98.8333 52.4057 98.0069 54.0276Z" fill="#FFFEFB"/>
+</svg>
diff --git a/app/assets/images/passkeys/1password_light.svg b/app/assets/images/passkeys/1password_light.svg
new file mode 100644
index 000000000..dcd5b1ce0
--- /dev/null
+++ b/app/assets/images/passkeys/1password_light.svg
@@ -0,0 +1,3 @@
+<svg width="240" height="240" viewBox="0 0 240 240" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M239.116 120.417C239.116 54.4193 185.613 0.916504 119.616 0.916504C53.619 0.916504 0.116211 54.4193 0.116211 120.417C0.116211 186.417 53.619 239.917 119.616 239.917C185.613 239.917 239.116 186.417 239.116 120.417ZM97.8658 54.0276C96.9263 55.8714 96.9263 58.2851 96.9263 63.1126V90.4729C96.9263 91.6788 96.9263 92.2817 97.0785 92.8392C97.2134 93.3331 97.4352 93.799 97.7335 94.215C98.0702 94.6847 98.5381 95.0648 99.4741 95.8251L106.395 101.447C107.523 102.364 108.087 102.822 108.292 103.374C108.471 103.857 108.471 104.39 108.292 104.873C108.087 105.425 107.523 105.883 106.395 106.8L99.4741 112.422C98.5382 113.182 98.0702 113.562 97.7335 114.032C97.4352 114.448 97.2134 114.914 97.0785 115.408C96.9263 115.965 96.9263 116.568 96.9263 117.774V177.719C96.9263 182.547 96.9263 184.961 97.8658 186.805C98.6922 188.426 100.011 189.745 101.633 190.571C103.477 191.511 105.89 191.511 110.718 191.511H128.515C133.342 191.511 135.756 191.511 137.6 190.571C139.221 189.745 140.54 188.426 141.367 186.805C142.306 184.961 142.306 182.547 142.306 177.719V150.359C142.306 149.153 142.306 148.55 142.154 147.993C142.019 147.499 141.797 147.033 141.499 146.617C141.162 146.147 140.694 145.767 139.758 145.007L132.837 139.385C131.709 138.468 131.145 138.01 130.94 137.459C130.761 136.975 130.761 136.443 130.94 135.959C131.145 135.407 131.709 134.949 132.837 134.033L139.758 128.41C140.694 127.65 141.162 127.27 141.499 126.8C141.797 126.384 142.019 125.918 142.154 125.424C142.306 124.867 142.306 124.264 142.306 123.058V63.1126C142.306 58.2851 142.306 55.8714 141.367 54.0276C140.54 52.4057 139.221 51.087 137.6 50.2606C135.756 49.3211 133.342 49.3211 128.515 49.3211H110.718C105.89 49.3211 103.477 49.3211 101.633 50.2606C100.011 51.087 98.6922 52.4057 97.8658 54.0276Z" fill="#1A285F"/>
+</svg>
diff --git a/app/assets/images/passkeys/apple_passwords_dark.svg b/app/assets/images/passkeys/apple_passwords_dark.svg
new file mode 100644
index 000000000..bd1715076
--- /dev/null
+++ b/app/assets/images/passkeys/apple_passwords_dark.svg
@@ -0,0 +1,38 @@
+<svg viewBox="0 0 322 322" xmlns="http://www.w3.org/2000/svg" xml:space="preserve" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2">
+    <path d="M321.347 72.106C321.347 32.31 289.037 0 249.241 0H72.106C32.31 0 0 32.31 0 72.106v177.135c0 39.796 32.31 72.106 72.106 72.106h177.135c39.796 0 72.106-32.31 72.106-72.106V72.106Z" style="fill:#fff"/>
+    <path d="M126.106 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.821-8.67-39.057-30.754-39.057-56.6 0-33.006 26.478-59.876 59.333-60.511-18.551 13.563-30.61 35.488-30.61 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.006c-.004.137-.006.275-.006.413 0 3.551 1.699 6.535 3.763 9.103Z" style="fill:#ebebeb"/>
+    <clipPath id="a">
+        <path d="M126.106 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.821-8.67-39.057-30.754-39.057-56.6 0-33.006 26.478-59.876 59.333-60.511-18.551 13.563-30.61 35.488-30.61 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.006c-.004.137-.006.275-.006.413 0 3.551 1.699 6.535 3.763 9.103Z"/>
+    </clipPath>
+    <g clip-path="url(#a)">
+        <path d="M126.531 277.545V43.603H55.027v233.942h71.504Z" style="fill:url(#b)"/>
+    </g>
+    <path d="M167.618 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.82-8.67-39.056-30.754-39.056-56.6 0-33.006 26.477-59.876 59.333-60.511-18.552 13.563-30.611 35.488-30.611 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.007c-.005.137-.007.275-.007.413 0 3.551 1.699 6.535 3.763 9.103Z" style="fill:#ebebeb"/>
+    <clipPath id="c">
+        <path d="M167.618 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.82-8.67-39.056-30.754-39.056-56.6 0-33.006 26.477-59.876 59.333-60.511-18.552 13.563-30.611 35.488-30.611 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.007c-.005.137-.007.275-.007.413 0 3.551 1.699 6.535 3.763 9.103Z"/>
+    </clipPath>
+    <g clip-path="url(#c)">
+        <path d="M168.043 277.545V43.603H96.54v233.942h71.503Z" style="fill:url(#d)"/>
+    </g>
+    <path d="M177.014 160.725c-22.82-8.67-39.056-30.753-39.056-56.599 0-33.404 27.119-60.523 60.523-60.523 33.403 0 60.523 27.119 60.523 60.523 0 28.22-19.357 51.956-45.506 58.642l26.358 26.862c.994 1.581.943 3.037-.059 4.377l-25.881 26.464 18.777 18.979c1.571 2.132 1.323 4.182-.256 6.171l-31.157 31.03c-1.686 1.207-3.364 1.133-5.008.135l-18.424-19.268c-.453-.648-.763-1.327-.834-2.057v-94.736Zm21.662-93.481c8.924 0 16.169 7.245 16.169 16.169s-7.245 16.169-16.169 16.169-16.169-7.245-16.169-16.169 7.245-16.169 16.169-16.169Z" style="fill:none"/>
+    <clipPath id="e">
+        <path d="M177.014 160.725c-22.82-8.67-39.056-30.753-39.056-56.599 0-33.404 27.119-60.523 60.523-60.523 33.403 0 60.523 27.119 60.523 60.523 0 28.22-19.357 51.956-45.506 58.642l26.358 26.862c.994 1.581.943 3.037-.059 4.377l-25.881 26.464 18.777 18.979c1.571 2.132 1.323 4.182-.256 6.171l-31.157 31.03c-1.686 1.207-3.364 1.133-5.008.135l-18.424-19.268c-.453-.648-.763-1.327-.834-2.057v-94.736Zm21.662-93.481c8.924 0 16.169 7.245 16.169 16.169s-7.245 16.169-16.169 16.169-16.169-7.245-16.169-16.169 7.245-16.169 16.169-16.169Z"/>
+    </clipPath>
+    <g clip-path="url(#e)">
+        <path d="M259.004 277.545V43.603H137.958v233.942h121.046Z" style="fill:url(#f)"/>
+    </g>
+    <defs>
+        <linearGradient id="b" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(0 233.943 -71.5033 0 90.78 43.603)">
+            <stop offset="0" style="stop-color:#ffdd53;stop-opacity:1"/>
+            <stop offset="1" style="stop-color:#ffbf01;stop-opacity:1"/>
+        </linearGradient>
+        <linearGradient id="d" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(0 233.943 -71.5033 0 132.291 43.603)">
+            <stop offset="0" style="stop-color:#51e376;stop-opacity:1"/>
+            <stop offset="1" style="stop-color:#34c759;stop-opacity:1"/>
+        </linearGradient>
+        <linearGradient id="f" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(0 233.943 -121.046 0 198.481 43.603)">
+            <stop offset="0" style="stop-color:#62ccf8;stop-opacity:1"/>
+            <stop offset="1" style="stop-color:#0079ff;stop-opacity:1"/>
+        </linearGradient>
+    </defs>
+</svg>
diff --git a/app/assets/images/passkeys/apple_passwords_light.svg b/app/assets/images/passkeys/apple_passwords_light.svg
new file mode 100644
index 000000000..bd1715076
--- /dev/null
+++ b/app/assets/images/passkeys/apple_passwords_light.svg
@@ -0,0 +1,38 @@
+<svg viewBox="0 0 322 322" xmlns="http://www.w3.org/2000/svg" xml:space="preserve" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2">
+    <path d="M321.347 72.106C321.347 32.31 289.037 0 249.241 0H72.106C32.31 0 0 32.31 0 72.106v177.135c0 39.796 32.31 72.106 72.106 72.106h177.135c39.796 0 72.106-32.31 72.106-72.106V72.106Z" style="fill:#fff"/>
+    <path d="M126.106 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.821-8.67-39.057-30.754-39.057-56.6 0-33.006 26.478-59.876 59.333-60.511-18.551 13.563-30.61 35.488-30.61 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.006c-.004.137-.006.275-.006.413 0 3.551 1.699 6.535 3.763 9.103Z" style="fill:#ebebeb"/>
+    <clipPath id="a">
+        <path d="M126.106 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.821-8.67-39.057-30.754-39.057-56.6 0-33.006 26.478-59.876 59.333-60.511-18.551 13.563-30.61 35.488-30.61 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.006c-.004.137-.006.275-.006.413 0 3.551 1.699 6.535 3.763 9.103Z"/>
+    </clipPath>
+    <g clip-path="url(#a)">
+        <path d="M126.531 277.545V43.603H55.027v233.942h71.504Z" style="fill:url(#b)"/>
+    </g>
+    <path d="M167.618 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.82-8.67-39.056-30.754-39.056-56.6 0-33.006 26.477-59.876 59.333-60.511-18.552 13.563-30.611 35.488-30.611 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.007c-.005.137-.007.275-.007.413 0 3.551 1.699 6.535 3.763 9.103Z" style="fill:#ebebeb"/>
+    <clipPath id="c">
+        <path d="M167.618 266.574c.775.965.309 2.517.017 2.43l-7.773 7.741c-1.686 1.206-3.365 1.132-5.009.135l-18.424-19.268c-.452-.649-.762-1.328-.833-2.058v-94.735c-22.82-8.67-39.056-30.754-39.056-56.6 0-33.006 26.477-59.876 59.333-60.511-18.552 13.563-30.611 35.488-30.611 60.208 0 28.109 15.593 52.604 38.593 65.301v87.841h.007c-.005.137-.007.275-.007.413 0 3.551 1.699 6.535 3.763 9.103Z"/>
+    </clipPath>
+    <g clip-path="url(#c)">
+        <path d="M168.043 277.545V43.603H96.54v233.942h71.503Z" style="fill:url(#d)"/>
+    </g>
+    <path d="M177.014 160.725c-22.82-8.67-39.056-30.753-39.056-56.599 0-33.404 27.119-60.523 60.523-60.523 33.403 0 60.523 27.119 60.523 60.523 0 28.22-19.357 51.956-45.506 58.642l26.358 26.862c.994 1.581.943 3.037-.059 4.377l-25.881 26.464 18.777 18.979c1.571 2.132 1.323 4.182-.256 6.171l-31.157 31.03c-1.686 1.207-3.364 1.133-5.008.135l-18.424-19.268c-.453-.648-.763-1.327-.834-2.057v-94.736Zm21.662-93.481c8.924 0 16.169 7.245 16.169 16.169s-7.245 16.169-16.169 16.169-16.169-7.245-16.169-16.169 7.245-16.169 16.169-16.169Z" style="fill:none"/>
+    <clipPath id="e">
+        <path d="M177.014 160.725c-22.82-8.67-39.056-30.753-39.056-56.599 0-33.404 27.119-60.523 60.523-60.523 33.403 0 60.523 27.119 60.523 60.523 0 28.22-19.357 51.956-45.506 58.642l26.358 26.862c.994 1.581.943 3.037-.059 4.377l-25.881 26.464 18.777 18.979c1.571 2.132 1.323 4.182-.256 6.171l-31.157 31.03c-1.686 1.207-3.364 1.133-5.008.135l-18.424-19.268c-.453-.648-.763-1.327-.834-2.057v-94.736Zm21.662-93.481c8.924 0 16.169 7.245 16.169 16.169s-7.245 16.169-16.169 16.169-16.169-7.245-16.169-16.169 7.245-16.169 16.169-16.169Z"/>
+    </clipPath>
+    <g clip-path="url(#e)">
+        <path d="M259.004 277.545V43.603H137.958v233.942h121.046Z" style="fill:url(#f)"/>
+    </g>
+    <defs>
+        <linearGradient id="b" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(0 233.943 -71.5033 0 90.78 43.603)">
+            <stop offset="0" style="stop-color:#ffdd53;stop-opacity:1"/>
+            <stop offset="1" style="stop-color:#ffbf01;stop-opacity:1"/>
+        </linearGradient>
+        <linearGradient id="d" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(0 233.943 -71.5033 0 132.291 43.603)">
+            <stop offset="0" style="stop-color:#51e376;stop-opacity:1"/>
+            <stop offset="1" style="stop-color:#34c759;stop-opacity:1"/>
+        </linearGradient>
+        <linearGradient id="f" x1="0" y1="0" x2="1" y2="0" gradientUnits="userSpaceOnUse" gradientTransform="matrix(0 233.943 -121.046 0 198.481 43.603)">
+            <stop offset="0" style="stop-color:#62ccf8;stop-opacity:1"/>
+            <stop offset="1" style="stop-color:#0079ff;stop-opacity:1"/>
+        </linearGradient>
+    </defs>
+</svg>
diff --git a/app/assets/images/passkeys/bitwarden_dark.svg b/app/assets/images/passkeys/bitwarden_dark.svg
new file mode 100644
index 000000000..761c97ab7
--- /dev/null
+++ b/app/assets/images/passkeys/bitwarden_dark.svg
@@ -0,0 +1,11 @@
+<svg width="300" height="300" viewBox="0 0 300 300" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_68_61)">
+<path d="M300 253.125C300 279.023 279.023 300 253.125 300H46.875C20.9766 300 0 279.023 0 253.125V46.875C0 20.9766 20.9766 0 46.875 0H253.125C279.023 0 300 20.9766 300 46.875V253.125Z" fill="#175DDC"/>
+<path d="M243.105 37.6758C241.201 35.7715 238.945 34.834 236.367 34.834H63.6328C61.0254 34.834 58.7988 35.7715 56.8945 37.6758C54.9902 39.5801 54.0527 41.8359 54.0527 44.4141V159.58C54.0527 168.164 55.7227 176.689 59.0625 185.156C62.4023 193.594 66.5625 201.094 71.5137 207.656C76.4648 214.189 82.3535 220.576 89.209 226.787C96.0645 232.998 102.393 238.125 108.164 242.227C113.965 246.328 120 250.195 126.299 253.857C132.598 257.52 137.08 259.98 139.717 261.27C142.354 262.559 144.492 263.584 146.074 264.258C147.275 264.844 148.564 265.166 149.971 265.166C151.377 265.166 152.666 264.873 153.867 264.258C155.479 263.555 157.588 262.559 160.254 261.27C162.891 259.98 167.373 257.49 173.672 253.857C179.971 250.195 186.006 246.328 191.807 242.227C197.607 238.125 203.936 232.969 210.791 226.787C217.646 220.576 223.535 214.219 228.486 207.656C233.438 201.094 237.568 193.623 240.938 185.156C244.277 176.719 245.947 168.193 245.947 159.58V44.4434C245.977 41.8359 245.01 39.5801 243.105 37.6758ZM220.84 160.664C220.84 202.354 150 238.271 150 238.271V59.502H220.84C220.84 59.502 220.84 118.975 220.84 160.664Z" fill="white"/>
+</g>
+<defs>
+<clipPath id="clip0_68_61">
+<rect width="300" height="300" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/images/passkeys/bitwarden_light.svg b/app/assets/images/passkeys/bitwarden_light.svg
new file mode 100644
index 000000000..761c97ab7
--- /dev/null
+++ b/app/assets/images/passkeys/bitwarden_light.svg
@@ -0,0 +1,11 @@
+<svg width="300" height="300" viewBox="0 0 300 300" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_68_61)">
+<path d="M300 253.125C300 279.023 279.023 300 253.125 300H46.875C20.9766 300 0 279.023 0 253.125V46.875C0 20.9766 20.9766 0 46.875 0H253.125C279.023 0 300 20.9766 300 46.875V253.125Z" fill="#175DDC"/>
+<path d="M243.105 37.6758C241.201 35.7715 238.945 34.834 236.367 34.834H63.6328C61.0254 34.834 58.7988 35.7715 56.8945 37.6758C54.9902 39.5801 54.0527 41.8359 54.0527 44.4141V159.58C54.0527 168.164 55.7227 176.689 59.0625 185.156C62.4023 193.594 66.5625 201.094 71.5137 207.656C76.4648 214.189 82.3535 220.576 89.209 226.787C96.0645 232.998 102.393 238.125 108.164 242.227C113.965 246.328 120 250.195 126.299 253.857C132.598 257.52 137.08 259.98 139.717 261.27C142.354 262.559 144.492 263.584 146.074 264.258C147.275 264.844 148.564 265.166 149.971 265.166C151.377 265.166 152.666 264.873 153.867 264.258C155.479 263.555 157.588 262.559 160.254 261.27C162.891 259.98 167.373 257.49 173.672 253.857C179.971 250.195 186.006 246.328 191.807 242.227C197.607 238.125 203.936 232.969 210.791 226.787C217.646 220.576 223.535 214.219 228.486 207.656C233.438 201.094 237.568 193.623 240.938 185.156C244.277 176.719 245.947 168.193 245.947 159.58V44.4434C245.977 41.8359 245.01 39.5801 243.105 37.6758ZM220.84 160.664C220.84 202.354 150 238.271 150 238.271V59.502H220.84C220.84 59.502 220.84 118.975 220.84 160.664Z" fill="white"/>
+</g>
+<defs>
+<clipPath id="clip0_68_61">
+<rect width="300" height="300" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/app/assets/images/passkeys/dashlane_dark.svg b/app/assets/images/passkeys/dashlane_dark.svg
new file mode 100644
index 000000000..f23ec9e3f
--- /dev/null
+++ b/app/assets/images/passkeys/dashlane_dark.svg
@@ -0,0 +1,8 @@
+<svg width="512" height="512" viewBox="0 0 512 512" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M257.474 359.209C257.474 356.189 254.454 353.169 250.215 351.959L199.411 333.231C190.895 329.601 181.264 333.831 181.264 339.89V475.779C181.264 478.809 184.283 482.438 187.303 483.648L239.326 502.376C247.195 505.396 257.474 501.166 257.474 494.508V359.209Z" fill="white"/>
+<path d="M352.736 321.104C352.736 318.084 349.717 315.064 345.477 313.854L294.674 295.126C286.157 291.496 276.526 295.726 276.526 301.785V437.674C276.526 440.704 279.546 444.333 282.566 445.543L334.589 464.271C342.458 467.291 352.736 463.061 352.736 456.403V321.104Z" fill="white"/>
+<path d="M257.474 35.3211C257.474 32.3013 254.454 29.2815 250.215 28.0717L199.411 9.34343C190.895 5.71399 181.264 9.94358 181.264 16.0022V151.892C181.264 154.921 184.283 158.551 187.303 159.76L239.326 178.489C247.195 181.509 257.474 177.279 257.474 170.62V35.3211Z" fill="white"/>
+<path d="M352.736 92.4777C352.736 89.4579 349.717 86.4382 345.477 85.2283L294.674 66.5C286.157 62.8706 276.526 67.1002 276.526 73.1588V209.048C276.526 212.078 279.546 215.707 282.566 216.917L334.589 235.645C342.458 238.665 352.736 234.436 352.736 227.777V92.4777Z" fill="white"/>
+<path d="M448 168.687C448 165.667 444.98 162.647 440.741 161.437L389.937 142.709C381.421 139.079 371.79 143.309 371.79 149.368V361.466C371.79 364.495 374.81 368.125 377.829 369.335L429.852 388.063C437.721 391.083 448 386.853 448 380.194V168.687Z" fill="white"/>
+<path d="M162.21 35.3306C162.21 32.3108 159.19 29.2815 154.951 28.0717L104.148 9.34343C95.6787 5.71399 86 9.94358 86 16.0022V475.789C86 478.808 89.0198 482.438 92.0492 483.648L144.063 502.376C151.931 505.396 162.21 501.166 162.21 494.507V35.3306Z" fill="white"/>
+</svg>
diff --git a/app/assets/images/passkeys/dashlane_light.svg b/app/assets/images/passkeys/dashlane_light.svg
new file mode 100644
index 000000000..49f658ffd
--- /dev/null
+++ b/app/assets/images/passkeys/dashlane_light.svg
@@ -0,0 +1,8 @@
+<svg width="512" height="512" viewBox="0 0 512 512" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M257.474 359.209C257.474 356.189 254.454 353.169 250.215 351.959L199.411 333.231C190.895 329.601 181.264 333.831 181.264 339.89V475.779C181.264 478.809 184.283 482.438 187.303 483.648L239.326 502.376C247.195 505.396 257.474 501.166 257.474 494.508V359.209Z" fill="#09363F"/>
+<path d="M352.736 321.103C352.736 318.084 349.717 315.064 345.477 313.854L294.674 295.126C286.157 291.496 276.526 295.726 276.526 301.785V437.674C276.526 440.704 279.546 444.333 282.566 445.543L334.589 464.271C342.458 467.291 352.736 463.061 352.736 456.403V321.103Z" fill="#09363F"/>
+<path d="M257.474 35.3211C257.474 32.3013 254.454 29.2815 250.215 28.0717L199.411 9.34343C190.895 5.71399 181.264 9.94358 181.264 16.0022V151.892C181.264 154.921 184.283 158.551 187.303 159.76L239.326 178.489C247.195 181.508 257.474 177.279 257.474 170.62V35.3211Z" fill="#09363F"/>
+<path d="M352.736 92.4777C352.736 89.4579 349.717 86.4382 345.477 85.2283L294.674 66.5C286.157 62.8706 276.526 67.1002 276.526 73.1588V209.048C276.526 212.078 279.546 215.707 282.566 216.917L334.589 235.645C342.458 238.665 352.736 234.436 352.736 227.777V92.4777Z" fill="#09363F"/>
+<path d="M448 168.687C448 165.667 444.98 162.647 440.741 161.437L389.937 142.709C381.421 139.079 371.79 143.309 371.79 149.368V361.466C371.79 364.495 374.81 368.125 377.829 369.335L429.852 388.063C437.721 391.083 448 386.853 448 380.194V168.687Z" fill="#09363F"/>
+<path d="M162.21 35.3306C162.21 32.3108 159.19 29.2815 154.951 28.0717L104.148 9.34343C95.6787 5.71399 86 9.94358 86 16.0022V475.789C86 478.808 89.0198 482.438 92.0492 483.648L144.063 502.376C151.931 505.396 162.21 501.166 162.21 494.507V35.3306Z" fill="#09363F"/>
+</svg>
diff --git a/app/assets/images/passkeys/generic_dark.svg b/app/assets/images/passkeys/generic_dark.svg
new file mode 100644
index 000000000..e80a38065
--- /dev/null
+++ b/app/assets/images/passkeys/generic_dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="none"><path d="M160 16a64 64 0 0 0-60.3 86.4L36 166.1V224h48v-32h32v-32h32l15.7-15.7A64 64 0 1 0 160 16Zm16 72a24 24 0 1 1 0-48 24 24 0 0 1 0 48Z" fill="#999"/></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/generic_light.svg b/app/assets/images/passkeys/generic_light.svg
new file mode 100644
index 000000000..3f941f839
--- /dev/null
+++ b/app/assets/images/passkeys/generic_light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="none"><path d="M160 16a64 64 0 0 0-60.3 86.4L36 166.1V224h48v-32h32v-32h32l15.7-15.7A64 64 0 1 0 160 16Zm16 72a24 24 0 1 1 0-48 24 24 0 0 1 0 48Z" fill="#888"/></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/google_password_manager_dark.svg b/app/assets/images/passkeys/google_password_manager_dark.svg
new file mode 100644
index 000000000..b13ae8a5e
--- /dev/null
+++ b/app/assets/images/passkeys/google_password_manager_dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 192 192" height="24px" viewBox="0 0 192 192" width="24px"><rect fill="none" height="192" width="192" y="0"/><g><path d="M69.29,106c-3.46,5.97-9.91,10-17.29,10c-11.03,0-20-8.97-20-20s8.97-20,20-20 c7.38,0,13.83,4.03,17.29,10h25.55C90.3,66.54,72.82,52,52,52C27.74,52,8,71.74,8,96s19.74,44,44,44c20.82,0,38.3-14.54,42.84-34 H69.29z" fill="#4285F4"/><rect fill="#FBBC04" height="24" width="44" x="94" y="84"/><path d="M94.32,84H68v0.05c2.5,3.34,4,7.47,4,11.95s-1.5,8.61-4,11.95V108h26.32 c1.08-3.82,1.68-7.84,1.68-12S95.41,87.82,94.32,84z" fill="#EA4335"/><path d="M184,106v26h-16v-8c0-4.42-3.58-8-8-8s-8,3.58-8,8v8h-16v-26H184z" fill="#34A853"/><rect fill="#188038" height="24" width="48" x="136" y="84"/></g></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/google_password_manager_light.svg b/app/assets/images/passkeys/google_password_manager_light.svg
new file mode 100644
index 000000000..b13ae8a5e
--- /dev/null
+++ b/app/assets/images/passkeys/google_password_manager_light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 192 192" height="24px" viewBox="0 0 192 192" width="24px"><rect fill="none" height="192" width="192" y="0"/><g><path d="M69.29,106c-3.46,5.97-9.91,10-17.29,10c-11.03,0-20-8.97-20-20s8.97-20,20-20 c7.38,0,13.83,4.03,17.29,10h25.55C90.3,66.54,72.82,52,52,52C27.74,52,8,71.74,8,96s19.74,44,44,44c20.82,0,38.3-14.54,42.84-34 H69.29z" fill="#4285F4"/><rect fill="#FBBC04" height="24" width="44" x="94" y="84"/><path d="M94.32,84H68v0.05c2.5,3.34,4,7.47,4,11.95s-1.5,8.61-4,11.95V108h26.32 c1.08-3.82,1.68-7.84,1.68-12S95.41,87.82,94.32,84z" fill="#EA4335"/><path d="M184,106v26h-16v-8c0-4.42-3.58-8-8-8s-8,3.58-8,8v8h-16v-26H184z" fill="#34A853"/><rect fill="#188038" height="24" width="48" x="136" y="84"/></g></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/lastpass_dark.svg b/app/assets/images/passkeys/lastpass_dark.svg
new file mode 100644
index 000000000..764d273f5
--- /dev/null
+++ b/app/assets/images/passkeys/lastpass_dark.svg
@@ -0,0 +1,13 @@
+<svg width="50" height="50" viewBox="0 0 50 50" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="50" height="50" rx="7.84782" fill="url(#paint0_linear_284_5743)"/>
+<path d="M39.3518 17.6383C38.905 17.6383 38.5668 17.9747 38.5668 18.4287V31.5604C38.5668 32.0108 38.9014 32.3509 39.3518 32.3509C39.8022 32.3509 40.1368 32.0144 40.1368 31.5604V18.4287C40.1368 17.9784 39.8022 17.6383 39.3518 17.6383Z" fill="white"/>
+<path d="M21.8918 22.5449C20.3814 22.5449 19.0954 23.7857 19.0954 25.3069C19.0954 26.8281 20.3272 28.1232 21.8375 28.1232C23.3478 28.1232 24.6339 26.8824 24.6339 25.3612C24.6339 23.84 23.4021 22.5449 21.8918 22.5449Z" fill="white"/>
+<path d="M31.0694 22.5449C29.5591 22.5449 28.2731 23.7857 28.2731 25.3069C28.2731 26.8281 29.5048 28.1232 31.0152 28.1232C32.5255 28.1232 33.8115 26.8824 33.8115 25.3612C33.8658 23.84 32.634 22.5449 31.0694 22.5449Z" fill="white"/>
+<path d="M12.6596 22.5449C11.1493 22.5449 9.86328 23.7857 9.86328 25.3069C9.86328 26.8281 11.0951 28.1232 12.6054 28.1232C14.1157 28.1232 15.4017 26.8824 15.4017 25.3612C15.4017 23.84 14.17 22.5449 12.6596 22.5449Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_284_5743" x1="25" y1="0" x2="25" y2="50" gradientUnits="userSpaceOnUse">
+<stop stop-color="#3C3D3D"/>
+<stop offset="1" stop-color="#262626"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/app/assets/images/passkeys/lastpass_light.svg b/app/assets/images/passkeys/lastpass_light.svg
new file mode 100644
index 000000000..aac8009ea
--- /dev/null
+++ b/app/assets/images/passkeys/lastpass_light.svg
@@ -0,0 +1,13 @@
+<svg width="50" height="50" viewBox="0 0 50 50" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="50" height="50" rx="7.84782" fill="url(#paint0_linear_284_5774)"/>
+<path d="M39.3517 17.6384C38.9049 17.6384 38.5667 17.9749 38.5667 18.4289V31.5605C38.5667 32.0108 38.9013 32.3509 39.3517 32.3509C39.8021 32.3509 40.1367 32.0145 40.1367 31.5605V18.4289C40.1367 17.9785 39.8021 17.6384 39.3517 17.6384Z" fill="white"/>
+<path d="M21.8918 22.545C20.3814 22.545 19.0954 23.7859 19.0954 25.307C19.0954 26.8282 20.3272 28.1233 21.8375 28.1233C23.3478 28.1233 24.6338 26.8825 24.6338 25.3613C24.6338 23.8401 23.4021 22.545 21.8918 22.545Z" fill="white"/>
+<path d="M31.0694 22.545C29.5591 22.545 28.273 23.7859 28.273 25.307C28.273 26.8282 29.5048 28.1233 31.0151 28.1233C32.5254 28.1233 33.8115 26.8825 33.8115 25.3613C33.8657 23.8401 32.634 22.545 31.0694 22.545Z" fill="white"/>
+<path d="M12.6597 22.545C11.1494 22.545 9.86339 23.7859 9.86339 25.307C9.86339 26.8282 11.0952 28.1233 12.6055 28.1233C14.1158 28.1233 15.4018 26.8825 15.4018 25.3613C15.4018 23.8401 14.17 22.545 12.6597 22.545Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear_284_5774" x1="25" y1="0" x2="25" y2="50" gradientUnits="userSpaceOnUse">
+<stop stop-color="#ED194A"/>
+<stop offset="1" stop-color="#C30833"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/app/assets/images/passkeys/samsung_pass_dark.svg b/app/assets/images/passkeys/samsung_pass_dark.svg
new file mode 100644
index 000000000..399033941
--- /dev/null
+++ b/app/assets/images/passkeys/samsung_pass_dark.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8"?><svg version="1.1" width="52px" height="52px" viewBox="0 0 52.0 52.0" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><clipPath id="i0"><path d="M360,0 L360,800 L0,800 L0,0 L360,0 Z"></path></clipPath><clipPath id="i1"><path d="M26,0 C33.9910278,0 41.1395833,0.975 45.9087778,5.77777778 C49.7101944,9.60591667 52,15.8650556 52,26 C52,36.1349444 49.7098333,42.3944444 45.9080556,46.2225833 C41.1388611,51.0246389 33.9903056,52 26,52 C18.0089722,52 10.8607778,51.0246389 6.09158333,46.2225833 C2.29016667,42.3944444 0,36.1349444 0,26 C0,15.8650556 2.28980556,9.60555556 6.09086111,5.77777778 C10.8600556,0.975 18.0086111,0 26,0 Z"></path></clipPath><linearGradient id="i2" x1="26px" y1="52px" x2="26px" y2="0.195921148px" gradientUnits="userSpaceOnUse"><stop stop-color="#2929B2" offset="0%"></stop><stop stop-color="#1A40CC" offset="100%"></stop></linearGradient><clipPath id="i3"><path d="M37.1944444,0 L37.1944444,5.72222222 L0,5.72222222 L0,0 L37.1944444,0 Z"></path></clipPath><clipPath id="i4"><path d="M1.88342213,0 C2.62075987,0 3.64356402,0.181610871 3.64356402,1.32111819 L3.64356402,1.68911562 L2.34279339,1.68911562 L2.34279339,1.36490659 C2.34279339,1.07957573 2.16319664,0.889153371 1.8581768,0.889153371 C1.52931788,0.889153371 1.41648398,1.07527088 1.38085927,1.24215109 C1.36679688,1.30026657 1.36090408,1.41172184 1.38614941,1.51725793 C1.53460802,2.1304973 3.51244902,2.45611887 3.73255883,3.55553727 C3.75371937,3.6670598 3.80079488,3.96113488 3.73804986,4.41300963 C3.61182321,5.28965203 2.8380572,5.61217949 1.89581043,5.61217949 C0.915729136,5.61217949 0,5.25998892 0,4.0888006 L0,3.68824773 L1.39940823,3.68824773 L1.40121625,4.19231879 C1.40121625,4.4786586 1.59608073,4.66928275 1.92185932,4.66928275 C2.2707404,4.66928275 2.38839569,4.49150589 2.43118552,4.31541061 C2.45622996,4.21639905 2.47149769,4.05463085 2.42100703,3.92864671 C2.15134406,3.25096911 0.297921677,2.94128895 0.0721199473,1.87032292 C0.0173436085,1.60564189 0.0238390912,1.39907634 0.0617405677,1.16426021 C0.200221581,0.308873007 0.957112727,0 1.88342213,0 Z M18.8411186,0.0296631089 C19.5704877,0.0296631089 20.5778901,0.206969129 20.5778901,1.33564706 L20.5778901,1.70075217 L19.2921864,1.70075217 L19.2921864,1.38044441 C19.2921864,1.0974005 19.115603,0.90879425 18.8144001,0.90879425 C18.4912331,0.90879425 18.3790688,1.09161586 18.34177,1.25937049 C18.3297835,1.31681334 18.3230871,1.42665428 18.3462566,1.53017248 C18.4943134,2.13641647 20.4503912,2.46311425 20.6660144,3.54921452 C20.6896526,3.65905547 20.7340496,3.95070907 20.6751885,4.3984135 C20.5517743,5.26510093 19.7824949,5.58480333 18.8510962,5.58480333 C17.8785818,5.58480333 16.9756428,5.23543783 16.9756428,4.07750037 L16.9756428,3.67788919 L18.3595154,3.67788919 L18.3599172,4.18061498 C18.3599172,4.46305352 18.5551834,4.65044903 18.8797567,4.65044903 C19.2257583,4.65044903 19.3424761,4.47516091 19.3823865,4.30088174 C19.4063595,4.20556966 19.4198192,4.04380146 19.3728107,3.9169429 C19.1064289,3.24726963 17.2711537,2.94007821 17.0477627,1.8811523 C16.9901069,1.6193636 16.9990801,1.41421058 17.0353074,1.18309393 C17.1723153,0.333827686 17.92251,0.0296631089 18.8411186,0.0296631089 Z M23.2364845,0.166880211 L23.2362291,4.11137366 C23.2372063,4.15798462 23.2408818,4.20406745 23.2496764,4.24115194 C23.2751226,4.37123913 23.3877556,4.62159308 23.7469491,4.62159308 C24.1108301,4.62159308 24.2205836,4.37123913 24.2481057,4.24115194 C24.2596905,4.1855252 24.2617663,4.10965222 24.2596905,4.04211988 L24.2596905,0.166880211 L25.5786083,0.166880211 L25.5786083,3.92185312 C25.5843002,4.01864499 25.5747244,4.21639905 25.5674253,4.26819178 C25.4747475,5.24667079 24.707477,5.56435529 23.7469491,5.56435529 C22.7882962,5.56435529 22.020557,5.24667079 21.9295532,4.26819178 C21.9238613,4.21639905 21.9162944,4.01864499 21.9179685,3.92185312 L21.9179685,0.166880211 L23.2364845,0.166880211 Z M34.6297621,0.0259636282 C35.5539956,0.0259636282 36.3600382,0.336854534 36.4587427,1.31950387 C36.465573,1.39119692 36.4683814,1.46511378 36.4693607,1.52618022 L36.469004,1.65575402 L36.4687203,1.66617884 L36.4687203,1.83803654 L35.1553605,1.83803654 L35.15515,1.53355556 C35.1544471,1.49873362 35.15149,1.40564123 35.1394901,1.34526571 C35.1166555,1.2313217 35.0170804,0.966035306 34.6181774,0.966035306 C34.2381582,0.966035306 34.1255921,1.21759999 34.0996772,1.34526571 C34.0817978,1.41542132 34.0761059,1.50811012 34.0761059,1.5927946 L34.0761059,3.98689672 C34.0761059,4.05463085 34.0801907,4.12761151 34.0897665,4.18613057 C34.1125342,4.327518 34.2438501,4.5682533 34.6209899,4.5682533 C35.0004064,4.5682533 35.134133,4.327518 35.1553605,4.18613057 C35.1669452,4.12761151 35.1706282,4.05463085 35.1689541,3.98689672 L35.1689541,3.22890676 L34.6344496,3.22890676 L34.6344496,2.46493036 L36.4791667,2.46493036 L36.4791667,3.86851334 C36.4770908,3.96443078 36.4754837,4.03868945 36.460015,4.21397757 C36.3728282,5.16958707 35.5539956,5.50832497 34.6260791,5.50832497 C33.7038545,5.50832497 32.87933,5.16958707 32.7936164,4.21397757 C32.775938,4.03868945 32.7728576,3.96443078 32.7728576,3.86851334 L32.7728576,1.66617884 C32.7728576,1.5702614 32.788728,1.40909857 32.7991074,1.31950387 C32.9141511,0.339746855 33.7038545,0.0259636282 34.6297621,0.0259636282 Z M12.1447447,0.166880211 L12.8022616,4.26159998 L13.4601804,0.166880211 L15.5852746,0.166880211 L15.7019255,5.40521036 L14.395262,5.40521036 L14.3598382,0.555931054 L13.4622562,5.40521036 L12.1398563,5.40521036 L11.2430779,0.555931054 L11.207788,5.40521036 L9.9044058,5.40521036 L10.0172397,0.166880211 L12.1447447,0.166880211 Z M7.9012525,0.166880211 L8.86325358,5.40521036 L7.4643141,5.40521036 L6.75382883,0.555931054 L6.02586602,5.40521036 L4.61714983,5.40521036 L5.58316873,0.166880211 L7.9012525,0.166880211 Z M28.304836,5.35059257 L27.0246233,5.35059257 L27.0246233,0.166880211 L28.9598753,0.166880211 L30.1879903,4.38435547 L30.1168748,0.166880211 L31.4054581,0.166880211 L31.4054581,5.35059257 L29.5494241,5.35059257 L28.23,0.999 L28.304836,5.35059257 Z"></path></clipPath><clipPath id="i5"><path d="M24.3352966,2.47006432 C25.3096502,2.47006432 26.121323,2.65660564 26.7692768,3.02897356 C27.4172305,3.40169883 27.9295017,3.90843367 28.3060902,4.55025015 L26.3954573,5.48259937 C26.1960869,5.1463247 25.9191836,4.88009236 25.5647473,4.68461708 C25.2103111,4.48914179 24.8004942,4.39122547 24.3352966,4.39122547 C23.8036422,4.39122547 23.4104395,4.49485953 23.1556885,4.70212766 C22.9005913,4.90939579 22.7735619,5.14954093 22.7735619,5.42220573 C22.7735619,5.73846831 22.9618562,5.96503381 23.3384447,6.10083017 C23.714687,6.23734125 24.2688398,6.38207158 24.9998646,6.53466381 C25.3986054,6.6111386 25.799769,6.71155644 26.204394,6.83734675 C26.6086729,6.9627797 26.9769543,7.13181043 27.3092383,7.34479631 C27.6415222,7.55742482 27.9101185,7.82973226 28.1150269,8.1627907 C28.3199354,8.49549178 28.4223896,8.91252955 28.4223896,9.41426137 C28.4223896,9.75232283 28.3448567,10.1043213 28.1897908,10.469542 C28.0343788,10.8347628 27.7938191,11.1731816 27.4670731,11.4837264 C27.1403272,11.794986 26.7277413,12.0483534 26.2293153,12.2445434 C25.7308893,12.4410908 25.1327782,12.5390071 24.4349818,12.5390071 C23.3605969,12.5390071 22.4689682,12.332811 21.7600957,11.9200616 C21.0512233,11.5069548 20.5029547,10.9105228 20.11529,10.1300511 L22.1920649,9.16518225 C22.4246637,9.60473363 22.7403335,9.94243774 23.1390743,10.1786519 C23.5378151,10.4145088 24.0030126,10.5320798 24.534667,10.5320798 C25.0884736,10.5320798 25.5038286,10.417725 25.7807319,10.1890153 C26.0572891,9.95994832 26.1960869,9.68764088 26.1960869,9.37102095 C26.1960869,9.19662983 26.1323992,9.05511573 26.0050236,8.94576392 C25.8776481,8.83712683 25.7115061,8.74135466 25.5065976,8.65987685 C25.3013431,8.57804167 25.0607833,8.51014349 24.78388,8.45511023 C24.5069767,8.40079169 24.2189972,8.3407554 23.9199416,8.27535873 C23.4987025,8.18816318 23.0864626,8.08488647 22.6821838,7.9648139 C22.277905,7.84509869 21.9151616,7.67856947 21.5939538,7.46629831 C21.2727459,7.25331244 21.0124568,6.98064764 20.8130864,6.64830392 C20.613716,6.3159602 20.5140308,5.89892243 20.5140308,5.39754797 C20.5140308,5.01553137 20.6054089,4.64780912 20.7881651,4.2936665 C20.9709213,3.93916653 21.2284414,3.62612018 21.5607254,3.35309803 C21.8930093,3.08079059 22.294173,2.86566056 22.7652548,2.7073506 C23.2359904,2.54904063 23.7593377,2.47006432 24.3352966,2.47006432 Z M33.1073515,2.47006432 C34.081705,2.47006432 34.8933779,2.65660564 35.5413316,3.02897356 C36.1892854,3.40169883 36.7015565,3.90843367 37.0781451,4.55025015 L35.1675122,5.48259937 C34.9681418,5.1463247 34.6912384,4.88009236 34.3368022,4.68461708 C33.9823659,4.48914179 33.572549,4.39122547 33.1073515,4.39122547 C32.5756971,4.39122547 32.1824944,4.49485953 31.9277433,4.70212766 C31.6726461,4.90939579 31.5456167,5.14954093 31.5456167,5.42220573 C31.5456167,5.73846831 31.733911,5.96503381 32.1104995,6.10083017 C32.4867419,6.23734125 33.0408947,6.38207158 33.7719194,6.53466381 C34.1706602,6.6111386 34.5718239,6.71155644 34.9764489,6.83734675 C35.3807277,6.9627797 35.7490091,7.13181043 36.0812931,7.34479631 C36.4135771,7.55742482 36.6821733,7.82973226 36.8870818,8.1627907 C37.0919902,8.49549178 37.1944444,8.91252955 37.1944444,9.41426137 C37.1944444,9.75232283 37.1169115,10.1043213 36.9618457,10.469542 C36.8064337,10.8347628 36.5658739,11.1731816 36.239128,11.4837264 C35.9123821,11.794986 35.4997961,12.0483534 35.0013702,12.2445434 C34.5029442,12.4410908 33.904833,12.5390071 33.2070367,12.5390071 C32.1326518,12.5390071 31.2410231,12.332811 30.5321506,11.9200616 C29.8232781,11.5069548 29.2750095,10.9105228 28.8873449,10.1300511 L30.9641198,9.16518225 C31.1967186,9.60473363 31.5123883,9.94243774 31.9111291,10.1786519 C32.3098699,10.4145088 32.7750675,10.5320798 33.3067218,10.5320798 C33.8605285,10.5320798 34.2758835,10.417725 34.5527868,10.1890153 C34.829344,9.95994832 34.9681418,9.68764088 34.9681418,9.37102095 C34.9681418,9.19662983 34.904454,9.05511573 34.7770785,8.94576392 C34.6497029,8.83712683 34.483561,8.74135466 34.2786525,8.65987685 C34.0733979,8.57804167 33.8328382,8.51014349 33.5559348,8.45511023 C33.2790315,8.40079169 32.9910521,8.3407554 32.6919965,8.27535873 C32.2707573,8.18816318 31.8585175,8.08488647 31.4542386,7.9648139 C31.0499598,7.84509869 30.6872165,7.67856947 30.3660086,7.46629831 C30.0448008,7.25331244 29.7845116,6.98064764 29.5851412,6.64830392 C29.3857709,6.3159602 29.2860857,5.89892243 29.2860857,5.39754797 C29.2860857,5.01553137 29.3774638,4.64780912 29.5602199,4.2936665 C29.7429761,3.93916653 30.0004962,3.62612018 30.3327802,3.35309803 C30.6650642,3.08079059 31.0662279,2.86566056 31.5373096,2.7073506 C32.0080453,2.54904063 32.5313926,2.47006432 33.1073515,2.47006432 Z M13.7732057,2.47002859 C14.4156214,2.47002859 15.0081945,2.59010116 15.550925,2.82953159 C16.0933094,3.06967673 16.5422389,3.39666007 16.8966751,3.81083897 L16.8966751,2.48718181 L19.139592,2.48718181 L19.139592,12.5218181 L16.8966751,12.5218181 L16.8966751,11.0959563 C16.5422389,11.5440843 16.0881174,11.8967975 15.5343108,12.1537385 C14.9805042,12.4106795 14.382393,12.5389714 13.7399773,12.5389714 C13.1529423,12.5389714 12.5742143,12.4264033 12.0037935,12.2005525 C11.4333726,11.9743444 10.9211015,11.646289 10.4669801,11.2163863 C10.0128586,10.7864836 9.64700011,10.260094 9.37044292,9.63757491 C9.0935396,9.01469844 8.95508794,8.30641322 8.95508794,7.51307658 C8.95508794,6.70830447 9.09042444,5.99501622 9.36213582,5.3717824 C9.63350107,4.74890593 9.99347539,4.22287371 10.4420588,3.79297103 C10.8906421,3.36271098 11.4056823,3.03501292 11.9871793,2.80951949 C12.5686763,2.58331134 13.1640184,2.47002859 13.7732057,2.47002859 Z M4.15354978,0 C4.78488935,0 5.36638632,0.117213701 5.89804069,0.351998461 C6.42969506,0.586425862 6.88900844,0.903403156 7.27701922,1.30400242 C7.66468386,1.70424432 7.96893138,2.175958 8.19080017,2.71914344 C8.41232282,3.26197152 8.52308415,3.84232228 8.52308415,4.46019572 C8.52308415,5.07735444 8.41232282,5.66056408 8.19080017,6.20946726 C7.96893138,6.75837044 7.66468386,7.23294299 7.27701922,7.63354225 C6.88900844,8.03378416 6.42692603,8.35111881 5.88973359,8.58518885 C5.35219502,8.81961625 4.76827515,8.93682995 4.13693558,8.93682995 L2.25953108,8.93682995 L2.25953108,12.5218539 L0,12.5218539 L0,0 L4.15354978,0 Z M14.1054897,4.58023256 C13.6956728,4.58023256 13.3107771,4.65563527 12.9508028,4.80572599 C12.5908285,4.9558167 12.2779278,5.16022596 12.0121006,5.41752433 C11.7462734,5.67553741 11.5385959,5.98179394 11.3890681,6.33629391 C11.2395403,6.69079389 11.1647764,7.07173841 11.1647764,7.48019957 C11.1647764,7.88830337 11.2395403,8.27246413 11.3890681,8.63196712 C11.5385959,8.99147012 11.7462734,9.30272967 12.0121006,9.5664605 C12.2779278,9.82947661 12.5908285,10.03603 12.9508028,10.1868354 C13.3107771,10.3369262 13.6956728,10.4119715 14.1054897,10.4119715 C14.5263827,10.4119715 14.9137012,10.3369262 15.2684836,10.1868354 C15.6229199,10.03603 15.9271674,9.82661774 16.1822646,9.55788389 C16.4370156,9.28950739 16.639155,8.97789048 16.7886828,8.62374787 C16.9382106,8.26960526 17.0129745,7.88830337 17.0129745,7.48019957 C17.0129745,7.08281654 16.9382106,6.70687503 16.7886828,6.35237506 C16.639155,5.99787509 16.4370156,5.68911705 16.1822646,5.42610094 C15.9271674,5.16272747 15.6229199,4.9558167 15.2684836,4.80572599 C14.9137012,4.65563527 14.5263827,4.58023256 14.1054897,4.58023256 Z M3.98740779,2.16130628 L2.25953108,2.16130628 L2.25953108,6.77552367 L3.98740779,6.77552367 C4.31969177,6.77552367 4.62428542,6.71548738 4.90118874,6.59541481 C5.17774593,6.47534224 5.41622892,6.30952774 5.6155993,6.09832866 C5.81496969,5.88677222 5.97003555,5.64055198 6.08079688,5.36038265 C6.19121208,5.08057067 6.24693887,4.78003189 6.24693887,4.46019572 C6.24693887,4.13964484 6.19121208,3.83946341 6.08079688,3.55929408 C5.97003555,3.27912475 5.81496969,3.03612073 5.6155993,2.83028204 C5.41622892,2.62444334 5.17774593,2.46148771 4.90118874,2.34141514 C4.62428542,2.22134257 4.31969177,2.16130628 3.98740779,2.16130628 Z"></path></clipPath></defs><g transform="translate(-233.0 -160.0)"><g clip-path="url(#i0)"><g transform="translate(233.0 160.0)"><g transform="translate(-0.00018055555555207548 0.0)"><g clip-path="url(#i1)"><polygon points="0,0 52,0 52,52 0,52 0,0" stroke="none" fill="url(#i2)"></polygon></g></g><g transform="translate(7.583333333333332 14.80555555555555)"><g clip-path="url(#i3)"><g clip-path="url(#i4)"><polygon points="0,0 36.4791667,0 36.4791667,5.61217949 0,5.61217949 0,0" stroke="none" fill="#FFFFFF"></polygon></g></g></g><g transform="translate(7.583333333333371 24.43208025547733)"><g clip-path="url(#i5)"><polygon points="0,0 37.1944444,0 37.1944444,12.5390071 0,12.5390071 0,0" stroke="none" fill="#FFFFFF"></polygon></g></g></g></g></g></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/samsung_pass_light.svg b/app/assets/images/passkeys/samsung_pass_light.svg
new file mode 100644
index 000000000..399033941
--- /dev/null
+++ b/app/assets/images/passkeys/samsung_pass_light.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8"?><svg version="1.1" width="52px" height="52px" viewBox="0 0 52.0 52.0" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><clipPath id="i0"><path d="M360,0 L360,800 L0,800 L0,0 L360,0 Z"></path></clipPath><clipPath id="i1"><path d="M26,0 C33.9910278,0 41.1395833,0.975 45.9087778,5.77777778 C49.7101944,9.60591667 52,15.8650556 52,26 C52,36.1349444 49.7098333,42.3944444 45.9080556,46.2225833 C41.1388611,51.0246389 33.9903056,52 26,52 C18.0089722,52 10.8607778,51.0246389 6.09158333,46.2225833 C2.29016667,42.3944444 0,36.1349444 0,26 C0,15.8650556 2.28980556,9.60555556 6.09086111,5.77777778 C10.8600556,0.975 18.0086111,0 26,0 Z"></path></clipPath><linearGradient id="i2" x1="26px" y1="52px" x2="26px" y2="0.195921148px" gradientUnits="userSpaceOnUse"><stop stop-color="#2929B2" offset="0%"></stop><stop stop-color="#1A40CC" offset="100%"></stop></linearGradient><clipPath id="i3"><path d="M37.1944444,0 L37.1944444,5.72222222 L0,5.72222222 L0,0 L37.1944444,0 Z"></path></clipPath><clipPath id="i4"><path d="M1.88342213,0 C2.62075987,0 3.64356402,0.181610871 3.64356402,1.32111819 L3.64356402,1.68911562 L2.34279339,1.68911562 L2.34279339,1.36490659 C2.34279339,1.07957573 2.16319664,0.889153371 1.8581768,0.889153371 C1.52931788,0.889153371 1.41648398,1.07527088 1.38085927,1.24215109 C1.36679688,1.30026657 1.36090408,1.41172184 1.38614941,1.51725793 C1.53460802,2.1304973 3.51244902,2.45611887 3.73255883,3.55553727 C3.75371937,3.6670598 3.80079488,3.96113488 3.73804986,4.41300963 C3.61182321,5.28965203 2.8380572,5.61217949 1.89581043,5.61217949 C0.915729136,5.61217949 0,5.25998892 0,4.0888006 L0,3.68824773 L1.39940823,3.68824773 L1.40121625,4.19231879 C1.40121625,4.4786586 1.59608073,4.66928275 1.92185932,4.66928275 C2.2707404,4.66928275 2.38839569,4.49150589 2.43118552,4.31541061 C2.45622996,4.21639905 2.47149769,4.05463085 2.42100703,3.92864671 C2.15134406,3.25096911 0.297921677,2.94128895 0.0721199473,1.87032292 C0.0173436085,1.60564189 0.0238390912,1.39907634 0.0617405677,1.16426021 C0.200221581,0.308873007 0.957112727,0 1.88342213,0 Z M18.8411186,0.0296631089 C19.5704877,0.0296631089 20.5778901,0.206969129 20.5778901,1.33564706 L20.5778901,1.70075217 L19.2921864,1.70075217 L19.2921864,1.38044441 C19.2921864,1.0974005 19.115603,0.90879425 18.8144001,0.90879425 C18.4912331,0.90879425 18.3790688,1.09161586 18.34177,1.25937049 C18.3297835,1.31681334 18.3230871,1.42665428 18.3462566,1.53017248 C18.4943134,2.13641647 20.4503912,2.46311425 20.6660144,3.54921452 C20.6896526,3.65905547 20.7340496,3.95070907 20.6751885,4.3984135 C20.5517743,5.26510093 19.7824949,5.58480333 18.8510962,5.58480333 C17.8785818,5.58480333 16.9756428,5.23543783 16.9756428,4.07750037 L16.9756428,3.67788919 L18.3595154,3.67788919 L18.3599172,4.18061498 C18.3599172,4.46305352 18.5551834,4.65044903 18.8797567,4.65044903 C19.2257583,4.65044903 19.3424761,4.47516091 19.3823865,4.30088174 C19.4063595,4.20556966 19.4198192,4.04380146 19.3728107,3.9169429 C19.1064289,3.24726963 17.2711537,2.94007821 17.0477627,1.8811523 C16.9901069,1.6193636 16.9990801,1.41421058 17.0353074,1.18309393 C17.1723153,0.333827686 17.92251,0.0296631089 18.8411186,0.0296631089 Z M23.2364845,0.166880211 L23.2362291,4.11137366 C23.2372063,4.15798462 23.2408818,4.20406745 23.2496764,4.24115194 C23.2751226,4.37123913 23.3877556,4.62159308 23.7469491,4.62159308 C24.1108301,4.62159308 24.2205836,4.37123913 24.2481057,4.24115194 C24.2596905,4.1855252 24.2617663,4.10965222 24.2596905,4.04211988 L24.2596905,0.166880211 L25.5786083,0.166880211 L25.5786083,3.92185312 C25.5843002,4.01864499 25.5747244,4.21639905 25.5674253,4.26819178 C25.4747475,5.24667079 24.707477,5.56435529 23.7469491,5.56435529 C22.7882962,5.56435529 22.020557,5.24667079 21.9295532,4.26819178 C21.9238613,4.21639905 21.9162944,4.01864499 21.9179685,3.92185312 L21.9179685,0.166880211 L23.2364845,0.166880211 Z M34.6297621,0.0259636282 C35.5539956,0.0259636282 36.3600382,0.336854534 36.4587427,1.31950387 C36.465573,1.39119692 36.4683814,1.46511378 36.4693607,1.52618022 L36.469004,1.65575402 L36.4687203,1.66617884 L36.4687203,1.83803654 L35.1553605,1.83803654 L35.15515,1.53355556 C35.1544471,1.49873362 35.15149,1.40564123 35.1394901,1.34526571 C35.1166555,1.2313217 35.0170804,0.966035306 34.6181774,0.966035306 C34.2381582,0.966035306 34.1255921,1.21759999 34.0996772,1.34526571 C34.0817978,1.41542132 34.0761059,1.50811012 34.0761059,1.5927946 L34.0761059,3.98689672 C34.0761059,4.05463085 34.0801907,4.12761151 34.0897665,4.18613057 C34.1125342,4.327518 34.2438501,4.5682533 34.6209899,4.5682533 C35.0004064,4.5682533 35.134133,4.327518 35.1553605,4.18613057 C35.1669452,4.12761151 35.1706282,4.05463085 35.1689541,3.98689672 L35.1689541,3.22890676 L34.6344496,3.22890676 L34.6344496,2.46493036 L36.4791667,2.46493036 L36.4791667,3.86851334 C36.4770908,3.96443078 36.4754837,4.03868945 36.460015,4.21397757 C36.3728282,5.16958707 35.5539956,5.50832497 34.6260791,5.50832497 C33.7038545,5.50832497 32.87933,5.16958707 32.7936164,4.21397757 C32.775938,4.03868945 32.7728576,3.96443078 32.7728576,3.86851334 L32.7728576,1.66617884 C32.7728576,1.5702614 32.788728,1.40909857 32.7991074,1.31950387 C32.9141511,0.339746855 33.7038545,0.0259636282 34.6297621,0.0259636282 Z M12.1447447,0.166880211 L12.8022616,4.26159998 L13.4601804,0.166880211 L15.5852746,0.166880211 L15.7019255,5.40521036 L14.395262,5.40521036 L14.3598382,0.555931054 L13.4622562,5.40521036 L12.1398563,5.40521036 L11.2430779,0.555931054 L11.207788,5.40521036 L9.9044058,5.40521036 L10.0172397,0.166880211 L12.1447447,0.166880211 Z M7.9012525,0.166880211 L8.86325358,5.40521036 L7.4643141,5.40521036 L6.75382883,0.555931054 L6.02586602,5.40521036 L4.61714983,5.40521036 L5.58316873,0.166880211 L7.9012525,0.166880211 Z M28.304836,5.35059257 L27.0246233,5.35059257 L27.0246233,0.166880211 L28.9598753,0.166880211 L30.1879903,4.38435547 L30.1168748,0.166880211 L31.4054581,0.166880211 L31.4054581,5.35059257 L29.5494241,5.35059257 L28.23,0.999 L28.304836,5.35059257 Z"></path></clipPath><clipPath id="i5"><path d="M24.3352966,2.47006432 C25.3096502,2.47006432 26.121323,2.65660564 26.7692768,3.02897356 C27.4172305,3.40169883 27.9295017,3.90843367 28.3060902,4.55025015 L26.3954573,5.48259937 C26.1960869,5.1463247 25.9191836,4.88009236 25.5647473,4.68461708 C25.2103111,4.48914179 24.8004942,4.39122547 24.3352966,4.39122547 C23.8036422,4.39122547 23.4104395,4.49485953 23.1556885,4.70212766 C22.9005913,4.90939579 22.7735619,5.14954093 22.7735619,5.42220573 C22.7735619,5.73846831 22.9618562,5.96503381 23.3384447,6.10083017 C23.714687,6.23734125 24.2688398,6.38207158 24.9998646,6.53466381 C25.3986054,6.6111386 25.799769,6.71155644 26.204394,6.83734675 C26.6086729,6.9627797 26.9769543,7.13181043 27.3092383,7.34479631 C27.6415222,7.55742482 27.9101185,7.82973226 28.1150269,8.1627907 C28.3199354,8.49549178 28.4223896,8.91252955 28.4223896,9.41426137 C28.4223896,9.75232283 28.3448567,10.1043213 28.1897908,10.469542 C28.0343788,10.8347628 27.7938191,11.1731816 27.4670731,11.4837264 C27.1403272,11.794986 26.7277413,12.0483534 26.2293153,12.2445434 C25.7308893,12.4410908 25.1327782,12.5390071 24.4349818,12.5390071 C23.3605969,12.5390071 22.4689682,12.332811 21.7600957,11.9200616 C21.0512233,11.5069548 20.5029547,10.9105228 20.11529,10.1300511 L22.1920649,9.16518225 C22.4246637,9.60473363 22.7403335,9.94243774 23.1390743,10.1786519 C23.5378151,10.4145088 24.0030126,10.5320798 24.534667,10.5320798 C25.0884736,10.5320798 25.5038286,10.417725 25.7807319,10.1890153 C26.0572891,9.95994832 26.1960869,9.68764088 26.1960869,9.37102095 C26.1960869,9.19662983 26.1323992,9.05511573 26.0050236,8.94576392 C25.8776481,8.83712683 25.7115061,8.74135466 25.5065976,8.65987685 C25.3013431,8.57804167 25.0607833,8.51014349 24.78388,8.45511023 C24.5069767,8.40079169 24.2189972,8.3407554 23.9199416,8.27535873 C23.4987025,8.18816318 23.0864626,8.08488647 22.6821838,7.9648139 C22.277905,7.84509869 21.9151616,7.67856947 21.5939538,7.46629831 C21.2727459,7.25331244 21.0124568,6.98064764 20.8130864,6.64830392 C20.613716,6.3159602 20.5140308,5.89892243 20.5140308,5.39754797 C20.5140308,5.01553137 20.6054089,4.64780912 20.7881651,4.2936665 C20.9709213,3.93916653 21.2284414,3.62612018 21.5607254,3.35309803 C21.8930093,3.08079059 22.294173,2.86566056 22.7652548,2.7073506 C23.2359904,2.54904063 23.7593377,2.47006432 24.3352966,2.47006432 Z M33.1073515,2.47006432 C34.081705,2.47006432 34.8933779,2.65660564 35.5413316,3.02897356 C36.1892854,3.40169883 36.7015565,3.90843367 37.0781451,4.55025015 L35.1675122,5.48259937 C34.9681418,5.1463247 34.6912384,4.88009236 34.3368022,4.68461708 C33.9823659,4.48914179 33.572549,4.39122547 33.1073515,4.39122547 C32.5756971,4.39122547 32.1824944,4.49485953 31.9277433,4.70212766 C31.6726461,4.90939579 31.5456167,5.14954093 31.5456167,5.42220573 C31.5456167,5.73846831 31.733911,5.96503381 32.1104995,6.10083017 C32.4867419,6.23734125 33.0408947,6.38207158 33.7719194,6.53466381 C34.1706602,6.6111386 34.5718239,6.71155644 34.9764489,6.83734675 C35.3807277,6.9627797 35.7490091,7.13181043 36.0812931,7.34479631 C36.4135771,7.55742482 36.6821733,7.82973226 36.8870818,8.1627907 C37.0919902,8.49549178 37.1944444,8.91252955 37.1944444,9.41426137 C37.1944444,9.75232283 37.1169115,10.1043213 36.9618457,10.469542 C36.8064337,10.8347628 36.5658739,11.1731816 36.239128,11.4837264 C35.9123821,11.794986 35.4997961,12.0483534 35.0013702,12.2445434 C34.5029442,12.4410908 33.904833,12.5390071 33.2070367,12.5390071 C32.1326518,12.5390071 31.2410231,12.332811 30.5321506,11.9200616 C29.8232781,11.5069548 29.2750095,10.9105228 28.8873449,10.1300511 L30.9641198,9.16518225 C31.1967186,9.60473363 31.5123883,9.94243774 31.9111291,10.1786519 C32.3098699,10.4145088 32.7750675,10.5320798 33.3067218,10.5320798 C33.8605285,10.5320798 34.2758835,10.417725 34.5527868,10.1890153 C34.829344,9.95994832 34.9681418,9.68764088 34.9681418,9.37102095 C34.9681418,9.19662983 34.904454,9.05511573 34.7770785,8.94576392 C34.6497029,8.83712683 34.483561,8.74135466 34.2786525,8.65987685 C34.0733979,8.57804167 33.8328382,8.51014349 33.5559348,8.45511023 C33.2790315,8.40079169 32.9910521,8.3407554 32.6919965,8.27535873 C32.2707573,8.18816318 31.8585175,8.08488647 31.4542386,7.9648139 C31.0499598,7.84509869 30.6872165,7.67856947 30.3660086,7.46629831 C30.0448008,7.25331244 29.7845116,6.98064764 29.5851412,6.64830392 C29.3857709,6.3159602 29.2860857,5.89892243 29.2860857,5.39754797 C29.2860857,5.01553137 29.3774638,4.64780912 29.5602199,4.2936665 C29.7429761,3.93916653 30.0004962,3.62612018 30.3327802,3.35309803 C30.6650642,3.08079059 31.0662279,2.86566056 31.5373096,2.7073506 C32.0080453,2.54904063 32.5313926,2.47006432 33.1073515,2.47006432 Z M13.7732057,2.47002859 C14.4156214,2.47002859 15.0081945,2.59010116 15.550925,2.82953159 C16.0933094,3.06967673 16.5422389,3.39666007 16.8966751,3.81083897 L16.8966751,2.48718181 L19.139592,2.48718181 L19.139592,12.5218181 L16.8966751,12.5218181 L16.8966751,11.0959563 C16.5422389,11.5440843 16.0881174,11.8967975 15.5343108,12.1537385 C14.9805042,12.4106795 14.382393,12.5389714 13.7399773,12.5389714 C13.1529423,12.5389714 12.5742143,12.4264033 12.0037935,12.2005525 C11.4333726,11.9743444 10.9211015,11.646289 10.4669801,11.2163863 C10.0128586,10.7864836 9.64700011,10.260094 9.37044292,9.63757491 C9.0935396,9.01469844 8.95508794,8.30641322 8.95508794,7.51307658 C8.95508794,6.70830447 9.09042444,5.99501622 9.36213582,5.3717824 C9.63350107,4.74890593 9.99347539,4.22287371 10.4420588,3.79297103 C10.8906421,3.36271098 11.4056823,3.03501292 11.9871793,2.80951949 C12.5686763,2.58331134 13.1640184,2.47002859 13.7732057,2.47002859 Z M4.15354978,0 C4.78488935,0 5.36638632,0.117213701 5.89804069,0.351998461 C6.42969506,0.586425862 6.88900844,0.903403156 7.27701922,1.30400242 C7.66468386,1.70424432 7.96893138,2.175958 8.19080017,2.71914344 C8.41232282,3.26197152 8.52308415,3.84232228 8.52308415,4.46019572 C8.52308415,5.07735444 8.41232282,5.66056408 8.19080017,6.20946726 C7.96893138,6.75837044 7.66468386,7.23294299 7.27701922,7.63354225 C6.88900844,8.03378416 6.42692603,8.35111881 5.88973359,8.58518885 C5.35219502,8.81961625 4.76827515,8.93682995 4.13693558,8.93682995 L2.25953108,8.93682995 L2.25953108,12.5218539 L0,12.5218539 L0,0 L4.15354978,0 Z M14.1054897,4.58023256 C13.6956728,4.58023256 13.3107771,4.65563527 12.9508028,4.80572599 C12.5908285,4.9558167 12.2779278,5.16022596 12.0121006,5.41752433 C11.7462734,5.67553741 11.5385959,5.98179394 11.3890681,6.33629391 C11.2395403,6.69079389 11.1647764,7.07173841 11.1647764,7.48019957 C11.1647764,7.88830337 11.2395403,8.27246413 11.3890681,8.63196712 C11.5385959,8.99147012 11.7462734,9.30272967 12.0121006,9.5664605 C12.2779278,9.82947661 12.5908285,10.03603 12.9508028,10.1868354 C13.3107771,10.3369262 13.6956728,10.4119715 14.1054897,10.4119715 C14.5263827,10.4119715 14.9137012,10.3369262 15.2684836,10.1868354 C15.6229199,10.03603 15.9271674,9.82661774 16.1822646,9.55788389 C16.4370156,9.28950739 16.639155,8.97789048 16.7886828,8.62374787 C16.9382106,8.26960526 17.0129745,7.88830337 17.0129745,7.48019957 C17.0129745,7.08281654 16.9382106,6.70687503 16.7886828,6.35237506 C16.639155,5.99787509 16.4370156,5.68911705 16.1822646,5.42610094 C15.9271674,5.16272747 15.6229199,4.9558167 15.2684836,4.80572599 C14.9137012,4.65563527 14.5263827,4.58023256 14.1054897,4.58023256 Z M3.98740779,2.16130628 L2.25953108,2.16130628 L2.25953108,6.77552367 L3.98740779,6.77552367 C4.31969177,6.77552367 4.62428542,6.71548738 4.90118874,6.59541481 C5.17774593,6.47534224 5.41622892,6.30952774 5.6155993,6.09832866 C5.81496969,5.88677222 5.97003555,5.64055198 6.08079688,5.36038265 C6.19121208,5.08057067 6.24693887,4.78003189 6.24693887,4.46019572 C6.24693887,4.13964484 6.19121208,3.83946341 6.08079688,3.55929408 C5.97003555,3.27912475 5.81496969,3.03612073 5.6155993,2.83028204 C5.41622892,2.62444334 5.17774593,2.46148771 4.90118874,2.34141514 C4.62428542,2.22134257 4.31969177,2.16130628 3.98740779,2.16130628 Z"></path></clipPath></defs><g transform="translate(-233.0 -160.0)"><g clip-path="url(#i0)"><g transform="translate(233.0 160.0)"><g transform="translate(-0.00018055555555207548 0.0)"><g clip-path="url(#i1)"><polygon points="0,0 52,0 52,52 0,52 0,0" stroke="none" fill="url(#i2)"></polygon></g></g><g transform="translate(7.583333333333332 14.80555555555555)"><g clip-path="url(#i3)"><g clip-path="url(#i4)"><polygon points="0,0 36.4791667,0 36.4791667,5.61217949 0,5.61217949 0,0" stroke="none" fill="#FFFFFF"></polygon></g></g></g><g transform="translate(7.583333333333371 24.43208025547733)"><g clip-path="url(#i5)"><polygon points="0,0 37.1944444,0 37.1944444,12.5390071 0,12.5390071 0,0" stroke="none" fill="#FFFFFF"></polygon></g></g></g></g></g></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/windows_hello_dark.svg b/app/assets/images/passkeys/windows_hello_dark.svg
new file mode 100644
index 000000000..960a7af56
--- /dev/null
+++ b/app/assets/images/passkeys/windows_hello_dark.svg
@@ -0,0 +1 @@
+<svg id="Layer_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><defs><style>.cls-1{fill:#0078d4;stroke-width:0px;}</style></defs><rect class="cls-1" x="24.25" y="24.25" width="98.35" height="98.35"/><rect class="cls-1" x="133.4" y="24.25" width="98.35" height="98.35"/><rect class="cls-1" x="24.25" y="133.4" width="98.35" height="98.35"/><rect class="cls-1" x="133.4" y="133.4" width="98.35" height="98.35"/></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/windows_hello_light.svg b/app/assets/images/passkeys/windows_hello_light.svg
new file mode 100644
index 000000000..960a7af56
--- /dev/null
+++ b/app/assets/images/passkeys/windows_hello_light.svg
@@ -0,0 +1 @@
+<svg id="Layer_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><defs><style>.cls-1{fill:#0078d4;stroke-width:0px;}</style></defs><rect class="cls-1" x="24.25" y="24.25" width="98.35" height="98.35"/><rect class="cls-1" x="133.4" y="24.25" width="98.35" height="98.35"/><rect class="cls-1" x="24.25" y="133.4" width="98.35" height="98.35"/><rect class="cls-1" x="133.4" y="133.4" width="98.35" height="98.35"/></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/yubikey_dark.svg b/app/assets/images/passkeys/yubikey_dark.svg
new file mode 100644
index 000000000..61bf17f54
--- /dev/null
+++ b/app/assets/images/passkeys/yubikey_dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="none"><circle cx="128" cy="128" r="120" fill="#9aca3c"/><path d="M128,160 L88,88 L108,88 L128,128 L148,88 L168,88 L140,148 L140,184 L116,184 L116,148 Z" fill="#fff"/></svg>
\ No newline at end of file
diff --git a/app/assets/images/passkeys/yubikey_light.svg b/app/assets/images/passkeys/yubikey_light.svg
new file mode 100644
index 000000000..61bf17f54
--- /dev/null
+++ b/app/assets/images/passkeys/yubikey_light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="none"><circle cx="128" cy="128" r="120" fill="#9aca3c"/><path d="M128,160 L88,88 L108,88 L128,128 L148,88 L168,88 L140,148 L140,184 L116,184 L116,148 Z" fill="#fff"/></svg>
\ No newline at end of file
diff --git a/app/assets/stylesheets/credentials.css b/app/assets/stylesheets/credentials.css
new file mode 100644
index 000000000..64e39005b
--- /dev/null
+++ b/app/assets/stylesheets/credentials.css
@@ -0,0 +1,29 @@
+@layer components {
+  .passkey-icon--dark {
+    display: none;
+  }
+
+  .passkey-icon--light {
+    html[data-theme="dark"] & {
+      display: none;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      html:not([data-theme]) & {
+        display: none;
+      }
+    }
+  }
+
+  .passkey-icon--dark {
+    html[data-theme="dark"] & {
+      display: inline;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      html:not([data-theme]) & {
+        display: inline;
+      }
+    }
+  }
+}
diff --git a/app/assets/stylesheets/icons.css b/app/assets/stylesheets/icons.css
index 35680e429..2f7fe8564 100644
--- a/app/assets/stylesheets/icons.css
+++ b/app/assets/stylesheets/icons.css
@@ -27,6 +27,7 @@
   .icon--art { --svg: url("art.svg "); }
   .icon--assigned { --svg: url("assigned.svg "); }
   .icon--attachment { --svg: url("attachment.svg "); }
+  .icon--authentication { --svg: url("authentication.svg "); }
   .icon--bell-alert { --svg: url("bell-alert.svg "); }
   .icon--bell-off { --svg: url("bell-off.svg "); }
   .icon--bell { --svg: url("bell.svg "); }
@@ -62,7 +63,6 @@
   .icon--history { --svg: url("history.svg "); }
   .icon--home { --svg: url("home.svg "); }
   .icon--install-edge { --svg: url("install-edge.svg "); }
-  .icon--key { --svg: url("key.svg "); }
   .icon--lifebuoy { --svg: url("lifebuoy.svg "); }
   .icon--lock { --svg: url("lock.svg "); }
   .icon--logout { --svg: url("logout.svg "); }
diff --git a/app/controllers/concerns/current_request.rb b/app/controllers/concerns/current_request.rb
index 193a2713b..689bc146a 100644
--- a/app/controllers/concerns/current_request.rb
+++ b/app/controllers/concerns/current_request.rb
@@ -10,6 +10,7 @@ module CurrentRequest
       Current.referrer    = request.referrer
 
       ActionPack::WebAuthn::Current.host = request.host
+      ActionPack::WebAuthn::Current.origin = request.base_url
     end
   end
 end
diff --git a/app/controllers/sessions/passkeys_controller.rb b/app/controllers/sessions/passkeys_controller.rb
index 5b997260b..18917583d 100644
--- a/app/controllers/sessions/passkeys_controller.rb
+++ b/app/controllers/sessions/passkeys_controller.rb
@@ -5,12 +5,8 @@ class Sessions::PasskeysController < ApplicationController
 
   def create
     credential = Identity::Credential.authenticate(
-      id: params.expect(:credential_id),
-      client_data_json: response_params[:client_data_json],
-      authenticator_data: response_params[:authenticator_data],
-      signature: response_params[:signature],
-      challenge: session.delete(:webauthn_challenge),
-      origin: request.base_url
+      passkey: passkey_params,
+      challenge: session.delete(:webauthn_challenge)
     )
 
     if credential
@@ -21,8 +17,8 @@ class Sessions::PasskeysController < ApplicationController
   end
 
   private
-    def response_params
-      params.expect(response: [ :client_data_json, :authenticator_data, :signature ])
+    def passkey_params
+      params.expect(passkey: [ :id, :client_data_json, :authenticator_data, :signature ])
     end
 
     def authentication_succeeded(identity)
diff --git a/app/controllers/users/credentials_controller.rb b/app/controllers/users/credentials_controller.rb
index 65ebe42ff..aa0f3d8e9 100644
--- a/app/controllers/users/credentials_controller.rb
+++ b/app/controllers/users/credentials_controller.rb
@@ -1,26 +1,28 @@
 class Users::CredentialsController < ApplicationController
-  before_action :set_credential, only: :destroy
+  before_action :set_credential, only: %i[ edit update destroy ]
 
   def index
     @credentials = Current.identity.credentials.order(name: :asc, created_at: :desc)
-  end
-
-  def new
     @creation_options = Identity::Credential.creation_options(identity: Current.identity, display_name: Current.user.name)
     session[:webauthn_challenge] = @creation_options.challenge
   end
 
   def create
-    Identity::Credential.register(
-      identity: Current.identity,
-      name: credential_params[:name],
-      client_data_json: credential_params[:client_data_json],
-      attestation_object: credential_params[:attestation_object],
-      challenge: session.delete(:webauthn_challenge),
-      origin: request.base_url,
-      transports: Array(credential_params[:transports])
+    credential = Current.identity.credentials.register(
+      passkey: passkey_params,
+      challenge: session.delete(:webauthn_challenge)
     )
 
+    render json: { location: edit_user_credential_path(Current.user, credential, created: true) }
+  rescue ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError => error
+    render json: { error: error.message }, status: :unprocessable_entity
+  end
+
+  def edit
+  end
+
+  def update
+    @credential.update!(credential_params)
     redirect_to user_credentials_path(Current.user)
   end
 
@@ -35,6 +37,10 @@ class Users::CredentialsController < ApplicationController
     end
 
     def credential_params
-      params.expect(credential: [ :name, :client_data_json, :attestation_object, transports: [] ])
+      params.expect(credential: [ :name ])
+    end
+
+    def passkey_params
+      params.expect(passkey: [ :client_data_json, :attestation_object, transports: [] ])
     end
 end
diff --git a/app/javascript/controllers/credential_controller.js b/app/javascript/controllers/credential_controller.js
index bd9b0baee..ddc76085d 100644
--- a/app/javascript/controllers/credential_controller.js
+++ b/app/javascript/controllers/credential_controller.js
@@ -1,60 +1,60 @@
 import { Controller } from "@hotwired/stimulus"
+import { post } from "@rails/request.js"
+import { base64urlToBuffer, bufferToBase64url } from "helpers/base64url_helpers"
 
 export default class extends Controller {
-  static values = { publicKey: Object }
-  static targets = ["clientDataJSON", "attestationObject"]
+  static values = { publicKey: Object, registerUrl: String }
+  static targets = ["button", "error", "cancelled"]
 
-  async create(event) {
-    event.preventDefault()
+  async create() {
+    this.buttonTarget.disabled = true
+    this.errorTarget.hidden = true
+    this.cancelledTarget.hidden = true
 
     try {
-      const publicKey = this.prepareOptions(this.publicKeyValue)
+      const publicKey = this.#prepareOptions(this.publicKeyValue)
       const credential = await navigator.credentials.create({ publicKey })
-      this.submitCredential(credential)
+      await this.#registerCredential(credential)
     } catch (error) {
-      if (error.name !== "AbortError" && error.name !== "NotAllowedError") {
-        console.error("Registration failed:", error)
+      if (error.name === "AbortError" || error.name === "NotAllowedError") {
+        this.cancelledTarget.hidden = false
+      } else {
+        this.errorTarget.hidden = false
       }
+      this.buttonTarget.disabled = false
     }
   }
 
-  submitCredential(credential) {
-    this.clientDataJSONTarget.value = this.bufferToBase64url(credential.response.clientDataJSON)
-    this.attestationObjectTarget.value = this.bufferToBase64url(credential.response.attestationObject)
+  async #registerCredential(credential) {
+    const response = await post(this.registerUrlValue, {
+      body: JSON.stringify({
+        passkey: {
+          client_data_json: new TextDecoder().decode(credential.response.clientDataJSON),
+          attestation_object: bufferToBase64url(credential.response.attestationObject),
+          transports: credential.response.getTransports?.() || []
+        }
+      }),
+      contentType: "application/json",
+      responseKind: "json"
+    })
 
-    for (const transport of credential.response.getTransports?.() || []) {
-      const input = document.createElement("input")
-      input.type = "hidden"
-      input.name = "credential[transports][]"
-      input.value = transport
-      this.element.appendChild(input)
+    if (response.ok) {
+      const { location } = await response.json
+      Turbo.visit(location)
+    } else {
+      throw new Error("Registration failed")
     }
-
-    this.element.requestSubmit()
   }
 
-  prepareOptions(options) {
+  #prepareOptions(options) {
     return {
       ...options,
-      challenge: this.base64urlToBuffer(options.challenge),
-      user: { ...options.user, id: this.base64urlToBuffer(options.user.id) },
+      challenge: base64urlToBuffer(options.challenge),
+      user: { ...options.user, id: base64urlToBuffer(options.user.id) },
       excludeCredentials: (options.excludeCredentials || []).map(cred => ({
         ...cred,
-        id: this.base64urlToBuffer(cred.id)
+        id: base64urlToBuffer(cred.id)
       }))
     }
   }
-
-  base64urlToBuffer(base64url) {
-    const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/")
-    const padding = "=".repeat((4 - base64.length % 4) % 4)
-    const binary = atob(base64 + padding)
-    return Uint8Array.from(binary, c => c.charCodeAt(0)).buffer
-  }
-
-  bufferToBase64url(buffer) {
-    const bytes = new Uint8Array(buffer)
-    const binary = String.fromCharCode(...bytes)
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
-  }
 }
diff --git a/app/javascript/controllers/passkey_controller.js b/app/javascript/controllers/passkey_controller.js
index 87145db77..566518bb9 100644
--- a/app/javascript/controllers/passkey_controller.js
+++ b/app/javascript/controllers/passkey_controller.js
@@ -1,4 +1,5 @@
 import { Controller } from "@hotwired/stimulus"
+import { base64urlToBuffer, bufferToBase64url } from "helpers/base64url_helpers"
 
 export default class extends Controller {
   static values = { publicKey: Object, url: String, csrfToken: String }
@@ -41,10 +42,10 @@ export default class extends Controller {
 
     const fields = {
       authenticity_token: this.csrfTokenValue,
-      credential_id: credential.id,
-      "response[client_data_json]": new TextDecoder().decode(credential.response.clientDataJSON),
-      "response[authenticator_data]": this.#bufferToBase64url(credential.response.authenticatorData),
-      "response[signature]": this.#bufferToBase64url(credential.response.signature)
+      "passkey[id]": credential.id,
+      "passkey[client_data_json]": new TextDecoder().decode(credential.response.clientDataJSON),
+      "passkey[authenticator_data]": bufferToBase64url(credential.response.authenticatorData),
+      "passkey[signature]": bufferToBase64url(credential.response.signature)
     }
 
     for (const [name, value] of Object.entries(fields)) {
@@ -62,13 +63,13 @@ export default class extends Controller {
   #prepareOptions(options) {
     const prepared = {
       ...options,
-      challenge: this.#base64urlToBuffer(options.challenge)
+      challenge: base64urlToBuffer(options.challenge)
     }
 
     if (options.allowCredentials?.length) {
       prepared.allowCredentials = options.allowCredentials.map(cred => ({
         ...cred,
-        id: this.#base64urlToBuffer(cred.id)
+        id: base64urlToBuffer(cred.id)
       }))
     } else {
       delete prepared.allowCredentials
@@ -76,17 +77,4 @@ export default class extends Controller {
 
     return prepared
   }
-
-  #base64urlToBuffer(base64url) {
-    const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/")
-    const padding = "=".repeat((4 - base64.length % 4) % 4)
-    const binary = atob(base64 + padding)
-    return Uint8Array.from(binary, c => c.charCodeAt(0)).buffer
-  }
-
-  #bufferToBase64url(buffer) {
-    const bytes = new Uint8Array(buffer)
-    const binary = String.fromCharCode(...bytes)
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
-  }
 }
diff --git a/app/javascript/helpers/base64url_helpers.js b/app/javascript/helpers/base64url_helpers.js
new file mode 100644
index 000000000..945826f58
--- /dev/null
+++ b/app/javascript/helpers/base64url_helpers.js
@@ -0,0 +1,12 @@
+export function base64urlToBuffer(base64url) {
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/")
+  const padding = "=".repeat((4 - base64.length % 4) % 4)
+  const binary = atob(base64 + padding)
+  return Uint8Array.from(binary, c => c.charCodeAt(0)).buffer
+}
+
+export function bufferToBase64url(buffer) {
+  const bytes = new Uint8Array(buffer)
+  const binary = String.fromCharCode(...bytes)
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+}
diff --git a/app/models/identity/credential.rb b/app/models/identity/credential.rb
index eb03add28..d233fbcb6 100644
--- a/app/models/identity/credential.rb
+++ b/app/models/identity/credential.rb
@@ -18,44 +18,51 @@ class Identity::Credential < ApplicationRecord
       ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(credentials: credentials.map(&:to_public_key_credential))
     end
 
-    def authenticate(id:, **params)
-      find_by(credential_id: id)&.authenticate(**params)
-    end
-
-    def register(identity:, name:, client_data_json:, attestation_object:, challenge:, origin:, transports: [])
+    def register(passkey:, challenge:, origin: ActionPack::WebAuthn::Current.origin, **attributes)
       public_key_credential = ActionPack::WebAuthn::PublicKeyCredential.create(
-        client_data_json: Base64.urlsafe_decode64(client_data_json),
-        attestation_object: Base64.urlsafe_decode64(attestation_object),
+        client_data_json: passkey[:client_data_json],
+        attestation_object: Base64.urlsafe_decode64(passkey[:attestation_object]),
         challenge: challenge,
         origin: origin,
-        transports: transports
+        transports: Array(passkey[:transports])
       )
 
-      identity.credentials.create!(
-        name: name,
+      create!(
+        **attributes,
+        name: attributes.fetch(:name, Authenticator.find_by_aaguid(public_key_credential.aaguid)&.name),
         credential_id: public_key_credential.id,
         public_key: public_key_credential.public_key.to_der,
         sign_count: public_key_credential.sign_count,
+        aaguid: public_key_credential.aaguid,
+        backed_up: public_key_credential.backed_up,
         transports: public_key_credential.transports
       )
     end
+
+    def authenticate(passkey:, challenge:, origin: ActionPack::WebAuthn::Current.origin)
+      find_by(credential_id: passkey[:id])&.authenticate(passkey: passkey, challenge: challenge, origin: origin)
+    end
   end
 
-  def authenticate(client_data_json:, authenticator_data:, signature:, challenge:, origin:)
+  def authenticate(passkey:, challenge:, origin: ActionPack::WebAuthn::Current.origin)
     pkc = to_public_key_credential
     pkc.authenticate(
-      client_data_json: client_data_json,
-      authenticator_data: Base64.urlsafe_decode64(authenticator_data),
-      signature: Base64.urlsafe_decode64(signature),
+      client_data_json: passkey[:client_data_json],
+      authenticator_data: Base64.urlsafe_decode64(passkey[:authenticator_data]),
+      signature: Base64.urlsafe_decode64(passkey[:signature]),
       challenge: challenge,
       origin: origin
     )
-    update!(sign_count: pkc.sign_count)
+    update!(sign_count: pkc.sign_count, backed_up: pkc.backed_up)
     self
   rescue ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError
     nil
   end
 
+  def authenticator
+    Authenticator.find_by_aaguid(aaguid)
+  end
+
   def to_public_key_credential
     ActionPack::WebAuthn::PublicKeyCredential.new(
       id: credential_id,
diff --git a/app/models/identity/credential/authenticator.rb b/app/models/identity/credential/authenticator.rb
new file mode 100644
index 000000000..72ebece0f
--- /dev/null
+++ b/app/models/identity/credential/authenticator.rb
@@ -0,0 +1,12 @@
+class Identity::Credential::Authenticator < Data.define(:name, :icon)
+  REGISTRY = Rails.application.config_for(:passkey_aaguids).each_with_object({}) do |(_key, attrs), hash|
+    authenticator = new(name: attrs[:name], icon: attrs[:icon])
+    attrs[:aaguids].each { |aaguid| hash[aaguid] = authenticator }
+  end.freeze
+
+  class << self
+    def find_by_aaguid(aaguid)
+      REGISTRY[aaguid]
+    end
+  end
+end
diff --git a/app/views/users/credentials/_credential.html.erb b/app/views/users/credentials/_credential.html.erb
index a240fc46f..38fe5cb0e 100644
--- a/app/views/users/credentials/_credential.html.erb
+++ b/app/views/users/credentials/_credential.html.erb
@@ -1,11 +1,10 @@
-<tr style="view-transition-name: <%= dom_id(credential) %>">
-  <td><strong><%= credential.name.presence || "Passkey" %></strong></td>
-  <td>
-    <%= button_to user_credential_path(Current.user, credential), method: :delete,
-          class: "btn btn--circle txt-negative txt-xx-small borderless",
-          data: { turbo_confirm: "Are you sure you want to remove this passkey?" } do %>
-      <%= icon_tag "trash" %>
-      <span class="for-screen-reader">Remove this passkey</span>
-    <% end %>
-  </td>
-</tr>
+<li class="list-style-none margin-none" style="view-transition-name: <%= dom_id(credential) %>">
+  <%= link_to edit_user_credential_path(Current.user, credential), class: "txt-ink flex align-center gap txt-medium full-width" do %>
+    <% authenticator = credential.authenticator %>
+    <%= image_tag authenticator&.icon&.[](:light) || "passkeys/generic_light.svg", size: 24, class: "flex-item-no-shrink passkey-icon passkey-icon--light", aria: { hidden: true } %>
+    <%= image_tag authenticator&.icon&.[](:dark) || "passkeys/generic_dark.svg", size: 24, class: "flex-item-no-shrink passkey-icon passkey-icon--dark", aria: { hidden: true } %>
+    <strong class="overflow-ellipsis min-width"><%= credential.name.presence || "Passkey" %></strong>
+    <hr class="separator--horizontal flex-item-grow" style="--border-color: var(--color-ink-medium); --border-style: dashed" aria-hidden="true">
+    <%= icon_tag "arrow-right", class: "txt-subtle txt-xx-small flex-item-no-shrink" %>
+  <% end %>
+</li>
diff --git a/app/views/users/credentials/edit.html.erb b/app/views/users/credentials/edit.html.erb
new file mode 100644
index 000000000..c8e4ddfa4
--- /dev/null
+++ b/app/views/users/credentials/edit.html.erb
@@ -0,0 +1,33 @@
+<% @page_title = "Name your passkey" %>
+
+<% content_for :header do %>
+  <div class="header__actions header__actions--start">
+    <%= back_link_to "Passkeys", user_credentials_path(Current.user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
+  </div>
+
+  <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
+<% end %>
+
+<section class="panel panel--wide shadow center txt-align-start flex flex-column gap">
+  <% if params[:created] %>
+    <p class="margin-none">Your passkey has been registered. Give it a name so you can identify it later.</p>
+  <% end %>
+
+  <%= form_with model: @credential, scope: :credential, url: user_credential_path(Current.user, @credential), html: { class: "flex flex-column gap" } do |form| %>
+    <div class="flex flex-column gap-half">
+      <strong><%= form.label :name %></strong>
+      <%= form.text_field :name, autofocus: true, class: "input", placeholder: "e.g. MacBook Pro, iPhone", data: { "1p-ignore": "" }, autocomplete: "off" %>
+    </div>
+
+    <%= form.submit "Save", class: "btn btn--primary" %>
+  <% end %>
+
+  <div class="txt-align-center">
+    <%= button_to user_credential_path(Current.user, @credential), method: :delete,
+          class: "btn txt-negative borderless txt-small",
+          data: { turbo_confirm: "Are you sure you want to remove this passkey?" } do %>
+      <%= icon_tag "trash" %>
+      <span>Remove this passkey</span>
+    <% end %>
+  </div>
+</section>
diff --git a/app/views/users/credentials/index.html.erb b/app/views/users/credentials/index.html.erb
index 3b54e1e9f..3278f6d14 100644
--- a/app/views/users/credentials/index.html.erb
+++ b/app/views/users/credentials/index.html.erb
@@ -8,25 +8,33 @@
   <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
 <% end %>
 
-<section class="panel panel--wide shadow center txt-align-start">
-  <p class="margin-none-block-start">Passkeys let you sign in using your device’s biometrics, PIN, or security key&mdash;no email code needed.</p>
+<section class="panel panel--wide shadow center"
+  data-controller="credential"
+  data-credential-public-key-value="<%= @creation_options.as_json.to_json %>"
+  data-credential-register-url-value="<%= user_credentials_path(Current.user) %>">
+
+  <p class="margin-none-block-start"><strong>Passkeys let you sign in securely without a password or email code.</strong></p>
 
   <% if @credentials.any? %>
-    <table class="access-tokens">
-      <thead>
-        <tr>
-          <th>Passkey</th>
-          <th></th>
-        </tr>
-      </thead>
-      <tbody>
-        <%= render partial: "users/credentials/credential", collection: @credentials %>
-      </tbody>
-    </table>
+    <ul class="flex flex-column gap margin-none-block-start unpad full-width">
+      <%= render partial: "users/credentials/credential", collection: @credentials %>
+    </ul>
   <% end %>
 
-  <%= link_to new_user_credential_path(Current.user), class: "btn btn--link" do %>
+  <p class="txt-small pad-inline-double pad-block-half">Your browser will prompt you to create a passkey
+    using your device's biometrics, PIN, or security key</p>
+
+  <button type="button" data-action="credential#create" data-credential-target="button" class="btn btn--link center txt-medium">
     <%= icon_tag "add" %>
-    <span>Add a passkey</span>
-  <% end %>
+    <span>Register passkey</span>
+  </button>
+
+  <p data-credential-target="error" class="txt-negative" hidden>
+    Something went wrong while registering your passkey.
+  </p>
+
+  <p data-credential-target="cancelled" class="txt-subtle" hidden>
+    Passkey registration was cancelled.
+    Try again when you are ready.
+  </p>
 </section>
diff --git a/app/views/users/credentials/new.html.erb b/app/views/users/credentials/new.html.erb
deleted file mode 100644
index 15ad75378..000000000
--- a/app/views/users/credentials/new.html.erb
+++ /dev/null
@@ -1,31 +0,0 @@
-<% @page_title = "Add a passkey" %>
-
-<% content_for :header do %>
-  <div class="header__actions header__actions--start">
-    <%= back_link_to "Passkeys", user_credentials_path(Current.user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
-  </div>
-
-  <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
-<% end %>
-
-<section class="panel panel--wide shadow center txt-align-start">
-  <%= form_with url: user_credentials_path(Current.user),
-        data: { controller: "credential", credential_public_key_value: @creation_options.as_json },
-        html: { class: "flex flex-column gap" } do |form| %>
-
-    <div class="flex flex-column gap-half">
-      <strong><label for="credential_name">Passkey name</label></strong>
-      <input type="text" id="credential_name" name="credential[name]" required autofocus class="input" placeholder="e.g. MacBook Pro, iPhone">
-    </div>
-
-    <input type="hidden" name="credential[client_data_json]" data-credential-target="clientDataJSON">
-    <input type="hidden" name="credential[attestation_object]" data-credential-target="attestationObject">
-
-    <button type="button" data-action="credential#create" class="btn btn--link center txt-medium">
-      <%= icon_tag "add" %>
-      <span>Register passkey</span>
-    </button>
-  <% end %>
-
-  <%= link_to "Cancel and go back", user_credentials_path(Current.user), hidden: true %>
-</section>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index ad4ba3a59..f75febf2a 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -6,7 +6,7 @@
     <div class="flex flex-column gap position-relative">
       <% if Current.user == @user %>
         <%= link_to user_credentials_path(@user), class: "user-edit-link btn", style: "inset: 0 auto auto 0", data: { controller: "tooltip" } do %>
-          <%= icon_tag "key" %>
+          <%= icon_tag "authentication" %>
           <span class="for-screen-reader">Manage passkeys</span>
         <% end %>
 
diff --git a/config/passkey_aaguids.yml b/config/passkey_aaguids.yml
new file mode 100644
index 000000000..537d99683
--- /dev/null
+++ b/config/passkey_aaguids.yml
@@ -0,0 +1,124 @@
+shared:
+  apple_passwords:
+    name: Apple Passwords
+    icon:
+      light: passkeys/apple_passwords_light.svg
+      dark: passkeys/apple_passwords_dark.svg
+    aaguids:
+      - dd4ec289-e01d-41c9-bb89-70fa845d4bf2
+      - fbfc3007-154e-4ecc-8c0b-6e020557d7bd
+
+  google_password_manager:
+    name: Google Password Manager
+    icon:
+      light: passkeys/google_password_manager_light.svg
+      dark: passkeys/google_password_manager_dark.svg
+    aaguids:
+      - ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4
+
+  windows_hello:
+    name: Windows Hello
+    icon:
+      light: passkeys/windows_hello_light.svg
+      dark: passkeys/windows_hello_dark.svg
+    aaguids:
+      - 08987058-cadc-4b81-b6e1-30de50dcbe96
+      - 6028b017-b1d4-4c02-b4b3-afcdafc96bb2
+      - 9ddd1817-af5a-4672-a2b9-3e3dd95000a9
+
+  1password:
+    name: 1Password
+    icon:
+      light: passkeys/1password_light.svg
+      dark: passkeys/1password_dark.svg
+    aaguids:
+      - bada5566-a7aa-401f-bd96-45619a55120d
+
+  bitwarden:
+    name: Bitwarden
+    icon:
+      light: passkeys/bitwarden_light.svg
+      dark: passkeys/bitwarden_dark.svg
+    aaguids:
+      - d548826e-79b4-db40-a3d8-11116f7e8349
+
+  samsung_pass:
+    name: Samsung Pass
+    icon:
+      light: passkeys/samsung_pass_light.svg
+      dark: passkeys/samsung_pass_dark.svg
+    aaguids:
+      - 53414d53-554e-4700-0000-000000000000
+
+  lastpass:
+    name: LastPass
+    icon:
+      light: passkeys/lastpass_light.svg
+      dark: passkeys/lastpass_dark.svg
+    aaguids:
+      - b78a0a55-6ef8-d246-a042-ba0f6d55050c
+
+  dashlane:
+    name: Dashlane
+    icon:
+      light: passkeys/dashlane_light.svg
+      dark: passkeys/dashlane_dark.svg
+    aaguids:
+      - 531126d6-e717-415c-9320-3d9aa6981239
+
+  yubikey:
+    name: YubiKey
+    icon:
+      light: passkeys/yubikey_light.svg
+      dark: passkeys/yubikey_dark.svg
+    aaguids:
+      - 19083c3d-8383-4b18-bc03-8f1c9ab2fd1b
+      - 1ac71f64-468d-4fe0-bef1-0e5f2f551f18
+      - 20ac7a17-c814-4833-93fe-539f0d5e3389
+      - 24673149-6c86-42e7-98d9-433fb5b73296
+      - 2fc0579f-8113-47ea-b116-bb5a8db9202a
+      - 3124e301-f14e-4e38-876d-fbeeb090e7bf
+      - 34744913-4f57-4e6e-a527-e9ec3c4b94e6
+      - 34f5766d-1536-4a24-9033-0e294e510fb0
+      - 3a662962-c6d4-4023-bebb-98ae92e78e20
+      - 3aa78eb1-ddd8-46a8-a821-8f8ec57a7bd5
+      - 3b24bf49-1d45-4484-a917-13175df0867b
+      - 4599062e-6926-4fe7-9566-9e8fb1aedaa0
+      - 4fc84f16-2545-4e53-b8fc-7bf4d7282a10
+      - 57f7de54-c807-4eab-b1c6-1c9be7984e92
+      - 58276709-bb4b-4bb3-baf1-60eea99282a7
+      - 5b0e46ba-db02-44ac-b979-ca9b84f5e335
+      - 62e54e98-c209-4df3-b692-de71bb6a8528
+      - 662ef48a-95e2-4aaa-a6c1-5b9c40375824
+      - 6ab56fad-881f-4a43-acb2-0be065924522
+      - 6ec5cff2-a0f9-4169-945b-f33b563f7b99
+      - 73bb0cd4-e502-49b8-9c6f-b59445bf720b
+      - 7409272d-1ff9-4e10-9fc9-ac0019c124fd
+      - 79f3c8ba-9e35-484b-8f47-53a5a0f5c630
+      - 7b96457d-e3cd-432b-9ceb-c9fdd7ef7432
+      - 7d1351a6-e097-4852-b8bf-c9ac5c9ce4a3
+      - 83c47309-aabb-4108-8470-8be838b573cb
+      - 85203421-48f9-4355-9bc8-8a53846e5083
+      - 8c39ee86-7f9a-4a95-9ba3-f6b097e5c2ee
+      - 905b4cb4-ed6f-4da9-92fc-45e0d4e9b5c7
+      - 90636e1f-ef82-43bf-bdcf-5255f139d12f
+      - 97e6a830-c952-4740-95fc-7c78dc97ce47
+      - 9e66c661-e428-452a-a8fb-51f7ed088acf
+      - 9eb7eabc-9db5-49a1-b6c3-555a802093f4
+      - a02167b9-ae71-4ac7-9a07-06432ebb6f1c
+      - a25342c0-3cdc-4414-8e46-f4807fca511c
+      - ad08c78a-4e41-49b9-86a2-ac15b06899e2
+      - b2c1a50b-dad8-4dc7-ba4d-0ce9597904bc
+      - b90e7dc1-316e-4fee-a25a-56a666a670fe
+      - c1f9a0bc-1dd2-404a-b27f-8e29047a43fd
+      - c5ef55ff-ad9a-4b9f-b580-adebafe026d0
+      - cb69481e-8ff7-4039-93ec-0a2729a154a8
+      - ce6bf97f-9f69-4ba7-9032-97adc6ca5cf1
+      - d2fbd093-ee62-488d-9dad-1e36389f8826
+      - d7781e5d-e353-46aa-afe2-3ca49f13332a
+      - d8522d9f-575b-4866-88a9-ba99fa02f35b
+      - dd86a2da-86a0-4cbe-b462-4bd31f57bc6f
+      - ee882879-721c-4913-9775-3dfcce97072a
+      - fa2b99dc-9e39-4257-8f92-4a30d23c4118
+      - fcc0118f-cd45-435b-8da1-9782b2da0715
+      - ff4dac45-ede8-4ec2-aced-cf66103f4335
diff --git a/config/routes.rb b/config/routes.rb
index d1ca55416..6353681d7 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -15,7 +15,7 @@ Rails.application.routes.draw do
       resource :avatar
       resource :role
       resource :events
-      resources :credentials, only: [ :index, :new, :create, :destroy ]
+      resources :credentials, except: %i[ show new ]
 
       resources :push_subscriptions
 
diff --git a/db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb b/db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb
new file mode 100644
index 000000000..172d88839
--- /dev/null
+++ b/db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb
@@ -0,0 +1,6 @@
+class AddAaguidAndBackedUpToIdentityCredentials < ActiveRecord::Migration[8.2]
+  def change
+    add_column :identity_credentials, :aaguid, :string
+    add_column :identity_credentials, :backed_up, :boolean
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 76ab5b9a0..07248185c 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.2].define(version: 2026_02_18_120000) do
+ActiveRecord::Schema[8.2].define(version: 2026_02_19_095815) do
   create_table "accesses", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.datetime "accessed_at"
     t.uuid "account_id", null: false
@@ -345,6 +345,8 @@ ActiveRecord::Schema[8.2].define(version: 2026_02_18_120000) do
   end
 
   create_table "identity_credentials", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.string "aaguid"
+    t.boolean "backed_up"
     t.datetime "created_at", null: false
     t.string "credential_id", null: false
     t.uuid "identity_id", null: false
diff --git a/lib/action_pack/web_authn.rb b/lib/action_pack/web_authn.rb
index 8ee72e6cb..f80c13321 100644
--- a/lib/action_pack/web_authn.rb
+++ b/lib/action_pack/web_authn.rb
@@ -3,5 +3,15 @@ module ActionPack::WebAuthn
     def relying_party
       RelyingParty.new
     end
+
+    def attestation_verifiers
+      @attestation_verifiers ||= {
+        "none" => Authenticator::AttestationVerifiers::None.new
+      }
+    end
+
+    def register_attestation_verifier(format, verifier)
+      attestation_verifiers[format.to_s] = verifier
+    end
   end
 end
diff --git a/lib/action_pack/web_authn/authenticator/attestation.rb b/lib/action_pack/web_authn/authenticator/attestation.rb
index 66714fd6c..beacf0fac 100644
--- a/lib/action_pack/web_authn/authenticator/attestation.rb
+++ b/lib/action_pack/web_authn/authenticator/attestation.rb
@@ -38,7 +38,7 @@
 class ActionPack::WebAuthn::Authenticator::Attestation
   attr_reader :authenticator_data, :format, :attestation_statement
 
-  delegate :credential_id, :public_key, :public_key_bytes, :sign_count, to: :authenticator_data
+  delegate :credential_id, :public_key, :public_key_bytes, :sign_count, :aaguid, :backed_up?, to: :authenticator_data
 
   def self.decode(bytes)
     cbor = ActionPack::WebAuthn::CborDecoder.decode(bytes)
diff --git a/lib/action_pack/web_authn/authenticator/attestation_response.rb b/lib/action_pack/web_authn/authenticator/attestation_response.rb
index e20b4d7f7..d27cc499b 100644
--- a/lib/action_pack/web_authn/authenticator/attestation_response.rb
+++ b/lib/action_pack/web_authn/authenticator/attestation_response.rb
@@ -25,10 +25,10 @@
 # In addition to the base Response validations, this class verifies:
 #
 # * The client data type is "webauthn.create"
-# * The attestation format is "none" (other formats require certificate verification)
+# * The attestation format has a registered verifier
+# * The attestation statement passes format-specific verification
 #
 class ActionPack::WebAuthn::Authenticator::AttestationResponse < ActionPack::WebAuthn::Authenticator::Response
-  SUPPORTED_ATTESTATION_FORMATS = %w[ none ].freeze
   attr_reader :attestation_object
 
   def initialize(attestation_object:, **attributes)
@@ -43,9 +43,13 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponse < ActionPack::Web
       raise InvalidResponseError, "Client data type is not webauthn.create"
     end
 
-    unless SUPPORTED_ATTESTATION_FORMATS.include?(attestation.format)
+    verifier = ActionPack::WebAuthn.attestation_verifiers[attestation.format]
+
+    unless verifier
       raise InvalidResponseError, "Unsupported attestation format: #{attestation.format}"
     end
+
+    verifier.verify!(attestation, client_data_json: client_data_json)
   end
 
   def attestation
diff --git a/lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb b/lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb
new file mode 100644
index 000000000..ebb039054
--- /dev/null
+++ b/lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb
@@ -0,0 +1,24 @@
+# = Action Pack WebAuthn None Attestation Verifier
+#
+# Verifies attestation responses with the "none" format, which indicates the
+# authenticator did not provide any attestation statement. This is the default
+# format used by most consumer authenticators.
+#
+# == Implementing Custom Verifiers
+#
+# To support other attestation formats (e.g., "packed", "fido-u2f"), implement
+# a class with the same +verify!+ interface and register it:
+#
+#   ActionPack::WebAuthn.register_attestation_verifier("packed", MyPackedVerifier.new)
+#
+# The +verify!+ method receives the decoded +Attestation+ object and the raw
+# +client_data_json+ bytes. Raise +InvalidResponseError+ if verification fails.
+#
+class ActionPack::WebAuthn::Authenticator::AttestationVerifiers::None
+  def verify!(attestation, client_data_json:)
+    if attestation.attestation_statement.present?
+      raise ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError,
+        "Attestation statement must be empty for 'none' format"
+    end
+  end
+end
diff --git a/lib/action_pack/web_authn/authenticator/data.rb b/lib/action_pack/web_authn/authenticator/data.rb
index a088179ef..5d4e0f224 100644
--- a/lib/action_pack/web_authn/authenticator/data.rb
+++ b/lib/action_pack/web_authn/authenticator/data.rb
@@ -57,7 +57,7 @@ class ActionPack::WebAuthn::Authenticator::Data
   BACKUP_STATE_FLAG = 0x10
   ATTESTED_CREDENTIAL_DATA_FLAG = 0x40
 
-  attr_reader :bytes, :relying_party_id_hash, :flags, :sign_count, :credential_id, :public_key_bytes
+  attr_reader :bytes, :relying_party_id_hash, :flags, :sign_count, :aaguid, :credential_id, :public_key_bytes
 
   class << self
     def wrap(data)
@@ -81,10 +81,13 @@ class ActionPack::WebAuthn::Authenticator::Data
       sign_count = bytes[position, SIGN_COUNT_LENGTH].pack("C*").unpack1("N")
       position += SIGN_COUNT_LENGTH
 
+      aaguid = nil
       credential_id = nil
       public_key_bytes = nil
 
       if flags & ATTESTED_CREDENTIAL_DATA_FLAG != 0
+        aaguid_bytes = bytes[position, AAGUID_LENGTH].pack("C*")
+        aaguid = aaguid_bytes.unpack("H8H4H4H4H12").join("-")
         position += AAGUID_LENGTH
 
         credential_id_length = bytes[position, CREDENTIAL_ID_LENGTH_BYTES].pack("C*").unpack1("n")
@@ -101,17 +104,19 @@ class ActionPack::WebAuthn::Authenticator::Data
         relying_party_id_hash: relying_party_id_hash,
         flags: flags,
         sign_count: sign_count,
+        aaguid: aaguid,
         credential_id: credential_id,
         public_key_bytes: public_key_bytes
       )
     end
   end
 
-  def initialize(bytes:, relying_party_id_hash:, flags:, sign_count:, credential_id:, public_key_bytes:)
+  def initialize(bytes:, relying_party_id_hash:, flags:, sign_count:, aaguid: nil, credential_id:, public_key_bytes:)
     @bytes = bytes
     @relying_party_id_hash = relying_party_id_hash
     @flags = flags
     @sign_count = sign_count
+    @aaguid = aaguid
     @credential_id = credential_id
     @public_key_bytes = public_key_bytes
   end
diff --git a/lib/action_pack/web_authn/current.rb b/lib/action_pack/web_authn/current.rb
index ab9038a80..88183af54 100644
--- a/lib/action_pack/web_authn/current.rb
+++ b/lib/action_pack/web_authn/current.rb
@@ -1,3 +1,3 @@
 class ActionPack::WebAuthn::Current < ActiveSupport::CurrentAttributes
-  attribute :host
+  attribute :host, :origin
 end
diff --git a/lib/action_pack/web_authn/public_key_credential.rb b/lib/action_pack/web_authn/public_key_credential.rb
index 6ca8a99df..062efab77 100644
--- a/lib/action_pack/web_authn/public_key_credential.rb
+++ b/lib/action_pack/web_authn/public_key_credential.rb
@@ -1,5 +1,5 @@
 class ActionPack::WebAuthn::PublicKeyCredential
-  attr_reader :id, :public_key, :sign_count, :transports, :owner
+  attr_reader :id, :public_key, :sign_count, :aaguid, :backed_up, :transports, :owner
 
   class << self
     def create(client_data_json:, attestation_object:, challenge:, origin:, transports: [], owner: nil)
@@ -14,16 +14,20 @@ class ActionPack::WebAuthn::PublicKeyCredential
         id: response.attestation.credential_id,
         public_key: response.attestation.public_key,
         sign_count: response.attestation.sign_count,
+        aaguid: response.attestation.aaguid,
+        backed_up: response.attestation.backed_up?,
         transports: transports,
         owner: owner
       )
     end
   end
 
-  def initialize(id:, public_key:, sign_count:, transports: [], owner: nil)
+  def initialize(id:, public_key:, sign_count:, aaguid: nil, backed_up: nil, transports: [], owner: nil)
     @id = id
     @public_key = public_key
     @sign_count = sign_count
+    @aaguid = aaguid
+    @backed_up = backed_up
     @transports = transports
     @owner = owner
   end
@@ -39,5 +43,6 @@ class ActionPack::WebAuthn::PublicKeyCredential
     response.validate!(challenge: challenge, origin: origin)
 
     @sign_count = response.authenticator_data.sign_count
+    @backed_up = response.authenticator_data.backed_up?
   end
 end
diff --git a/lib/action_pack/web_authn/public_key_credential/creation_options.rb b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
index 46510ad62..e68d8eba4 100644
--- a/lib/action_pack/web_authn/public_key_credential/creation_options.rb
+++ b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
@@ -68,7 +68,11 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::W
   # [+:exclude_credentials+]
   #   Optional. Existing credentials to exclude from registration. Each must
   #   respond to +id+ and +transports+.
-  def initialize(id:, name:, display_name:, resident_key: :preferred, exclude_credentials: [], **attrs)
+  #
+  # [+:attestation+]
+  #   Optional. The attestation conveyance preference. One of +:none+,
+  #   +:indirect+, +:direct+, or +:enterprise+. Defaults to +:none+.
+  def initialize(id:, name:, display_name:, resident_key: :preferred, exclude_credentials: [], attestation: :none, **attrs)
     super(**attrs)
 
     @id = id
@@ -76,6 +80,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::W
     @display_name = display_name
     @resident_key = resident_key
     @exclude_credentials = exclude_credentials
+    @attestation = validate_attestation(attestation)
   end
 
   # Returns a Hash suitable for JSON serialization and passing to the
@@ -104,10 +109,24 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::W
       json[:excludeCredentials] = @exclude_credentials.map { |credential| exclude_credential_json(credential) }
     end
 
+    if @attestation != :none
+      json[:attestation] = @attestation.to_s
+    end
+
     json
   end
 
   private
+    ATTESTATION_PREFERENCES = %i[ none indirect direct enterprise ].freeze
+
+    def validate_attestation(value)
+      if ATTESTATION_PREFERENCES.include?(value)
+        value
+      else
+        raise ArgumentError, "Invalid attestation preference: #{value.inspect}. Must be one of: #{ATTESTATION_PREFERENCES.map(&:inspect).join(", ")}"
+      end
+    end
+
     def exclude_credential_json(credential)
       hash = { type: "public-key", id: credential.id }
       hash[:transports] = credential.transports if credential.transports.any?
diff --git a/test/controllers/sessions/passkeys_controller_test.rb b/test/controllers/sessions/passkeys_controller_test.rb
index 88512f2df..e8e8d315a 100644
--- a/test/controllers/sessions/passkeys_controller_test.rb
+++ b/test/controllers/sessions/passkeys_controller_test.rb
@@ -44,7 +44,7 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
       challenge = session[:webauthn_challenge]
 
       params = assertion_params(challenge: challenge)
-      params[:response][:signature] = Base64.urlsafe_encode64("invalid", padding: false)
+      params[:passkey][:signature] = Base64.urlsafe_encode64("invalid", padding: false)
 
       post session_passkey_url, params: params
 
@@ -59,8 +59,8 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
       get new_session_url
 
       post session_passkey_url, params: {
-        credential_id: "nonexistent",
-        response: {
+        passkey: {
+          id: "nonexistent",
           client_data_json: Base64.urlsafe_encode64("{}", padding: false),
           authenticator_data: Base64.urlsafe_encode64("x", padding: false),
           signature: Base64.urlsafe_encode64("x", padding: false)
@@ -89,8 +89,8 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
       get new_session_url
 
       post session_passkey_url(format: :json), params: {
-        credential_id: "nonexistent",
-        response: {
+        passkey: {
+          id: "nonexistent",
           client_data_json: Base64.urlsafe_encode64("{}", padding: false),
           authenticator_data: Base64.urlsafe_encode64("x", padding: false),
           signature: Base64.urlsafe_encode64("x", padding: false)
@@ -116,8 +116,8 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
       signature = sign(authenticator_data, client_data_json)
 
       {
-        credential_id: @credential.credential_id,
-        response: {
+        passkey: {
+          id: @credential.credential_id,
           client_data_json: client_data_json,
           authenticator_data: Base64.urlsafe_encode64(authenticator_data, padding: false),
           signature: Base64.urlsafe_encode64(signature, padding: false)
diff --git a/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb b/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
index 5d58a3ff4..bed10e4a4 100644
--- a/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
+++ b/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
@@ -98,7 +98,7 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSuppo
     assert_equal "Origin does not match", error.message
   end
 
-  test "validate! raises when attestation format is not supported" do
+  test "validate! raises when attestation format is not registered" do
     response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: @client_data_json,
       attestation_object: build_attestation_object(user_verified: true, format: "packed")
@@ -111,6 +111,24 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSuppo
     assert_equal "Unsupported attestation format: packed", error.message
   end
 
+  test "validate! calls registered verifier for custom format" do
+    verified = false
+    custom_verifier = Object.new
+    custom_verifier.define_singleton_method(:verify!) { |_attestation, client_data_json:| verified = true }
+
+    ActionPack::WebAuthn.register_attestation_verifier("packed", custom_verifier)
+
+    response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
+      client_data_json: @client_data_json,
+      attestation_object: build_attestation_object(user_verified: true, format: "packed")
+    )
+
+    response.validate!(challenge: @challenge, origin: @origin)
+    assert verified
+  ensure
+    ActionPack::WebAuthn.attestation_verifiers.delete("packed")
+  end
+
   private
     def build_attestation_object(user_verified:, format: "none")
       auth_data = build_authenticator_data(user_verified: user_verified)
diff --git a/test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb b/test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb
new file mode 100644
index 000000000..5d3b71e23
--- /dev/null
+++ b/test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb
@@ -0,0 +1,33 @@
+require "test_helper"
+
+class ActionPack::WebAuthn::Authenticator::AttestationVerifiers::NoneTest < ActiveSupport::TestCase
+  setup do
+    @verifier = ActionPack::WebAuthn::Authenticator::AttestationVerifiers::None.new
+  end
+
+  test "verify! passes with nil attestation statement" do
+    attestation = stub(attestation_statement: nil)
+
+    assert_nothing_raised do
+      @verifier.verify!(attestation, client_data_json: "")
+    end
+  end
+
+  test "verify! passes with empty attestation statement" do
+    attestation = stub(attestation_statement: {})
+
+    assert_nothing_raised do
+      @verifier.verify!(attestation, client_data_json: "")
+    end
+  end
+
+  test "verify! raises with non-empty attestation statement" do
+    attestation = stub(attestation_statement: { "sig" => "abc" })
+
+    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+      @verifier.verify!(attestation, client_data_json: "")
+    end
+
+    assert_equal "Attestation statement must be empty for 'none' format", error.message
+  end
+end
diff --git a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
index 2fc1acfbc..232cb74ba 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
@@ -84,6 +84,34 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
     ], options.as_json[:excludeCredentials]
   end
 
+  test "as_json excludes attestation when none" do
+    assert_nil @options.as_json[:attestation]
+  end
+
+  test "as_json includes attestation when not none" do
+    options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+      id: "user-123",
+      name: "user@example.com",
+      display_name: "Test User",
+      attestation: :direct,
+      relying_party: @relying_party
+    )
+
+    assert_equal "direct", options.as_json[:attestation]
+  end
+
+  test "raises with invalid attestation preference" do
+    assert_raises(ArgumentError) do
+      ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
+        id: "user-123",
+        name: "user@example.com",
+        display_name: "Test User",
+        attestation: :invalid,
+        relying_party: @relying_party
+      )
+    end
+  end
+
   test "as_json excludeCredentials omits transports when empty" do
     options = ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
       id: "user-123",

From ee7fc3495d3b5580ac1187713b0836caadde0c5d Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Fri, 20 Feb 2026 11:13:06 -0600
Subject: [PATCH 097/107] Move passkeys button below profile area

---
 app/views/users/show.html.erb | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index f75febf2a..d96184e5f 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -5,11 +5,6 @@
   <div class="settings__panel panel shadow txt-align-center">
     <div class="flex flex-column gap position-relative">
       <% if Current.user == @user %>
-        <%= link_to user_credentials_path(@user), class: "user-edit-link btn", style: "inset: 0 auto auto 0", data: { controller: "tooltip" } do %>
-          <%= icon_tag "authentication" %>
-          <span class="for-screen-reader">Manage passkeys</span>
-        <% end %>
-
         <%= link_to edit_user_path(@user), class: "user-edit-link btn", data: { controller: "tooltip" } do %>
           <%= icon_tag "pencil" %>
           <span class="for-screen-reader">Edit profile</span>
@@ -46,6 +41,11 @@
       <% if Current.user == @user %>
         <hr class="separator--horizontal full-width flex-item-grow margin-block-start-double" style="--border-color: var(--color-ink-light);" aria-hidden="true">
 
+        <%= link_to user_credentials_path(@user), class: "btn txt-x-small center" do %>
+          <%= icon_tag "authentication" %>
+          <span>Manage passkeys</span>
+        <% end %>
+
         <%= button_to session_path(script_name: nil), method: :delete, class: "btn txt-x-small center", form: { data: { turbo: false, controller: "clear-offline-cache", action: "submit->clear-offline-cache#clearCache" } } do %>
           <span>Sign out of Fizzy on this device</span>
         <% end %>

From f4fbe17b223e99b034dd91f26fc4585056ebecf4 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Fri, 20 Feb 2026 11:42:56 -0600
Subject: [PATCH 098/107] Nicer passkey styles

---
 app/assets/stylesheets/credentials.css        | 43 +++++++++++--------
 app/assets/stylesheets/utilities.css          | 29 ++++++++++++-
 .../users/credentials/_credential.html.erb    | 11 +++--
 app/views/users/credentials/edit.html.erb     |  6 +--
 app/views/users/credentials/index.html.erb    | 33 +++++++-------
 5 files changed, 77 insertions(+), 45 deletions(-)

diff --git a/app/assets/stylesheets/credentials.css b/app/assets/stylesheets/credentials.css
index 64e39005b..bb6db0b37 100644
--- a/app/assets/stylesheets/credentials.css
+++ b/app/assets/stylesheets/credentials.css
@@ -1,29 +1,34 @@
 @layer components {
-  .passkey-icon--dark {
-    display: none;
+  .credential {
+    border-block-start: var(--border);
+    list-style: none;
+
+    &:last-child {
+      border-block-end: var(--border);
+    }
   }
 
-  .passkey-icon--light {
-    html[data-theme="dark"] & {
-      display: none;
-    }
+  .credential__link {
+    align-items: center;
+    block-size: 1.75lh;
+    color: currentcolor;
+    display: flex;
+    gap: 1ch;
+    padding-inline: 1ch;
 
-    @media (prefers-color-scheme: dark) {
-      html:not([data-theme]) & {
-        display: none;
+    @media (any-hover: hover) {
+      &:hover {
+        background: var(--color-ink-lightest);
+
+        .credential__arrow {
+          opacity: 0.66;
+        }
       }
     }
   }
 
-  .passkey-icon--dark {
-    html[data-theme="dark"] & {
-      display: inline;
-    }
-
-    @media (prefers-color-scheme: dark) {
-      html:not([data-theme]) & {
-        display: inline;
-      }
-    }
+  .credential__arrow {
+    margin-inline-start: auto;
+    opacity: 0;
   }
 }
diff --git a/app/assets/stylesheets/utilities.css b/app/assets/stylesheets/utilities.css
index 53837034c..2aa07029c 100644
--- a/app/assets/stylesheets/utilities.css
+++ b/app/assets/stylesheets/utilities.css
@@ -31,9 +31,10 @@
   .txt-capitalize-first-letter::first-letter { text-transform: capitalize; }
   .txt-link { color: var(--color-link); text-decoration: underline; }
 
-  .font-weight-normal { font-weight: normal; }
+  .font-weight-normal { font-weight: 400; }
+  .font-weight-medium { font-weight: 500; }
   .font-weight-semibold { font-weight: 600; }
-  .font-weight-bold { font-weight: bold; }
+  .font-weight-bold { font-weight: 700; }
   .font-weight-black { font-weight: 900; }
 
   /* Flexbox and Grid */
@@ -283,4 +284,28 @@
       display: none;
     }
   }
+
+  .hide-on-dark-mode {
+    html[data-theme="dark"] & {
+      display: none;
+    }
+
+    html:not([data-theme]) & {
+      @media (prefers-color-scheme: dark) {
+        display: none;
+      }
+    }
+  }
+
+  .hide-on-light-mode {
+    html[data-theme="light"] & {
+      display: none;
+    }
+
+    html:not([data-theme]) & {
+      @media (prefers-color-scheme: light) {
+        display: none;
+      }
+    }
+  }
 }
diff --git a/app/views/users/credentials/_credential.html.erb b/app/views/users/credentials/_credential.html.erb
index 38fe5cb0e..fa1e733e6 100644
--- a/app/views/users/credentials/_credential.html.erb
+++ b/app/views/users/credentials/_credential.html.erb
@@ -1,10 +1,9 @@
-<li class="list-style-none margin-none" style="view-transition-name: <%= dom_id(credential) %>">
-  <%= link_to edit_user_credential_path(Current.user, credential), class: "txt-ink flex align-center gap txt-medium full-width" do %>
+<li class="credential" style="view-transition-name: <%= dom_id(credential) %>">
+  <%= link_to edit_user_credential_path(Current.user, credential), class: "credential__link" do %>
     <% authenticator = credential.authenticator %>
-    <%= image_tag authenticator&.icon&.[](:light) || "passkeys/generic_light.svg", size: 24, class: "flex-item-no-shrink passkey-icon passkey-icon--light", aria: { hidden: true } %>
-    <%= image_tag authenticator&.icon&.[](:dark) || "passkeys/generic_dark.svg", size: 24, class: "flex-item-no-shrink passkey-icon passkey-icon--dark", aria: { hidden: true } %>
+    <%= image_tag authenticator&.icon&.[](:light) || "passkeys/generic_light.svg", size: 24, class: "flex-item-no-shrink hide-on-dark-mode", aria: { hidden: true } %>
+    <%= image_tag authenticator&.icon&.[](:dark) || "passkeys/generic_dark.svg", size: 24, class: "flex-item-no-shrink hide-on-light-mode", aria: { hidden: true } %>
     <strong class="overflow-ellipsis min-width"><%= credential.name.presence || "Passkey" %></strong>
-    <hr class="separator--horizontal flex-item-grow" style="--border-color: var(--color-ink-medium); --border-style: dashed" aria-hidden="true">
-    <%= icon_tag "arrow-right", class: "txt-subtle txt-xx-small flex-item-no-shrink" %>
+    <strong class="credential__arrow">→</strong>
   <% end %>
 </li>
diff --git a/app/views/users/credentials/edit.html.erb b/app/views/users/credentials/edit.html.erb
index c8e4ddfa4..4beb0bba8 100644
--- a/app/views/users/credentials/edit.html.erb
+++ b/app/views/users/credentials/edit.html.erb
@@ -1,4 +1,4 @@
-<% @page_title = "Name your passkey" %>
+<% @page_title = "Edit Passkey" %>
 
 <% content_for :header do %>
   <div class="header__actions header__actions--start">
@@ -15,11 +15,11 @@
 
   <%= form_with model: @credential, scope: :credential, url: user_credential_path(Current.user, @credential), html: { class: "flex flex-column gap" } do |form| %>
     <div class="flex flex-column gap-half">
-      <strong><%= form.label :name %></strong>
+      <strong><%= form.label "Name your passkey" %></strong>
       <%= form.text_field :name, autofocus: true, class: "input", placeholder: "e.g. MacBook Pro, iPhone", data: { "1p-ignore": "" }, autocomplete: "off" %>
     </div>
 
-    <%= form.submit "Save", class: "btn btn--primary" %>
+    <%= form.submit "Save", class: "btn btn--link center" %>
   <% end %>
 
   <div class="txt-align-center">
diff --git a/app/views/users/credentials/index.html.erb b/app/views/users/credentials/index.html.erb
index 3278f6d14..f37d8a373 100644
--- a/app/views/users/credentials/index.html.erb
+++ b/app/views/users/credentials/index.html.erb
@@ -13,28 +13,31 @@
   data-credential-public-key-value="<%= @creation_options.as_json.to_json %>"
   data-credential-register-url-value="<%= user_credentials_path(Current.user) %>">
 
-  <p class="margin-none-block-start"><strong>Passkeys let you sign in securely without a password or email code.</strong></p>
+  <p class="font-weight-medium margin-none-block-start">Passkeys let you sign in securely without a password or email code.</p>
 
   <% if @credentials.any? %>
-    <ul class="flex flex-column gap margin-none-block-start unpad full-width">
+    <ul class="margin-none-block-start margin-block-end-double unpad">
       <%= render partial: "users/credentials/credential", collection: @credentials %>
     </ul>
   <% end %>
 
-  <p class="txt-small pad-inline-double pad-block-half">Your browser will prompt you to create a passkey
-    using your device's biometrics, PIN, or security key</p>
+  <footer>
+    <button type="button" data-action="credential#create" data-credential-target="button" class="btn btn--link center txt-medium">
+      <%= icon_tag "add" %>
+      <span>Register a passkey</span>
+    </button>
 
-  <button type="button" data-action="credential#create" data-credential-target="button" class="btn btn--link center txt-medium">
-    <%= icon_tag "add" %>
-    <span>Register passkey</span>
-  </button>
+    <p class="txt-small txt-subtle txt-balance margin-none-block-end">
+      Your browser will prompt you to create a passkey using your device's biometrics, PIN, or security key
+    </p>
 
-  <p data-credential-target="error" class="txt-negative" hidden>
-    Something went wrong while registering your passkey.
-  </p>
+    <p data-credential-target="error" class="txt-negative" hidden>
+      Something went wrong while registering your passkey.
+    </p>
 
-  <p data-credential-target="cancelled" class="txt-subtle" hidden>
-    Passkey registration was cancelled.
-    Try again when you are ready.
-  </p>
+    <p data-credential-target="cancelled" class="txt-subtle" hidden>
+      Passkey registration was cancelled.
+      Try again when you are ready.
+    </p>
+  </footer>
 </section>

From 017bcc9ce1216b5e3379be94f97d4516d18add44 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Wed, 4 Mar 2026 14:12:40 +0100
Subject: [PATCH 099/107] Polish up Passkey interface

- Fix indentation
- Split awkward initializer into separate methods
- Rename credentials to passkeys
- Simplify authenticator registry loading
- Flatten nested errors under ActionPack::WebAuthn
- Set passkey current params only requests that use it
- Inline anemic methods
- Replace custom validation with ActiveModel::Validation
- Rename identity to holder in Passkey
- Rename credentials to passkeys in JS
- Extract framework library out of controllers
- Pass params hashes down to ActionPack
- Attempt to simplify public interface
- Push data decoding down to the classes representing the data
- Introduce has_passkeys
- Add CBOR bigint support
- Rename ActionPack::WebAuthn::Passkey to ActionPack::Passkey
- Add create_passkey_button helper
- Rename public-key to creation-options
- Add sign_in_with_passkey_button helper
- Dispatch events for the whole Passkey lifecycle
- Add ED25519 support
- Prevent crash on missing meta tag
- Validate resident key options
- Don't clobber existing ActionPack config options
- Validate cryptographic params
- Move CurrentWebAuthnRequest into ActionPack::Passkey
- Use ActiveModel::Attributes for Options objects
- Implement expiring challanges
- Add lifecycle events
- Extract param helpers into Request
- Add passkey_creation_options and passkey_request_options helpers
- Add create_passkey_challenge to make it easier to override the create method if needed
- Prefix all view helpers with passkey_
- Auto-include ActionPack::Passkey::Holder
- Make the passkey challange url configurable
- Add a reminder about Passkeys to the magic link email
---
 app/assets/stylesheets/credentials.css        |   9 +
 app/controllers/concerns/current_request.rb   |   3 -
 .../my/passkey_challenges_controller.rb       |   7 +
 app/controllers/my/passkeys_controller.rb     |  34 +++
 .../sessions/passkeys_controller.rb           |  35 +--
 app/controllers/sessions_controller.rb        |   6 +-
 .../users/credentials_controller.rb           |  46 ----
 app/javascript/application.js                 |   1 +
 .../controllers/credential_controller.js      |  60 -----
 .../controllers/passkey_controller.js         |  80 ------
 app/javascript/helpers/base64url_helpers.js   |  12 -
 app/javascript/lib/action_pack/passkey.js     | 246 ++++++++++++++++++
 app/javascript/lib/action_pack/webauthn.js    |  83 ++++++
 app/models/identity.rb                        |   3 +-
 app/models/identity/credential.rb             |  74 ------
 .../identity/credential/authenticator.rb      |  12 -
 app/models/passkey/authenticator.rb           |  23 ++
 .../sign_in_instructions.html.erb             |   4 +
 .../sign_in_instructions.text.erb             |   4 +
 app/views/my/access_tokens/index.html.erb     |   2 +-
 app/views/my/passkeys/_passkey.html.erb       |  13 +
 .../credentials => my/passkeys}/edit.html.erb |   6 +-
 .../passkeys}/index.html.erb                  |  22 +-
 app/views/sessions/new.html.erb               |  13 +-
 .../users/credentials/_credential.html.erb    |   9 -
 app/views/users/show.html.erb                 |   2 +-
 config/application.rb                         |   4 +
 config/importmap.rb                           |   1 +
 config/initializers/passkeys.rb               |   3 +
 config/routes.rb                              |   4 +-
 ...60213154740_create_action_pack_passkeys.rb |  20 ++
 ...60213154740_create_identity_credentials.rb |  17 --
 ...d_and_backed_up_to_identity_credentials.rb |   6 -
 db/schema.rb                                  |  33 +--
 db/schema_sqlite.rb                           |  16 ++
 lib/action_pack/passkey.rb                    | 104 ++++++++
 .../passkey/challenges_controller.rb          |  37 +++
 lib/action_pack/passkey/form_helper.rb        |  87 +++++++
 lib/action_pack/passkey/holder.rb             | 143 ++++++++++
 lib/action_pack/passkey/request.rb            |  81 ++++++
 lib/action_pack/railtie.rb                    |  70 +++++
 lib/action_pack/web_authn.rb                  |  47 ++++
 .../authenticator/assertion_response.rb       |  55 ++--
 .../web_authn/authenticator/attestation.rb    |  15 ++
 .../authenticator/attestation_response.rb     |  50 ++--
 .../attestation_verifiers/none.rb             |   2 +-
 .../web_authn/authenticator/data.rb           |  27 ++
 .../web_authn/authenticator/response.rb       | 142 +++++-----
 lib/action_pack/web_authn/cbor_decoder.rb     |  35 ++-
 lib/action_pack/web_authn/cose_key.rb         |  62 ++++-
 lib/action_pack/web_authn/current.rb          |  22 +-
 .../web_authn/public_key_credential.rb        | 138 ++++++++--
 .../public_key_credential/creation_options.rb |  83 ++----
 .../public_key_credential/options.rb          |  77 +++++-
 .../public_key_credential/request_options.rb  |  19 +-
 ...ion_pack_passkey_infer_name_from_aaguid.rb |  15 ++
 .../my/passkey_challenges_controller_test.rb  |  33 +++
 .../my/passkeys_controller_test.rb            |  26 ++
 .../sessions/passkeys_controller_test.rb      |  71 +----
 test/lib/action_pack/passkey_test.rb          |  92 +++++++
 .../authenticator/assertion_response_test.rb  |  65 +++--
 .../attestation_response_test.rb              | 180 ++++++-------
 .../authenticator/attestation_test.rb         | 132 ++--------
 .../attestation_verifiers/none_test.rb        |   2 +-
 .../web_authn/authenticator/data_test.rb      | 163 +++++-------
 .../web_authn/authenticator/response_test.rb  |  56 ++--
 .../web_authn/cbor_decoder_test.rb            |  20 +-
 .../action_pack/web_authn/cose_key_test.rb    | 216 ++++++++++-----
 .../creation_options_test.rb                  |  12 +-
 .../request_options_test.rb                   |   9 +-
 ...ack_passkey_infer_name_from_aaguid_test.rb |  32 +++
 .../previews/magic_link_mailer_preview.rb     |   2 +-
 test/test_helpers/webauthn_test_helper.rb     |  94 +++++++
 73 files changed, 2326 insertions(+), 1103 deletions(-)
 create mode 100644 app/controllers/my/passkey_challenges_controller.rb
 create mode 100644 app/controllers/my/passkeys_controller.rb
 delete mode 100644 app/controllers/users/credentials_controller.rb
 delete mode 100644 app/javascript/controllers/credential_controller.js
 delete mode 100644 app/javascript/controllers/passkey_controller.js
 delete mode 100644 app/javascript/helpers/base64url_helpers.js
 create mode 100644 app/javascript/lib/action_pack/passkey.js
 create mode 100644 app/javascript/lib/action_pack/webauthn.js
 delete mode 100644 app/models/identity/credential.rb
 delete mode 100644 app/models/identity/credential/authenticator.rb
 create mode 100644 app/models/passkey/authenticator.rb
 create mode 100644 app/views/my/passkeys/_passkey.html.erb
 rename app/views/{users/credentials => my/passkeys}/edit.html.erb (73%)
 rename app/views/{users/credentials => my/passkeys}/index.html.erb (61%)
 delete mode 100644 app/views/users/credentials/_credential.html.erb
 create mode 100644 config/initializers/passkeys.rb
 create mode 100644 db/migrate/20260213154740_create_action_pack_passkeys.rb
 delete mode 100644 db/migrate/20260213154740_create_identity_credentials.rb
 delete mode 100644 db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb
 create mode 100644 lib/action_pack/passkey.rb
 create mode 100644 lib/action_pack/passkey/challenges_controller.rb
 create mode 100644 lib/action_pack/passkey/form_helper.rb
 create mode 100644 lib/action_pack/passkey/holder.rb
 create mode 100644 lib/action_pack/passkey/request.rb
 create mode 100644 lib/action_pack/railtie.rb
 create mode 100644 lib/rails_ext/action_pack_passkey_infer_name_from_aaguid.rb
 create mode 100644 test/controllers/my/passkey_challenges_controller_test.rb
 create mode 100644 test/controllers/my/passkeys_controller_test.rb
 create mode 100644 test/lib/action_pack/passkey_test.rb
 create mode 100644 test/lib/rails_ext/action_pack_passkey_infer_name_from_aaguid_test.rb
 create mode 100644 test/test_helpers/webauthn_test_helper.rb

diff --git a/app/assets/stylesheets/credentials.css b/app/assets/stylesheets/credentials.css
index bb6db0b37..d57583017 100644
--- a/app/assets/stylesheets/credentials.css
+++ b/app/assets/stylesheets/credentials.css
@@ -31,4 +31,13 @@
     margin-inline-start: auto;
     opacity: 0;
   }
+
+  [data-passkey-errors] [data-passkey-error] {
+    display: none;
+  }
+
+  [data-passkey-errors][data-passkey-error-state="error"] [data-passkey-error="error"],
+  [data-passkey-errors][data-passkey-error-state="cancelled"] [data-passkey-error="cancelled"] {
+    display: block;
+  }
 }
diff --git a/app/controllers/concerns/current_request.rb b/app/controllers/concerns/current_request.rb
index 689bc146a..15f574ab0 100644
--- a/app/controllers/concerns/current_request.rb
+++ b/app/controllers/concerns/current_request.rb
@@ -8,9 +8,6 @@ module CurrentRequest
       Current.user_agent  = request.user_agent
       Current.ip_address  = request.ip
       Current.referrer    = request.referrer
-
-      ActionPack::WebAuthn::Current.host = request.host
-      ActionPack::WebAuthn::Current.origin = request.base_url
     end
   end
 end
diff --git a/app/controllers/my/passkey_challenges_controller.rb b/app/controllers/my/passkey_challenges_controller.rb
new file mode 100644
index 000000000..12029ef9e
--- /dev/null
+++ b/app/controllers/my/passkey_challenges_controller.rb
@@ -0,0 +1,7 @@
+class My::PasskeyChallengesController < ActionPack::Passkey::ChallengesController
+  include Authentication
+  include Authorization
+
+  allow_unauthenticated_access
+  disallow_account_scope
+end
diff --git a/app/controllers/my/passkeys_controller.rb b/app/controllers/my/passkeys_controller.rb
new file mode 100644
index 000000000..40ddaca24
--- /dev/null
+++ b/app/controllers/my/passkeys_controller.rb
@@ -0,0 +1,34 @@
+class My::PasskeysController < ApplicationController
+  include ActionPack::Passkey::Request
+
+  before_action :set_passkey, only: %i[ edit update destroy ]
+
+  def index
+    @passkeys = Current.identity.passkeys.order(name: :asc, created_at: :desc)
+    @creation_options = passkey_creation_options(holder: Current.identity)
+  end
+
+  def create
+    passkey = Current.identity.passkeys.register(passkey_creation_params)
+
+    redirect_to edit_my_passkey_path(passkey, created: true)
+  end
+
+  def edit
+  end
+
+  def update
+    @passkey.update!(params.expect(passkey: [ :name ]))
+    redirect_to my_passkeys_path
+  end
+
+  def destroy
+    @passkey.destroy!
+    redirect_to my_passkeys_path
+  end
+
+  private
+    def set_passkey
+      @passkey = Current.identity.passkeys.find(params[:id])
+    end
+end
diff --git a/app/controllers/sessions/passkeys_controller.rb b/app/controllers/sessions/passkeys_controller.rb
index 18917583d..4dc087986 100644
--- a/app/controllers/sessions/passkeys_controller.rb
+++ b/app/controllers/sessions/passkeys_controller.rb
@@ -1,44 +1,27 @@
 class Sessions::PasskeysController < ApplicationController
+  include ActionPack::Passkey::Request
+
   disallow_account_scope
   require_unauthenticated_access
   rate_limit to: 10, within: 3.minutes, only: :create, with: :rate_limit_exceeded
 
   def create
-    credential = Identity::Credential.authenticate(
-      passkey: passkey_params,
-      challenge: session.delete(:webauthn_challenge)
-    )
-
-    if credential
-      authentication_succeeded(credential.identity)
-    else
-      authentication_failed
-    end
-  end
-
-  private
-    def passkey_params
-      params.expect(passkey: [ :id, :client_data_json, :authenticator_data, :signature ])
-    end
-
-    def authentication_succeeded(identity)
-      start_new_session_for identity
+    if credential = ActionPack::Passkey.authenticate(passkey_request_params)
+      start_new_session_for credential.holder
 
       respond_to do |format|
         format.html { redirect_to after_authentication_url }
         format.json { render json: { session_token: session_token } }
       end
-    end
-
-    def authentication_failed
-      alert_message = "That passkey didn't work. Try again."
-
+    else
       respond_to do |format|
-        format.html { redirect_to new_session_path, alert: alert_message }
-        format.json { render json: { message: alert_message }, status: :unauthorized }
+        format.html { redirect_to new_session_path, alert: "That passkey didn't work. Try again." }
+        format.json { render json: { message: "That passkey didn't work. Try again." }, status: :unauthorized }
       end
     end
+  end
 
+  private
     def rate_limit_exceeded
       rate_limit_exceeded_message = "Try again later."
 
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index eb7fa8309..cfbb778f2 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -1,4 +1,6 @@
 class SessionsController < ApplicationController
+  include ActionPack::Passkey::Request
+
   disallow_account_scope
   require_unauthenticated_access except: :destroy
   rate_limit to: 10, within: 3.minutes, only: :create, with: :rate_limit_exceeded
@@ -6,8 +8,7 @@ class SessionsController < ApplicationController
   layout "public"
 
   def new
-    @request_options = Identity::Credential.request_options
-    session[:webauthn_challenge] = @request_options.challenge
+    @request_options = passkey_request_options
   end
 
   def create
@@ -69,5 +70,4 @@ class SessionsController < ApplicationController
         end
       end
     end
-
 end
diff --git a/app/controllers/users/credentials_controller.rb b/app/controllers/users/credentials_controller.rb
deleted file mode 100644
index aa0f3d8e9..000000000
--- a/app/controllers/users/credentials_controller.rb
+++ /dev/null
@@ -1,46 +0,0 @@
-class Users::CredentialsController < ApplicationController
-  before_action :set_credential, only: %i[ edit update destroy ]
-
-  def index
-    @credentials = Current.identity.credentials.order(name: :asc, created_at: :desc)
-    @creation_options = Identity::Credential.creation_options(identity: Current.identity, display_name: Current.user.name)
-    session[:webauthn_challenge] = @creation_options.challenge
-  end
-
-  def create
-    credential = Current.identity.credentials.register(
-      passkey: passkey_params,
-      challenge: session.delete(:webauthn_challenge)
-    )
-
-    render json: { location: edit_user_credential_path(Current.user, credential, created: true) }
-  rescue ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError => error
-    render json: { error: error.message }, status: :unprocessable_entity
-  end
-
-  def edit
-  end
-
-  def update
-    @credential.update!(credential_params)
-    redirect_to user_credentials_path(Current.user)
-  end
-
-  def destroy
-    @credential.destroy!
-    redirect_to user_credentials_path(Current.user)
-  end
-
-  private
-    def set_credential
-      @credential = Current.identity.credentials.find(params[:id])
-    end
-
-    def credential_params
-      params.expect(credential: [ :name ])
-    end
-
-    def passkey_params
-      params.expect(passkey: [ :client_data_json, :attestation_object, transports: [] ])
-    end
-end
diff --git a/app/javascript/application.js b/app/javascript/application.js
index c43a45eaa..6642e1ab1 100644
--- a/app/javascript/application.js
+++ b/app/javascript/application.js
@@ -6,3 +6,4 @@ import "controllers"
 
 import "lexxy"
 import "@rails/actiontext"
+import "lib/action_pack/passkey"
diff --git a/app/javascript/controllers/credential_controller.js b/app/javascript/controllers/credential_controller.js
deleted file mode 100644
index ddc76085d..000000000
--- a/app/javascript/controllers/credential_controller.js
+++ /dev/null
@@ -1,60 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-import { post } from "@rails/request.js"
-import { base64urlToBuffer, bufferToBase64url } from "helpers/base64url_helpers"
-
-export default class extends Controller {
-  static values = { publicKey: Object, registerUrl: String }
-  static targets = ["button", "error", "cancelled"]
-
-  async create() {
-    this.buttonTarget.disabled = true
-    this.errorTarget.hidden = true
-    this.cancelledTarget.hidden = true
-
-    try {
-      const publicKey = this.#prepareOptions(this.publicKeyValue)
-      const credential = await navigator.credentials.create({ publicKey })
-      await this.#registerCredential(credential)
-    } catch (error) {
-      if (error.name === "AbortError" || error.name === "NotAllowedError") {
-        this.cancelledTarget.hidden = false
-      } else {
-        this.errorTarget.hidden = false
-      }
-      this.buttonTarget.disabled = false
-    }
-  }
-
-  async #registerCredential(credential) {
-    const response = await post(this.registerUrlValue, {
-      body: JSON.stringify({
-        passkey: {
-          client_data_json: new TextDecoder().decode(credential.response.clientDataJSON),
-          attestation_object: bufferToBase64url(credential.response.attestationObject),
-          transports: credential.response.getTransports?.() || []
-        }
-      }),
-      contentType: "application/json",
-      responseKind: "json"
-    })
-
-    if (response.ok) {
-      const { location } = await response.json
-      Turbo.visit(location)
-    } else {
-      throw new Error("Registration failed")
-    }
-  }
-
-  #prepareOptions(options) {
-    return {
-      ...options,
-      challenge: base64urlToBuffer(options.challenge),
-      user: { ...options.user, id: base64urlToBuffer(options.user.id) },
-      excludeCredentials: (options.excludeCredentials || []).map(cred => ({
-        ...cred,
-        id: base64urlToBuffer(cred.id)
-      }))
-    }
-  }
-}
diff --git a/app/javascript/controllers/passkey_controller.js b/app/javascript/controllers/passkey_controller.js
deleted file mode 100644
index 566518bb9..000000000
--- a/app/javascript/controllers/passkey_controller.js
+++ /dev/null
@@ -1,80 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-import { base64urlToBuffer, bufferToBase64url } from "helpers/base64url_helpers"
-
-export default class extends Controller {
-  static values = { publicKey: Object, url: String, csrfToken: String }
-
-  #abortController
-
-  connect() {
-    this.#attemptConditionalMediation()
-  }
-
-  disconnect() {
-    this.#abortController?.abort()
-  }
-
-  async #attemptConditionalMediation() {
-    if (!await PublicKeyCredential?.isConditionalMediationAvailable?.()) return
-
-    this.#abortController = new AbortController()
-
-    try {
-      const credential = await navigator.credentials.get({
-        publicKey: this.#prepareOptions(this.publicKeyValue),
-        mediation: "conditional",
-        signal: this.#abortController.signal
-      })
-
-      this.#submitAssertion(credential)
-    } catch (error) {
-      if (error.name !== "AbortError") {
-        console.error("Passkey error:", error)
-      }
-    }
-  }
-
-  #submitAssertion(credential) {
-    const form = document.createElement("form")
-    form.method = "POST"
-    form.action = this.urlValue
-    form.style.display = "none"
-
-    const fields = {
-      authenticity_token: this.csrfTokenValue,
-      "passkey[id]": credential.id,
-      "passkey[client_data_json]": new TextDecoder().decode(credential.response.clientDataJSON),
-      "passkey[authenticator_data]": bufferToBase64url(credential.response.authenticatorData),
-      "passkey[signature]": bufferToBase64url(credential.response.signature)
-    }
-
-    for (const [name, value] of Object.entries(fields)) {
-      const input = document.createElement("input")
-      input.type = "hidden"
-      input.name = name
-      input.value = value
-      form.appendChild(input)
-    }
-
-    document.body.appendChild(form)
-    form.submit()
-  }
-
-  #prepareOptions(options) {
-    const prepared = {
-      ...options,
-      challenge: base64urlToBuffer(options.challenge)
-    }
-
-    if (options.allowCredentials?.length) {
-      prepared.allowCredentials = options.allowCredentials.map(cred => ({
-        ...cred,
-        id: base64urlToBuffer(cred.id)
-      }))
-    } else {
-      delete prepared.allowCredentials
-    }
-
-    return prepared
-  }
-}
diff --git a/app/javascript/helpers/base64url_helpers.js b/app/javascript/helpers/base64url_helpers.js
deleted file mode 100644
index 945826f58..000000000
--- a/app/javascript/helpers/base64url_helpers.js
+++ /dev/null
@@ -1,12 +0,0 @@
-export function base64urlToBuffer(base64url) {
-  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/")
-  const padding = "=".repeat((4 - base64.length % 4) % 4)
-  const binary = atob(base64 + padding)
-  return Uint8Array.from(binary, c => c.charCodeAt(0)).buffer
-}
-
-export function bufferToBase64url(buffer) {
-  const bytes = new Uint8Array(buffer)
-  const binary = String.fromCharCode(...bytes)
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
-}
diff --git a/app/javascript/lib/action_pack/passkey.js b/app/javascript/lib/action_pack/passkey.js
new file mode 100644
index 000000000..115a630dc
--- /dev/null
+++ b/app/javascript/lib/action_pack/passkey.js
@@ -0,0 +1,246 @@
+// JS companion for the ActionPack::Passkey Ruby helpers.
+//
+// Binds click handlers to passkey buttons and manages the WebAuthn ceremony
+// lifecycle (challenge refresh, credential creation/authentication, form submission).
+//
+// Expected data attributes:
+//   [data-passkey="create"]              — triggers the registration ceremony
+//   [data-passkey="sign_in"]             — triggers the authentication ceremony
+//   [data-passkey-mediation="conditional"] — on a <form>, enables autofill-assisted sign in
+//   [data-passkey-errors]                — container whose data-passkey-error-state is set on failure
+//   [data-passkey-error="error|cancelled"] — children shown/hidden via CSS based on error state
+//   [data-passkey-field="..."]           — hidden fields populated before form submission
+//
+// Custom events (all bubble):
+//   passkey:start   — ceremony begun
+//   passkey:success — credential obtained, form about to submit
+//   passkey:error   — ceremony failed; detail: { error, cancelled }
+//
+// Meta tags (rendered by the Ruby form helpers):
+//   <meta name="passkey-creation-options"> — JSON WebAuthn creation options
+//   <meta name="passkey-request-options">  — JSON WebAuthn request options
+//   <meta name="passkey-challenge-url">    — endpoint to refresh the challenge nonce
+
+import { register, authenticate } from "lib/action_pack/webauthn"
+
+let listeners
+let currentDocument
+
+document.addEventListener("DOMContentLoaded", setup)
+document.addEventListener("turbo:load", setup)
+document.addEventListener("turbo:before-cache", teardown)
+
+// Set error state on the nearest [data-passkey-errors] container.
+// The app's CSS is responsible for showing/hiding children based on
+// the data-passkey-error-state attribute ("error" or "cancelled").
+document.addEventListener("passkey:error", ({ target, detail: { cancelled } }) => {
+  const container = target.closest("[data-passkey-errors]")
+
+  if (container) {
+    container.dataset.passkeyErrorState = cancelled ? "cancelled" : "error"
+  }
+})
+
+// Bind click handlers to passkey buttons and attempt conditional mediation.
+// Guards against duplicate setup.
+function setup() {
+  if (currentDocument !== document.documentElement) {
+    currentDocument = document.documentElement
+
+    listeners?.abort()
+    listeners = new AbortController()
+
+    for (const button of document.querySelectorAll('[data-passkey="create"]')) {
+      button.addEventListener("click", () => createPasskey(button), { signal: listeners.signal })
+    }
+
+    for (const button of document.querySelectorAll('[data-passkey="sign_in"]')) {
+      button.addEventListener("click", () => signInWithPasskey(button), { signal: listeners.signal })
+    }
+
+    attemptConditionalMediation()
+  }
+}
+
+// Reset transient DOM state and unbind event handlers to prevent leaks and duplicate handlers.
+function teardown() {
+  currentDocument = null
+  listeners?.abort()
+
+  for (const button of document.querySelectorAll('[data-passkey][disabled]')) {
+    button.disabled = false
+  }
+
+  for (const container of document.querySelectorAll("[data-passkey-errors]")) {
+    delete container.dataset.passkeyErrorState
+  }
+}
+
+// Run the WebAuthn registration ceremony: refresh the challenge, prompt the
+// browser to create a credential, fill the form's hidden fields, and submit.
+async function createPasskey(button) {
+  const form = button.closest("form")
+
+  if (form) {
+    button.disabled = true
+    button.dispatchEvent(new CustomEvent("passkey:start", { bubbles: true }))
+
+    try {
+      if (!passkeysAvailable()) throw new Error("Passkeys are not supported by this browser")
+
+      const creationOptions = getCreationOptions()
+      if (!creationOptions) throw new Error("Missing passkey creation options")
+
+      await refreshChallenge(creationOptions)
+      const passkey = await register(creationOptions)
+
+      button.dispatchEvent(new CustomEvent("passkey:success", { bubbles: true }))
+      fillCreateForm(form, passkey)
+      form.submit()
+    } catch (error) {
+      button.disabled = false
+
+      const cancelled = error.name === "AbortError" || error.name === "NotAllowedError"
+      button.dispatchEvent(new CustomEvent("passkey:error", { bubbles: true, detail: { error, cancelled } }))
+    }
+  }
+}
+
+function passkeysAvailable() {
+  return !!window.PublicKeyCredential
+}
+
+// Read WebAuthn creation options from the <meta> tag rendered by
+// +passkey_creation_options_meta_tag+. Returns undefined if the tag is missing.
+function getCreationOptions() {
+  return getOptions("passkey-creation-options")
+}
+
+// Parse and return the JSON content of a <meta> tag by name.
+function getOptions(name) {
+  const meta = document.querySelector(`meta[name="${name}"]`)
+
+  if (meta) {
+    return JSON.parse(meta.content)
+  }
+}
+
+// POST to the challenge endpoint to get a fresh nonce, preventing replay attacks
+// when the page has been open for a while before the user initiates the ceremony.
+async function refreshChallenge(options) {
+  const url = document.querySelector('meta[name="passkey-challenge-url"]')?.content
+  if (!url) throw new Error("Missing passkey challenge URL")
+  const token = document.querySelector('meta[name="csrf-token"]')?.content
+
+  const response = await fetch(url, {
+    method: "POST",
+    credentials: "same-origin",
+    headers: {
+      "X-CSRF-Token": token,
+      "Accept": "application/json"
+    }
+  })
+
+  if (!response.ok) throw new Error("Failed to refresh challenge")
+
+  const { challenge } = await response.json()
+  options.challenge = challenge
+}
+
+// Populate the registration form's hidden fields with the credential response.
+// Clones the transports template input for each reported transport.
+function fillCreateForm(form, passkey) {
+  form.querySelector('[data-passkey-field="client_data_json"]').value = passkey.client_data_json
+  form.querySelector('[data-passkey-field="attestation_object"]').value = passkey.attestation_object
+
+  const template = form.querySelector('[data-passkey-field="transports"]')
+  for (const transport of passkey.transports) {
+    const input = template.cloneNode()
+    input.value = transport
+    template.before(input)
+  }
+  template.remove()
+}
+
+// Run the WebAuthn authentication ceremony: refresh the challenge, prompt the
+// browser to sign with an existing credential, fill the form, and submit.
+async function signInWithPasskey(button) {
+  const form = button.closest("form")
+
+  if (form) {
+    button.disabled = true
+    button.dispatchEvent(new CustomEvent("passkey:start", { bubbles: true }))
+
+    try {
+      if (!passkeysAvailable()) throw new Error("Passkeys are not supported by this browser")
+
+      const requestOptions = getRequestOptions()
+      if (!requestOptions) throw new Error("Missing passkey request options")
+
+      await refreshChallenge(requestOptions)
+      const passkey = await authenticate(requestOptions)
+
+      button.dispatchEvent(new CustomEvent("passkey:success", { bubbles: true }))
+      fillSignInForm(form, passkey)
+      form.submit()
+    } catch (error) {
+      button.disabled = false
+
+      const cancelled = error.name === "AbortError" || error.name === "NotAllowedError"
+      button.dispatchEvent(new CustomEvent("passkey:error", { bubbles: true, detail: { error, cancelled } }))
+    }
+  }
+}
+
+// Read WebAuthn request options from the <meta> tag rendered by
+// +passkey_request_options_meta_tag+. Returns undefined if the tag is missing.
+function getRequestOptions() {
+  return getOptions("passkey-request-options")
+}
+
+// Populate the authentication form's hidden fields with the assertion response.
+function fillSignInForm(form, passkey) {
+  form.querySelector('[data-passkey-field="id"]').value = passkey.id
+  form.querySelector('[data-passkey-field="client_data_json"]').value = passkey.client_data_json
+  form.querySelector('[data-passkey-field="authenticator_data"]').value = passkey.authenticator_data
+  form.querySelector('[data-passkey-field="signature"]').value = passkey.signature
+}
+
+// Start the conditional mediation (autofill) ceremony if the page opts in with
+// a form[data-passkey-mediation="conditional"] and the browser supports it.
+// Unlike the button-driven ceremonies, this runs automatically on page load.
+async function attemptConditionalMediation() {
+  if (await conditionalMediationAvailable()) {
+    const form = document.querySelector('form[data-passkey-mediation="conditional"]')
+    form.dispatchEvent(new CustomEvent("passkey:start", { bubbles: true }))
+
+    const requestOptions = getRequestOptions()
+
+    try {
+      await refreshChallenge(requestOptions)
+
+      const passkey = await authenticate(requestOptions, { mediation: "conditional" })
+
+      form.dispatchEvent(new CustomEvent("passkey:success", { bubbles: true }))
+      fillSignInForm(form, passkey)
+      form.submit()
+    } catch (error) {
+      const cancelled = error.name === "AbortError" || error.name === "NotAllowedError"
+      form.dispatchEvent(new CustomEvent("passkey:error", { bubbles: true, detail: { error, cancelled } }))
+    }
+  }
+}
+
+// Check all preconditions for conditional mediation: the page has opted in,
+// request options are present, the browser supports passkeys, and the browser
+// supports the conditional mediation UI (autofill).
+async function conditionalMediationAvailable() {
+  return isConditionalMediationFormPresent() &&
+         getRequestOptions() &&
+         passkeysAvailable() &&
+         await window.PublicKeyCredential.isConditionalMediationAvailable?.()
+}
+
+function isConditionalMediationFormPresent() {
+  return !!document.querySelector('form[data-passkey-mediation="conditional"]')
+}
diff --git a/app/javascript/lib/action_pack/webauthn.js b/app/javascript/lib/action_pack/webauthn.js
new file mode 100644
index 000000000..5d9ec9c23
--- /dev/null
+++ b/app/javascript/lib/action_pack/webauthn.js
@@ -0,0 +1,83 @@
+// Thin wrapper around the browser WebAuthn API (navigator.credentials).
+//
+// Handles the base64url ↔ ArrayBuffer conversions required by the spec so
+// callers can work with plain JSON objects from the server-rendered meta tags.
+
+// Call navigator.credentials.create() with the given creation options.
+// Returns { client_data_json, attestation_object, transports } with all
+// binary fields encoded as base64url strings ready for form submission.
+export async function register(options) {
+  const publicKey = prepareCreationOptions(options)
+  const credential = await navigator.credentials.create({ publicKey })
+
+  return {
+    client_data_json: new TextDecoder().decode(credential.response.clientDataJSON),
+    attestation_object: bufferToBase64url(credential.response.attestationObject),
+    transports: credential.response.getTransports?.() || []
+  }
+}
+
+// Call navigator.credentials.get() with the given request options.
+// Accepts an optional signal (AbortSignal) and mediation hint ("conditional"
+// for autofill UI). Returns { id, client_data_json, authenticator_data, signature }
+// with binary fields encoded as base64url strings.
+export async function authenticate(options, { signal, mediation } = {}) {
+  const publicKey = prepareRequestOptions(options)
+  const credential = await navigator.credentials.get({ publicKey, signal, mediation })
+
+  return {
+    id: credential.id,
+    client_data_json: new TextDecoder().decode(credential.response.clientDataJSON),
+    authenticator_data: bufferToBase64url(credential.response.authenticatorData),
+    signature: bufferToBase64url(credential.response.signature)
+  }
+}
+
+// Convert JSON creation options into the format expected by the browser:
+// decode base64url challenge, user.id, and excludeCredentials[].id into ArrayBuffers.
+function prepareCreationOptions(options) {
+  return {
+    ...options,
+    challenge: base64urlToBuffer(options.challenge),
+    user: { ...options.user, id: base64urlToBuffer(options.user.id) },
+    excludeCredentials: (options.excludeCredentials || []).map(cred => ({
+      ...cred,
+      id: base64urlToBuffer(cred.id)
+    }))
+  }
+}
+
+// Convert JSON request options into the format expected by the browser:
+// decode base64url challenge and allowCredentials[].id into ArrayBuffers.
+// Strips allowCredentials entirely when empty so the browser prompts for
+// any available credential (required for conditional mediation).
+function prepareRequestOptions(options) {
+  const prepared = {
+    ...options,
+    challenge: base64urlToBuffer(options.challenge)
+  }
+
+  if (options.allowCredentials?.length) {
+    prepared.allowCredentials = options.allowCredentials.map(cred => ({
+      ...cred,
+      id: base64urlToBuffer(cred.id)
+    }))
+  } else {
+    delete prepared.allowCredentials
+  }
+
+  return prepared
+}
+
+function base64urlToBuffer(base64url) {
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/")
+  const padding = "=".repeat((4 - base64.length % 4) % 4)
+  const binary = atob(base64 + padding)
+  return Uint8Array.from(binary, c => c.charCodeAt(0)).buffer
+}
+
+function bufferToBase64url(buffer) {
+  const bytes = new Uint8Array(buffer)
+  const binary = String.fromCharCode(...bytes)
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+}
diff --git a/app/models/identity.rb b/app/models/identity.rb
index 8e56ce196..ae4f7a8cb 100644
--- a/app/models/identity.rb
+++ b/app/models/identity.rb
@@ -1,8 +1,9 @@
 class Identity < ApplicationRecord
   include Joinable, Transferable
 
+  has_passkeys name: :email_address, display_name: -> { Current.user&.name || email_address }
+
   has_many :access_tokens, dependent: :destroy
-  has_many :credentials, dependent: :destroy
   has_many :magic_links, dependent: :destroy
   has_many :sessions, dependent: :destroy
   has_many :users, dependent: :nullify
diff --git a/app/models/identity/credential.rb b/app/models/identity/credential.rb
deleted file mode 100644
index d233fbcb6..000000000
--- a/app/models/identity/credential.rb
+++ /dev/null
@@ -1,74 +0,0 @@
-class Identity::Credential < ApplicationRecord
-  belongs_to :identity
-
-  serialize :transports, coder: JSON, type: Array, default: []
-
-  class << self
-    def creation_options(identity:, display_name:)
-      ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
-        id: identity.id,
-        name: identity.email_address,
-        display_name: display_name,
-        resident_key: :required,
-        exclude_credentials: identity.credentials.map(&:to_public_key_credential)
-      )
-    end
-
-    def request_options(credentials: [])
-      ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(credentials: credentials.map(&:to_public_key_credential))
-    end
-
-    def register(passkey:, challenge:, origin: ActionPack::WebAuthn::Current.origin, **attributes)
-      public_key_credential = ActionPack::WebAuthn::PublicKeyCredential.create(
-        client_data_json: passkey[:client_data_json],
-        attestation_object: Base64.urlsafe_decode64(passkey[:attestation_object]),
-        challenge: challenge,
-        origin: origin,
-        transports: Array(passkey[:transports])
-      )
-
-      create!(
-        **attributes,
-        name: attributes.fetch(:name, Authenticator.find_by_aaguid(public_key_credential.aaguid)&.name),
-        credential_id: public_key_credential.id,
-        public_key: public_key_credential.public_key.to_der,
-        sign_count: public_key_credential.sign_count,
-        aaguid: public_key_credential.aaguid,
-        backed_up: public_key_credential.backed_up,
-        transports: public_key_credential.transports
-      )
-    end
-
-    def authenticate(passkey:, challenge:, origin: ActionPack::WebAuthn::Current.origin)
-      find_by(credential_id: passkey[:id])&.authenticate(passkey: passkey, challenge: challenge, origin: origin)
-    end
-  end
-
-  def authenticate(passkey:, challenge:, origin: ActionPack::WebAuthn::Current.origin)
-    pkc = to_public_key_credential
-    pkc.authenticate(
-      client_data_json: passkey[:client_data_json],
-      authenticator_data: Base64.urlsafe_decode64(passkey[:authenticator_data]),
-      signature: Base64.urlsafe_decode64(passkey[:signature]),
-      challenge: challenge,
-      origin: origin
-    )
-    update!(sign_count: pkc.sign_count, backed_up: pkc.backed_up)
-    self
-  rescue ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError
-    nil
-  end
-
-  def authenticator
-    Authenticator.find_by_aaguid(aaguid)
-  end
-
-  def to_public_key_credential
-    ActionPack::WebAuthn::PublicKeyCredential.new(
-      id: credential_id,
-      public_key: OpenSSL::PKey.read(public_key),
-      sign_count: sign_count,
-      transports: transports
-    )
-  end
-end
diff --git a/app/models/identity/credential/authenticator.rb b/app/models/identity/credential/authenticator.rb
deleted file mode 100644
index 72ebece0f..000000000
--- a/app/models/identity/credential/authenticator.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-class Identity::Credential::Authenticator < Data.define(:name, :icon)
-  REGISTRY = Rails.application.config_for(:passkey_aaguids).each_with_object({}) do |(_key, attrs), hash|
-    authenticator = new(name: attrs[:name], icon: attrs[:icon])
-    attrs[:aaguids].each { |aaguid| hash[aaguid] = authenticator }
-  end.freeze
-
-  class << self
-    def find_by_aaguid(aaguid)
-      REGISTRY[aaguid]
-    end
-  end
-end
diff --git a/app/models/passkey/authenticator.rb b/app/models/passkey/authenticator.rb
new file mode 100644
index 000000000..2af6edc58
--- /dev/null
+++ b/app/models/passkey/authenticator.rb
@@ -0,0 +1,23 @@
+class Passkey::Authenticator < Data.define(:aaguids, :name, :icon)
+  class << self
+    def find_by_aaguid(aaguid)
+      registry[aaguid]
+    end
+
+    def registry
+      @registry ||= Hash.new.tap do |registry|
+        all.each do |authenticator|
+          authenticator.aaguids.each do |aaguid|
+            registry[aaguid] = authenticator
+          end
+        end
+      end
+    end
+
+    def all
+      Rails.application.config_for(:passkey_aaguids).each_value.map do |attrs|
+        new(aaguids: attrs[:aaguids], name: attrs[:name], icon: attrs[:icon])
+      end
+    end
+  end
+end
diff --git a/app/views/mailers/magic_link_mailer/sign_in_instructions.html.erb b/app/views/mailers/magic_link_mailer/sign_in_instructions.html.erb
index 7ed9dc5bf..7873ad54b 100644
--- a/app/views/mailers/magic_link_mailer/sign_in_instructions.html.erb
+++ b/app/views/mailers/magic_link_mailer/sign_in_instructions.html.erb
@@ -11,6 +11,10 @@
 
 <p>This code will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.</p>
 
+<% if account = @magic_link.identity.accounts.last %>
+  <p>P.S. You can make your account more secure and sign-in faster with a <%= link_to "Passkey", my_passkeys_url(script_name: account.slug) %></p>
+<% end %>
+
 <p class="footer">Need help? <%= mail_to "support@fizzy.do", "Send us an email"%>.
 </p>
 
diff --git a/app/views/mailers/magic_link_mailer/sign_in_instructions.text.erb b/app/views/mailers/magic_link_mailer/sign_in_instructions.text.erb
index e24141018..431566644 100644
--- a/app/views/mailers/magic_link_mailer/sign_in_instructions.text.erb
+++ b/app/views/mailers/magic_link_mailer/sign_in_instructions.text.erb
@@ -7,3 +7,7 @@ Please enter this 6-character verification code to finish creating your account:
 <%= @magic_link.code %>
 
 This code will work for <%= distance_of_time_in_words(MagicLink::EXPIRATION_TIME) %>.
+
+<% if account = @magic_link.identity.accounts.last %>
+P.S. If you want to sign-in faster, and make your account more secure, add a passkey: <%= my_passkeys_url(script_name: account.slug) %>
+<% end %>
diff --git a/app/views/my/access_tokens/index.html.erb b/app/views/my/access_tokens/index.html.erb
index 6cfd1abd8..7ed938d7f 100644
--- a/app/views/my/access_tokens/index.html.erb
+++ b/app/views/my/access_tokens/index.html.erb
@@ -11,7 +11,7 @@
 <section class="panel panel--wide shadow center webhooks">
   <% if @access_tokens.any? %>
     <p class="margin-none-block-start">Tokens you have generated that can be used to access the Fizzy API.</p>
-    <table class="access_tokens_table margin-block-end-double max-width txt-small">
+    <table class="access-tokens margin-block-end-double max-width txt-small">
       <thead>
         <tr>
           <th>Description</th>
diff --git a/app/views/my/passkeys/_passkey.html.erb b/app/views/my/passkeys/_passkey.html.erb
new file mode 100644
index 000000000..826dd8516
--- /dev/null
+++ b/app/views/my/passkeys/_passkey.html.erb
@@ -0,0 +1,13 @@
+<li class="credential" style="view-transition-name: <%= dom_id(passkey) %>">
+  <%= link_to edit_my_passkey_path(passkey), class: "credential__link" do %>
+    <% if icon = passkey.authenticator&.icon %>
+      <%= image_tag icon[:light], size: 24, class: "flex-item-no-shrink hide-on-dark-mode", aria: { hidden: true } %>
+      <%= image_tag icon[:dark], size: 24, class: "flex-item-no-shrink hide-on-light-mode", aria: { hidden: true } %>
+    <% else %>
+      <%= image_tag "passkeys/generic_light.svg", size: 24, class: "flex-item-no-shrink hide-on-dark-mode", aria: { hidden: true } %>
+      <%= image_tag "passkeys/generic_dark.svg", size: 24, class: "flex-item-no-shrink hide-on-light-mode", aria: { hidden: true } %>
+    <% end %>
+    <strong class="overflow-ellipsis min-width"><%= passkey.name.presence || "Passkey" %></strong>
+    <strong class="credential__arrow">→</strong>
+  <% end %>
+</li>
diff --git a/app/views/users/credentials/edit.html.erb b/app/views/my/passkeys/edit.html.erb
similarity index 73%
rename from app/views/users/credentials/edit.html.erb
rename to app/views/my/passkeys/edit.html.erb
index 4beb0bba8..6a28ddff7 100644
--- a/app/views/users/credentials/edit.html.erb
+++ b/app/views/my/passkeys/edit.html.erb
@@ -2,7 +2,7 @@
 
 <% content_for :header do %>
   <div class="header__actions header__actions--start">
-    <%= back_link_to "Passkeys", user_credentials_path(Current.user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
+    <%= back_link_to "Passkeys", my_passkeys_path, "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
   </div>
 
   <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
@@ -13,7 +13,7 @@
     <p class="margin-none">Your passkey has been registered. Give it a name so you can identify it later.</p>
   <% end %>
 
-  <%= form_with model: @credential, scope: :credential, url: user_credential_path(Current.user, @credential), html: { class: "flex flex-column gap" } do |form| %>
+  <%= form_with model: @passkey, scope: :passkey, url: my_passkey_path(@passkey), html: { class: "flex flex-column gap" } do |form| %>
     <div class="flex flex-column gap-half">
       <strong><%= form.label "Name your passkey" %></strong>
       <%= form.text_field :name, autofocus: true, class: "input", placeholder: "e.g. MacBook Pro, iPhone", data: { "1p-ignore": "" }, autocomplete: "off" %>
@@ -23,7 +23,7 @@
   <% end %>
 
   <div class="txt-align-center">
-    <%= button_to user_credential_path(Current.user, @credential), method: :delete,
+    <%= button_to my_passkey_path(@passkey), method: :delete,
           class: "btn txt-negative borderless txt-small",
           data: { turbo_confirm: "Are you sure you want to remove this passkey?" } do %>
       <%= icon_tag "trash" %>
diff --git a/app/views/users/credentials/index.html.erb b/app/views/my/passkeys/index.html.erb
similarity index 61%
rename from app/views/users/credentials/index.html.erb
rename to app/views/my/passkeys/index.html.erb
index f37d8a373..545c15a43 100644
--- a/app/views/users/credentials/index.html.erb
+++ b/app/views/my/passkeys/index.html.erb
@@ -1,5 +1,9 @@
 <% @page_title = "Passkeys" %>
 
+<% content_for :head do %>
+  <%= passkey_creation_options_meta_tag(@creation_options) %>
+<% end %>
+
 <% content_for :header do %>
   <div class="header__actions header__actions--start">
     <%= back_link_to "My profile", user_path(Current.user), "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click" %>
@@ -8,34 +12,30 @@
   <h1 class="header__title" data-bridge--title-target="header"><%= @page_title %></h1>
 <% end %>
 
-<section class="panel panel--wide shadow center"
-  data-controller="credential"
-  data-credential-public-key-value="<%= @creation_options.as_json.to_json %>"
-  data-credential-register-url-value="<%= user_credentials_path(Current.user) %>">
-
+<section class="panel panel--wide shadow center" data-passkey-errors>
   <p class="font-weight-medium margin-none-block-start">Passkeys let you sign in securely without a password or email code.</p>
 
-  <% if @credentials.any? %>
+  <% if @passkeys.any? %>
     <ul class="margin-none-block-start margin-block-end-double unpad">
-      <%= render partial: "users/credentials/credential", collection: @credentials %>
+      <%= render partial: "my/passkeys/passkey", collection: @passkeys %>
     </ul>
   <% end %>
 
   <footer>
-    <button type="button" data-action="credential#create" data-credential-target="button" class="btn btn--link center txt-medium">
+    <%= passkey_creation_button my_passkeys_path, class: "btn btn--link center txt-medium" do %>
       <%= icon_tag "add" %>
       <span>Register a passkey</span>
-    </button>
+    <% end %>
 
     <p class="txt-small txt-subtle txt-balance margin-none-block-end">
       Your browser will prompt you to create a passkey using your device's biometrics, PIN, or security key
     </p>
 
-    <p data-credential-target="error" class="txt-negative" hidden>
+    <p data-passkey-error="error" class="txt-negative">
       Something went wrong while registering your passkey.
     </p>
 
-    <p data-credential-target="cancelled" class="txt-subtle" hidden>
+    <p data-passkey-error="cancelled" class="txt-subtle">
       Passkey registration was cancelled.
       Try again when you are ready.
     </p>
diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb
index 553236f1d..6d2567639 100644
--- a/app/views/sessions/new.html.erb
+++ b/app/views/sessions/new.html.erb
@@ -1,15 +1,16 @@
 <% @page_title = "Enter your email" %>
 
-<div class="panel panel--centered flex flex-column gap-half" data-controller="passkey"
-  data-passkey-public-key-value="<%= @request_options.as_json.to_json %>"
-  data-passkey-url-value="<%= session_passkey_path %>"
-  data-passkey-csrf-token-value="<%= form_authenticity_token %>">
+<% content_for :head do %>
+  <%= passkey_request_options_meta_tag(@request_options) %>
+<% end %>
+
+<div class="panel panel--centered flex flex-column gap-half">
   <h1 class="txt-x-large font-weight-black margin-block-end">Get into Fizzy</h1>
 
   <%= form_with url: session_path, class: "flex flex-column gap-half txt-medium" do |form| %>
     <div class="flex align-center gap">
       <label class="flex align-center gap input input--actor">
-        <%= form.email_field :email_address, required: true, class: "input txt-large full-width", autofocus: true, autocomplete: "email webauthn", placeholder: "Enter your email address…" %>
+        <%= form.email_field :email_address, required: true, class: "input txt-large full-width", autofocus: true, autocomplete: "username webauthn", placeholder: "Enter your email address…" %>
       </label>
     </div>
 
@@ -25,6 +26,8 @@
     </button>
   <% end %>
 
+  <%= passkey_sign_in_button "Sign in with a passkey", session_passkey_path, mediation: "conditional", class: "btn btn--link center txt-medium", hidden: true %>
+
 </div>
 
 <% content_for :footer do %>
diff --git a/app/views/users/credentials/_credential.html.erb b/app/views/users/credentials/_credential.html.erb
deleted file mode 100644
index fa1e733e6..000000000
--- a/app/views/users/credentials/_credential.html.erb
+++ /dev/null
@@ -1,9 +0,0 @@
-<li class="credential" style="view-transition-name: <%= dom_id(credential) %>">
-  <%= link_to edit_user_credential_path(Current.user, credential), class: "credential__link" do %>
-    <% authenticator = credential.authenticator %>
-    <%= image_tag authenticator&.icon&.[](:light) || "passkeys/generic_light.svg", size: 24, class: "flex-item-no-shrink hide-on-dark-mode", aria: { hidden: true } %>
-    <%= image_tag authenticator&.icon&.[](:dark) || "passkeys/generic_dark.svg", size: 24, class: "flex-item-no-shrink hide-on-light-mode", aria: { hidden: true } %>
-    <strong class="overflow-ellipsis min-width"><%= credential.name.presence || "Passkey" %></strong>
-    <strong class="credential__arrow">→</strong>
-  <% end %>
-</li>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index d96184e5f..c30f67de4 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -41,7 +41,7 @@
       <% if Current.user == @user %>
         <hr class="separator--horizontal full-width flex-item-grow margin-block-start-double" style="--border-color: var(--color-ink-light);" aria-hidden="true">
 
-        <%= link_to user_credentials_path(@user), class: "btn txt-x-small center" do %>
+        <%= link_to my_passkeys_path, class: "btn txt-x-small center" do %>
           <%= icon_tag "authentication" %>
           <span>Manage passkeys</span>
         <% end %>
diff --git a/config/application.rb b/config/application.rb
index ced9d9305..33b8bd83d 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -1,6 +1,7 @@
 require_relative "boot"
 require "rails/all"
 require_relative "../lib/fizzy"
+require_relative "../lib/action_pack/railtie"
 
 Bundler.require(*Rails.groups)
 
@@ -25,6 +26,9 @@ module Fizzy
       g.orm :active_record, primary_key_type: :uuid
     end
 
+    config.action_pack.passkey.draw_routes = false
+    config.action_pack.passkey.challenge_url = -> { my_passkey_challenge_path(script_name: "") }
+
     config.mission_control.jobs.http_basic_auth_enabled = false
   end
 end
diff --git a/config/importmap.rb b/config/importmap.rb
index f6910c3e1..82586dbae 100644
--- a/config/importmap.rb
+++ b/config/importmap.rb
@@ -10,6 +10,7 @@ pin "@rails/request.js", to: "@rails--request.js" # @0.0.13
 
 pin_all_from "app/javascript/controllers", under: "controllers"
 pin_all_from "app/javascript/helpers", under: "helpers"
+pin_all_from "app/javascript/lib", under: "lib"
 pin_all_from "app/javascript/initializers", under: "initializers"
 pin_all_from "app/javascript/bridge/initializers", under: "bridge/initializers"
 pin_all_from "app/javascript/bridge/helpers", under: "bridge/helpers"
diff --git a/config/initializers/passkeys.rb b/config/initializers/passkeys.rb
new file mode 100644
index 000000000..cd8b02dde
--- /dev/null
+++ b/config/initializers/passkeys.rb
@@ -0,0 +1,3 @@
+Rails.application.config.to_prepare do
+  ActionPack::Passkey.prepend ActionPackPasskeyInferNameFromAaguid
+end
diff --git a/config/routes.rb b/config/routes.rb
index 6353681d7..a21a0c457 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -15,8 +15,6 @@ Rails.application.routes.draw do
       resource :avatar
       resource :role
       resource :events
-      resources :credentials, except: %i[ show new ]
-
       resources :push_subscriptions
 
       resources :email_addresses, param: :token do
@@ -174,8 +172,10 @@ Rails.application.routes.draw do
   resource :landing
 
   namespace :my do
+    resource :passkey_challenge, only: :create
     resource :identity, only: :show
     resources :access_tokens
+    resources :passkeys, except: %i[ show new ]
     resources :pins
     resource :timezone
     resource :menu
diff --git a/db/migrate/20260213154740_create_action_pack_passkeys.rb b/db/migrate/20260213154740_create_action_pack_passkeys.rb
new file mode 100644
index 000000000..85991cd07
--- /dev/null
+++ b/db/migrate/20260213154740_create_action_pack_passkeys.rb
@@ -0,0 +1,20 @@
+class CreateActionPackPasskeys < ActiveRecord::Migration[8.2]
+  def change
+    create_table :action_pack_passkeys, id: :uuid do |t|
+      t.uuid :holder_id, null: false
+      t.string :holder_type, null: false
+      t.string :credential_id, null: false
+      t.binary :public_key, null: false
+      t.integer :sign_count, null: false, default: 0
+      t.string :name
+      t.text :transports
+      t.string :aaguid
+      t.boolean :backed_up
+
+      t.timestamps
+
+      t.index [ :holder_type, :holder_id ]
+      t.index :credential_id, unique: true
+    end
+  end
+end
diff --git a/db/migrate/20260213154740_create_identity_credentials.rb b/db/migrate/20260213154740_create_identity_credentials.rb
deleted file mode 100644
index b7bf70568..000000000
--- a/db/migrate/20260213154740_create_identity_credentials.rb
+++ /dev/null
@@ -1,17 +0,0 @@
-class CreateIdentityCredentials < ActiveRecord::Migration[8.2]
-  def change
-    create_table :identity_credentials, id: :uuid do |t|
-      t.uuid :identity_id, null: false
-      t.string :credential_id, null: false
-      t.binary :public_key, null: false
-      t.integer :sign_count, null: false, default: 0
-      t.string :name
-      t.text :transports
-
-      t.timestamps
-
-      t.index :identity_id
-      t.index :credential_id, unique: true
-    end
-  end
-end
diff --git a/db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb b/db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb
deleted file mode 100644
index 172d88839..000000000
--- a/db/migrate/20260219095815_add_aaguid_and_backed_up_to_identity_credentials.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-class AddAaguidAndBackedUpToIdentityCredentials < ActiveRecord::Migration[8.2]
-  def change
-    add_column :identity_credentials, :aaguid, :string
-    add_column :identity_credentials, :backed_up, :boolean
-  end
-end
diff --git a/db/schema.rb b/db/schema.rb
index 07248185c..99e6be953 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.2].define(version: 2026_02_19_095815) do
+ActiveRecord::Schema[8.2].define(version: 2026_02_18_120000) do
   create_table "accesses", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.datetime "accessed_at"
     t.uuid "account_id", null: false
@@ -69,6 +69,22 @@ ActiveRecord::Schema[8.2].define(version: 2026_02_19_095815) do
     t.index ["external_account_id"], name: "index_accounts_on_external_account_id", unique: true
   end
 
+  create_table "action_pack_passkeys", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.string "aaguid"
+    t.boolean "backed_up"
+    t.datetime "created_at", null: false
+    t.string "credential_id", null: false
+    t.uuid "holder_id", null: false
+    t.string "holder_type", null: false
+    t.string "name"
+    t.binary "public_key", null: false
+    t.integer "sign_count", default: 0, null: false
+    t.text "transports"
+    t.datetime "updated_at", null: false
+    t.index ["credential_id"], name: "index_action_pack_passkeys_on_credential_id", unique: true
+    t.index ["holder_type", "holder_id"], name: "index_action_pack_passkeys_on_holder_type_and_holder_id"
+  end
+
   create_table "action_text_rich_texts", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.uuid "account_id", null: false
     t.text "body", size: :long
@@ -344,21 +360,6 @@ ActiveRecord::Schema[8.2].define(version: 2026_02_19_095815) do
     t.index ["identity_id"], name: "index_access_token_on_identity_id"
   end
 
-  create_table "identity_credentials", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
-    t.string "aaguid"
-    t.boolean "backed_up"
-    t.datetime "created_at", null: false
-    t.string "credential_id", null: false
-    t.uuid "identity_id", null: false
-    t.string "name"
-    t.binary "public_key", null: false
-    t.integer "sign_count", default: 0, null: false
-    t.text "transports"
-    t.datetime "updated_at", null: false
-    t.index ["credential_id"], name: "index_identity_credentials_on_credential_id", unique: true
-    t.index ["identity_id"], name: "index_identity_credentials_on_identity_id"
-  end
-
   create_table "magic_links", id: :uuid, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "code", null: false
     t.datetime "created_at", null: false
diff --git a/db/schema_sqlite.rb b/db/schema_sqlite.rb
index c8ce19e07..00125d1d6 100644
--- a/db/schema_sqlite.rb
+++ b/db/schema_sqlite.rb
@@ -69,6 +69,22 @@ ActiveRecord::Schema[8.2].define(version: 2026_02_18_120000) do
     t.index ["external_account_id"], name: "index_accounts_on_external_account_id", unique: true
   end
 
+  create_table "action_pack_passkeys", id: :uuid, force: :cascade do |t|
+    t.string "aaguid", limit: 255
+    t.boolean "backed_up"
+    t.datetime "created_at", null: false
+    t.string "credential_id", limit: 255, null: false
+    t.uuid "holder_id", null: false
+    t.string "holder_type", limit: 255, null: false
+    t.string "name", limit: 255
+    t.binary "public_key", null: false
+    t.integer "sign_count", default: 0, null: false
+    t.text "transports", limit: 65535
+    t.datetime "updated_at", null: false
+    t.index ["credential_id"], name: "index_action_pack_passkeys_on_credential_id", unique: true
+    t.index ["holder_type", "holder_id"], name: "index_action_pack_passkeys_on_holder_type_and_holder_id"
+  end
+
   create_table "action_text_rich_texts", id: :uuid, force: :cascade do |t|
     t.uuid "account_id", null: false
     t.text "body", limit: 4294967295
diff --git a/lib/action_pack/passkey.rb b/lib/action_pack/passkey.rb
new file mode 100644
index 000000000..ace33176c
--- /dev/null
+++ b/lib/action_pack/passkey.rb
@@ -0,0 +1,104 @@
+# ActionPack::Passkey provides WebAuthn passkey registration and authentication backed by Active Record.
+#
+# Passkeys are scoped to a polymorphic +holder+ (typically a User or Identity) and store the
+# credential ID, public key, sign count, and transport hints needed for the WebAuthn ceremonies.
+#
+# == Registration
+#
+# Generate options for the browser's +navigator.credentials.create()+ call, then register the
+# response:
+#
+#   options = ActionPack::Passkey.creation_options(holder: current_user)
+#   # Pass options to the browser
+#
+#   passkey = ActionPack::Passkey.register(params[:passkey], holder: current_user)
+#
+# == Authentication
+#
+# Generate options for the browser's +navigator.credentials.get()+ call, then authenticate the
+# response:
+#
+#   options = ActionPack::Passkey.request_options
+#   # Pass options to the browser
+#
+#   passkey = ActionPack::Passkey.authenticate(params[:passkey])
+#
+# == Holder integration
+#
+# Call +has_passkeys+ in your model to set up the association and configure ceremony options
+# per-holder. See ActionPack::Passkey::Holder for details.
+class ActionPack::Passkey < Rails.configuration.action_pack.passkey.parent_class_name.constantize
+  self.table_name = "action_pack_passkeys"
+  belongs_to :holder, polymorphic: true
+  serialize :transports, coder: JSON, type: Array, default: []
+
+  class << self
+    # Returns a CreationOptions object for the given +holder+, suitable for passing to the
+    # browser's +navigator.credentials.create()+ call. Merges global defaults from the Rails
+    # configuration, holder-specific options from +holder.passkey_creation_options+, and any
+    # additional +options+ overrides.
+    def creation_options(holder:, **options)
+      ActionPack::WebAuthn::PublicKeyCredential.creation_options(
+        **Rails.configuration.action_pack.web_authn.default_creation_options.to_h,
+        **holder.passkey_creation_options.to_h,
+        **options
+      )
+    end
+
+    # Verifies the attestation response from the browser and persists a new passkey record.
+    # The +passkey+ hash should contain +client_data_json+, +attestation_object+, and +transports+
+    # as submitted by the registration form. The +challenge+ defaults to
+    # +ActionPack::WebAuthn::Current.challenge+, which is automatically populated from the session
+    # by ActionPack::Passkey::Request. Any additional +attributes+ (e.g. +holder+) are passed
+    # through to +create!+.
+    #
+    # Raises ActionPack::WebAuthn::InvalidResponseError if the attestation is invalid.
+    def register(passkey, challenge: ActionPack::WebAuthn::Current.challenge, **attributes)
+      credential = ActionPack::WebAuthn::PublicKeyCredential.register(passkey, challenge: challenge)
+
+      create!(**credential.to_h, **attributes)
+    end
+
+    # Returns a RequestOptions object suitable for passing to the browser's
+    # +navigator.credentials.get()+ call. When a +holder+ is provided, their existing credentials
+    # are included so the browser can offer them for selection. Merges global defaults, holder
+    # options, and any additional +options+ overrides.
+    def request_options(holder: nil, **options)
+      ActionPack::WebAuthn::PublicKeyCredential.request_options(
+        **Rails.configuration.action_pack.web_authn.default_request_options.to_h,
+        **holder&.passkey_request_options.to_h,
+        **options
+      )
+    end
+
+    # Looks up a passkey by credential ID and verifies the assertion response from the browser.
+    # Returns the authenticated Passkey record, or +nil+ if the credential is not found or
+    # verification fails.
+    def authenticate(passkey, challenge: ActionPack::WebAuthn::Current.challenge)
+      find_by(credential_id: passkey[:id])&.authenticate(passkey, challenge: challenge)
+    end
+  end
+
+  # Verifies the assertion response against this passkey's stored credential and updates the
+  # +sign_count+ and +backed_up+ attributes. Returns +self+ on success, or +nil+ if the
+  # response is invalid.
+  def authenticate(passkey, challenge: ActionPack::WebAuthn::Current.challenge)
+    credential = to_public_key_credential
+    credential.authenticate(passkey, challenge: challenge)
+    update!(sign_count: credential.sign_count, backed_up: credential.backed_up)
+    self
+  rescue ActionPack::WebAuthn::InvalidResponseError
+    nil
+  end
+
+  # Returns an ActionPack::WebAuthn::PublicKeyCredential initialized from this record's stored
+  # credential data.
+  def to_public_key_credential
+    ActionPack::WebAuthn::PublicKeyCredential.new(
+      id: credential_id,
+      public_key: public_key,
+      sign_count: sign_count,
+      transports: transports
+    )
+  end
+end
diff --git a/lib/action_pack/passkey/challenges_controller.rb b/lib/action_pack/passkey/challenges_controller.rb
new file mode 100644
index 000000000..bec1770b0
--- /dev/null
+++ b/lib/action_pack/passkey/challenges_controller.rb
@@ -0,0 +1,37 @@
+# = Action Pack Passkey Challenges Controller
+#
+# Generates fresh WebAuthn challenges for passkey ceremonies. The companion
+# JavaScript calls this endpoint before initiating a registration or
+# authentication ceremony so that the challenge is issued just-in-time rather
+# than embedded in the initial page load.
+#
+# The generated challenge is stored in an encrypted, HTTP-only, same-site
+# cookie and simultaneously returned in the JSON response body. The cookie is
+# consumed by ActionPack::Passkey::Request on the subsequent form submission.
+#
+# == Route
+#
+# By default mounted at +/rails/action_pack/passkey/challenge+ (configurable
+# via +config.action_pack.passkey.routes_prefix+).
+#
+class ActionPack::Passkey::ChallengesController < ActionController::Base
+  COOKIE_NAME = :action_pack_passkey_challenge
+
+  include ActionPack::Passkey::Request
+
+  # Generates a fresh challenge, stores it in an encrypted cookie, and returns
+  # it as JSON. The cookie is consumed on the next passkey form submission.
+  def create
+    challenge = create_passkey_challenge
+
+    cookies.encrypted[COOKIE_NAME] = { value: challenge, httponly: true, same_site: :strict, secure: !request.local? && request.ssl? }
+    render json: { challenge: challenge }
+  end
+
+  private
+    def create_passkey_challenge
+      ActionPack::WebAuthn::PublicKeyCredential::Options.new(
+        challenge_expiration: Rails.configuration.action_pack.web_authn.request_challenge_expiration
+      ).challenge
+    end
+end
diff --git a/lib/action_pack/passkey/form_helper.rb b/lib/action_pack/passkey/form_helper.rb
new file mode 100644
index 000000000..4fc9a4444
--- /dev/null
+++ b/lib/action_pack/passkey/form_helper.rb
@@ -0,0 +1,87 @@
+# View helpers for rendering passkey forms and meta tags.
+#
+# Include this module in your helper or ApplicationHelper to get access to:
+#
+# - +passkey_creation_options_meta_tag+ / +passkey_request_options_meta_tag+ — render a <meta>
+#   tag containing the JSON-serialized WebAuthn options for the browser credential API.
+# - +passkey_creation_button+ — render a form with hidden fields for the registration ceremony.
+# - +passkey_sign_in_button+ — render a form with hidden fields for the authentication
+#   ceremony.
+module ActionPack::Passkey::FormHelper
+  # Renders +<meta>+ tags containing JSON-serialized creation options and the challenge endpoint
+  # URL for the WebAuthn registration ceremony. The companion JavaScript reads these tags to call
+  # +navigator.credentials.create()+.
+  def passkey_creation_options_meta_tag(creation_options, challenge_url: nil)
+    passkey_challenge_url_meta_tag(challenge_url: challenge_url) +
+      tag.meta(name: "passkey-creation-options", content: creation_options.to_json)
+  end
+
+  # Renders +<meta>+ tags containing JSON-serialized request options and the challenge endpoint
+  # URL for the WebAuthn authentication ceremony. The companion JavaScript reads these tags to
+  # call +navigator.credentials.get()+.
+  def passkey_request_options_meta_tag(request_options, challenge_url: nil)
+    passkey_challenge_url_meta_tag(challenge_url: challenge_url) +
+      tag.meta(name: "passkey-request-options", content: request_options.to_json)
+  end
+
+  # Renders a form with hidden fields for the passkey registration ceremony. The form POSTs to
+  # +url+ and includes hidden fields for +client_data_json+, +attestation_object+, and
+  # +transports+ — populated by the Stimulus controller after the browser credential API
+  # resolves. Accepts a +label+ string or a block for button content.
+  #
+  # Options:
+  # - +param+: the form parameter namespace (default: +:passkey+)
+  # - +form+: additional HTML attributes for the +<form>+ tag
+  # - All other options are passed to the +<button>+ tag
+  def passkey_creation_button(name = nil, url = nil, param: :passkey, form: {}, **options, &block)
+    url, name = name, block ? capture(&block) : nil if block_given?
+    form_options = form.reverse_merge(method: :post, action: url, class: "button_to")
+
+    tag.form(**form_options) do
+      hidden_field_tag(:authenticity_token, form_authenticity_token) +
+        hidden_field_tag("#{param}[client_data_json]", nil, id: nil, data: { passkey_field: "client_data_json" }) +
+        hidden_field_tag("#{param}[attestation_object]", nil, id: nil, data: { passkey_field: "attestation_object" }) +
+        hidden_field_tag("#{param}[transports][]", nil, id: nil, data: { passkey_field: "transports" }) +
+        tag.button(name, type: :button, data: { passkey: "create" }, **options)
+    end
+  end
+
+  # Renders a form with hidden fields for the passkey authentication ceremony. The form POSTs to
+  # +url+ and includes hidden fields for +id+, +client_data_json+, +authenticator_data+, and
+  # +signature+
+  # Accepts a +label+ string or a block for button content.
+  #
+  # Options:
+  # - +param+: the form parameter namespace (default: +:passkey+)
+  # - +mediation+: WebAuthn mediation hint (e.g. +"conditional"+ for autofill-assisted sign in)
+  # - +form+: additional HTML attributes for the +<form>+ tag
+  # - All other options are passed to the +<button>+ tag
+  def passkey_sign_in_button(name = nil, url = nil, param: :passkey, mediation: nil, form: {}, **options, &block)
+    url, name = name, block ? capture(&block) : nil if block_given?
+    form_data = {}
+    form_data[:passkey_mediation] = mediation if mediation
+    form_options = form.reverse_merge(method: :post, action: url, class: "button_to", data: form_data)
+
+    tag.form(**form_options) do
+      hidden_field_tag(:authenticity_token, form_authenticity_token) +
+        hidden_field_tag("#{param}[id]", nil, id: nil, data: { passkey_field: "id" }) +
+        hidden_field_tag("#{param}[client_data_json]", nil, id: nil, data: { passkey_field: "client_data_json" }) +
+        hidden_field_tag("#{param}[authenticator_data]", nil, id: nil, data: { passkey_field: "authenticator_data" }) +
+        hidden_field_tag("#{param}[signature]", nil, id: nil, data: { passkey_field: "signature" }) +
+        tag.button(name, type: :button, data: { passkey: "sign_in" }, **options)
+    end
+  end
+
+  private
+    def passkey_challenge_url_meta_tag(challenge_url: nil)
+      tag.meta(name: "passkey-challenge-url", content: challenge_url || default_passkey_challenge_url)
+    end
+
+    def default_passkey_challenge_url
+      if challenge_url = Rails.configuration.action_pack.passkey.challenge_url
+        instance_exec(&challenge_url)
+      else
+        passkey_challenge_path
+      end
+    end
+end
diff --git a/lib/action_pack/passkey/holder.rb b/lib/action_pack/passkey/holder.rb
new file mode 100644
index 000000000..007ddbae5
--- /dev/null
+++ b/lib/action_pack/passkey/holder.rb
@@ -0,0 +1,143 @@
+# Adds passkey support to an Active Record model (the "holder" of passkeys).
+#
+# == Usage
+#
+#   class User < ApplicationRecord
+#     has_passkeys name: :email_address, display_name: :name
+#   end
+#
+# This sets up a polymorphic +has_many :passkeys+ association and defines two methods on the
+# model that supply holder-specific options for the WebAuthn ceremonies:
+#
+# - +passkey_creation_options+ — merged into ActionPack::Passkey.creation_options
+# - +passkey_request_options+ — merged into ActionPack::Passkey.request_options
+#
+# == Options
+#
+# +has_passkeys+ accepts keyword arguments that map to WebAuthn creation or request option
+# fields. Values can be symbols (sent to the record), procs (evaluated in the record's context),
+# or plain values:
+#
+# [+name+]
+#   A human-readable account identifier (typically an email or username) shown by the
+#   authenticator when the user selects a passkey. Maps to the WebAuthn +user.name+ field.
+#
+# [+display_name+]
+#   A friendly label for the user (typically their full name) shown by the authenticator
+#   during passkey registration. Maps to the WebAuthn +user.displayName+ field.
+#
+#   has_passkeys name: :email, display_name: :name
+#
+# For more complex configuration, pass a block that receives a ActionPack::Passkey::Holder::Config:
+#
+#   has_passkeys do |config|
+#     config.creation_options { { name: email, display_name: name } }
+#     config.request_options  { { user_verification: "required" } }
+#   end
+module ActionPack::Passkey::Holder
+  extend ActiveSupport::Concern
+
+  class_methods do
+    # Declares that this model can hold passkeys. Sets up a polymorphic +has_many+ association
+    # and defines +passkey_creation_options+ and +passkey_request_options+ instance methods used
+    # by ActionPack::Passkey to build ceremony options.
+    #
+    # Keyword arguments matching CreationOptions or RequestOptions fields are extracted and
+    # turned into holder-scoped option procs automatically. An optional block yields a Config
+    # for more complex setup.
+    def has_passkeys(**options, &block)
+      config = Config.new(**options)
+      block&.call(config)
+
+      has_many config.association_name,
+        as: :holder,
+        dependent: config.dependent,
+        class_name: "ActionPack::Passkey"
+
+      define_method(:passkey_creation_options) do
+        {
+          id: id,
+          exclude_credentials: public_send(config.association_name)
+        }.merge(config.evaluate_creation_options(self))
+      end
+
+      define_method(:passkey_request_options) do
+        { credentials: public_send(config.association_name) }.merge(config.evaluate_request_options(self))
+      end
+    end
+  end
+
+  # Configuration object yielded by +has_passkeys+ when a block is given. Allows setting
+  # custom association options and ceremony option blocks.
+  class Config
+    attr_accessor :association_name, :dependent
+
+    def initialize(**options)
+      @association_name = options.delete(:association_name) || :passkeys
+      @dependent = options.delete(:dependent) || :destroy
+
+      if creation_opts = extract_options_for(ActionPack::WebAuthn::PublicKeyCredential::CreationOptions, options)
+        @creation_options = options_to_proc(creation_opts)
+      end
+
+      if request_opts = extract_options_for(ActionPack::WebAuthn::PublicKeyCredential::RequestOptions, options)
+        @request_options = options_to_proc(request_opts)
+      end
+    end
+
+    # Sets a block to evaluate in the holder's context to produce additional request options.
+    #
+    #   config.request_options { { user_verification: "required" } }
+    def request_options(&block)
+      @request_options = block
+    end
+
+    # Sets a block to evaluate in the holder's context to produce additional creation options.
+    #
+    #   config.creation_options { { name: email, display_name: name } }
+    def creation_options(&block)
+      @creation_options = block
+    end
+
+    # Evaluates the request options block (if any) in the context of the given +record+. Called
+    # internally by the +passkey_request_options+ method defined on the holder.
+    def evaluate_request_options(record)
+      if @request_options
+        record.instance_exec(&@request_options)
+      else
+        {}
+      end
+    end
+
+    # Evaluates the creation options block (if any) in the context of the given +record+. Called
+    # internally by the +passkey_creation_options+ method defined on the holder.
+    def evaluate_creation_options(record)
+      if @creation_options
+        record.instance_exec(&@creation_options)
+      else
+        {}
+      end
+    end
+
+    private
+      def extract_options_for(klass, options)
+        keys = klass.attribute_names.map(&:to_sym)
+
+        extracted = options.slice(*keys)
+        options.except!(*keys)
+        extracted if extracted.any?
+      end
+
+      def options_to_proc(options)
+        proc do
+          options.transform_values do |value|
+            case value
+            when Symbol then send(value)
+            when Proc then instance_exec(&value)
+            else value
+            end
+          end
+        end
+      end
+  end
+end
diff --git a/lib/action_pack/passkey/request.rb b/lib/action_pack/passkey/request.rb
new file mode 100644
index 000000000..6e7832517
--- /dev/null
+++ b/lib/action_pack/passkey/request.rb
@@ -0,0 +1,81 @@
+# = Action Pack Passkey Request
+#
+# Controller concern that sets up the WebAuthn request context and provides
+# helper methods for passkey registration and authentication. Include this
+# in any controller that handles passkey form submissions.
+#
+# == Registration example
+#
+#   class PasskeysController < ApplicationController
+#     include ActionPack::Passkey::Request
+#
+#     def new
+#       @creation_options = passkey_creation_options(holder: Current.user)
+#     end
+#
+#     def create
+#       @passkey = ActionPack::Passkey.register(
+#         passkey_creation_params, holder: Current.user
+#       )
+#       redirect_to settings_path
+#     end
+#   end
+#
+# == Authentication example
+#
+#   class SessionsController < ApplicationController
+#     include ActionPack::Passkey::Request
+#
+#     def new
+#       @request_options = passkey_request_options
+#     end
+#
+#     def create
+#       if passkey = ActionPack::Passkey.authenticate(passkey_request_params)
+#         sign_in passkey.holder
+#         redirect_to root_path
+#       else
+#         redirect_to new_session_path, alert: "Authentication failed"
+#       end
+#     end
+#   end
+#
+# == Before Action
+#
+# Automatically populates +ActionPack::WebAuthn::Current+ with the request
+# host, origin, and challenge (read from the encrypted cookie set by
+# ChallengesController). The cookie is deleted after being read to prevent
+# replay.
+#
+module ActionPack::Passkey::Request
+  extend ActiveSupport::Concern
+
+  included do
+    before_action do
+      ActionPack::WebAuthn::Current.host = request.host
+      ActionPack::WebAuthn::Current.origin = request.base_url
+      ActionPack::WebAuthn::Current.challenge = cookies.encrypted[ActionPack::Passkey::ChallengesController::COOKIE_NAME]
+      cookies.delete(ActionPack::Passkey::ChallengesController::COOKIE_NAME)
+    end
+  end
+
+  # Returns strong parameters for the passkey registration ceremony.
+  def passkey_creation_params(param: :passkey)
+    params.expect(param => [ :client_data_json, :attestation_object, transports: [] ])
+  end
+
+  # Returns strong parameters for the passkey authentication ceremony.
+  def passkey_request_params(param: :passkey)
+    params.expect(param => [ :id, :client_data_json, :authenticator_data, :signature ])
+  end
+
+  # Returns RequestOptions for the authentication ceremony.
+  def passkey_request_options(**options)
+    ActionPack::Passkey.request_options(**options)
+  end
+
+  # Returns CreationOptions for the registration ceremony.
+  def passkey_creation_options(**options)
+    ActionPack::Passkey.creation_options(**options)
+  end
+end
diff --git a/lib/action_pack/railtie.rb b/lib/action_pack/railtie.rb
new file mode 100644
index 000000000..25511cc37
--- /dev/null
+++ b/lib/action_pack/railtie.rb
@@ -0,0 +1,70 @@
+require_relative "web_authn"
+
+# = Action Pack Railtie
+#
+# Integrates the WebAuthn and Passkey subsystems into the Rails application.
+# Configures default options for WebAuthn ceremonies and sets up the passkey
+# challenge endpoint route.
+#
+# == Configuration
+#
+#   # config/application.rb or config/initializers/passkeys.rb
+#   config.action_pack.web_authn.default_creation_options = { attestation: :none }
+#   config.action_pack.web_authn.default_request_options  = { user_verification: :required }
+#   config.action_pack.web_authn.creation_challenge_expiration = 10.minutes
+#   config.action_pack.web_authn.request_challenge_expiration = 5.minutes
+#
+#   config.action_pack.passkey.routes_prefix = "/rails/action_pack/passkey"
+#   config.action_pack.passkey.draw_routes   = true
+#
+class ActionPack::Railtie < Rails::Railtie
+  config.action_pack = ActiveSupport::OrderedOptions.new unless config.respond_to?(:action_pack)
+
+  config.action_pack.web_authn = ActiveSupport::OrderedOptions.new
+  config.action_pack.web_authn.default_request_options = {}
+  config.action_pack.web_authn.default_creation_options = {}
+  config.action_pack.web_authn.creation_challenge_expiration = 10.minutes
+  config.action_pack.web_authn.request_challenge_expiration = 5.minutes
+
+  config.action_pack.passkey = ActiveSupport::OrderedOptions.new
+  config.action_pack.passkey.parent_class_name = "ApplicationRecord"
+  config.action_pack.passkey.routes_prefix = "/rails/action_pack/passkey"
+  config.action_pack.passkey.draw_routes = true
+  config.action_pack.passkey.challenge_url = nil
+
+  initializer "action_pack.passkey.routes" do |app|
+    passkey_config = config.action_pack.passkey
+
+    app.routes.prepend do
+      if passkey_config.draw_routes
+        scope passkey_config.routes_prefix, as: :passkey do
+          post "/challenge" => "action_pack/passkey/challenges#create", as: :challenge
+        end
+      end
+    end
+  end
+
+  initializer "action_pack.passkey.holder" do
+    ActiveSupport.on_load(:active_record) do
+      # We need this shim because Holder is namespaced under Passkey, which is an ActiveRecort
+      # and can't be required before ActiveRecord is loaded.
+      def self.has_passkeys(**options, &block)
+        include ActionPack::Passkey::Holder
+        has_passkeys(**options, &block)
+      end
+    end
+  end
+
+  initializer "action_pack.passkey.form_helper" do
+    ActiveSupport.on_load(:action_view) do
+      require_relative "passkey/form_helper"
+      include ActionPack::Passkey::FormHelper
+    end
+  end
+
+  initializer "action_pack.passkey.request" do
+    ActiveSupport.on_load(:action_controller) do
+      require_relative "passkey/request"
+    end
+  end
+end
diff --git a/lib/action_pack/web_authn.rb b/lib/action_pack/web_authn.rb
index f80c13321..648a1ea72 100644
--- a/lib/action_pack/web_authn.rb
+++ b/lib/action_pack/web_authn.rb
@@ -1,15 +1,62 @@
+# = Action Pack WebAuthn
+#
+# Provides a pure-Ruby implementation of the WebAuthn (Web Authentication)
+# specification for passkey registration and authentication. This module
+# is the top-level namespace for all WebAuthn components and provides
+# shared utilities used across ceremonies.
+#
+# == Components
+#
+# [ActionPack::WebAuthn::RelyingParty]
+#   Identifies your application to authenticators.
+#
+# [ActionPack::WebAuthn::PublicKeyCredential]
+#   Orchestrates registration and authentication ceremonies.
+#
+# [ActionPack::WebAuthn::Authenticator]
+#   Parses and validates authenticator responses.
+#
+# [ActionPack::WebAuthn::CborDecoder]
+#   Decodes CBOR-encoded data from authenticators.
+#
+# [ActionPack::WebAuthn::CoseKey]
+#   Parses COSE public keys into OpenSSL key objects.
+#
+# == Extending Attestation Formats
+#
+# By default only the "none" attestation format is supported. Register
+# additional verifiers with:
+#
+#   ActionPack::WebAuthn.register_attestation_verifier("packed", MyPackedVerifier.new)
+#
 module ActionPack::WebAuthn
+  class InvalidResponseError < StandardError; end
+  class InvalidCborError < StandardError; end
+  class InvalidKeyError < StandardError; end
+  class UnsupportedKeyTypeError < StandardError; end
+  class InvalidOptionsError < StandardError; end
+
   class << self
+    # Returns a new RelyingParty configured from the current request context.
     def relying_party
       RelyingParty.new
     end
 
+    # Returns the MessageVerifier used to sign and verify WebAuthn challenges.
+    def challenge_verifier
+      Rails.application.message_verifier("action_pack.webauthn.challenge")
+    end
+
+    # Returns the registry of attestation format verifiers, keyed by format
+    # string (e.g., "none", "packed"). Only "none" is registered by default.
     def attestation_verifiers
       @attestation_verifiers ||= {
         "none" => Authenticator::AttestationVerifiers::None.new
       }
     end
 
+    # Registers a custom attestation verifier for the given +format+.
+    # The +verifier+ must respond to +verify!(attestation, client_data_json:)+.
     def register_attestation_verifier(format, verifier)
       attestation_verifiers[format.to_s] = verifier
     end
diff --git a/lib/action_pack/web_authn/authenticator/assertion_response.rb b/lib/action_pack/web_authn/authenticator/assertion_response.rb
index fa6aafcfd..6d4f07cd0 100644
--- a/lib/action_pack/web_authn/authenticator/assertion_response.rb
+++ b/lib/action_pack/web_authn/authenticator/assertion_response.rb
@@ -9,21 +9,20 @@
 #
 #   # Look up the credential by ID
 #   credential = user.credentials.find_by!(
-#     credentail_id: params[:id]
+#     credential_id: params[:id]
 #   )
 #
 #   response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
 #     client_data_json: params[:response][:clientDataJSON],
 #     authenticator_data: params[:response][:authenticatorData],
 #     signature: params[:response][:signature],
-#     credential: credential.to_public_key_credential
-#   )
-#
-#   response.validate!(
-#     challenge: session[:authentication_challenge],
+#     credential: credential.to_public_key_credential,
+#     challenge: ActionPack::WebAuthn::Current.challenge,
 #     origin: "https://example.com"
 #   )
 #
+#   response.validate!
+#
 # == Validation
 #
 # In addition to the base Response validations, this class verifies:
@@ -34,37 +33,43 @@
 class ActionPack::WebAuthn::Authenticator::AssertionResponse < ActionPack::WebAuthn::Authenticator::Response
   attr_reader :credential, :authenticator_data, :signature
 
+  validate :client_data_type_must_be_get
+  validate :signature_must_be_valid
+  validate :sign_count_must_increase
+
   def initialize(credential:, authenticator_data:, signature:, **attributes)
     super(**attributes)
     @credential = credential
     @signature = signature
+    @signature = Base64.urlsafe_decode64(@signature) unless @signature.encoding == Encoding::BINARY
     @authenticator_data = ActionPack::WebAuthn::Authenticator::Data.wrap(authenticator_data)
-  end
-
-  def validate!(**args)
-    super(**args)
-
-    unless client_data["type"] == "webauthn.get"
-      raise InvalidResponseError, "Client data type is not webauthn.get"
-    end
-
-    unless valid_signature?
-      raise InvalidResponseError, "Invalid signature"
-    end
-
-    unless sign_count_increased?
-      raise InvalidResponseError, "Sign count did not increase"
-    end
+  rescue ArgumentError
+    raise ActionPack::WebAuthn::InvalidResponseError, "Invalid base64 encoding in signature"
   end
 
   private
-    def valid_signature?
+    def client_data_type_must_be_get
+      unless client_data["type"] == "webauthn.get"
+        errors.add(:base, "Client data type is not webauthn.get")
+      end
+    end
+
+    def signature_must_be_valid
       client_data_hash = Digest::SHA256.digest(client_data_json)
       signed_data = authenticator_data.bytes.pack("C*") + client_data_hash
+      digest = credential.public_key.oid == "ED25519" ? nil : "SHA256"
 
-      credential.public_key.verify("SHA256", signature, signed_data)
+      unless credential.public_key.verify(digest, signature, signed_data)
+        errors.add(:base, "Invalid signature")
+      end
     rescue OpenSSL::PKey::PKeyError
-      false
+      errors.add(:base, "Invalid signature")
+    end
+
+    def sign_count_must_increase
+      unless sign_count_increased?
+        errors.add(:base, "Sign count did not increase")
+      end
     end
 
     def sign_count_increased?
diff --git a/lib/action_pack/web_authn/authenticator/attestation.rb b/lib/action_pack/web_authn/authenticator/attestation.rb
index beacf0fac..1d9141160 100644
--- a/lib/action_pack/web_authn/authenticator/attestation.rb
+++ b/lib/action_pack/web_authn/authenticator/attestation.rb
@@ -40,6 +40,21 @@ class ActionPack::WebAuthn::Authenticator::Attestation
 
   delegate :credential_id, :public_key, :public_key_bytes, :sign_count, :aaguid, :backed_up?, to: :authenticator_data
 
+  # Wraps raw attestation data into an Attestation instance. Accepts an
+  # existing Attestation object (returned as-is), a Base64URL-encoded string,
+  # or raw binary.
+  def self.wrap(data)
+    if data.is_a?(self)
+      data
+    else
+      data = Base64.urlsafe_decode64(data) unless data.encoding == Encoding::BINARY
+      decode(data)
+    end
+  rescue ArgumentError
+    raise ActionPack::WebAuthn::InvalidResponseError, "Invalid base64 encoding in attestation object"
+  end
+
+  # Decodes a CBOR-encoded attestation object into an Attestation instance.
   def self.decode(bytes)
     cbor = ActionPack::WebAuthn::CborDecoder.decode(bytes)
 
diff --git a/lib/action_pack/web_authn/authenticator/attestation_response.rb b/lib/action_pack/web_authn/authenticator/attestation_response.rb
index d27cc499b..58fdecacd 100644
--- a/lib/action_pack/web_authn/authenticator/attestation_response.rb
+++ b/lib/action_pack/web_authn/authenticator/attestation_response.rb
@@ -8,14 +8,13 @@
 #
 #   response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
 #     client_data_json: params[:response][:clientDataJSON],
-#     attestation_object: params[:response][:attestationObject]
-#   )
-#
-#   response.validate!(
-#     challenge: session[:registration_challenge],
+#     attestation_object: params[:response][:attestationObject],
+#     challenge: ActionPack::WebAuthn::Current.challenge,
 #     origin: "https://example.com"
 #   )
 #
+#   response.validate!
+#
 #   # Store the credential
 #   credential_id = response.attestation.credential_id
 #   public_key = response.attestation.public_key
@@ -31,32 +30,39 @@
 class ActionPack::WebAuthn::Authenticator::AttestationResponse < ActionPack::WebAuthn::Authenticator::Response
   attr_reader :attestation_object
 
+  validate :client_data_type_must_be_create
+  validate :attestation_must_be_valid
+
   def initialize(attestation_object:, **attributes)
     super(**attributes)
     @attestation_object = attestation_object
   end
 
-  def validate!(**args)
-    super(**args)
-
-    unless client_data["type"] == "webauthn.create"
-      raise InvalidResponseError, "Client data type is not webauthn.create"
-    end
-
-    verifier = ActionPack::WebAuthn.attestation_verifiers[attestation.format]
-
-    unless verifier
-      raise InvalidResponseError, "Unsupported attestation format: #{attestation.format}"
-    end
-
-    verifier.verify!(attestation, client_data_json: client_data_json)
-  end
-
+  # Returns the decoded Attestation object, lazily parsed from the raw
+  # attestation object bytes.
   def attestation
-    @attestation ||= ActionPack::WebAuthn::Authenticator::Attestation.decode(attestation_object)
+    @attestation ||= ActionPack::WebAuthn::Authenticator::Attestation.wrap(attestation_object)
   end
 
+  # Returns the authenticator data extracted from the attestation object.
   def authenticator_data
     attestation.authenticator_data
   end
+
+  private
+    def client_data_type_must_be_create
+      unless client_data["type"] == "webauthn.create"
+        errors.add(:base, "Client data type is not webauthn.create")
+      end
+    end
+
+    def attestation_must_be_valid
+      verifier = ActionPack::WebAuthn.attestation_verifiers[attestation.format]
+
+      if verifier
+        verifier.verify!(attestation, client_data_json: client_data_json)
+      else
+        errors.add(:base, "Unsupported attestation format: #{attestation.format}")
+      end
+    end
 end
diff --git a/lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb b/lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb
index ebb039054..f160b2e3f 100644
--- a/lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb
+++ b/lib/action_pack/web_authn/authenticator/attestation_verifiers/none.rb
@@ -17,7 +17,7 @@
 class ActionPack::WebAuthn::Authenticator::AttestationVerifiers::None
   def verify!(attestation, client_data_json:)
     if attestation.attestation_statement.present?
-      raise ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError,
+      raise ActionPack::WebAuthn::InvalidResponseError,
         "Attestation statement must be empty for 'none' format"
     end
   end
diff --git a/lib/action_pack/web_authn/authenticator/data.rb b/lib/action_pack/web_authn/authenticator/data.rb
index 5d4e0f224..2bc232386 100644
--- a/lib/action_pack/web_authn/authenticator/data.rb
+++ b/lib/action_pack/web_authn/authenticator/data.rb
@@ -60,16 +60,29 @@ class ActionPack::WebAuthn::Authenticator::Data
   attr_reader :bytes, :relying_party_id_hash, :flags, :sign_count, :aaguid, :credential_id, :public_key_bytes
 
   class << self
+    # Wraps raw authenticator data into a Data instance. Accepts an existing
+    # Data object (returned as-is), a Base64URL-encoded string, or raw binary.
     def wrap(data)
       if data.is_a?(self)
         data
       else
+        data = Base64.urlsafe_decode64(data) unless data.encoding == Encoding::BINARY
         decode(data)
       end
+    rescue ArgumentError
+      raise ActionPack::WebAuthn::InvalidResponseError, "Invalid base64 encoding in authenticator data"
     end
 
+    # Decodes raw authenticator data bytes into a Data instance, parsing the
+    # RP ID hash, flags, sign count, and (if present) attested credential data.
     def decode(bytes)
       bytes = bytes.bytes if bytes.is_a?(String)
+
+      minimum_length = RELYING_PARTY_ID_HASH_LENGTH + FLAGS_LENGTH + SIGN_COUNT_LENGTH
+      if bytes.length < minimum_length
+        raise ActionPack::WebAuthn::InvalidResponseError, "Authenticator data is too short"
+      end
+
       position = 0
 
       relying_party_id_hash = bytes[position, RELYING_PARTY_ID_HASH_LENGTH].pack("C*")
@@ -86,6 +99,10 @@ class ActionPack::WebAuthn::Authenticator::Data
       public_key_bytes = nil
 
       if flags & ATTESTED_CREDENTIAL_DATA_FLAG != 0
+        if bytes.length < position + AAGUID_LENGTH + CREDENTIAL_ID_LENGTH_BYTES
+          raise ActionPack::WebAuthn::InvalidResponseError, "Authenticator data is too short for attested credential data"
+        end
+
         aaguid_bytes = bytes[position, AAGUID_LENGTH].pack("C*")
         aaguid = aaguid_bytes.unpack("H8H4H4H4H12").join("-")
         position += AAGUID_LENGTH
@@ -93,6 +110,10 @@ class ActionPack::WebAuthn::Authenticator::Data
         credential_id_length = bytes[position, CREDENTIAL_ID_LENGTH_BYTES].pack("C*").unpack1("n")
         position += CREDENTIAL_ID_LENGTH_BYTES
 
+        if bytes.length < position + credential_id_length + 1
+          raise ActionPack::WebAuthn::InvalidResponseError, "Authenticator data is too short for credential ID and public key"
+        end
+
         credential_id = Base64.urlsafe_encode64(bytes[position, credential_id_length].pack("C*"), padding: false)
         position += credential_id_length
 
@@ -121,10 +142,13 @@ class ActionPack::WebAuthn::Authenticator::Data
     @public_key_bytes = public_key_bytes
   end
 
+  # Returns true if the user performed a test of presence (e.g., touched the
+  # authenticator).
   def user_present?
     flags & USER_PRESENT_FLAG != 0
   end
 
+  # Returns true if the user was verified via biometrics, PIN, or similar.
   def user_verified?
     flags & USER_VERIFIED_FLAG != 0
   end
@@ -141,6 +165,9 @@ class ActionPack::WebAuthn::Authenticator::Data
     flags & BACKUP_STATE_FLAG != 0
   end
 
+  # Decodes the COSE public key bytes into an OpenSSL key object.
+  # Returns +nil+ when no attested credential data is present (authentication
+  # responses).
   def public_key
     @public_key ||= ActionPack::WebAuthn::CoseKey.decode(public_key_bytes).to_openssl_key if public_key_bytes
   end
diff --git a/lib/action_pack/web_authn/authenticator/response.rb b/lib/action_pack/web_authn/authenticator/response.rb
index cdedc8411..af878405b 100644
--- a/lib/action_pack/web_authn/authenticator/response.rb
+++ b/lib/action_pack/web_authn/authenticator/response.rb
@@ -18,65 +18,57 @@
 #
 # == Example
 #
-#   response.validate!(
-#     challenge: session[:webauthn_challenge],
+#   response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
+#     client_data_json: client_data_json,
+#     authenticator_data: authenticator_data,
+#     signature: signature,
+#     credential: credential,
+#     challenge: ActionPack::WebAuthn::Current.challenge,
 #     origin: "https://example.com",
 #     user_verification: :required
 #   )
 #
+#   response.validate!
+#
 class ActionPack::WebAuthn::Authenticator::Response
-  # Raised when response validation fails.
-  class InvalidResponseError < StandardError; end
+  include ActiveModel::Validations
 
   attr_reader :client_data_json
+  attr_accessor :challenge, :origin, :user_verification
 
-  def initialize(client_data_json:)
+  validate :challenge_must_match
+  validate :challenge_must_not_be_expired
+  validate :origin_must_match
+  validate :must_not_be_cross_origin
+  validate :must_not_have_token_binding
+  validate :relying_party_id_must_match
+  validate :user_must_be_present
+  validate :user_must_be_verified_when_required
+
+  def initialize(client_data_json:, challenge: nil, origin: nil, user_verification: :preferred)
     @client_data_json = client_data_json
+    @challenge = challenge
+    @origin = origin
+    @user_verification = user_verification.to_sym
   end
 
-  def valid?(**args)
-    validate!(**args)
-    true
-  rescue InvalidResponseError
-    false
-  end
-
-  def validate!(challenge:, origin:, user_verification: :preferred)
-    unless challenge_matches?(challenge)
-      raise InvalidResponseError, "Challenge does not match"
-    end
-
-    unless origin_matches?(origin)
-      raise InvalidResponseError, "Origin does not match"
-    end
-
-    if cross_origin?
-      raise InvalidResponseError, "Cross-origin requests are not supported"
-    end
-
-    if token_binding_present?
-      raise InvalidResponseError, "Token binding is not supported"
-    end
-
-    unless relying_party_id_matches?
-      raise InvalidResponseError, "Relying party ID does not match"
-    end
-
-    unless user_present?
-      raise InvalidResponseError, "User presence is required"
-    end
-
-    if user_verification == :required && !user_verified?
-      raise InvalidResponseError, "User verification is required"
-    end
+  def validate!
+    super
+  rescue ActiveModel::ValidationError
+    raise ActionPack::WebAuthn::InvalidResponseError, errors.full_messages.join(", ")
   end
 
+  # Returns the RelyingParty used for RP ID validation.
   def relying_party
     ActionPack::WebAuthn.relying_party
   end
 
+  # Parses the client data JSON string into a Hash. Raises
+  # +InvalidResponseError+ if the JSON is malformed.
   def client_data
     @client_data ||= JSON.parse(client_data_json)
+  rescue JSON::ParserError
+    raise ActionPack::WebAuthn::InvalidResponseError, "Client data is not valid JSON"
   end
 
   def authenticator_data
@@ -84,34 +76,68 @@ class ActionPack::WebAuthn::Authenticator::Response
   end
 
   private
-    def challenge_matches?(expected_challenge)
-      ActiveSupport::SecurityUtils.secure_compare(expected_challenge, client_data["challenge"])
+    def challenge_must_match
+      if challenge.blank?
+        errors.add(:base, "Challenge missing")
+      elsif client_data["challenge"].blank?
+        errors.add(:base, "Challenge missing in client data")
+      elsif !ActiveSupport::SecurityUtils.secure_compare(challenge.to_s, client_data["challenge"].to_s)
+        errors.add(:base, "Challenge does not match")
+      end
     end
 
-    def origin_matches?(expected_origin)
-      ActiveSupport::SecurityUtils.secure_compare(expected_origin, client_data["origin"])
+    def challenge_must_not_be_expired
+      return if errors.any? || challenge.blank?
+
+      signed_message = Base64.urlsafe_decode64(challenge)
+
+      unless ActionPack::WebAuthn.challenge_verifier.verified(signed_message)
+        errors.add(:base, "Challenge has expired")
+      end
+    rescue ArgumentError
+      errors.add(:base, "Challenge is invalid")
     end
 
-    def relying_party_id_matches?
-      ActiveSupport::SecurityUtils.secure_compare(
+    def origin_must_match
+      if origin.blank?
+        errors.add(:base, "Origin missing")
+      elsif client_data["origin"].blank?
+        errors.add(:base, "Origin missing in client data")
+      elsif !ActiveSupport::SecurityUtils.secure_compare(origin.to_s, client_data["origin"].to_s)
+        errors.add(:base, "Origin does not match")
+      end
+    end
+
+    def must_not_be_cross_origin
+      if client_data["crossOrigin"] == true
+        errors.add(:base, "Cross-origin requests are not supported")
+      end
+    end
+
+    def must_not_have_token_binding
+      if client_data.dig("tokenBinding", "status") == "present"
+        errors.add(:base, "Token binding is not supported")
+      end
+    end
+
+    def relying_party_id_must_match
+      unless ActiveSupport::SecurityUtils.secure_compare(
         Digest::SHA256.digest(relying_party.id),
         authenticator_data&.relying_party_id_hash || ""
       )
+        errors.add(:base, "Relying party ID does not match")
+      end
     end
 
-    def cross_origin?
-      client_data["crossOrigin"] == true
+    def user_must_be_present
+      unless authenticator_data&.user_present?
+        errors.add(:base, "User presence is required")
+      end
     end
 
-    def token_binding_present?
-      client_data.dig("tokenBinding", "status") == "present"
-    end
-
-    def user_present?
-      authenticator_data&.user_present?
-    end
-
-    def user_verified?
-      authenticator_data&.user_verified?
+    def user_must_be_verified_when_required
+      if user_verification == :required && !authenticator_data&.user_verified?
+        errors.add(:base, "User verification is required")
+      end
     end
 end
diff --git a/lib/action_pack/web_authn/cbor_decoder.rb b/lib/action_pack/web_authn/cbor_decoder.rb
index af8e284f7..6daeb4ac6 100644
--- a/lib/action_pack/web_authn/cbor_decoder.rb
+++ b/lib/action_pack/web_authn/cbor_decoder.rb
@@ -49,11 +49,8 @@
 #
 # == Errors
 #
-# Raises +DecodeError+ when encountering malformed or unsupported CBOR data.
+# Raises +InvalidCborError+ when encountering malformed or unsupported CBOR data.
 class ActionPack::WebAuthn::CborDecoder
-  # Raised when the decoder encounters invalid or unsupported CBOR data.
-  class DecodeError < StandardError; end
-
   # Major types
   UNSIGNED_INTEGER_TYPE = 0
   NEGATIVE_INTEGER_TYPE = 1
@@ -86,6 +83,10 @@ class ActionPack::WebAuthn::CborDecoder
   MAX_DEPTH = 16
   MAX_SIZE = 10.megabytes
 
+  # Tags
+  POSITIVE_BIGNUM_TAG = 2
+  NEGATIVE_BIGNUM_TAG = 3
+
   class << self
     # Decodes a CBOR-encoded byte sequence into a Ruby object.
     #
@@ -98,7 +99,7 @@ class ActionPack::WebAuthn::CborDecoder
   end
 
   def initialize(bytes, max_depth: MAX_DEPTH, max_size: MAX_SIZE) # :nodoc:
-    raise DecodeError, "Input exceeds maximum size" if bytes.length > max_size
+    raise ActionPack::WebAuthn::InvalidCborError, "Input exceeds maximum size" if bytes.length > max_size
 
     @bytes = bytes
     @max_depth = max_depth
@@ -108,8 +109,8 @@ class ActionPack::WebAuthn::CborDecoder
 
   # Decodes the next CBOR data item from the byte sequence.
   def decode
-    raise DecodeError, "Unexpected end of input" if @position >= @bytes.length
-    raise DecodeError, "Maximum nesting depth exceeded" if @depth > @max_depth
+    raise ActionPack::WebAuthn::InvalidCborError, "Unexpected end of input" if @position >= @bytes.length
+    raise ActionPack::WebAuthn::InvalidCborError, "Maximum nesting depth exceeded" if @depth >= @max_depth
 
     @depth += 1
 
@@ -190,13 +191,19 @@ class ActionPack::WebAuthn::CborDecoder
       when FOUR_BYTE_VALUE_FOLLOWS then read_bytes(4).pack("C*").unpack1("g")
       when EIGHT_BYTE_VALUE_FOLLOWS then read_bytes(8).pack("C*").unpack1("G")
       else
-        raise DecodeError, "Invalid simple value: #{info}"
+        raise ActionPack::WebAuthn::InvalidCborError, "Invalid simple value: #{info}"
       end
     end
 
     def decode_tag
-      read_argument
-      decode
+      tag = read_argument
+      value = decode
+
+      case tag
+      when POSITIVE_BIGNUM_TAG then value.bytes.inject(0) { |n, b| (n << 8) | b }
+      when NEGATIVE_BIGNUM_TAG then -1 - value.bytes.inject(0) { |n, b| (n << 8) | b }
+      else value
+      end
     end
 
     def decode_half_float
@@ -225,9 +232,9 @@ class ActionPack::WebAuthn::CborDecoder
       when FOUR_BYTE_VALUE_FOLLOWS then read_bytes(4).pack("C*").unpack1("N")
       when EIGHT_BYTE_VALUE_FOLLOWS then read_bytes(8).pack("C*").unpack1("Q>")
       when RESERVED_VALUE_RANGE
-        raise DecodeError, "Reserved additional info: #{info}"
+        raise ActionPack::WebAuthn::InvalidCborError, "Reserved additional info: #{info}"
       else
-        raise DecodeError, "Invalid additional info: #{info}"
+        raise ActionPack::WebAuthn::InvalidCborError, "Invalid additional info: #{info}"
       end
     end
 
@@ -245,7 +252,7 @@ class ActionPack::WebAuthn::CborDecoder
     end
 
     def read_bytes(length)
-      raise DecodeError, "Unexpected end of input" if @position + length > @bytes.length
+      raise ActionPack::WebAuthn::InvalidCborError, "Unexpected end of input" if @position + length > @bytes.length
 
       bytes = @bytes[@position, length]
       @position += length
@@ -253,7 +260,7 @@ class ActionPack::WebAuthn::CborDecoder
     end
 
     def read_byte
-      raise DecodeError, "Unexpected end of input" if @position >= @bytes.length
+      raise ActionPack::WebAuthn::InvalidCborError, "Unexpected end of input" if @position >= @bytes.length
 
       byte = @bytes[@position]
       @position += 1
diff --git a/lib/action_pack/web_authn/cose_key.rb b/lib/action_pack/web_authn/cose_key.rb
index 53ef3037c..1b7437286 100644
--- a/lib/action_pack/web_authn/cose_key.rb
+++ b/lib/action_pack/web_authn/cose_key.rb
@@ -19,22 +19,25 @@
 # [ES256]
 #   ECDSA with P-256 curve and SHA-256. The most common algorithm for WebAuthn.
 #
+# [EdDSA]
+#   EdDSA with Ed25519 curve. Increasingly supported by modern authenticators.
+#
 # [RS256]
 #   RSASSA-PKCS1-v1_5 with SHA-256. Used by some security keys and platforms.
 #
 # == Attributes
 #
 # [+key_type+]
-#   The COSE key type (2 for EC2, 3 for RSA).
+#   The COSE key type (1 for OKP, 2 for EC2, 3 for RSA).
 #
 # [+algorithm+]
-#   The COSE algorithm identifier (-7 for ES256, -257 for RS256).
+#   The COSE algorithm identifier (-7 for ES256, -8 for EdDSA, -257 for RS256).
 #
 # [+parameters+]
 #   The full COSE key parameters map, including curve and coordinate data.
 class ActionPack::WebAuthn::CoseKey
-  # Raised when the key type, algorithm, or curve is not supported.
-  class UnsupportedKeyTypeError < StandardError; end
+  P256_COORDINATE_LENGTH = 32
+  MINIMUM_RSA_KEY_BITS = 2048
 
   # COSE key labels
   KEY_TYPE_LABEL = 1
@@ -44,18 +47,25 @@ class ActionPack::WebAuthn::CoseKey
   EC2_Y_LABEL = -3
   RSA_N_LABEL = -1
   RSA_E_LABEL = -2
+  OKP_CURVE_LABEL = -1
+  OKP_X_LABEL = -2
 
   # COSE key types
+  OKP = 1
   EC2 = 2
   RSA = 3
 
   # COSE algorithms
   ES256 = -7
+  EDDSA = -8
   RS256 = -257
 
   # COSE EC2 curves
   P256 = 1
 
+  # COSE OKP curves
+  ED25519 = 6
+
   # OpenSSL types
   UNCOMPRESSED_POINT_MARKER = 0x04
 
@@ -84,26 +94,30 @@ class ActionPack::WebAuthn::CoseKey
 
   # Converts the COSE key to an OpenSSL public key object.
   #
-  # Returns an +OpenSSL::PKey::EC+ for EC2 keys or +OpenSSL::PKey::RSA+ for
-  # RSA keys, suitable for use with +OpenSSL::PKey#verify+.
+  # Returns an +OpenSSL::PKey::EC+ for EC2 keys, +OpenSSL::PKey::RSA+ for
+  # RSA keys, or an Ed25519 key for OKP keys, suitable for use with
+  # +OpenSSL::PKey#verify+.
   #
   # Raises +UnsupportedKeyTypeError+ if the key type, algorithm, or curve
   # is not supported.
   def to_openssl_key
     case [ key_type, algorithm ]
     when [ EC2, ES256 ] then build_ec2_es256_key
+    when [ OKP, EDDSA ] then build_okp_eddsa_key
     when [ RSA, RS256 ] then build_rsa_rs256_key
-    else raise UnsupportedKeyTypeError, "Unsupported COSE key type/algorithm: #{key_type}/#{algorithm}"
+    else raise ActionPack::WebAuthn::UnsupportedKeyTypeError, "Unsupported COSE key type/algorithm: #{key_type}/#{algorithm}"
     end
   end
 
   private
     def build_ec2_es256_key
       curve = parameters[EC2_CURVE_LABEL]
-      raise UnsupportedKeyTypeError, "Unsupported EC curve: #{curve}" unless curve == P256
+      raise ActionPack::WebAuthn::UnsupportedKeyTypeError, "Unsupported EC curve: #{curve}" unless curve == P256
 
       x = parameters[EC2_X_LABEL]
       y = parameters[EC2_Y_LABEL]
+      raise ActionPack::WebAuthn::InvalidKeyError, "Missing EC2 key coordinates" if x.nil? || y.nil?
+      raise ActionPack::WebAuthn::InvalidKeyError, "Invalid EC2 coordinate length" unless x.bytesize == P256_COORDINATE_LENGTH && y.bytesize == P256_COORDINATE_LENGTH
 
       # Uncompressed point format: 0x04 || x || y
       public_key_bytes = [ UNCOMPRESSED_POINT_MARKER, *x.bytes, *y.bytes ].pack("C*")
@@ -117,11 +131,37 @@ class ActionPack::WebAuthn::CoseKey
       ])
 
       OpenSSL::PKey::EC.new(asn1.to_der)
+    rescue OpenSSL::PKey::PKeyError => error
+      raise ActionPack::WebAuthn::InvalidKeyError, "Invalid EC2 key: #{error.message}"
+    end
+
+    def build_okp_eddsa_key
+      curve = parameters[OKP_CURVE_LABEL]
+      raise ActionPack::WebAuthn::UnsupportedKeyTypeError, "Unsupported OKP curve: #{curve}" unless curve == ED25519
+
+      x = parameters[OKP_X_LABEL]
+      raise ActionPack::WebAuthn::InvalidKeyError, "Missing OKP key coordinate" if x.nil?
+
+      asn1 = OpenSSL::ASN1::Sequence([
+        OpenSSL::ASN1::Sequence([
+          OpenSSL::ASN1::ObjectId("ED25519")
+        ]),
+        OpenSSL::ASN1::BitString(x)
+      ])
+
+      OpenSSL::PKey.read(asn1.to_der)
+    rescue OpenSSL::PKey::PKeyError => error
+      raise ActionPack::WebAuthn::InvalidKeyError, "Invalid OKP key: #{error.message}"
     end
 
     def build_rsa_rs256_key
-      n = OpenSSL::BN.new(parameters[RSA_N_LABEL], 2)
-      e = OpenSSL::BN.new(parameters[RSA_E_LABEL], 2)
+      n_bytes = parameters[RSA_N_LABEL]
+      e_bytes = parameters[RSA_E_LABEL]
+      raise ActionPack::WebAuthn::InvalidKeyError, "Missing RSA key parameters" if n_bytes.nil? || e_bytes.nil?
+      raise ActionPack::WebAuthn::InvalidKeyError, "RSA key must be at least #{MINIMUM_RSA_KEY_BITS} bits" if n_bytes.bytesize * 8 < MINIMUM_RSA_KEY_BITS
+
+      n = OpenSSL::BN.new(n_bytes, 2)
+      e = OpenSSL::BN.new(e_bytes, 2)
 
       asn1 = OpenSSL::ASN1::Sequence([
         OpenSSL::ASN1::Sequence([
@@ -137,5 +177,7 @@ class ActionPack::WebAuthn::CoseKey
       ])
 
       OpenSSL::PKey::RSA.new(asn1.to_der)
+    rescue OpenSSL::PKey::PKeyError => error
+      raise ActionPack::WebAuthn::InvalidKeyError, "Invalid RSA key: #{error.message}"
     end
 end
diff --git a/lib/action_pack/web_authn/current.rb b/lib/action_pack/web_authn/current.rb
index 88183af54..7189a4dd5 100644
--- a/lib/action_pack/web_authn/current.rb
+++ b/lib/action_pack/web_authn/current.rb
@@ -1,3 +1,23 @@
+# = Action Pack WebAuthn Current Attributes
+#
+# Thread-isolated request-scoped attributes for WebAuthn ceremonies. These are
+# set automatically by ActionPack::Passkey::Request at the start of each
+# request and consumed by the registration/authentication flows.
+#
+# == Attributes
+#
+# [+host+]
+#   The relying party identifier (typically +request.host+). Used as the
+#   default RelyingParty ID.
+#
+# [+origin+]
+#   The expected origin (typically +request.base_url+). Validated against the
+#   +origin+ field in the authenticator's client data.
+#
+# [+challenge+]
+#   The Base64URL-encoded challenge read from the encrypted cookie. Validated
+#   against the +challenge+ field in the authenticator's client data.
+#
 class ActionPack::WebAuthn::Current < ActiveSupport::CurrentAttributes
-  attribute :host, :origin
+  attribute :host, :origin, :challenge
 end
diff --git a/lib/action_pack/web_authn/public_key_credential.rb b/lib/action_pack/web_authn/public_key_credential.rb
index 062efab77..647443ef5 100644
--- a/lib/action_pack/web_authn/public_key_credential.rb
+++ b/lib/action_pack/web_authn/public_key_credential.rb
@@ -1,14 +1,94 @@
+# = Action Pack WebAuthn Public Key Credential
+#
+# Represents a WebAuthn public key credential and orchestrates the registration
+# and authentication ceremonies. During registration (+.register+), it verifies
+# the attestation response and returns a new credential. During authentication
+# (+#authenticate+), it verifies the assertion response against the stored
+# public key.
+#
+# == Registration
+#
+#   credential = ActionPack::WebAuthn::PublicKeyCredential.register(
+#     params[:passkey],
+#     challenge: ActionPack::WebAuthn::Current.challenge,
+#     origin: ActionPack::WebAuthn::Current.origin
+#   )
+#
+#   credential.id         # => Base64URL-encoded credential ID
+#   credential.public_key # => OpenSSL::PKey::EC
+#   credential.sign_count # => 0
+#
+# == Authentication
+#
+#   credential = ActionPack::WebAuthn::PublicKeyCredential.new(
+#     id: stored_credential_id,
+#     public_key: stored_public_key,
+#     sign_count: stored_sign_count
+#   )
+#
+#   credential.authenticate(params[:passkey])
+#
+# == Ceremony Options
+#
+# Use +.creation_options+ and +.request_options+ to generate the JSON options
+# passed to the browser's +navigator.credentials.create()+ and
+# +navigator.credentials.get()+ calls.
+#
+# == Attributes
+#
+# [+id+]
+#   The Base64URL-encoded credential identifier.
+#
+# [+public_key+]
+#   The OpenSSL public key for signature verification.
+#
+# [+sign_count+]
+#   The signature counter, used for replay detection.
+#
+# [+aaguid+]
+#   The authenticator attestation GUID (set during registration).
+#
+# [+backed_up+]
+#   Whether the credential is backed up to cloud storage (synced passkey).
+#
+# [+transports+]
+#   Transport hints (e.g., "internal", "usb", "ble", "nfc").
+#
 class ActionPack::WebAuthn::PublicKeyCredential
-  attr_reader :id, :public_key, :sign_count, :aaguid, :backed_up, :transports, :owner
+  attr_reader :id, :public_key, :sign_count, :aaguid, :backed_up, :transports
 
   class << self
-    def create(client_data_json:, attestation_object:, challenge:, origin:, transports: [], owner: nil)
+    # Returns a RequestOptions object for the authentication ceremony.
+    # Credentials responding to +to_public_key_credential+ are automatically
+    # transformed.
+    def request_options(**attributes)
+      attributes[:credentials] = transform_credentials(attributes[:credentials]) if attributes[:credentials]
+
+      ActionPack::WebAuthn::PublicKeyCredential::RequestOptions.new(**attributes)
+    end
+
+    # Returns a CreationOptions object for the registration ceremony.
+    # Credentials in +exclude_credentials+ responding to
+    # +to_public_key_credential+ are automatically transformed.
+    def creation_options(**attributes)
+      attributes[:exclude_credentials] = transform_credentials(attributes[:exclude_credentials]) if attributes[:exclude_credentials]
+
+      ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(**attributes)
+    end
+
+    # Verifies an attestation response from the browser and returns a new
+    # PublicKeyCredential with the registered credential data.
+    #
+    # Raises +InvalidResponseError+ if the attestation is invalid.
+    def register(params, challenge: ActionPack::WebAuthn::Current.challenge, origin: ActionPack::WebAuthn::Current.origin)
       response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
-        client_data_json: client_data_json,
-        attestation_object: attestation_object
+        client_data_json: params[:client_data_json],
+        attestation_object: params[:attestation_object],
+        challenge: challenge,
+        origin: origin
       )
 
-      response.validate!(challenge: challenge, origin: origin)
+      response.validate!
 
       new(
         id: response.attestation.credential_id,
@@ -16,33 +96,61 @@ class ActionPack::WebAuthn::PublicKeyCredential
         sign_count: response.attestation.sign_count,
         aaguid: response.attestation.aaguid,
         backed_up: response.attestation.backed_up?,
-        transports: transports,
-        owner: owner
+        transports: Array(params[:transports])
       )
     end
+
+    private
+      def transform_credentials(credentials)
+        Array(credentials).map do |credential|
+          if credential.respond_to?(:to_public_key_credential)
+            credential.to_public_key_credential
+          else
+            credential
+          end
+        end
+      end
   end
 
-  def initialize(id:, public_key:, sign_count:, aaguid: nil, backed_up: nil, transports: [], owner: nil)
+  def initialize(id:, public_key:, sign_count:, aaguid: nil, backed_up: nil, transports: [])
     @id = id
     @public_key = public_key
+    @public_key = OpenSSL::PKey.read(public_key) unless public_key.is_a?(OpenSSL::PKey::PKey)
     @sign_count = sign_count
     @aaguid = aaguid
     @backed_up = backed_up
     @transports = transports
-    @owner = owner
   end
 
-  def authenticate(client_data_json:, authenticator_data:, signature:, challenge:, origin:)
+  # Verifies an assertion response against this credential's public key.
+  # Updates +sign_count+ and +backed_up+ on success.
+  #
+  # Raises +InvalidResponseError+ if the assertion is invalid.
+  def authenticate(params, challenge: ActionPack::WebAuthn::Current.challenge, origin: ActionPack::WebAuthn::Current.origin)
     response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
-      client_data_json: client_data_json,
-      authenticator_data: authenticator_data,
-      signature: signature,
-      credential: self
+      client_data_json: params[:client_data_json],
+      authenticator_data: params[:authenticator_data],
+      signature: params[:signature],
+      credential: self,
+      challenge: challenge,
+      origin: origin
     )
 
-    response.validate!(challenge: challenge, origin: origin)
+    response.validate!
 
     @sign_count = response.authenticator_data.sign_count
     @backed_up = response.authenticator_data.backed_up?
   end
+
+  # Returns a Hash of the credential data suitable for persisting.
+  def to_h
+    {
+      credential_id: id,
+      public_key: public_key.to_der,
+      sign_count: sign_count,
+      aaguid: aaguid,
+      backed_up: backed_up,
+      transports: transports
+    }
+  end
 end
diff --git a/lib/action_pack/web_authn/public_key_credential/creation_options.rb b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
index e68d8eba4..0a5f97970 100644
--- a/lib/action_pack/web_authn/public_key_credential/creation_options.rb
+++ b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
@@ -36,51 +36,33 @@
 #
 # == Supported Algorithms
 #
-# By default, supports ES256 (ECDSA with P-256 and SHA-256) and RS256
-# (RSASSA-PKCS1-v1_5 with SHA-256), which cover the vast majority of
-# authenticators.
+# By default, supports ES256 (ECDSA with P-256 and SHA-256), EdDSA
+# (Ed25519), and RS256 (RSASSA-PKCS1-v1_5 with SHA-256), which cover
+# the vast majority of authenticators.
 class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::WebAuthn::PublicKeyCredential::Options
   ES256 = { type: "public-key", alg: -7 }.freeze
+  EDDSA = { type: "public-key", alg: -8 }.freeze
   RS256 = { type: "public-key", alg: -257 }.freeze
+  RESIDENT_KEY_OPTIONS = %i[ preferred required discouraged ].freeze
+  ATTESTATION_PREFERENCES = %i[ none indirect direct enterprise ].freeze
 
-  attr_reader :id, :name, :display_name
+  attribute :id
+  attribute :name
+  attribute :display_name
+  attribute :resident_key, default: :preferred
+  attribute :exclude_credentials, default: -> { [] }
+  attribute :attestation, default: :none
+  attribute :challenge_expiration, default: -> { Rails.configuration.action_pack.web_authn.creation_challenge_expiration }
 
-  # Creates a new set of credential creation options.
-  #
-  # ==== Options
-  #
-  # [+:id+]
-  #   Required. The user's unique identifier.
-  #
-  # [+:name+]
-  #   Required. The user's account name (e.g., email).
-  #
-  # [+:display_name+]
-  #   Required. The user's display name.
-  #
-  # [+:relying_party+]
-  #   Optional. The relying party configuration.
-  #
-  # [+:resident_key+]
-  #   Optional. Resident key requirement. One of +:preferred+, +:required+,
-  #   or +:discouraged+. Defaults to +:preferred+.
-  #
-  # [+:exclude_credentials+]
-  #   Optional. Existing credentials to exclude from registration. Each must
-  #   respond to +id+ and +transports+.
-  #
-  # [+:attestation+]
-  #   Optional. The attestation conveyance preference. One of +:none+,
-  #   +:indirect+, +:direct+, or +:enterprise+. Defaults to +:none+.
-  def initialize(id:, name:, display_name:, resident_key: :preferred, exclude_credentials: [], attestation: :none, **attrs)
-    super(**attrs)
+  validates :id, :name, :display_name, presence: true
+  validates :resident_key, inclusion: { in: RESIDENT_KEY_OPTIONS }
+  validates :attestation, inclusion: { in: ATTESTATION_PREFERENCES }
 
-    @id = id
-    @name = name
-    @display_name = display_name
-    @resident_key = resident_key
-    @exclude_credentials = exclude_credentials
-    @attestation = validate_attestation(attestation)
+  def initialize(attributes = {})
+    super
+    self.resident_key = resident_key.to_sym
+    self.attestation = attestation.to_sym
+    validate!
   end
 
   # Returns a Hash suitable for JSON serialization and passing to the
@@ -96,37 +78,28 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::W
       },
       pubKeyCredParams: [
         ES256,
+        EDDSA,
         RS256
       ],
       authenticatorSelection: {
-        residentKey: @resident_key.to_s,
-        requireResidentKey: @resident_key == :required,
+        residentKey: resident_key.to_s,
+        requireResidentKey: resident_key == :required,
         userVerification: user_verification.to_s
       }
     }
 
-    if @exclude_credentials.any?
-      json[:excludeCredentials] = @exclude_credentials.map { |credential| exclude_credential_json(credential) }
+    if exclude_credentials.any?
+      json[:excludeCredentials] = exclude_credentials.map { |credential| exclude_credential_json(credential) }
     end
 
-    if @attestation != :none
-      json[:attestation] = @attestation.to_s
+    if attestation != :none
+      json[:attestation] = attestation.to_s
     end
 
     json
   end
 
   private
-    ATTESTATION_PREFERENCES = %i[ none indirect direct enterprise ].freeze
-
-    def validate_attestation(value)
-      if ATTESTATION_PREFERENCES.include?(value)
-        value
-      else
-        raise ArgumentError, "Invalid attestation preference: #{value.inspect}. Must be one of: #{ATTESTATION_PREFERENCES.map(&:inspect).join(", ")}"
-      end
-    end
-
     def exclude_credential_json(credential)
       hash = { type: "public-key", id: credential.id }
       hash[:transports] = credential.transports if credential.transports.any?
diff --git a/lib/action_pack/web_authn/public_key_credential/options.rb b/lib/action_pack/web_authn/public_key_credential/options.rb
index 24c0fc29b..0d3d107a8 100644
--- a/lib/action_pack/web_authn/public_key_credential/options.rb
+++ b/lib/action_pack/web_authn/public_key_credential/options.rb
@@ -1,26 +1,77 @@
+# = Action Pack WebAuthn Public Key Credential Options
+#
+# Abstract base class for WebAuthn ceremony options. Provides shared
+# attributes and challenge generation for both CreationOptions (registration)
+# and RequestOptions (authentication).
+#
+# This class should not be instantiated directly. Use CreationOptions or
+# RequestOptions instead.
+#
+# == Challenge Generation
+#
+# Each options object generates a signed, expiring challenge via
+# +ActionPack::WebAuthn.challenge_verifier+. The challenge is Base64URL-encoded
+# and includes an embedded timestamp so the server can reject stale challenges.
+#
+# == Attributes
+#
+# [+user_verification+]
+#   Controls whether user verification (biometrics/PIN) is required. One of
+#   +:required+, +:preferred+, or +:discouraged+. Defaults to +:preferred+.
+#
+# [+relying_party+]
+#   The RelyingParty configuration. Defaults to +ActionPack::WebAuthn.relying_party+.
+#
+# [+challenge_expiration+]
+#   How long the challenge remains valid. Defaults vary by ceremony type
+#   (configured in the Railtie).
+#
 class ActionPack::WebAuthn::PublicKeyCredential::Options
+  include ActiveModel::API
+  include ActiveModel::Attributes
+
   CHALLENGE_LENGTH = 32
-  USER_VERIFICATION_OPTIONS = [ :required, :preferred, :discouraged ].freeze
+  USER_VERIFICATION_OPTIONS = %i[ required preferred discouraged ].freeze
 
-  attr_reader :user_verification, :relying_party
+  attribute :user_verification, default: :preferred
+  attribute :relying_party, default: -> { ActionPack::WebAuthn.relying_party }
+  attribute :challenge_expiration
 
-  def initialize(user_verification: :preferred, relying_party: ActionPack::WebAuthn.relying_party)
-    @user_verification = user_verification.to_sym
-    @relying_party = relying_party
+  validates :user_verification, inclusion: { in: USER_VERIFICATION_OPTIONS }
 
-    unless USER_VERIFICATION_OPTIONS.include?(user_verification)
-      raise ArgumentError, "Invalid user verification option: #{user_verification.inspect}"
-    end
+  def initialize(attributes = {})
+    super
+    self.user_verification = user_verification.to_sym
   end
 
-  # Returns a Base64URL-encoded random challenge. The challenge is generated
-  # once and memoized for the lifetime of this object.
+  # Validates the options, raising +InvalidOptionsError+ if any are invalid.
+  def validate!
+    super
+  rescue ActiveModel::ValidationError
+    raise ActionPack::WebAuthn::InvalidOptionsError, errors.full_messages.to_sentence
+  end
+
+  # Returns a human-readable representation of the options.
+  def inspect
+    attributes_string = attributes.map { |name, value| "#{name}: #{value.inspect}" }.join(", ")
+    "#<#{self.class.name} #{attributes_string}>"
+  end
+
+  # Returns a Base64URL-encoded signed challenge containing a random nonce and
+  # an embedded timestamp. The challenge is generated once and memoized for the
+  # lifetime of this object.
   #
-  # The challenge must be stored server-side and verified when the client
-  # responds, to prevent replay attacks.
+  # The timestamp allows the server to reject stale challenges. The expiration
+  # window is configurable per-ceremony via
+  # +config.action_pack.web_authn.creation_challenge_expiration+ and
+  # +config.action_pack.web_authn.request_challenge_expiration+, or per-instance
+  # via the +challenge_expiration+ attribute.
   def challenge
     @challenge ||= Base64.urlsafe_encode64(
-      SecureRandom.random_bytes(CHALLENGE_LENGTH),
+      ActionPack::WebAuthn.challenge_verifier.generate(
+        Base64.strict_encode64(SecureRandom.random_bytes(CHALLENGE_LENGTH)),
+        expires_in: challenge_expiration
+      ),
       padding: false
     )
   end
diff --git a/lib/action_pack/web_authn/public_key_credential/request_options.rb b/lib/action_pack/web_authn/public_key_credential/request_options.rb
index 0b62ad532..90a9006b4 100644
--- a/lib/action_pack/web_authn/public_key_credential/request_options.rb
+++ b/lib/action_pack/web_authn/public_key_credential/request_options.rb
@@ -24,21 +24,12 @@
 #   The relying party (your application) configuration. Defaults to
 #   +ActionPack::WebAuthn.relying_party+.
 class ActionPack::WebAuthn::PublicKeyCredential::RequestOptions < ActionPack::WebAuthn::PublicKeyCredential::Options
-  attr_reader :credentials
+  attribute :credentials, default: -> { [] }
+  attribute :challenge_expiration, default: -> { Rails.configuration.action_pack.web_authn.request_challenge_expiration }
 
-  # Creates a new set of credential request options.
-  #
-  # ==== Options
-  #
-  # [+:credentials+]
-  #   Required. The user's registered WebAuthn credentials.
-  #
-  # [+:relying_party+]
-  #   Optional. The relying party configuration.
-  def initialize(credentials:, **attrs)
-    super(**attrs)
-
-    @credentials = credentials
+  def initialize(attributes = {})
+    super
+    validate!
   end
 
   # Returns a Hash suitable for JSON serialization and passing to the
diff --git a/lib/rails_ext/action_pack_passkey_infer_name_from_aaguid.rb b/lib/rails_ext/action_pack_passkey_infer_name_from_aaguid.rb
new file mode 100644
index 000000000..a911c19f9
--- /dev/null
+++ b/lib/rails_ext/action_pack_passkey_infer_name_from_aaguid.rb
@@ -0,0 +1,15 @@
+module ActionPackPasskeyInferNameFromAaguid
+  extend ActiveSupport::Concern
+
+  class_methods do
+    def register(...)
+      super(...).tap do |credential|
+        credential.update!(name: credential.authenticator.name) if credential.authenticator && credential.name.blank?
+      end
+    end
+  end
+
+  def authenticator
+    Passkey::Authenticator.find_by_aaguid(aaguid)
+  end
+end
diff --git a/test/controllers/my/passkey_challenges_controller_test.rb b/test/controllers/my/passkey_challenges_controller_test.rb
new file mode 100644
index 000000000..80f64298c
--- /dev/null
+++ b/test/controllers/my/passkey_challenges_controller_test.rb
@@ -0,0 +1,33 @@
+require "test_helper"
+
+class My::PasskeyChallengesControllerTest < ActionDispatch::IntegrationTest
+  test "returns a fresh challenge" do
+    untenanted do
+      post my_passkey_challenge_url
+
+      assert_response :success
+      assert_not_nil response.parsed_body["challenge"]
+    end
+  end
+
+  test "stores challenge in cookie" do
+    untenanted do
+      post my_passkey_challenge_url
+
+      jar = ActionDispatch::Cookies::CookieJar.build(request, cookies.to_hash)
+      assert_equal response.parsed_body["challenge"], jar.encrypted[ActionPack::Passkey::ChallengesController::COOKIE_NAME]
+    end
+  end
+
+  test "returns a different challenge each time" do
+    untenanted do
+      post my_passkey_challenge_url
+      first_challenge = response.parsed_body["challenge"]
+
+      post my_passkey_challenge_url
+      second_challenge = response.parsed_body["challenge"]
+
+      assert_not_equal first_challenge, second_challenge
+    end
+  end
+end
diff --git a/test/controllers/my/passkeys_controller_test.rb b/test/controllers/my/passkeys_controller_test.rb
new file mode 100644
index 000000000..f6b343728
--- /dev/null
+++ b/test/controllers/my/passkeys_controller_test.rb
@@ -0,0 +1,26 @@
+require "test_helper"
+
+class My::PasskeysControllerTest < ActionDispatch::IntegrationTest
+  include WebauthnTestHelper
+
+  setup do
+    sign_in_as :kevin
+  end
+
+  test "index" do
+    get my_passkeys_path
+    assert_response :success
+  end
+
+  test "register a passkey" do
+    challenge = request_webauthn_challenge
+
+    assert_difference -> { identities(:kevin).passkeys.count }, 1 do
+      post my_passkeys_path, params: build_attestation_params(challenge: challenge)
+    end
+
+    passkey = identities(:kevin).passkeys.order(created_at: :desc).first
+    assert_redirected_to edit_my_passkey_path(passkey, created: true)
+    assert_equal [ "internal" ], passkey.transports
+  end
+end
diff --git a/test/controllers/sessions/passkeys_controller_test.rb b/test/controllers/sessions/passkeys_controller_test.rb
index e8e8d315a..bbf4ba069 100644
--- a/test/controllers/sessions/passkeys_controller_test.rb
+++ b/test/controllers/sessions/passkeys_controller_test.rb
@@ -1,14 +1,15 @@
 require "test_helper"
 
 class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
+  include WebauthnTestHelper
+
   setup do
     @identity = identities(:kevin)
-    @private_key = OpenSSL::PKey::EC.generate("prime256v1")
 
-    @credential = @identity.credentials.create!(
+    @credential = @identity.passkeys.create!(
       name: "Test Passkey",
       credential_id: Base64.urlsafe_encode64(SecureRandom.random_bytes(32), padding: false),
-      public_key: @private_key.public_to_der,
+      public_key: webauthn_private_key.public_to_der,
       sign_count: 0,
       transports: [ "internal" ]
     )
@@ -16,10 +17,9 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
 
   test "successful authentication" do
     untenanted do
-      get new_session_url
-      challenge = session[:webauthn_challenge]
+      challenge = request_webauthn_challenge
 
-      post session_passkey_url, params: assertion_params(challenge: challenge)
+      post session_passkey_url, params: build_assertion_params(challenge: challenge, credential: @credential)
 
       assert_response :redirect
       assert cookies[:session_token].present?
@@ -29,10 +29,9 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
 
   test "updates sign count" do
     untenanted do
-      get new_session_url
-      challenge = session[:webauthn_challenge]
+      challenge = request_webauthn_challenge
 
-      post session_passkey_url, params: assertion_params(challenge: challenge, sign_count: 1)
+      post session_passkey_url, params: build_assertion_params(challenge: challenge, credential: @credential, sign_count: 1)
 
       assert_equal 1, @credential.reload.sign_count
     end
@@ -40,10 +39,9 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
 
   test "rejects invalid signature" do
     untenanted do
-      get new_session_url
-      challenge = session[:webauthn_challenge]
+      challenge = request_webauthn_challenge
 
-      params = assertion_params(challenge: challenge)
+      params = build_assertion_params(challenge: challenge, credential: @credential)
       params[:passkey][:signature] = Base64.urlsafe_encode64("invalid", padding: false)
 
       post session_passkey_url, params: params
@@ -56,7 +54,7 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
 
   test "rejects unknown credential" do
     untenanted do
-      get new_session_url
+      request_webauthn_challenge
 
       post session_passkey_url, params: {
         passkey: {
@@ -74,10 +72,9 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
 
   test "successful authentication via JSON" do
     untenanted do
-      get new_session_url
-      challenge = session[:webauthn_challenge]
+      challenge = request_webauthn_challenge
 
-      post session_passkey_url(format: :json), params: assertion_params(challenge: challenge)
+      post session_passkey_url(format: :json), params: build_assertion_params(challenge: challenge, credential: @credential)
 
       assert_response :success
       assert @response.parsed_body["session_token"].present?
@@ -86,7 +83,7 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
 
   test "failed authentication via JSON" do
     untenanted do
-      get new_session_url
+      request_webauthn_challenge
 
       post session_passkey_url(format: :json), params: {
         passkey: {
@@ -101,44 +98,4 @@ class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
       assert_equal "That passkey didn't work. Try again.", @response.parsed_body["message"]
     end
   end
-
-  private
-    def assertion_params(challenge:, sign_count: 1)
-      origin = "http://www.example.com"
-
-      client_data_json = {
-        challenge: challenge,
-        origin: origin,
-        type: "webauthn.get"
-      }.to_json
-
-      authenticator_data = build_authenticator_data(sign_count: sign_count)
-      signature = sign(authenticator_data, client_data_json)
-
-      {
-        passkey: {
-          id: @credential.credential_id,
-          client_data_json: client_data_json,
-          authenticator_data: Base64.urlsafe_encode64(authenticator_data, padding: false),
-          signature: Base64.urlsafe_encode64(signature, padding: false)
-        }
-      }
-    end
-
-    def build_authenticator_data(sign_count:)
-      rp_id_hash = Digest::SHA256.digest("www.example.com")
-      flags = 0x01 | 0x04 # user present + user verified
-
-      bytes = []
-      bytes.concat(rp_id_hash.bytes)
-      bytes << flags
-      bytes.concat([ sign_count ].pack("N").bytes)
-      bytes.pack("C*")
-    end
-
-    def sign(authenticator_data, client_data_json)
-      client_data_hash = Digest::SHA256.digest(client_data_json)
-      signed_data = authenticator_data + client_data_hash
-      @private_key.sign("SHA256", signed_data)
-    end
 end
diff --git a/test/lib/action_pack/passkey_test.rb b/test/lib/action_pack/passkey_test.rb
new file mode 100644
index 000000000..56dc49095
--- /dev/null
+++ b/test/lib/action_pack/passkey_test.rb
@@ -0,0 +1,92 @@
+require "test_helper"
+
+class ActionPack::PasskeyTest < ActiveSupport::TestCase
+  setup do
+    @identity = identities(:kevin)
+    @private_key = OpenSSL::PKey::EC.generate("prime256v1")
+
+    ActionPack::WebAuthn::Current.host = "www.example.com"
+    ActionPack::WebAuthn::Current.origin = "http://www.example.com"
+
+    @passkey = @identity.passkeys.create!(
+      credential_id: Base64.urlsafe_encode64(SecureRandom.random_bytes(32), padding: false),
+      public_key: @private_key.public_to_der,
+      sign_count: 0,
+      transports: [ "internal" ]
+    )
+  end
+
+  test "authenticate with valid assertion" do
+    challenge = ActionPack::Passkey.request_options(credentials: [ @passkey ]).challenge
+    assertion = build_assertion(challenge: challenge)
+
+    result = @passkey.authenticate(assertion, challenge: challenge)
+
+    assert_equal @passkey, result
+  end
+
+  test "authenticate returns nil with invalid signature" do
+    challenge = ActionPack::Passkey.request_options(credentials: [ @passkey ]).challenge
+    assertion = build_assertion(challenge: challenge)
+    assertion[:signature] = Base64.urlsafe_encode64("invalid", padding: false)
+
+    assert_nil @passkey.authenticate(assertion, challenge: challenge)
+  end
+
+  test "authenticate updates sign count and backed_up" do
+    challenge = ActionPack::Passkey.request_options(credentials: [ @passkey ]).challenge
+    assertion = build_assertion(challenge: challenge, sign_count: 5, backed_up: true)
+
+    @passkey.authenticate(assertion, challenge: challenge)
+
+    assert_equal 5, @passkey.reload.sign_count
+    assert @passkey.backed_up?
+  end
+
+  test "to_public_key_credential" do
+    credential = @passkey.to_public_key_credential
+
+    assert_equal @passkey.credential_id, credential.id
+    assert_equal @passkey.sign_count, credential.sign_count
+    assert_equal @passkey.transports, credential.transports
+  end
+
+  private
+    def build_assertion(challenge:, sign_count: 1, backed_up: false)
+      origin = ActionPack::WebAuthn::Current.origin
+
+      client_data_json = {
+        challenge: challenge,
+        origin: origin,
+        type: "webauthn.get"
+      }.to_json
+
+      authenticator_data = build_authenticator_data(sign_count: sign_count, backed_up: backed_up)
+      signature = sign(authenticator_data, client_data_json)
+
+      {
+        id: @passkey.credential_id,
+        client_data_json: client_data_json,
+        authenticator_data: Base64.urlsafe_encode64(authenticator_data, padding: false),
+        signature: Base64.urlsafe_encode64(signature, padding: false)
+      }
+    end
+
+    def build_authenticator_data(sign_count:, backed_up: false)
+      rp_id_hash = Digest::SHA256.digest(ActionPack::WebAuthn::Current.host)
+      flags = 0x01 | 0x04 # user present + user verified
+      flags |= 0x08 | 0x10 if backed_up # backup eligible + backup state
+
+      bytes = []
+      bytes.concat(rp_id_hash.bytes)
+      bytes << flags
+      bytes.concat([ sign_count ].pack("N").bytes)
+      bytes.pack("C*")
+    end
+
+    def sign(authenticator_data, client_data_json)
+      client_data_hash = Digest::SHA256.digest(client_data_json)
+      signed_data = authenticator_data + client_data_hash
+      @private_key.sign("SHA256", signed_data)
+    end
+end
diff --git a/test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb b/test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb
index 68abaf2df..c0b2a96c4 100644
--- a/test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb
+++ b/test/lib/action_pack/web_authn/authenticator/assertion_response_test.rb
@@ -1,10 +1,12 @@
 require "test_helper"
 
 class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport::TestCase
+  include WebauthnTestHelper
+
   setup do
     ActionPack::WebAuthn::Current.host = "example.com"
 
-    @challenge = "test-challenge-123"
+    @challenge = webauthn_challenge
     @origin = "https://example.com"
     @client_data_json = {
       challenge: @challenge,
@@ -24,7 +26,9 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
       client_data_json: @client_data_json,
       authenticator_data: @authenticator_data,
       signature: @signature,
-      credential: @credential
+      credential: @credential,
+      challenge: @challenge,
+      origin: @origin
     )
   end
 
@@ -36,7 +40,7 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
 
   test "validate! succeeds with valid challenge, origin, type, and signature" do
     assert_nothing_raised do
-      @response.validate!(challenge: @challenge, origin: @origin)
+      @response.validate!
     end
   end
 
@@ -51,11 +55,13 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
       client_data_json: client_data_json,
       authenticator_data: @authenticator_data,
       signature: sign(@authenticator_data, client_data_json),
-      credential: @credential
+      credential: @credential,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "Client data type is not webauthn.get", error.message
@@ -65,28 +71,34 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
     response = ActionPack::WebAuthn::Authenticator::AssertionResponse.new(
       client_data_json: @client_data_json,
       authenticator_data: @authenticator_data,
-      signature: "invalid-signature",
-      credential: @credential
+      signature: Base64.urlsafe_encode64("invalid-signature", padding: false),
+      credential: @credential,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "Invalid signature", error.message
   end
 
   test "validate! raises when challenge does not match" do
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      @response.validate!(challenge: "wrong-challenge", origin: @origin)
+    @response.challenge = "wrong-challenge"
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      @response.validate!
     end
 
     assert_equal "Challenge does not match", error.message
   end
 
   test "validate! raises when origin does not match" do
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      @response.validate!(challenge: @challenge, origin: "https://evil.com")
+    @response.origin = "https://evil.com"
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      @response.validate!
     end
 
     assert_equal "Origin does not match", error.message
@@ -98,11 +110,14 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
       client_data_json: @client_data_json,
       authenticator_data: authenticator_data,
       signature: sign(authenticator_data, @client_data_json),
-      credential: @credential
+      credential: @credential,
+      challenge: @challenge,
+      origin: @origin,
+      user_verification: :preferred
     )
 
     assert_nothing_raised do
-      response.validate!(challenge: @challenge, origin: @origin, user_verification: :preferred)
+      response.validate!
     end
   end
 
@@ -112,11 +127,14 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
       client_data_json: @client_data_json,
       authenticator_data: authenticator_data,
       signature: sign(authenticator_data, @client_data_json),
-      credential: @credential
+      credential: @credential,
+      challenge: @challenge,
+      origin: @origin,
+      user_verification: :required
     )
 
     assert_nothing_raised do
-      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+      response.validate!
     end
   end
 
@@ -126,11 +144,14 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
       client_data_json: @client_data_json,
       authenticator_data: authenticator_data,
       signature: sign(authenticator_data, @client_data_json),
-      credential: @credential
+      credential: @credential,
+      challenge: @challenge,
+      origin: @origin,
+      user_verification: :required
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "User verification is required", error.message
@@ -146,7 +167,7 @@ class ActionPack::WebAuthn::Authenticator::AssertionResponseTest < ActiveSupport
       bytes = []
       bytes.concat(rp_id_hash.bytes)
       bytes << flags
-      bytes.concat([sign_count].pack("N").bytes)
+      bytes.concat([ sign_count ].pack("N").bytes)
       bytes.pack("C*")
     end
 
diff --git a/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb b/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
index bed10e4a4..7aaca8ae4 100644
--- a/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
+++ b/test/lib/action_pack/web_authn/authenticator/attestation_response_test.rb
@@ -1,10 +1,43 @@
 require "test_helper"
 
 class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSupport::TestCase
+  # Auth data in all objects contains:
+  #   rp_id_hash: SHA-256("example.com") (32 bytes)
+  #   sign_count: 0
+  #   aaguid: 00010203-0405-0607-0809-0a0b0c0d0e0f (16 bytes)
+  #   credential_id: 32 sequential bytes 0x00..0x1f
+  #   cose_key: EC2/ES256 P-256 {1: 2, 3: -7, -1: 1, -2: <x>, -3: <y>}
+
+  # {"fmt": "none", "attStmt": {}, "authData": <flags: 0x45 (UP+UV+AT)>}
+  ATTESTATION_NONE_VERIFIED = [ "a363666d74646e6f6e656761747453746d74a068617574684461" \
+    "746158a4a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586ce1947" \
+    "4500000000000102030405060708090a0b0c0d0e0f0020000102030405060708090a0b0c" \
+    "0d0e0f101112131415161718191a1b1c1d1e1fa50102032620012158202ba472104c686f" \
+    "39d4b623cc9324953e7053b47cae818e8cf774203a4f51af7122582069cb8ac519bdd929" \
+    "e2bdbe79e9f9b8d14c2d89a7cbd324647a1ccd68b8de3ca0" ].pack("H*")
+
+  # {"fmt": "none", "attStmt": {}, "authData": <flags: 0x41 (UP+AT)>}
+  ATTESTATION_NONE_NOT_VERIFIED = [ "a363666d74646e6f6e656761747453746d74a06861757468" \
+    "4461746158a4a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586ce" \
+    "19474100000000000102030405060708090a0b0c0d0e0f0020000102030405060708090a" \
+    "0b0c0d0e0f101112131415161718191a1b1c1d1e1fa50102032620012158202ba472104c" \
+    "686f39d4b623cc9324953e7053b47cae818e8cf774203a4f51af7122582069cb8ac519bd" \
+    "d929e2bdbe79e9f9b8d14c2d89a7cbd324647a1ccd68b8de3ca0" ].pack("H*")
+
+  # {"fmt": "packed", "attStmt": {}, "authData": <flags: 0x45 (UP+UV+AT)>}
+  ATTESTATION_PACKED_VERIFIED = [ "a363666d74667061636b65646761747453746d74a068617574" \
+    "684461746158a4a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586" \
+    "ce19474500000000000102030405060708090a0b0c0d0e0f0020000102030405060708090" \
+    "a0b0c0d0e0f101112131415161718191a1b1c1d1e1fa50102032620012158202ba472104" \
+    "c686f39d4b623cc9324953e7053b47cae818e8cf774203a4f51af7122582069cb8ac519b" \
+    "dd929e2bdbe79e9f9b8d14c2d89a7cbd324647a1ccd68b8de3ca0" ].pack("H*")
+
+  include WebauthnTestHelper
+
   setup do
     ActionPack::WebAuthn::Current.host = "example.com"
 
-    @challenge = "test-challenge-123"
+    @challenge = webauthn_challenge
     @origin = "https://example.com"
     @client_data_json = {
       challenge: @challenge,
@@ -14,7 +47,9 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSuppo
 
     @response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: @client_data_json,
-      attestation_object: build_attestation_object(user_verified: true)
+      attestation_object: ATTESTATION_NONE_VERIFIED,
+      challenge: @challenge,
+      origin: @origin
     )
   end
 
@@ -24,40 +59,49 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSuppo
 
   test "validate! succeeds with valid challenge, origin, and type" do
     assert_nothing_raised do
-      @response.validate!(challenge: @challenge, origin: @origin)
+      @response.validate!
     end
   end
 
   test "validate! succeeds with user_verification preferred when not verified" do
     response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: @client_data_json,
-      attestation_object: build_attestation_object(user_verified: false)
+      attestation_object: ATTESTATION_NONE_NOT_VERIFIED,
+      challenge: @challenge,
+      origin: @origin,
+      user_verification: :preferred
     )
 
     assert_nothing_raised do
-      response.validate!(challenge: @challenge, origin: @origin, user_verification: :preferred)
+      response.validate!
     end
   end
 
   test "validate! succeeds with user_verification required when verified" do
     response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: @client_data_json,
-      attestation_object: build_attestation_object(user_verified: true)
+      attestation_object: ATTESTATION_NONE_VERIFIED,
+      challenge: @challenge,
+      origin: @origin,
+      user_verification: :required
     )
 
     assert_nothing_raised do
-      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+      response.validate!
     end
   end
 
   test "validate! raises with user_verification required when not verified" do
     response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: @client_data_json,
-      attestation_object: build_attestation_object(user_verified: false)
+      attestation_object: ATTESTATION_NONE_NOT_VERIFIED,
+      challenge: @challenge,
+      origin: @origin,
+      user_verification: :required
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin, user_verification: :required)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "User verification is required", error.message
@@ -72,27 +116,33 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSuppo
 
     response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: client_data_json,
-      attestation_object: build_attestation_object(user_verified: true)
+      attestation_object: ATTESTATION_NONE_VERIFIED,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "Client data type is not webauthn.create", error.message
   end
 
   test "validate! raises when challenge does not match" do
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      @response.validate!(challenge: "wrong-challenge", origin: @origin)
+    @response.challenge = "wrong-challenge"
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      @response.validate!
     end
 
     assert_equal "Challenge does not match", error.message
   end
 
   test "validate! raises when origin does not match" do
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      @response.validate!(challenge: @challenge, origin: "https://evil.com")
+    @response.origin = "https://evil.com"
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      @response.validate!
     end
 
     assert_equal "Origin does not match", error.message
@@ -101,11 +151,13 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSuppo
   test "validate! raises when attestation format is not registered" do
     response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: @client_data_json,
-      attestation_object: build_attestation_object(user_verified: true, format: "packed")
+      attestation_object: ATTESTATION_PACKED_VERIFIED,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "Unsupported attestation format: packed", error.message
@@ -120,94 +172,14 @@ class ActionPack::WebAuthn::Authenticator::AttestationResponseTest < ActiveSuppo
 
     response = ActionPack::WebAuthn::Authenticator::AttestationResponse.new(
       client_data_json: @client_data_json,
-      attestation_object: build_attestation_object(user_verified: true, format: "packed")
+      attestation_object: ATTESTATION_PACKED_VERIFIED,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    response.validate!(challenge: @challenge, origin: @origin)
+    response.validate!
     assert verified
   ensure
     ActionPack::WebAuthn.attestation_verifiers.delete("packed")
   end
-
-  private
-    def build_attestation_object(user_verified:, format: "none")
-      auth_data = build_authenticator_data(user_verified: user_verified)
-      encode_cbor_attestation_object(auth_data, format: format)
-    end
-
-    def build_authenticator_data(user_verified:)
-      rp_id_hash = Digest::SHA256.digest("example.com")
-      flags = 0x41 # user present + attested credential
-      flags |= 0x04 if user_verified
-      sign_count = 0
-      aaguid = SecureRandom.random_bytes(16)
-      credential_id = SecureRandom.random_bytes(32)
-      cose_key = build_cose_key
-
-      bytes = []
-      bytes.concat(rp_id_hash.bytes)
-      bytes << flags
-      bytes.concat([sign_count].pack("N").bytes)
-      bytes.concat(aaguid.bytes)
-      bytes.concat([credential_id.bytesize].pack("n").bytes)
-      bytes.concat(credential_id.bytes)
-      bytes.concat(cose_key.bytes)
-      bytes.pack("C*")
-    end
-
-    def build_cose_key
-      ec_key = OpenSSL::PKey::EC.generate("prime256v1")
-      public_key_bn = ec_key.public_key.to_bn
-      public_key_point = public_key_bn.to_s(2)
-      x = public_key_point[1, 32]
-      y = public_key_point[33, 32]
-
-      params = { 1 => 2, 3 => -7, -1 => 1, -2 => x, -3 => y }
-      encode_cbor_map(params)
-    end
-
-    def encode_cbor_attestation_object(auth_data, format:)
-      bytes = [0xa3]
-      bytes.concat([0x63, *"fmt".bytes])
-      bytes.concat([0x40 + format.bytesize, *format.bytes])
-      bytes.concat([0x67, *"attStmt".bytes])
-      bytes << 0xa0
-      bytes.concat([0x68, *"authData".bytes])
-      if auth_data.bytesize <= 255
-        bytes.concat([0x58, auth_data.bytesize])
-      else
-        bytes.concat([0x59, (auth_data.bytesize >> 8) & 0xff, auth_data.bytesize & 0xff])
-      end
-      bytes.concat(auth_data.bytes)
-      bytes.pack("C*")
-    end
-
-    def encode_cbor_map(hash)
-      bytes = [0xa0 + hash.size]
-      hash.each do |key, value|
-        bytes.concat(encode_cbor_integer(key))
-        bytes.concat(encode_cbor_value(value))
-      end
-      bytes.pack("C*")
-    end
-
-    def encode_cbor_integer(int)
-      if int >= 0 && int <= 23
-        [int]
-      elsif int >= -24 && int < 0
-        [0x20 - int - 1]
-      else
-        raise "Integer encoding not implemented for #{int}"
-      end
-    end
-
-    def encode_cbor_value(value)
-      case value
-      when Integer
-        encode_cbor_integer(value)
-      when String
-        length = value.bytesize
-        length <= 23 ? [0x40 + length, *value.bytes] : [0x58, length, *value.bytes]
-      end
-    end
 end
diff --git a/test/lib/action_pack/web_authn/authenticator/attestation_test.rb b/test/lib/action_pack/web_authn/authenticator/attestation_test.rb
index 4531039e0..2247ece61 100644
--- a/test/lib/action_pack/web_authn/authenticator/attestation_test.rb
+++ b/test/lib/action_pack/web_authn/authenticator/attestation_test.rb
@@ -1,26 +1,26 @@
 require "test_helper"
 
 class ActionPack::WebAuthn::Authenticator::AttestationTest < ActiveSupport::TestCase
-  setup do
-    @rp_id_hash = Digest::SHA256.digest("example.com")
-    @sign_count = 42
-    @aaguid = SecureRandom.random_bytes(16)
-    @credential_id = SecureRandom.random_bytes(32)
+  # Attestation object: {"fmt": "none", "attStmt": {}, "authData": <164 bytes>}
+  # Auth data contains:
+  #   rp_id_hash: SHA-256("example.com") (32 bytes)
+  #   flags: 0x41 (user present + attested credential)
+  #   sign_count: 42
+  #   aaguid: 00010203-0405-0607-0809-0a0b0c0d0e0f (16 bytes)
+  #   credential_id: 32 sequential bytes 0x00..0x1f
+  #   cose_key: EC2/ES256 P-256 {1: 2, 3: -7, -1: 1, -2: <x>, -3: <y>}
+  ATTESTATION_CBOR = [ "a363666d74646e6f6e656761747453746d74a068617574684461746158a4a3" \
+    "79a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586ce1947410000002a" \
+    "000102030405060708090a0b0c0d0e0f0020000102030405060708090a0b0c0d0e0f1011" \
+    "12131415161718191a1b1c1d1e1fa50102032620012158202ba472104c686f39d4b623cc" \
+    "9324953e7053b47cae818e8cf774203a4f51af7122582069cb8ac519bdd929e2bdbe79e9" \
+    "f9b8d14c2d89a7cbd324647a1ccd68b8de3ca0" ].pack("H*")
 
-    # Generate a real EC key
-    ec_key = OpenSSL::PKey::EC.generate("prime256v1")
-    public_key_bn = ec_key.public_key.to_bn
-    public_key_point = public_key_bn.to_s(2)
-    x_coord = public_key_point[1, 32]
-    y_coord = public_key_point[33, 32]
-
-    @cose_key = build_cose_key(x_coord, y_coord)
-    @auth_data = build_authenticator_data
-    @attestation_object = build_attestation_object
-  end
+  CREDENTIAL_ID_BASE64 = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
+  SIGN_COUNT = 42
 
   test "decodes attestation object" do
-    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(ATTESTATION_CBOR)
 
     assert_equal "none", attestation.format
     assert_equal({}, attestation.attestation_statement)
@@ -28,108 +28,20 @@ class ActionPack::WebAuthn::Authenticator::AttestationTest < ActiveSupport::Test
   end
 
   test "delegates credential_id to authenticator_data" do
-    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(ATTESTATION_CBOR)
 
-    assert_equal Base64.urlsafe_encode64(@credential_id, padding: false), attestation.credential_id
+    assert_equal CREDENTIAL_ID_BASE64, attestation.credential_id
   end
 
   test "delegates sign_count to authenticator_data" do
-    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(ATTESTATION_CBOR)
 
-    assert_equal @sign_count, attestation.sign_count
+    assert_equal SIGN_COUNT, attestation.sign_count
   end
 
   test "delegates public_key to authenticator_data" do
-    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(@attestation_object)
+    attestation = ActionPack::WebAuthn::Authenticator::Attestation.decode(ATTESTATION_CBOR)
 
     assert_instance_of OpenSSL::PKey::EC, attestation.public_key
   end
-
-  private
-    def build_authenticator_data
-      bytes = []
-      bytes.concat(@rp_id_hash.bytes)
-      bytes << 0x41 # flags: user present + attested credential
-      bytes.concat([@sign_count].pack("N").bytes)
-      bytes.concat(@aaguid.bytes)
-      bytes.concat([@credential_id.bytesize].pack("n").bytes)
-      bytes.concat(@credential_id.bytes)
-      bytes.concat(@cose_key.bytes)
-      bytes.pack("C*")
-    end
-
-    def build_attestation_object
-      # CBOR map: { "fmt": "none", "attStmt": {}, "authData": <bytes> }
-      encode_cbor_attestation_object
-    end
-
-    def encode_cbor_attestation_object
-      bytes = [0xa3] # map with 3 items
-
-      # "fmt" => "none"
-      bytes.concat([0x63, *"fmt".bytes]) # text string "fmt"
-      bytes.concat([0x64, *"none".bytes]) # text string "none"
-
-      # "attStmt" => {}
-      bytes.concat([0x67, *"attStmt".bytes]) # text string "attStmt"
-      bytes << 0xa0 # empty map
-
-      # "authData" => <bytes>
-      bytes.concat([0x68, *"authData".bytes]) # text string "authData"
-      auth_data_length = @auth_data.bytesize
-      if auth_data_length <= 23
-        bytes << (0x40 + auth_data_length)
-      elsif auth_data_length <= 255
-        bytes.concat([0x58, auth_data_length])
-      else
-        bytes.concat([0x59, (auth_data_length >> 8) & 0xff, auth_data_length & 0xff])
-      end
-      bytes.concat(@auth_data.bytes)
-
-      bytes.pack("C*")
-    end
-
-    def build_cose_key(x, y)
-      params = {
-        1 => 2,    # kty: EC2
-        3 => -7,   # alg: ES256
-        -1 => 1,   # crv: P-256
-        -2 => x,
-        -3 => y
-      }
-      encode_cbor_map(params)
-    end
-
-    def encode_cbor_map(hash)
-      bytes = [0xa0 + hash.size]
-      hash.each do |key, value|
-        bytes.concat(encode_cbor_integer(key))
-        bytes.concat(encode_cbor_value(value))
-      end
-      bytes.pack("C*")
-    end
-
-    def encode_cbor_integer(int)
-      if int >= 0 && int <= 23
-        [int]
-      elsif int >= -24 && int < 0
-        [0x20 - int - 1]
-      else
-        raise "Integer encoding not implemented for #{int}"
-      end
-    end
-
-    def encode_cbor_value(value)
-      case value
-      when Integer
-        encode_cbor_integer(value)
-      when String
-        length = value.bytesize
-        if length <= 23
-          [0x40 + length, *value.bytes]
-        else
-          [0x58, length, *value.bytes]
-        end
-      end
-    end
 end
diff --git a/test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb b/test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb
index 5d3b71e23..7a3a956fb 100644
--- a/test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb
+++ b/test/lib/action_pack/web_authn/authenticator/attestation_verifiers/none_test.rb
@@ -24,7 +24,7 @@ class ActionPack::WebAuthn::Authenticator::AttestationVerifiers::NoneTest < Acti
   test "verify! raises with non-empty attestation statement" do
     attestation = stub(attestation_statement: { "sig" => "abc" })
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
       @verifier.verify!(attestation, client_data_json: "")
     end
 
diff --git a/test/lib/action_pack/web_authn/authenticator/data_test.rb b/test/lib/action_pack/web_authn/authenticator/data_test.rb
index 3291585cc..ed41ed60e 100644
--- a/test/lib/action_pack/web_authn/authenticator/data_test.rb
+++ b/test/lib/action_pack/web_authn/authenticator/data_test.rb
@@ -1,46 +1,64 @@
 require "test_helper"
 
 class ActionPack::WebAuthn::Authenticator::DataTest < ActiveSupport::TestCase
-  setup do
-    @rp_id_hash = Digest::SHA256.digest("example.com")
-    @sign_count = 42
-    @aaguid = SecureRandom.random_bytes(16)
-    @credential_id = SecureRandom.random_bytes(32)
+  # Common values:
+  #   rp_id_hash: SHA-256("example.com") (32 bytes)
+  #   sign_count: 42
+  #   aaguid: 00010203-0405-0607-0809-0a0b0c0d0e0f (16 bytes)
+  #   credential_id: 32 sequential bytes 0x00..0x1f
+  #   cose_key: EC2/ES256 P-256 {1: 2, 3: -7, -1: 1, -2: <x>, -3: <y>}
 
-    # Generate a real EC key for COSE encoding
-    ec_key = OpenSSL::PKey::EC.generate("prime256v1")
-    public_key_bn = ec_key.public_key.to_bn
-    public_key_point = public_key_bn.to_s(2)
-    x_coord = public_key_point[1, 32]
-    y_coord = public_key_point[33, 32]
+  RP_ID_HASH = [ "a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2125586ce1947" ].pack("H*")
+  SIGN_COUNT = 42
+  CREDENTIAL_ID_BASE64 = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
 
-    @cose_key = build_cose_key(x_coord, y_coord)
-  end
+  COSE_KEY_CBOR = [ "a50102032620012158202ba472104c686f39d4b623cc9324953e7053b47cae81" \
+    "8e8cf774203a4f51af7122582069cb8ac519bdd929e2bdbe79e9f9b8d14c2d89a7cbd324" \
+    "647a1ccd68b8de3ca0" ].pack("H*")
+
+  # rp_id_hash(32) + flags 0x01 (UP) + sign_count 42
+  AUTH_DATA_NO_CREDENTIAL = [ "a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2" \
+    "125586ce1947010000002a" ].pack("H*")
+
+  # rp_id_hash(32) + flags 0x41 (UP+AT) + sign_count 42 + aaguid(16) +
+  # credential_id_len 32 (2 bytes) + credential_id(32) + cose_key CBOR
+  AUTH_DATA_WITH_CREDENTIAL = [ "a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13" \
+    "d2125586ce1947410000002a000102030405060708090a0b0c0d0e0f0020000102030405" \
+    "060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fa5010203262001215820" \
+    "2ba472104c686f39d4b623cc9324953e7053b47cae818e8cf774203a4f51af7122582069" \
+    "cb8ac519bdd929e2bdbe79e9f9b8d14c2d89a7cbd324647a1ccd68b8de3ca0" ].pack("H*")
+
+  # Error test data: flags 0x41 (AT set) but no attested credential data after header
+  # rp_id_hash(32) + flags 0x41 + sign_count 42
+  AUTH_DATA_AT_FLAG_NO_CREDENTIAL = [ "a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30" \
+    "ab13d2125586ce1947410000002a" ].pack("H*")
+
+  # rp_id_hash(32) + flags 0x41 + sign_count 0 + aaguid(16), missing credential_id_len
+  AUTH_DATA_TRUNCATED_BEFORE_CRED_LEN = [ "a379a6f6eeafb9a55e378c118034e2751e682fab9f" \
+    "2d30ab13d2125586ce19474100000000000102030405060708090a0b0c0d0e0f" ].pack("H*")
+
+  # rp_id_hash(32) + flags 0x41 + sign_count 0 + aaguid(16) + credential_id_len 9999
+  AUTH_DATA_HUGE_CRED_LEN = [ "a379a6f6eeafb9a55e378c118034e2751e682fab9f2d30ab13d2" \
+    "125586ce19474100000000000102030405060708090a0b0c0d0e0f270f" ].pack("H*")
 
   test "decodes authenticator data without attested credential" do
-    flags = 0x01 # user present only
-    bytes = build_authenticator_data(flags: flags, include_credential: false)
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(AUTH_DATA_NO_CREDENTIAL)
 
-    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
-
-    assert_equal @rp_id_hash, data.relying_party_id_hash
-    assert_equal flags, data.flags
-    assert_equal @sign_count, data.sign_count
+    assert_equal RP_ID_HASH, data.relying_party_id_hash
+    assert_equal 0x01, data.flags
+    assert_equal SIGN_COUNT, data.sign_count
     assert_nil data.credential_id
     assert_nil data.public_key_bytes
   end
 
   test "decodes authenticator data with attested credential" do
-    flags = 0x41 # user present + attested credential data
-    bytes = build_authenticator_data(flags: flags, include_credential: true)
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(AUTH_DATA_WITH_CREDENTIAL)
 
-    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
-
-    assert_equal @rp_id_hash, data.relying_party_id_hash
-    assert_equal flags, data.flags
-    assert_equal @sign_count, data.sign_count
-    assert_equal Base64.urlsafe_encode64(@credential_id, padding: false), data.credential_id
-    assert_equal @cose_key, data.public_key_bytes
+    assert_equal RP_ID_HASH, data.relying_party_id_hash
+    assert_equal 0x41, data.flags
+    assert_equal SIGN_COUNT, data.sign_count
+    assert_equal CREDENTIAL_ID_BASE64, data.credential_id
+    assert_equal COSE_KEY_CBOR, data.public_key_bytes
   end
 
   test "user_present? returns true when flag is set" do
@@ -84,91 +102,44 @@ class ActionPack::WebAuthn::Authenticator::DataTest < ActiveSupport::TestCase
   end
 
   test "public_key returns OpenSSL key when public_key_bytes present" do
-    flags = 0x41
-    bytes = build_authenticator_data(flags: flags, include_credential: true)
-    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(AUTH_DATA_WITH_CREDENTIAL)
 
     assert_instance_of OpenSSL::PKey::EC, data.public_key
   end
 
   test "public_key returns nil when public_key_bytes not present" do
-    flags = 0x01
-    bytes = build_authenticator_data(flags: flags, include_credential: false)
-    data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes)
+    data = ActionPack::WebAuthn::Authenticator::Data.decode(AUTH_DATA_NO_CREDENTIAL)
 
     assert_nil data.public_key
   end
 
-  private
-    def build_authenticator_data(flags:, include_credential:)
-      bytes = []
-      bytes.concat(@rp_id_hash.bytes)
-      bytes << flags
-      bytes.concat([ @sign_count ].pack("N").bytes)
-
-      if include_credential
-        bytes.concat(@aaguid.bytes)
-        bytes.concat([ @credential_id.bytesize ].pack("n").bytes)
-        bytes.concat(@credential_id.bytes)
-        bytes.concat(@cose_key.bytes)
-      end
-
-      bytes.pack("C*")
+  test "raises when attested credential flag set but data truncated before AAGUID" do
+    assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      ActionPack::WebAuthn::Authenticator::Data.decode(AUTH_DATA_AT_FLAG_NO_CREDENTIAL)
     end
+  end
 
+  test "raises when attested credential flag set but data truncated before credential ID" do
+    assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      ActionPack::WebAuthn::Authenticator::Data.decode(AUTH_DATA_TRUNCATED_BEFORE_CRED_LEN)
+    end
+  end
+
+  test "raises when credential ID length exceeds remaining bytes" do
+    assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      ActionPack::WebAuthn::Authenticator::Data.decode(AUTH_DATA_HUGE_CRED_LEN)
+    end
+  end
+
+  private
     def build_data_with_flags(flags)
       ActionPack::WebAuthn::Authenticator::Data.new(
         bytes: [],
-        relying_party_id_hash: @rp_id_hash,
+        relying_party_id_hash: RP_ID_HASH,
         flags: flags,
         sign_count: 0,
         credential_id: nil,
         public_key_bytes: nil
       )
     end
-
-    def build_cose_key(x, y)
-      # Simple CBOR map for EC2 key
-      params = {
-        1 => 2,    # kty: EC2
-        3 => -7,   # alg: ES256
-        -1 => 1,   # crv: P-256
-        -2 => x,
-        -3 => y
-      }
-      encode_cbor_map(params)
-    end
-
-    def encode_cbor_map(hash)
-      bytes = [ 0xa0 + hash.size ]
-      hash.each do |key, value|
-        bytes.concat(encode_cbor_integer(key))
-        bytes.concat(encode_cbor_value(value))
-      end
-      bytes.pack("C*")
-    end
-
-    def encode_cbor_integer(int)
-      if int >= 0 && int <= 23
-        [ int ]
-      elsif int >= -24 && int < 0
-        [ 0x20 - int - 1 ]
-      else
-        raise "Integer encoding not implemented for #{int}"
-      end
-    end
-
-    def encode_cbor_value(value)
-      case value
-      when Integer
-        encode_cbor_integer(value)
-      when String
-        length = value.bytesize
-        if length <= 23
-          [ 0x40 + length, *value.bytes ]
-        else
-          [ 0x58, length, *value.bytes ]
-        end
-      end
-    end
 end
diff --git a/test/lib/action_pack/web_authn/authenticator/response_test.rb b/test/lib/action_pack/web_authn/authenticator/response_test.rb
index 8a172e561..ce0b5dc9f 100644
--- a/test/lib/action_pack/web_authn/authenticator/response_test.rb
+++ b/test/lib/action_pack/web_authn/authenticator/response_test.rb
@@ -1,10 +1,12 @@
 require "test_helper"
 
 class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCase
+  include WebauthnTestHelper
+
   setup do
     ActionPack::WebAuthn::Current.host = "example.com"
 
-    @challenge = "test-challenge-123"
+    @challenge = webauthn_challenge
     @origin = "https://example.com"
     @client_data_json = {
       challenge: @challenge,
@@ -15,7 +17,9 @@ class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCas
     @authenticator_data = build_authenticator_data
     @response = TestableResponse.new(
       client_data_json: @client_data_json,
-      authenticator_data: @authenticator_data
+      authenticator_data: @authenticator_data,
+      challenge: @challenge,
+      origin: @origin
     )
   end
 
@@ -34,28 +38,34 @@ class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCas
   end
 
   test "valid? returns true when challenge and origin match" do
-    assert @response.valid?(challenge: @challenge, origin: @origin)
+    assert @response.valid?
   end
 
   test "valid? returns false when challenge does not match" do
-    assert_not @response.valid?(challenge: "wrong-challenge", origin: @origin)
+    @response.challenge = "wrong-challenge"
+    assert_not @response.valid?
   end
 
   test "valid? returns false when origin does not match" do
-    assert_not @response.valid?(challenge: @challenge, origin: "https://evil.com")
+    @response.origin = "https://evil.com"
+    assert_not @response.valid?
   end
 
   test "validate! raises when challenge does not match" do
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      @response.validate!(challenge: "wrong-challenge", origin: @origin)
+    @response.challenge = "wrong-challenge"
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      @response.validate!
     end
 
     assert_equal "Challenge does not match", error.message
   end
 
   test "validate! raises when origin does not match" do
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      @response.validate!(challenge: @challenge, origin: "https://evil.com")
+    @response.origin = "https://evil.com"
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      @response.validate!
     end
 
     assert_equal "Origin does not match", error.message
@@ -71,11 +81,13 @@ class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCas
 
     response = TestableResponse.new(
       client_data_json: client_data_json,
-      authenticator_data: @authenticator_data
+      authenticator_data: @authenticator_data,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "Cross-origin requests are not supported", error.message
@@ -89,17 +101,19 @@ class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCas
     bytes = []
     bytes.concat(rp_id_hash.bytes)
     bytes << flags
-    bytes.concat([sign_count].pack("N").bytes)
+    bytes.concat([ sign_count ].pack("N").bytes)
 
     wrong_rp_data = ActionPack::WebAuthn::Authenticator::Data.decode(bytes.pack("C*"))
 
     response = TestableResponse.new(
       client_data_json: @client_data_json,
-      authenticator_data: wrong_rp_data
+      authenticator_data: wrong_rp_data,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "Relying party ID does not match", error.message
@@ -115,11 +129,13 @@ class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCas
 
     response = TestableResponse.new(
       client_data_json: client_data_json,
-      authenticator_data: @authenticator_data
+      authenticator_data: @authenticator_data,
+      challenge: @challenge,
+      origin: @origin
     )
 
-    error = assert_raises(ActionPack::WebAuthn::Authenticator::Response::InvalidResponseError) do
-      response.validate!(challenge: @challenge, origin: @origin)
+    error = assert_raises(ActionPack::WebAuthn::InvalidResponseError) do
+      response.validate!
     end
 
     assert_equal "Token binding is not supported", error.message
@@ -134,7 +150,7 @@ class ActionPack::WebAuthn::Authenticator::ResponseTest < ActiveSupport::TestCas
       bytes = []
       bytes.concat(rp_id_hash.bytes)
       bytes << flags
-      bytes.concat([sign_count].pack("N").bytes)
+      bytes.concat([ sign_count ].pack("N").bytes)
 
       ActionPack::WebAuthn::Authenticator::Data.decode(bytes.pack("C*"))
     end
diff --git a/test/lib/action_pack/web_authn/cbor_decoder_test.rb b/test/lib/action_pack/web_authn/cbor_decoder_test.rb
index ea4a12984..19d81da61 100644
--- a/test/lib/action_pack/web_authn/cbor_decoder_test.rb
+++ b/test/lib/action_pack/web_authn/cbor_decoder_test.rb
@@ -152,7 +152,7 @@ class ActionPack::WebAuthn::CborDecoderTest < ActiveSupport::TestCase
   end
 
   test "raises error for reserved additional info values" do
-    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       decode("1c")
     end
   end
@@ -165,6 +165,10 @@ class ActionPack::WebAuthn::CborDecoderTest < ActiveSupport::TestCase
     assert_equal [], decode("9fff")
   end
 
+  test "decodes empty indefinite length map" do
+    assert_equal({}, decode("bfff"))
+  end
+
   test "decodes indefinite length map" do
     assert_equal({ "a" => 1, "b" => 2 }, decode("bf616101616202ff"))
   end
@@ -228,7 +232,7 @@ class ActionPack::WebAuthn::CborDecoderTest < ActiveSupport::TestCase
   end
 
   test "raises error for unsupported simple value" do
-    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       decode("e0")
     end
   end
@@ -243,28 +247,28 @@ class ActionPack::WebAuthn::CborDecoderTest < ActiveSupport::TestCase
   end
 
   test "raises error for empty input" do
-    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       ActionPack::WebAuthn::CborDecoder.decode([])
     end
   end
 
   test "raises error for truncated byte string" do
     # 0x44 = byte string of length 4, but only 2 bytes follow
-    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       decode("440102")
     end
   end
 
   test "raises error for truncated integer" do
     # 0x19 = 2-byte integer follows, but only 1 byte provided
-    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       decode("19ff")
     end
   end
 
   test "raises error for truncated array" do
     # 0x82 = array of 2 items, but only 1 provided
-    assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       decode("8201")
     end
   end
@@ -274,7 +278,7 @@ class ActionPack::WebAuthn::CborDecoderTest < ActiveSupport::TestCase
     # 0x81 = array of 1 item
     deeply_nested = "81" * 20 + "01"
 
-    error = assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    error = assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       decode(deeply_nested)
     end
 
@@ -282,7 +286,7 @@ class ActionPack::WebAuthn::CborDecoderTest < ActiveSupport::TestCase
   end
 
   test "raises error for input exceeding max size" do
-    error = assert_raises(ActionPack::WebAuthn::CborDecoder::DecodeError) do
+    error = assert_raises(ActionPack::WebAuthn::InvalidCborError) do
       ActionPack::WebAuthn::CborDecoder.decode([ 0x01 ], max_size: 0)
     end
 
diff --git a/test/lib/action_pack/web_authn/cose_key_test.rb b/test/lib/action_pack/web_authn/cose_key_test.rb
index a3f9a33e9..346969651 100644
--- a/test/lib/action_pack/web_authn/cose_key_test.rb
+++ b/test/lib/action_pack/web_authn/cose_key_test.rb
@@ -1,33 +1,64 @@
 require "test_helper"
 
 class ActionPack::WebAuthn::CoseKeyTest < ActiveSupport::TestCase
-  setup do
-    # Generate a real EC key for valid test data
-    ec_key = OpenSSL::PKey::EC.generate("prime256v1")
-    public_key_bn = ec_key.public_key.to_bn
-    public_key_bytes = public_key_bn.to_s(2)
-    # Skip the 0x04 uncompressed point prefix
-    @ec2_x = public_key_bytes[1, 32]
-    @ec2_y = public_key_bytes[33, 32]
+  # EC2/ES256 P-256 public key (32-byte x and y coordinates)
+  EC2_X = [ "2ba472104c686f39d4b623cc9324953e7053b47cae818e8cf774203a4f51af71" ].pack("H*")
+  EC2_Y = [ "69cb8ac519bdd929e2bdbe79e9f9b8d14c2d89a7cbd324647a1ccd68b8de3ca0" ].pack("H*")
 
+  # CBOR: {1: 2, 3: -7, -1: 1, -2: <x 32 bytes>, -3: <y 32 bytes>}
+  EC2_CBOR = [ "a50102032620012158202ba472104c686f39d4b623cc9324953e7053b47cae81" \
+    "8e8cf774203a4f51af7122582069cb8ac519bdd929e2bdbe79e9f9b8d14c2d89a7cbd324" \
+    "647a1ccd68b8de3ca0" ].pack("H*")
+
+  # Ed25519 public key (32 bytes)
+  ED25519_X = [ "a95ee02872a2c5224b394832767bea746620e50776e845872228716065f16005" ].pack("H*")
+
+  # CBOR: {1: 1, 3: -8, -1: 6, -2: <x 32 bytes>}
+  OKP_CBOR = [ "a4010103272006215820a95ee02872a2c5224b394832767bea746620e50776e8" \
+    "45872228716065f16005" ].pack("H*")
+
+  # RSA 2048-bit public key (256-byte modulus, 3-byte exponent 65537)
+  RSA_N = [ "d388adb3aa7812402281c57ce870821b17558f0a247a771834892d85399ecd4f" \
+    "830dd35f65e7afe5030d9ee10f4873567039976486202cce8ac499114194d32fe615026e" \
+    "7eeee5b2ff564041d68b9b33c35a2ac17210c69c9e85fa74249b06e4ffa6b38ff5ef54e" \
+    "1860aa59a6fb043e2b65ecf0ce8d0ff90d25683ca2da016618308f3fa7f74efc178ec46" \
+    "e0224f10cf0eed7d46cc6167210f088cc6b77fc08a7fcd14536aa9c726519806a96ea00" \
+    "517ce1ed1336ae6962338a6c4cc4754d953ebbffb5d6b1bc76368b552b628adb788b0bc" \
+    "9f895dff6b1c74d79ce210b5941995beb1f498a1e9123666bdc92bc6b0f2a04fdb40cf1" \
+    "d253ba1582673ec293113" ].pack("H*")
+  RSA_E = [ "010001" ].pack("H*")
+
+  # CBOR: {1: 3, 3: -257, -1: <n 256 bytes>, -2: <e 3 bytes>}
+  RSA_CBOR = [ "a401030339010020590100d388adb3aa7812402281c57ce870821b17558f0a24" \
+    "7a771834892d85399ecd4f830dd35f65e7afe5030d9ee10f4873567039976486202cce8a" \
+    "c499114194d32fe615026e7eeee5b2ff564041d68b9b33c35a2ac17210c69c9e85fa742" \
+    "49b06e4ffa6b38ff5ef54e1860aa59a6fb043e2b65ecf0ce8d0ff90d25683ca2da01661" \
+    "8308f3fa7f74efc178ec46e0224f10cf0eed7d46cc6167210f088cc6b77fc08a7fcd145" \
+    "36aa9c726519806a96ea00517ce1ed1336ae6962338a6c4cc4754d953ebbffb5d6b1bc7" \
+    "6368b552b628adb788b0bc9f895dff6b1c74d79ce210b5941995beb1f498a1e9123666b" \
+    "dc92bc6b0f2a04fdb40cf1d253ba1582673ec2931132143010001" ].pack("H*")
+
+  setup do
     @ec2_parameters = {
       1 => 2,    # kty: EC2
       3 => -7,   # alg: ES256
       -1 => 1,   # crv: P-256
-      -2 => @ec2_x,
-      -3 => @ec2_y
+      -2 => EC2_X,
+      -3 => EC2_Y
     }
 
-    # Generate a real RSA key for valid test data
-    rsa_key = OpenSSL::PKey::RSA.new(2048)
-    @rsa_n = rsa_key.n.to_s(2)
-    @rsa_e = rsa_key.e.to_s(2)
-
     @rsa_parameters = {
       1 => 3,     # kty: RSA
       3 => -257,  # alg: RS256
-      -1 => @rsa_n,
-      -2 => @rsa_e
+      -1 => RSA_N,
+      -2 => RSA_E
+    }
+
+    @okp_parameters = {
+      1 => 1,    # kty: OKP
+      3 => -8,   # alg: EdDSA
+      -1 => 6,   # crv: Ed25519
+      -2 => ED25519_X
     }
   end
 
@@ -44,16 +75,21 @@ class ActionPack::WebAuthn::CoseKeyTest < ActiveSupport::TestCase
   end
 
   test "decodes EC2/ES256 key from CBOR" do
-    cbor = encode_cbor(@ec2_parameters)
-    key = ActionPack::WebAuthn::CoseKey.decode(cbor)
+    key = ActionPack::WebAuthn::CoseKey.decode(EC2_CBOR)
 
     assert_equal 2, key.key_type
     assert_equal(-7, key.algorithm)
   end
 
+  test "decodes OKP/EdDSA key from CBOR" do
+    key = ActionPack::WebAuthn::CoseKey.decode(OKP_CBOR)
+
+    assert_equal 1, key.key_type
+    assert_equal(-8, key.algorithm)
+  end
+
   test "decodes RSA/RS256 key from CBOR" do
-    cbor = encode_cbor(@rsa_parameters)
-    key = ActionPack::WebAuthn::CoseKey.decode(cbor)
+    key = ActionPack::WebAuthn::CoseKey.decode(RSA_CBOR)
 
     assert_equal 3, key.key_type
     assert_equal(-257, key.algorithm)
@@ -72,6 +108,18 @@ class ActionPack::WebAuthn::CoseKeyTest < ActiveSupport::TestCase
     assert_equal "prime256v1", openssl_key.group.curve_name
   end
 
+  test "converts OKP/EdDSA key to OpenSSL Ed25519 key" do
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 1,
+      algorithm: -8,
+      parameters: @okp_parameters
+    )
+
+    openssl_key = key.to_openssl_key
+
+    assert_equal "ED25519", openssl_key.oid
+  end
+
   test "converts RSA/RS256 key to OpenSSL RSA key" do
     key = ActionPack::WebAuthn::CoseKey.new(
       key_type: 3,
@@ -92,13 +140,28 @@ class ActionPack::WebAuthn::CoseKeyTest < ActiveSupport::TestCase
       parameters: {}
     )
 
-    error = assert_raises(ActionPack::WebAuthn::CoseKey::UnsupportedKeyTypeError) do
+    error = assert_raises(ActionPack::WebAuthn::UnsupportedKeyTypeError) do
       key.to_openssl_key
     end
 
     assert_match(/99\/-7/, error.message)
   end
 
+  test "raises error for unsupported OKP curve" do
+    parameters = @okp_parameters.merge(-1 => 5) # Ed448 instead of Ed25519
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 1,
+      algorithm: -8,
+      parameters: parameters
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::UnsupportedKeyTypeError) do
+      key.to_openssl_key
+    end
+
+    assert_match(/curve/, error.message.downcase)
+  end
+
   test "raises error for unsupported EC curve" do
     parameters = @ec2_parameters.merge(-1 => 2) # P-384 instead of P-256
     key = ActionPack::WebAuthn::CoseKey.new(
@@ -107,55 +170,86 @@ class ActionPack::WebAuthn::CoseKeyTest < ActiveSupport::TestCase
       parameters: parameters
     )
 
-    error = assert_raises(ActionPack::WebAuthn::CoseKey::UnsupportedKeyTypeError) do
+    error = assert_raises(ActionPack::WebAuthn::UnsupportedKeyTypeError) do
       key.to_openssl_key
     end
 
     assert_match(/curve/, error.message.downcase)
   end
 
-  private
-    def encode_cbor(hash)
-      # CBOR map encoding
-      bytes = [ 0xa0 + hash.size ] # map with n items
+  test "raises error for EC2 key with missing coordinates" do
+    parameters = @ec2_parameters.except(-3) # missing y coordinate
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 2,
+      algorithm: -7,
+      parameters: parameters
+    )
 
-      hash.each do |key, value|
-        bytes.concat(encode_cbor_integer(key))
-        bytes.concat(encode_cbor_value(value))
-      end
-
-      bytes.pack("C*")
+    error = assert_raises(ActionPack::WebAuthn::InvalidKeyError) do
+      key.to_openssl_key
     end
 
-    def encode_cbor_integer(int)
-      if int >= 0 && int <= 23
-        [ int ]
-      elsif int >= 0 && int <= 255
-        [ 0x18, int ]
-      elsif int >= -24 && int < 0
-        [ 0x20 - int - 1 ]
-      elsif int >= -256 && int < -24
-        [ 0x38, -int - 1 ]
-      else
-        # 16-bit negative integer
-        val = -int - 1
-        [ 0x39, (val >> 8) & 0xff, val & 0xff ]
-      end
+    assert_match(/missing ec2 key coordinates/i, error.message)
+  end
+
+  test "raises error for EC2 key with wrong coordinate length" do
+    parameters = @ec2_parameters.merge(-2 => "\x00" * 16) # 16 bytes instead of 32
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 2,
+      algorithm: -7,
+      parameters: parameters
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidKeyError) do
+      key.to_openssl_key
     end
 
-    def encode_cbor_value(value)
-      case value
-      when Integer
-        encode_cbor_integer(value)
-      when String
-        length = value.bytesize
-        if length <= 23
-          [ 0x40 + length, *value.bytes ]
-        elsif length <= 255
-          [ 0x58, length, *value.bytes ]
-        else
-          [ 0x59, (length >> 8) & 0xff, length & 0xff, *value.bytes ]
-        end
-      end
+    assert_match(/invalid ec2 coordinate length/i, error.message)
+  end
+
+  test "raises error for OKP key with missing coordinate" do
+    parameters = @okp_parameters.except(-2) # missing x coordinate
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 1,
+      algorithm: -8,
+      parameters: parameters
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidKeyError) do
+      key.to_openssl_key
     end
+
+    assert_match(/missing okp key coordinate/i, error.message)
+  end
+
+  test "raises error for RSA key with missing parameters" do
+    parameters = @rsa_parameters.except(-1) # missing n
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 3,
+      algorithm: -257,
+      parameters: parameters
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidKeyError) do
+      key.to_openssl_key
+    end
+
+    assert_match(/missing rsa key parameters/i, error.message)
+  end
+
+  test "raises error for RSA key smaller than 2048 bits" do
+    small_n = "\x01" + ("\x00" * 127) # 1024-bit modulus
+    parameters = @rsa_parameters.merge(-1 => small_n)
+    key = ActionPack::WebAuthn::CoseKey.new(
+      key_type: 3,
+      algorithm: -257,
+      parameters: parameters
+    )
+
+    error = assert_raises(ActionPack::WebAuthn::InvalidKeyError) do
+      key.to_openssl_key
+    end
+
+    assert_match(/at least 2048 bits/i, error.message)
+  end
 end
diff --git a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
index 232cb74ba..0cf9c7fe6 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
@@ -22,9 +22,12 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
     assert_match(/\A[A-Za-z0-9_-]+\z/, @options.challenge)
   end
 
-  test "generates challenge of correct length" do
-    decoded = Base64.urlsafe_decode64(@options.challenge)
-    assert_equal 32, decoded.bytesize
+  test "generates signed challenge containing nonce" do
+    signed_message = Base64.urlsafe_decode64(@options.challenge)
+    nonce = ActionPack::WebAuthn.challenge_verifier.verified(signed_message)
+
+    assert_not_nil nonce
+    assert_equal 32, Base64.strict_decode64(nonce).bytesize
   end
 
   test "as_json" do
@@ -39,6 +42,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
 
     assert_equal [
       { type: "public-key", alg: -7 },
+      { type: "public-key", alg: -8 },
       { type: "public-key", alg: -257 }
     ], @options.as_json[:pubKeyCredParams]
 
@@ -101,7 +105,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
   end
 
   test "raises with invalid attestation preference" do
-    assert_raises(ArgumentError) do
+    assert_raises(ActionPack::WebAuthn::InvalidOptionsError) do
       ActionPack::WebAuthn::PublicKeyCredential::CreationOptions.new(
         id: "user-123",
         name: "user@example.com",
diff --git a/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
index 96c064ffc..0ef7981af 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/request_options_test.rb
@@ -22,9 +22,12 @@ class ActionPack::WebAuthn::PublicKeyCredential::RequestOptionsTest < ActiveSupp
     assert_match(/\A[A-Za-z0-9_-]+\z/, @options.challenge)
   end
 
-  test "generates challenge of correct length" do
-    decoded = Base64.urlsafe_decode64(@options.challenge)
-    assert_equal 32, decoded.bytesize
+  test "generates signed challenge containing nonce" do
+    signed_message = Base64.urlsafe_decode64(@options.challenge)
+    nonce = ActionPack::WebAuthn.challenge_verifier.verified(signed_message)
+
+    assert_not_nil nonce
+    assert_equal 32, Base64.strict_decode64(nonce).bytesize
   end
 
   test "as_json" do
diff --git a/test/lib/rails_ext/action_pack_passkey_infer_name_from_aaguid_test.rb b/test/lib/rails_ext/action_pack_passkey_infer_name_from_aaguid_test.rb
new file mode 100644
index 000000000..0e56ccc88
--- /dev/null
+++ b/test/lib/rails_ext/action_pack_passkey_infer_name_from_aaguid_test.rb
@@ -0,0 +1,32 @@
+require "test_helper"
+
+class ActionPackPasskeyInferNameFromAaguidTest < ActiveSupport::TestCase
+  setup do
+    @identity = identities(:kevin)
+    @private_key = OpenSSL::PKey::EC.generate("prime256v1")
+
+    ActionPack::WebAuthn::Current.host = "www.example.com"
+    ActionPack::WebAuthn::Current.origin = "http://www.example.com"
+  end
+
+  test "authenticator lookup by known aaguid" do
+    authenticator = Passkey::Authenticator.find_by_aaguid("dd4ec289-e01d-41c9-bb89-70fa845d4bf2")
+
+    assert_equal "Apple Passwords", authenticator.name
+  end
+
+  test "authenticator lookup returns nil for unknown aaguid" do
+    assert_nil Passkey::Authenticator.find_by_aaguid("00000000-0000-0000-0000-000000000000")
+  end
+
+  test "authenticator lookup by aaguid on passkey" do
+    passkey = @identity.passkeys.create!(
+      credential_id: Base64.urlsafe_encode64(SecureRandom.random_bytes(32), padding: false),
+      public_key: @private_key.public_to_der,
+      sign_count: 0,
+      aaguid: "dd4ec289-e01d-41c9-bb89-70fa845d4bf2"
+    )
+
+    assert_equal "Apple Passwords", passkey.authenticator.name
+  end
+end
diff --git a/test/mailers/previews/magic_link_mailer_preview.rb b/test/mailers/previews/magic_link_mailer_preview.rb
index 387de9507..6569b09e8 100644
--- a/test/mailers/previews/magic_link_mailer_preview.rb
+++ b/test/mailers/previews/magic_link_mailer_preview.rb
@@ -1,6 +1,6 @@
 class MagicLinkMailerPreview < ActionMailer::Preview
   def magic_link
-    identity = Identity.new email_address: "test@example.com"
+    identity = Identity.all.sample
     magic_link = MagicLink.new(identity: identity)
     magic_link.valid?
 
diff --git a/test/test_helpers/webauthn_test_helper.rb b/test/test_helpers/webauthn_test_helper.rb
new file mode 100644
index 000000000..2c530aef6
--- /dev/null
+++ b/test/test_helpers/webauthn_test_helper.rb
@@ -0,0 +1,94 @@
+module WebauthnTestHelper
+  # Fixed EC P-256 key pair for WebAuthn tests.
+  WEBAUTHN_PRIVATE_KEY = OpenSSL::PKey::EC.new(
+    [ "307702010104201dd589de7210b3318620f32150e3012cce021519df1d6e9e01" \
+      "0471146d395cdca00a06082a8648ce3d030107a14403420004116847fe19e1ad" \
+      "4471ab9980d7ff9cc1e4c7cb7a3af00e082b64fcd84f5ae70114c2495eef16f" \
+      "542b5e57dd1b263661624e3cf28f581b57a441edbd756a41d0e" ].pack("H*")
+  )
+
+  # Pre-encoded COSE EC2/ES256 public key (CBOR) for the key above.
+  # {1: 2, 3: -7, -1: 1, -2: <x 32 bytes>, -3: <y 32 bytes>}
+  COSE_PUBLIC_KEY = [ "a5010203262001215820116847fe19e1ad4471ab9980d7ff9cc1" \
+    "e4c7cb7a3af00e082b64fcd84f5ae70122582014c2495eef16f542b5e57dd1b2" \
+    "63661624e3cf28f581b57a441edbd756a41d0e" ].pack("H*")
+
+  # CBOR prefix for {"fmt": "none", "attStmt": {}, "authData": bytes(164)}.
+  # Auth data is always 164 bytes: rp_id_hash(32) + flags(1) + sign_count(4)
+  # + aaguid(16) + credential_id_length(2) + credential_id(32) + cose_key(77).
+  ATTESTATION_OBJECT_CBOR_PREFIX =
+    [ "a363666d74646e6f6e656761747453746d74a068617574684461746158a4" ].pack("H*")
+
+  private
+    def request_webauthn_challenge
+      untenanted { post my_passkey_challenge_url }
+      response.parsed_body["challenge"]
+    end
+
+    def webauthn_challenge
+      ActionPack::WebAuthn::PublicKeyCredential::Options.new.challenge
+    end
+
+    def webauthn_private_key
+      WEBAUTHN_PRIVATE_KEY
+    end
+
+    def build_attestation_params(challenge:)
+      credential_id = SecureRandom.random_bytes(32)
+      auth_data = build_attestation_auth_data(credential_id: credential_id)
+
+      {
+        passkey: {
+          client_data_json: webauthn_client_data_json(challenge: challenge, type: "webauthn.create"),
+          attestation_object: Base64.urlsafe_encode64(ATTESTATION_OBJECT_CBOR_PREFIX + auth_data, padding: false),
+          transports: [ "internal" ]
+        }
+      }
+    end
+
+    def build_assertion_params(challenge:, credential:, sign_count: 1)
+      client_data_json = webauthn_client_data_json(challenge: challenge, type: "webauthn.get")
+      authenticator_data = build_assertion_auth_data(sign_count: sign_count)
+      signature = webauthn_sign(authenticator_data, client_data_json)
+
+      {
+        passkey: {
+          id: credential.credential_id,
+          client_data_json: client_data_json,
+          authenticator_data: Base64.urlsafe_encode64(authenticator_data, padding: false),
+          signature: Base64.urlsafe_encode64(signature, padding: false)
+        }
+      }
+    end
+
+    def webauthn_client_data_json(challenge:, type:)
+      { challenge: challenge, origin: "http://www.example.com", type: type }.to_json
+    end
+
+    # Attestation auth data includes the attested credential (public key + credential ID).
+    def build_attestation_auth_data(credential_id:)
+      [
+        Digest::SHA256.digest("www.example.com"),   # rp_id_hash
+        [ 0x45 ].pack("C"),                         # flags: UP + UV + AT
+        [ 0 ].pack("N"),                            # sign_count
+        "\x00" * 16,                                # aaguid
+        [ credential_id.bytesize ].pack("n"),       # credential_id_length
+        credential_id,
+        COSE_PUBLIC_KEY
+      ].join.b
+    end
+
+    # Assertion auth data is simpler — no attested credential.
+    def build_assertion_auth_data(sign_count:)
+      [
+        Digest::SHA256.digest("www.example.com"),
+        [ 0x05 ].pack("C"),                         # flags: UP + UV
+        [ sign_count ].pack("N")
+      ].join.b
+    end
+
+    def webauthn_sign(authenticator_data, client_data_json)
+      signed_data = authenticator_data + Digest::SHA256.digest(client_data_json)
+      WEBAUTHN_PRIVATE_KEY.sign("SHA256", signed_data)
+    end
+end

From 1e245fbe455cf1a979b73d05566579306e949424 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy@37signals.com>
Date: Tue, 17 Mar 2026 12:06:17 -0500
Subject: [PATCH 100/107] Add onboarding card

---
 app/models/account/seeder.rb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/models/account/seeder.rb b/app/models/account/seeder.rb
index ff97538be..34eb14f12 100644
--- a/app/models/account/seeder.rb
+++ b/app/models/account/seeder.rb
@@ -33,6 +33,12 @@ class Account::Seeder
         <action-text-attachment url="https://videos.37signals.com/fizzy/assets/videos/fizzyorientation-4k.mp4" caption="Fizzy orientation" content-type="video/mp4" filename="fizzyorientation-4k.mp4"></action-text-attachment>
       HTML
 
+      # TODO: Replace the video here with a screencap of creating a passkey
+      playground.cards.create! creator: creator, title: "Then, set up a Passkey", status: "published", description: <<~HTML
+        <p>Passkeys let you sign in securely without using passwords or email codes. To set one up, open the Fizzy menu and go to “<b><strong>My Profile > Manage Passkeys</b></strong>”. Using a passkey is optional, but recommended.</p>
+        <action-text-attachment url="https://videos.37signals.com/fizzy/assets/images/invite-link.gif" alt="Demo of adding a passkey" caption="Create a passkey to sign in without passwords or email codes" content-type="image/*" filename="invite-link.gif" presentation="gallery"></action-text-attachment>
+      HTML
+
       playground.cards.create! creator: creator, title: "Now, grab the invite link to invite someone else", status: "published", description: <<~HTML
         <p>Open the Fizzy menu, select “<b><strong>+ Add people</b></strong>”, then copy the invite link. You can give this link to someone else so they can make a login for themselves in your account.</p>
         <action-text-attachment url="https://videos.37signals.com/fizzy/assets/images/invite-link.gif" alt="Demo of copying invite link" caption="Get a link to invite co-workers" content-type="image/*" filename="invite-link.gif" presentation="gallery"></action-text-attachment>

From 1cf1f598e15501a1fab62fe7f04a85b1f75a0aae Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Mon, 16 Mar 2026 17:06:32 +0100
Subject: [PATCH 101/107] Require resident keys by default

---
 lib/action_pack/railtie.rb                                    | 2 +-
 .../web_authn/public_key_credential/creation_options.rb       | 2 +-
 .../web_authn/public_key_credential/creation_options_test.rb  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/action_pack/railtie.rb b/lib/action_pack/railtie.rb
index 25511cc37..ba0bf5096 100644
--- a/lib/action_pack/railtie.rb
+++ b/lib/action_pack/railtie.rb
@@ -46,7 +46,7 @@ class ActionPack::Railtie < Rails::Railtie
 
   initializer "action_pack.passkey.holder" do
     ActiveSupport.on_load(:active_record) do
-      # We need this shim because Holder is namespaced under Passkey, which is an ActiveRecort
+      # We need this shim because Holder is namespaced under Passkey, which is an ActiveRecord
       # and can't be required before ActiveRecord is loaded.
       def self.has_passkeys(**options, &block)
         include ActionPack::Passkey::Holder
diff --git a/lib/action_pack/web_authn/public_key_credential/creation_options.rb b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
index 0a5f97970..da71aeb22 100644
--- a/lib/action_pack/web_authn/public_key_credential/creation_options.rb
+++ b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
@@ -49,7 +49,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::W
   attribute :id
   attribute :name
   attribute :display_name
-  attribute :resident_key, default: :preferred
+  attribute :resident_key, default: :required
   attribute :exclude_credentials, default: -> { [] }
   attribute :attestation, default: :none
   attribute :challenge_expiration, default: -> { Rails.configuration.action_pack.web_authn.creation_challenge_expiration }
diff --git a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
index 0cf9c7fe6..8e8fd686a 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
@@ -46,8 +46,8 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
       { type: "public-key", alg: -257 }
     ], @options.as_json[:pubKeyCredParams]
 
-    assert_equal "preferred", @options.as_json[:authenticatorSelection][:residentKey]
-    assert_equal false, @options.as_json[:authenticatorSelection][:requireResidentKey]
+    assert_equal "required", @options.as_json[:authenticatorSelection][:residentKey]
+    assert_equal true, @options.as_json[:authenticatorSelection][:requireResidentKey]
     assert_equal "preferred", @options.as_json[:authenticatorSelection][:userVerification]
   end
 

From 14f938dbf931dd935955884999ebfe29f1bf87d7 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Wed, 18 Mar 2026 14:48:00 +0100
Subject: [PATCH 102/107] Add demo video for creating a Passkey

---
 app/models/account/seeder.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/models/account/seeder.rb b/app/models/account/seeder.rb
index 34eb14f12..7c892eebe 100644
--- a/app/models/account/seeder.rb
+++ b/app/models/account/seeder.rb
@@ -36,7 +36,7 @@ class Account::Seeder
       # TODO: Replace the video here with a screencap of creating a passkey
       playground.cards.create! creator: creator, title: "Then, set up a Passkey", status: "published", description: <<~HTML
         <p>Passkeys let you sign in securely without using passwords or email codes. To set one up, open the Fizzy menu and go to “<b><strong>My Profile > Manage Passkeys</b></strong>”. Using a passkey is optional, but recommended.</p>
-        <action-text-attachment url="https://videos.37signals.com/fizzy/assets/images/invite-link.gif" alt="Demo of adding a passkey" caption="Create a passkey to sign in without passwords or email codes" content-type="image/*" filename="invite-link.gif" presentation="gallery"></action-text-attachment>
+        <action-text-attachment url="https://videos.37signals.com/fizzy/assets/videos/creating_a_passkey.mp4" alt="Demo of adding a passkey" caption="Create a passkey to sign in without passwords or email codes" content-type="video/mp4" filename="creating_a_passkey.mp4"></action-text-attachment>
       HTML
 
       playground.cards.create! creator: creator, title: "Now, grab the invite link to invite someone else", status: "published", description: <<~HTML

From e0d66b2fd01302ff2d176d34bcafbce15a7e1db6 Mon Sep 17 00:00:00 2001
From: Peter Baker <pcbaker@gmail.com>
Date: Wed, 18 Mar 2026 15:38:06 +0000
Subject: [PATCH 103/107] Fix ambiguous column in SQLite FTS multi-term search
 (#2688)

* Fix multi-term SQLite FTS5 search causing a 500 error

When filtering cards by more than one term, `matching` was called
once per term via an association join. Rails did not deduplicate
association joins, resulting in two JOINs to `search_records_fts`
in a single query. SQLite FTS5 then raised "ambiguous column name"
when evaluating the MATCH condition.

Fix by using a string join instead, which Rails deduplicates so
only one JOIN to `search_records_fts` is generated regardless of
how many terms are searched.

Fixes: https://github.com/basecamp/fizzy/discussions/2354

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test: verify multi-term search requires ALL terms to match

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Mike Dalessio <mike@37signals.com>
---
 app/models/search/record/sqlite.rb |  5 ++++-
 test/models/filter/search_test.rb  | 10 ++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/models/search/record/sqlite.rb b/app/models/search/record/sqlite.rb
index ae0d34281..857e858a7 100644
--- a/app/models/search/record/sqlite.rb
+++ b/app/models/search/record/sqlite.rb
@@ -10,7 +10,10 @@ module Search::Record::SQLite
 
     after_save :upsert_to_fts5_table
 
-    scope :matching, ->(query, account_id) { joins(:search_records_fts).where("search_records_fts MATCH ?", query) }
+    scope :matching, ->(query, account_id) {
+      joins("INNER JOIN search_records_fts ON search_records_fts.rowid = #{table_name}.id")
+        .where("search_records_fts MATCH ?", query)
+    }
   end
 
   class_methods do
diff --git a/test/models/filter/search_test.rb b/test/models/filter/search_test.rb
index cbdd9558d..8e3344114 100644
--- a/test/models/filter/search_test.rb
+++ b/test/models/filter/search_test.rb
@@ -12,4 +12,14 @@ class Filter::SearchTest < ActiveSupport::TestCase
 
     assert_equal [ card ], filter.cards.to_a
   end
+
+  test "multiple terms all match" do
+    matching_card = @board.cards.create!(title: "haggis neeps tatties", creator: @user, status: "published")
+    @board.cards.create!(title: "haggis only", creator: @user, status: "published")
+    @board.cards.create!(title: "neeps only", creator: @user, status: "published")
+
+    filter = @user.filters.new(terms: [ "haggis", "neeps" ], indexed_by: "all", sorted_by: "latest")
+
+    assert_equal [ matching_card ], filter.cards.to_a
+  end
 end

From ad1b10368d7599def9399813a74ad314e5be11fc Mon Sep 17 00:00:00 2001
From: Daniel Pinto <642149+Mouxy@users.noreply.github.com>
Date: Wed, 18 Mar 2026 15:41:22 +0000
Subject: [PATCH 104/107] Fix export size doubling from re-exporting prior
 export blobs (#2707)

* Exclude export/import blobs and attachments from account exports

Export and import file blobs were being assigned the account's
account_id (via the Current.account default), causing subsequent
exports to include previous export/import ZIP files in the data.
This roughly doubled the export size each time and made imports
fail with an IntegrityError on unrecognized "Account::Export"
record type.

Filter out blobs attached to Export/Import records in
BlobRecordSet, FileRecordSet, and a new AttachmentRecordSet.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Use STI base type for export blob exclusion filter

Rails polymorphic_name returns base_class.name for STI models,
so ActiveStorage stores record_type as "Export" rather than the
concrete subclass names. Filter on the base type accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix export filtering for mixed-use Active Storage blobs

Exclude only internal-only blobs for account export metadata/file sets, scope attachment subqueries by account, and add regression coverage for blobs shared between user records and export attachments.

* Simplify export blob filtering

Exports always create fresh blobs, so a blob can never be legitimately
shared between an Export/Import and a real account record. Replace the
internal_only/external split with a single excluded_blob_ids subquery
and drop the contrived shared-blob test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../active_storage/attachment_record_set.rb   | 11 +++++++
 .../active_storage/blob_record_set.rb         |  8 +++++
 .../active_storage/file_record_set.rb         |  6 +++-
 app/models/account/data_transfer/manifest.rb  |  2 +-
 .../account/data_transfer/record_set.rb       |  1 +
 test/models/account/export_test.rb            | 31 +++++++++++++++++++
 6 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 app/models/account/data_transfer/active_storage/attachment_record_set.rb

diff --git a/app/models/account/data_transfer/active_storage/attachment_record_set.rb b/app/models/account/data_transfer/active_storage/attachment_record_set.rb
new file mode 100644
index 000000000..0c87c10af
--- /dev/null
+++ b/app/models/account/data_transfer/active_storage/attachment_record_set.rb
@@ -0,0 +1,11 @@
+class Account::DataTransfer::ActiveStorage::AttachmentRecordSet < Account::DataTransfer::RecordSet
+  def initialize(account)
+    super(account: account, model: ::ActiveStorage::Attachment)
+  end
+
+  private
+    def records
+      ::ActiveStorage::Attachment.where(account: account)
+        .where.not(record_type: INTERNAL_RECORD_TYPES)
+    end
+end
diff --git a/app/models/account/data_transfer/active_storage/blob_record_set.rb b/app/models/account/data_transfer/active_storage/blob_record_set.rb
index 0c4a553c1..7adc5742e 100644
--- a/app/models/account/data_transfer/active_storage/blob_record_set.rb
+++ b/app/models/account/data_transfer/active_storage/blob_record_set.rb
@@ -8,6 +8,14 @@ class Account::DataTransfer::ActiveStorage::BlobRecordSet < Account::DataTransfe
   end
 
   private
+    def records
+      ::ActiveStorage::Blob.where(account: account).where.not(id: excluded_blob_ids)
+    end
+
+    def excluded_blob_ids
+      ::ActiveStorage::Attachment.where(account: account, record_type: INTERNAL_RECORD_TYPES).select(:blob_id)
+    end
+
     def import_batch(files)
       batch_data = files.map do |file|
         data = load(file)
diff --git a/app/models/account/data_transfer/active_storage/file_record_set.rb b/app/models/account/data_transfer/active_storage/file_record_set.rb
index 421a2e520..f64f53d3a 100644
--- a/app/models/account/data_transfer/active_storage/file_record_set.rb
+++ b/app/models/account/data_transfer/active_storage/file_record_set.rb
@@ -5,7 +5,11 @@ class Account::DataTransfer::ActiveStorage::FileRecordSet < Account::DataTransfe
 
   private
     def records
-      ::ActiveStorage::Blob.where(account: account)
+      ::ActiveStorage::Blob.where(account: account).where.not(id: excluded_blob_ids)
+    end
+
+    def excluded_blob_ids
+      ::ActiveStorage::Attachment.where(account: account, record_type: INTERNAL_RECORD_TYPES).select(:blob_id)
     end
 
     def export_record(blob)
diff --git a/app/models/account/data_transfer/manifest.rb b/app/models/account/data_transfer/manifest.rb
index 9de76f9bf..f7a7791e1 100644
--- a/app/models/account/data_transfer/manifest.rb
+++ b/app/models/account/data_transfer/manifest.rb
@@ -58,7 +58,7 @@ class Account::DataTransfer::Manifest
           ::Webhook::Delivery
         ),
         Account::DataTransfer::ActiveStorage::BlobRecordSet.new(account),
-        *build_record_sets(::ActiveStorage::Attachment),
+        Account::DataTransfer::ActiveStorage::AttachmentRecordSet.new(account),
         Account::DataTransfer::ActionText::RichTextRecordSet.new(account),
         Account::DataTransfer::ActiveStorage::FileRecordSet.new(account)
       ].then { set_importable_model_names(it) }
diff --git a/app/models/account/data_transfer/record_set.rb b/app/models/account/data_transfer/record_set.rb
index 2fba9402d..ff7b79b5c 100644
--- a/app/models/account/data_transfer/record_set.rb
+++ b/app/models/account/data_transfer/record_set.rb
@@ -3,6 +3,7 @@ class Account::DataTransfer::RecordSet
   class ConflictError < IntegrityError; end
 
   IMPORT_BATCH_SIZE = 100
+  INTERNAL_RECORD_TYPES = %w[Export Account::Import].freeze
 
   attr_accessor :importable_model_names
   attr_reader :account, :model, :attributes
diff --git a/test/models/account/export_test.rb b/test/models/account/export_test.rb
index d449764b8..4c7d261b9 100644
--- a/test/models/account/export_test.rb
+++ b/test/models/account/export_test.rb
@@ -60,6 +60,37 @@ class Account::ExportTest < ActiveSupport::TestCase
     end
   end
 
+  test "export excludes blobs and attachments from previous exports" do
+    first_export = Account::Export.create!(account: Current.account, user: users(:david))
+    first_export.build
+    assert first_export.completed?
+
+    first_export_blob = first_export.file.blob
+    first_export_attachment = first_export.file.attachment
+
+    second_export = Account::Export.create!(account: Current.account, user: users(:david))
+    second_export.build
+    assert second_export.completed?
+
+    second_export.file.open do |file|
+      reader = ZipKit::FileReader.read_zip_structure(io: file)
+      filenames = reader.map(&:filename)
+
+      blob_entries = filenames.select { |f| f.start_with?("data/active_storage_blobs/") }
+      blob_ids = blob_entries.map { |f| File.basename(f, ".json") }
+      assert_not_includes blob_ids, first_export_blob.id, "Export should not include blob metadata from previous exports"
+
+      storage_entries = filenames.select { |f| f.start_with?("storage/") }
+      assert_not storage_entries.any? { |f| f == "storage/#{first_export_blob.key}" },
+        "Export should not include blob file from previous exports"
+
+      attachment_entries = filenames.select { |f| f.start_with?("data/active_storage_attachments/") }
+      attachment_ids = attachment_entries.map { |f| File.basename(f, ".json") }
+      assert_not_includes attachment_ids, first_export_attachment.id,
+        "Export should not include attachment records from previous exports"
+    end
+  end
+
   test "build succeeds when rich text references missing blob" do
     blob = ActiveStorage::Blob.create_and_upload!(
       io: file_fixture("moon.jpg").open,

From 248fc5d3e758012c277d06677a10185ebecb4310 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 18 Mar 2026 17:03:13 -0400
Subject: [PATCH 105/107] Fix back navigation from filter views to cards
 (#2725)

* test: update sign_in_as system test helper to be more generic

and support fixture users with more than one board

* test: backfill a test for the card "back link"

when coming from a board filter page

* Fix back navigation to filter views from cards

When navigating from a filter view to a card, the back link now shows
the filter's label and navigates back to the filter URL instead of the
card's board.

The turbo-navigation Stimulus controller stores the page title alongside
the referrer URL in sessionStorage. On the card show page, a
referrerBackLink target rewrites the back link's href and label from the
stored values. This is scoped only to the card show page to avoid
navigation loops in multi-level deep pages.

* Add referrer allowlist to prevent stale referrer rewrites

The back link is only rewritten when the stored referrer's path matches
an allowlist of paths passed via prefer_referrer. This prevents stale
referrers from unrelated pages (e.g., settings) from overriding the
card's back link.

* Move back link navigation tests to dedicated system test file

Extract back link tests from smoke_test.rb into their own file since
they test specific JavaScript behavior that needs regression coverage.
Move sign_in_as helper to ApplicationSystemTestCase for reuse.

* Move markdown paste tests to dedicated system test file
---
 app/helpers/application_helper.rb             |  9 +++-
 app/helpers/boards_helper.rb                  |  4 +-
 .../turbo_navigation_controller.js            | 21 +++++++++
 app/views/cards/show.html.erb                 |  2 +-
 app/views/layouts/application.html.erb        |  1 +
 test/application_system_test_case.rb          |  6 +++
 test/system/back_link_navigation_test.rb      | 38 ++++++++++++++++
 test/system/markdown_paste_test.rb            | 44 ++++++++++++++++++
 test/system/smoke_test.rb                     | 45 -------------------
 9 files changed, 120 insertions(+), 50 deletions(-)
 create mode 100644 test/system/back_link_navigation_test.rb
 create mode 100644 test/system/markdown_paste_test.rb

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 9e0a72f81..6b97da279 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -10,8 +10,13 @@ module ApplicationHelper
     tag.span class: class_names("icon icon--#{name}", options.delete(:class)), "aria-hidden": true, **options
   end
 
-  def back_link_to(label, url, action, **options)
-    link_to url, class: "btn btn--back btn--circle-mobile", data: { controller: "hotkey", action: action }, **options do
+  def back_link_to(label, url, action, prefer_referrer: [], **options)
+    data = { controller: "hotkey", action: action }
+    if prefer_referrer.any?
+      data[:turbo_navigation_target] = "referrerBackLink"
+      data[:turbo_navigation_allowed_referrer_paths] = prefer_referrer.join(",")
+    end
+    link_to url, class: "btn btn--back btn--circle-mobile", data: data, **options do
       icon_tag("arrow-left") + tag.strong("Back to #{label}", class: "overflow-ellipsis") + tag.kbd("ESC", class: "txt-x-small hide-on-touch").html_safe
     end
   end
diff --git a/app/helpers/boards_helper.rb b/app/helpers/boards_helper.rb
index 5f12b9259..814b0b0e2 100644
--- a/app/helpers/boards_helper.rb
+++ b/app/helpers/boards_helper.rb
@@ -1,6 +1,6 @@
 module BoardsHelper
-  def link_back_to_board(board)
-    back_link_to board.name, board, "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click click->turbo-navigation#backIfSamePath"
+  def link_back_to_board(board, prefer_referrer: [])
+    back_link_to board.name, board, "keydown.left@document->hotkey#click keydown.esc@document->hotkey#click click->turbo-navigation#backIfSamePath", prefer_referrer:
   end
 
   def link_to_edit_board(board)
diff --git a/app/javascript/controllers/turbo_navigation_controller.js b/app/javascript/controllers/turbo_navigation_controller.js
index d755342e9..8f47dac9b 100644
--- a/app/javascript/controllers/turbo_navigation_controller.js
+++ b/app/javascript/controllers/turbo_navigation_controller.js
@@ -1,8 +1,12 @@
 import { Controller } from "@hotwired/stimulus"
 
 export default class extends Controller {
+  static values = { label: String }
+  static targets = [ "referrerBackLink" ]
+
   rememberLocation() {
     sessionStorage.setItem("referrerUrl", window.location.href)
+    sessionStorage.setItem("referrerLabel", this.labelValue)
   }
 
   backIfSamePath(event) {
@@ -16,6 +20,19 @@ export default class extends Controller {
       Turbo.visit(this.#referrerUrl)
     }
   }
+
+  referrerBackLinkTargetConnected(link) {
+    if (!this.#referrerUrl || !this.#referrerLabel) { return }
+
+    const allowedPaths = (link.dataset.turboNavigationAllowedReferrerPaths || "").split(",")
+    const referrerPath = new URL(this.#referrerUrl).pathname
+    if (!allowedPaths.includes(referrerPath)) { return }
+
+    link.href = this.#referrerUrl
+    const strong = link.querySelector("strong")
+    if (strong) { strong.textContent = `Back to ${this.#referrerLabel}` }
+  }
+
   get #referrerPath() {
     if (!this.#referrerUrl) return null
     return new URL(this.#referrerUrl).pathname
@@ -24,4 +41,8 @@ export default class extends Controller {
   get #referrerUrl() {
     return sessionStorage.getItem("referrerUrl")
   }
+
+  get #referrerLabel() {
+    return sessionStorage.getItem("referrerLabel")
+  }
 }
diff --git a/app/views/cards/show.html.erb b/app/views/cards/show.html.erb
index fabd2ad02..fd9101d58 100644
--- a/app/views/cards/show.html.erb
+++ b/app/views/cards/show.html.erb
@@ -7,7 +7,7 @@
 
 <% content_for :header do %>
   <div class="header__actions header__actions--start">
-    <%= link_back_to_board(@card.board) %>
+    <%= link_back_to_board @card.board, prefer_referrer: [ cards_path, board_path(@card.board) ] %>
   </div>
 <% end %>
 
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index b83d199d2..2e54a82df 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -5,6 +5,7 @@
   <body class="<%= @body_class %>"
     data-controller="local-time timezone-cookie turbo-navigation theme bridge--title bridge--text-size bridge--insets"
     data-action="turbo:morph@window->local-time#refreshAll turbo:before-visit@document->turbo-navigation#rememberLocation"
+    data-turbo-navigation-label-value="<%= @page_title %>"
     data-platform="<%= platform.type %>"
     data-bridge-platform="<%= platform.bridge_name %>"
     data-bridge-components="<%= platform.bridge_components %>"
diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb
index 01bcbabeb..4e7854ea9 100644
--- a/test/application_system_test_case.rb
+++ b/test/application_system_test_case.rb
@@ -28,4 +28,10 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
   else
     driven_by :chrome_headless, screen_size: [ 1200, 1000 ]
   end
+
+  private
+    def sign_in_as(user)
+      visit session_transfer_url(user.identity.transfer_id, script_name: nil)
+      assert_current_path root_path
+    end
 end
diff --git a/test/system/back_link_navigation_test.rb b/test/system/back_link_navigation_test.rb
new file mode 100644
index 000000000..e46bff521
--- /dev/null
+++ b/test/system/back_link_navigation_test.rb
@@ -0,0 +1,38 @@
+require "application_system_test_case"
+
+class BackLinkNavigationTest < ApplicationSystemTestCase
+  test "card back link returns to board filter view when navigating from it" do
+    sign_in_as(users(:david))
+
+    filter_url = board_url(boards(:writebook), creator_ids: [ users(:david).id ])
+    visit filter_url
+    click_on cards(:logo).title
+
+    back_link = find("a.btn--back")
+    assert_selector "a.btn--back strong", text: "Back to Writebook"
+    back_link.click
+    assert_current_path filter_url, ignore_query: false
+  end
+
+  test "card back link returns to global filter view when navigating from it" do
+    sign_in_as(users(:kevin))
+
+    filter_url = cards_url(creator_ids: [ users(:kevin).id ])
+    visit filter_url
+    click_on cards(:text).title
+
+    assert_selector "a.btn--back strong", text: "Back to all boards"
+    find("a.btn--back").click
+    assert_current_path filter_url, ignore_query: false
+  end
+
+  test "card back link is not rewritten when navigating from a non-filter page" do
+    sign_in_as(users(:david))
+
+    visit account_settings_url
+    click_on "Invite people"
+    visit card_url(cards(:logo))
+
+    assert_selector "a.btn--back strong", text: "Back to Writebook"
+  end
+end
diff --git a/test/system/markdown_paste_test.rb b/test/system/markdown_paste_test.rb
new file mode 100644
index 000000000..5b723f4a4
--- /dev/null
+++ b/test/system/markdown_paste_test.rb
@@ -0,0 +1,44 @@
+require "application_system_test_case"
+
+class MarkdownPasteTest < ApplicationSystemTestCase
+  test "markdown paste adds block spacing" do
+    sign_in_as(users(:david))
+
+    visit card_url(cards(:layout))
+    find("lexxy-editor").click
+    paste_markdown("Hello\n\nWorld")
+
+    within("lexxy-editor") do
+      assert_selector "p", text: "Hello"
+      assert_selector "p br", visible: :all
+      assert_selector "p", text: "World"
+    end
+  end
+
+  test "markdown paste preserves line breaks" do
+    sign_in_as(users(:david))
+
+    visit card_url(cards(:layout))
+    find("lexxy-editor").click
+    paste_markdown("Hello\nWorld")
+
+    inner_html = find("lexxy-editor p", text: "Hello").native.property("innerHTML")
+    children = Nokogiri::HTML5.fragment(inner_html).children
+    assert_pattern do
+      children => [
+        { name: "span", inner_html: "Hello" },
+        { name: "br" },
+        { name: "span", inner_html: "World" }
+      ]
+    end
+  end
+
+  private
+    def paste_markdown(markdown)
+      page.execute_script(<<~JS, markdown)
+        const dt = new DataTransfer();
+        dt.setData("text/plain", arguments[0]);
+        document.activeElement.dispatchEvent(new ClipboardEvent("paste", { clipboardData: dt, bubbles: true }));
+      JS
+    end
+end
diff --git a/test/system/smoke_test.rb b/test/system/smoke_test.rb
index 5af13f890..467483fc1 100644
--- a/test/system/smoke_test.rb
+++ b/test/system/smoke_test.rb
@@ -76,38 +76,6 @@ class SmokeTest < ApplicationSystemTestCase
     assert_no_selector "div##{dom_id(notification)}"
   end
 
-  test "markdown paste adds block spacing" do
-    sign_in_as(users(:david))
-
-    visit card_url(cards(:layout))
-    find("lexxy-editor").click
-    paste_markdown("Hello\n\nWorld")
-
-    within("lexxy-editor") do
-      assert_selector "p", text: "Hello"
-      assert_selector "p br", visible: :all
-      assert_selector "p", text: "World"
-    end
-  end
-
-  test "markdown paste preserves line breaks" do
-    sign_in_as(users(:david))
-
-    visit card_url(cards(:layout))
-    find("lexxy-editor").click
-    paste_markdown("Hello\nWorld")
-
-    inner_html = find("lexxy-editor p", text: "Hello").native.property("innerHTML")
-    children = Nokogiri::HTML5.fragment(inner_html).children
-    assert_pattern do
-      children => [
-        { name: "span", inner_html: "Hello" },
-        { name: "br" },
-        { name: "span", inner_html: "World" }
-      ]
-    end
-  end
-
   test "dragging card to a new column" do
     sign_in_as(users(:david))
 
@@ -127,22 +95,9 @@ class SmokeTest < ApplicationSystemTestCase
   end
 
   private
-    def sign_in_as(user)
-      visit session_transfer_url(user.identity.transfer_id, script_name: nil)
-      assert_selector "h1", text: "Latest Activity"
-    end
-
     def fill_in_lexxy(selector = "lexxy-editor", with:)
       editor_element = find(selector)
       editor_element.set with
       page.execute_script("arguments[0].value = '#{with}'", editor_element)
     end
-
-    def paste_markdown(markdown)
-      page.execute_script(<<~JS, markdown)
-        const dt = new DataTransfer();
-        dt.setData("text/plain", arguments[0]);
-        document.activeElement.dispatchEvent(new ClipboardEvent("paste", { clipboardData: dt, bubbles: true }));
-      JS
-    end
 end

From 11df9c3589a87079af98c7b13497727bd76da84e Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 18 Mar 2026 22:03:36 -0400
Subject: [PATCH 106/107] Fix back navigation from activity page to cards
 (#2727)

Three changes needed to support navigating back from a card to the
activity page:

- Add root_path to the prefer_referrer allowlist on the card show page
- Switch event links from HTML target="_top" to data-turbo-frame="_top"
  so Turbo handles the navigation and turbo:before-visit fires to save
  the referrer
- Normalize trailing slashes in the referrer path comparison so
  /account_id and /account_id/ both match

ref: https://app.fizzy.do/5986089/cards/2390
---
 .../turbo_navigation_controller.js            |  5 ++--
 app/views/cards/show.html.erb                 |  2 +-
 app/views/events/event/_layout.html.erb       |  2 +-
 test/system/back_link_navigation_test.rb      | 24 +++++++++++++++++++
 4 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/app/javascript/controllers/turbo_navigation_controller.js b/app/javascript/controllers/turbo_navigation_controller.js
index 8f47dac9b..169fb93be 100644
--- a/app/javascript/controllers/turbo_navigation_controller.js
+++ b/app/javascript/controllers/turbo_navigation_controller.js
@@ -24,8 +24,9 @@ export default class extends Controller {
   referrerBackLinkTargetConnected(link) {
     if (!this.#referrerUrl || !this.#referrerLabel) { return }
 
-    const allowedPaths = (link.dataset.turboNavigationAllowedReferrerPaths || "").split(",")
-    const referrerPath = new URL(this.#referrerUrl).pathname
+    const stripTrailingSlash = path => path.replace(/\/$/, "")
+    const allowedPaths = (link.dataset.turboNavigationAllowedReferrerPaths || "").split(",").map(stripTrailingSlash)
+    const referrerPath = stripTrailingSlash(new URL(this.#referrerUrl).pathname)
     if (!allowedPaths.includes(referrerPath)) { return }
 
     link.href = this.#referrerUrl
diff --git a/app/views/cards/show.html.erb b/app/views/cards/show.html.erb
index fd9101d58..9acb305bf 100644
--- a/app/views/cards/show.html.erb
+++ b/app/views/cards/show.html.erb
@@ -7,7 +7,7 @@
 
 <% content_for :header do %>
   <div class="header__actions header__actions--start">
-    <%= link_back_to_board @card.board, prefer_referrer: [ cards_path, board_path(@card.board) ] %>
+    <%= link_back_to_board @card.board, prefer_referrer: [ root_path, cards_path, board_path(@card.board) ] %>
   </div>
 <% end %>
 
diff --git a/app/views/events/event/_layout.html.erb b/app/views/events/event/_layout.html.erb
index 4a78490e8..8b7d2d520 100644
--- a/app/views/events/event/_layout.html.erb
+++ b/app/views/events/event/_layout.html.erb
@@ -2,8 +2,8 @@
       id: dom_id(event, "timelined"),
       class: "event event--#{ event.action } #{ "golden-effect" if event.card.golden? } center-block flex flex-column full-width align-start justify-start position-relative",
       style: "--card-color: #{ card.closed? ? "var(--color-card-complete)" : card.color };",
-      target: "_top",
       data: {
+        turbo_frame: "_top",
         related_element_target: "related",
         related_element_group_value: card.id,
         action: "mouseover->related-element#highlight mouseout->related-element#unhighlight" } do %>
diff --git a/test/system/back_link_navigation_test.rb b/test/system/back_link_navigation_test.rb
index e46bff521..981115bf2 100644
--- a/test/system/back_link_navigation_test.rb
+++ b/test/system/back_link_navigation_test.rb
@@ -26,6 +26,30 @@ class BackLinkNavigationTest < ApplicationSystemTestCase
     assert_current_path filter_url, ignore_query: false
   end
 
+  test "card back link returns to activity page when navigating from it" do
+    sign_in_as(users(:david))
+
+    assert_text "Layout is broken"
+    click_on "Layout is broken"
+
+    assert_selector "a.btn--back strong", text: "Back to Home"
+    find("a.btn--back").click
+    assert_current_path root_path
+  end
+
+  test "card back link returns to activity page when navigating from it without trailing slash" do
+    sign_in_as(users(:david))
+
+    activity_url_without_trailing_slash = root_url.chomp("/")
+    visit activity_url_without_trailing_slash
+    assert_text "Layout is broken"
+    click_on "Layout is broken"
+
+    assert_selector "a.btn--back strong", text: "Back to Home"
+    find("a.btn--back").click
+    assert_current_path activity_url_without_trailing_slash
+  end
+
   test "card back link is not rewritten when navigating from a non-filter page" do
     sign_in_as(users(:david))
 

From cf10dbd91e0e0d0f79bfa1977f1b1250d44216dd Mon Sep 17 00:00:00 2001
From: Jorge Manrubia <jorge.manrubia@gmail.com>
Date: Thu, 19 Mar 2026 12:38:39 +0100
Subject: [PATCH 107/107] Add 1GB storage cap with staff bypass (#2729)

Re-applies the storage limit from #2713 (reverted in #2715) with an
exception for staff identities so our own account isn't blocked.
---
 app/assets/stylesheets/card-perma.css         |  8 +++
 app/assets/stylesheets/comments.css           |  8 +++
 app/views/cards/_messages.html.erb            |  6 +-
 .../cards/container/footer/_create.html.erb   |  2 +
 app/views/cards/drafts/_container.html.erb    |  6 +-
 .../concerns/card/storage_limited.rb          |  8 +++
 .../card/storage_limited/commenting.rb        |  9 +++
 .../concerns/card/storage_limited/creation.rb |  9 +++
 .../card/storage_limited/publishing.rb        |  9 +++
 saas/app/models/account/storage_limited.rb    | 14 +++++
 .../views/cards/comments/saas/_new.html.erb   |  5 ++
 .../saas/_storage_limit_exceeded.html.erb     | 12 ++++
 .../container/footer/saas/_create.html.erb    |  5 ++
 .../saas/_storage_limit_exceeded.html.erb     |  8 +++
 .../saas/_storage_limit_notice.html.erb       |  6 ++
 saas/lib/fizzy/saas/engine.rb                 |  4 ++
 .../card/storage_limited/commenting_test.rb   | 44 +++++++++++++
 .../card/storage_limited/creation_test.rb     | 63 +++++++++++++++++++
 .../card/storage_limited/publishing_test.rb   | 35 +++++++++++
 .../controllers/card/storage_limited_test.rb  | 39 ++++++++++++
 .../comment/storage_limited_test.rb           | 37 +++++++++++
 .../models/account/storage_limited_test.rb    | 39 ++++++++++++
 22 files changed, 374 insertions(+), 2 deletions(-)
 create mode 100644 saas/app/controllers/concerns/card/storage_limited.rb
 create mode 100644 saas/app/controllers/concerns/card/storage_limited/commenting.rb
 create mode 100644 saas/app/controllers/concerns/card/storage_limited/creation.rb
 create mode 100644 saas/app/controllers/concerns/card/storage_limited/publishing.rb
 create mode 100644 saas/app/models/account/storage_limited.rb
 create mode 100644 saas/app/views/cards/comments/saas/_new.html.erb
 create mode 100644 saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
 create mode 100644 saas/app/views/cards/container/footer/saas/_create.html.erb
 create mode 100644 saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
 create mode 100644 saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
 create mode 100644 saas/test/controllers/card/storage_limited/commenting_test.rb
 create mode 100644 saas/test/controllers/card/storage_limited/creation_test.rb
 create mode 100644 saas/test/controllers/card/storage_limited/publishing_test.rb
 create mode 100644 saas/test/controllers/card/storage_limited_test.rb
 create mode 100644 saas/test/controllers/comment/storage_limited_test.rb
 create mode 100644 saas/test/models/account/storage_limited_test.rb

diff --git a/app/assets/stylesheets/card-perma.css b/app/assets/stylesheets/card-perma.css
index 6d966d0ae..407b1beac 100644
--- a/app/assets/stylesheets/card-perma.css
+++ b/app/assets/stylesheets/card-perma.css
@@ -543,4 +543,12 @@
       }
     }
   }
+
+  .card-perma__account-limit-message {
+    background-color: var(--color-canvas);
+    border: 2px solid var(--color-container);
+    border-radius: 4px;
+    margin-block-start: calc(var(--padding-block) / -2);
+    padding: 1ch 2ch;
+  }
 }
diff --git a/app/assets/stylesheets/comments.css b/app/assets/stylesheets/comments.css
index 2369d62b3..05c51dc57 100644
--- a/app/assets/stylesheets/comments.css
+++ b/app/assets/stylesheets/comments.css
@@ -220,4 +220,12 @@
       display: none;
     }
   }
+
+  .comment-by-system--account-limit {
+    --stripe-color: oklch(var(--lch-blue-lightest));
+
+    .comment__content {
+      padding: 3ch;
+    }
+  }
 }
diff --git a/app/views/cards/_messages.html.erb b/app/views/cards/_messages.html.erb
index a2784e72a..c51ab6d8b 100644
--- a/app/views/cards/_messages.html.erb
+++ b/app/views/cards/_messages.html.erb
@@ -1,7 +1,11 @@
 <%= messages_tag(card) do %>
   <% if card.published? %>
     <%= render partial: "cards/comments/comment", collection: card.comments.preloaded.chronologically, cached: true %>
-    <%= render "cards/comments/new", card: card %>
+    <% if Fizzy.saas? %>
+      <%= render "cards/comments/saas/new", card: card %>
+    <% else %>
+      <%= render "cards/comments/new", card: card %>
+    <% end %>
 
     <%= render "cards/comments/watchers", card: card %>
   <% end %>
diff --git a/app/views/cards/container/footer/_create.html.erb b/app/views/cards/container/footer/_create.html.erb
index 648beffd1..4e5a83e20 100644
--- a/app/views/cards/container/footer/_create.html.erb
+++ b/app/views/cards/container/footer/_create.html.erb
@@ -13,5 +13,7 @@
       <span>Create and add another</span>
     <% end %>
   </div>
+
+  <%= render "cards/container/footer/saas/storage_limit_notice" if Fizzy.saas? %>
 </div>
 
diff --git a/app/views/cards/drafts/_container.html.erb b/app/views/cards/drafts/_container.html.erb
index 9ffc04711..fa7134b55 100644
--- a/app/views/cards/drafts/_container.html.erb
+++ b/app/views/cards/drafts/_container.html.erb
@@ -26,5 +26,9 @@
     </div>
   <% end %>
 
-  <%= render "cards/container/footer/create", card: card %>
+  <% if Fizzy.saas? %>
+    <%= render "cards/container/footer/saas/create", card: card %>
+  <% else %>
+    <%= render "cards/container/footer/create", card: card %>
+  <% end %>
 </section>
diff --git a/saas/app/controllers/concerns/card/storage_limited.rb b/saas/app/controllers/concerns/card/storage_limited.rb
new file mode 100644
index 000000000..0c0ef949b
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited.rb
@@ -0,0 +1,8 @@
+module Card::StorageLimited
+  extend ActiveSupport::Concern
+
+  private
+    def ensure_within_storage_limit
+      head :forbidden if Current.account.exceeding_storage_limit? && !Current.identity.staff?
+    end
+end
diff --git a/saas/app/controllers/concerns/card/storage_limited/commenting.rb b/saas/app/controllers/concerns/card/storage_limited/commenting.rb
new file mode 100644
index 000000000..a4b7e3307
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited/commenting.rb
@@ -0,0 +1,9 @@
+module Card::StorageLimited::Commenting
+  extend ActiveSupport::Concern
+
+  included do
+    include Card::StorageLimited
+
+    before_action :ensure_within_storage_limit, only: :create
+  end
+end
diff --git a/saas/app/controllers/concerns/card/storage_limited/creation.rb b/saas/app/controllers/concerns/card/storage_limited/creation.rb
new file mode 100644
index 000000000..9d894779d
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited/creation.rb
@@ -0,0 +1,9 @@
+module Card::StorageLimited::Creation
+  extend ActiveSupport::Concern
+
+  included do
+    include Card::StorageLimited
+
+    before_action :ensure_within_storage_limit, only: :create, if: -> { request.format.json? }
+  end
+end
diff --git a/saas/app/controllers/concerns/card/storage_limited/publishing.rb b/saas/app/controllers/concerns/card/storage_limited/publishing.rb
new file mode 100644
index 000000000..abf7731a4
--- /dev/null
+++ b/saas/app/controllers/concerns/card/storage_limited/publishing.rb
@@ -0,0 +1,9 @@
+module Card::StorageLimited::Publishing
+  extend ActiveSupport::Concern
+
+  included do
+    include Card::StorageLimited
+
+    before_action :ensure_within_storage_limit, only: :create
+  end
+end
diff --git a/saas/app/models/account/storage_limited.rb b/saas/app/models/account/storage_limited.rb
new file mode 100644
index 000000000..dbab32b5d
--- /dev/null
+++ b/saas/app/models/account/storage_limited.rb
@@ -0,0 +1,14 @@
+module Account::StorageLimited
+  extend ActiveSupport::Concern
+
+  STORAGE_LIMIT = 1.gigabyte
+  NEAR_STORAGE_LIMIT_THRESHOLD = 500.megabytes
+
+  def exceeding_storage_limit?
+    bytes_used > STORAGE_LIMIT
+  end
+
+  def nearing_storage_limit?
+    !exceeding_storage_limit? && bytes_used > STORAGE_LIMIT - NEAR_STORAGE_LIMIT_THRESHOLD
+  end
+end
diff --git a/saas/app/views/cards/comments/saas/_new.html.erb b/saas/app/views/cards/comments/saas/_new.html.erb
new file mode 100644
index 000000000..ee5f3fe6e
--- /dev/null
+++ b/saas/app/views/cards/comments/saas/_new.html.erb
@@ -0,0 +1,5 @@
+<% if Current.account.exceeding_storage_limit? && !Current.identity.staff? %>
+  <%= render "cards/comments/saas/storage_limit_exceeded" %>
+<% else %>
+  <%= render "cards/comments/new", card: card %>
+<% end %>
diff --git a/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
new file mode 100644
index 000000000..82ab7f25e
--- /dev/null
+++ b/saas/app/views/cards/comments/saas/_storage_limit_exceeded.html.erb
@@ -0,0 +1,12 @@
+<div class="comment-by-system comment-by-system--account-limit">
+  <div class="comment align-start full-width">
+    <div class="comment__content flex flex-column flex-item-grow full-width">
+      <div class="comment__body lexxy-content">
+        <div class="action-text-content">
+          <strong>This account has used all the included free storage (<%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %>).</strong>
+          <div><%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.</div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/saas/app/views/cards/container/footer/saas/_create.html.erb b/saas/app/views/cards/container/footer/saas/_create.html.erb
new file mode 100644
index 000000000..ad10443c5
--- /dev/null
+++ b/saas/app/views/cards/container/footer/saas/_create.html.erb
@@ -0,0 +1,5 @@
+<% if Current.account.exceeding_storage_limit? && !Current.identity.staff? %>
+  <%= render "cards/container/footer/saas/storage_limit_exceeded" %>
+<% else %>
+  <%= render "cards/container/footer/create", card: card %>
+<% end %>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
new file mode 100644
index 000000000..ca0dc9be0
--- /dev/null
+++ b/saas/app/views/cards/container/footer/saas/_storage_limit_exceeded.html.erb
@@ -0,0 +1,8 @@
+<div class="card-perma__notch card-perma__notch--bottom">
+  <div class="card-perma__account-limit-message">
+    <strong>This account has used all the included free storage (<%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %>).</strong>
+    <div>
+      <%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", target: "_blank" %> for unlimited storage.
+    </div>
+  </div>
+</div>
diff --git a/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb b/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
new file mode 100644
index 000000000..a45d2ef74
--- /dev/null
+++ b/saas/app/views/cards/container/footer/saas/_storage_limit_notice.html.erb
@@ -0,0 +1,6 @@
+<% if Current.account.nearing_storage_limit? && !Current.identity.staff? %>
+  <div class="txt-small">
+    This account has used <strong><%= number_to_human_size(Current.account.bytes_used) %></strong> of <strong><%= number_to_human_size(Account::StorageLimited::STORAGE_LIMIT) %></strong> storage.
+    <div><%= link_to "Self-host Fizzy", "https://github.com/basecamp/fizzy", class: "txt-current txt-underline", target: "_blank" %> for unlimited storage.</div>
+  </div>
+<% end %>
diff --git a/saas/lib/fizzy/saas/engine.rb b/saas/lib/fizzy/saas/engine.rb
index dea321cfc..673be1147 100644
--- a/saas/lib/fizzy/saas/engine.rb
+++ b/saas/lib/fizzy/saas/engine.rb
@@ -133,10 +133,14 @@ module Fizzy
       end
 
       config.to_prepare do
+        ::Account.include Account::StorageLimited
         ::Identity.include Authorization::Identity, Identity::Devices
         ::Session.include Session::Devices
         ::Signup.prepend Signup
         ApplicationController.include Authorization::Controller
+        CardsController.include(Card::StorageLimited::Creation)
+        Cards::CommentsController.include(Card::StorageLimited::Commenting)
+        Cards::PublishesController.include(Card::StorageLimited::Publishing)
 
         Notification.register_push_target(:native)
 
diff --git a/saas/test/controllers/card/storage_limited/commenting_test.rb b/saas/test/controllers/card/storage_limited/commenting_test.rb
new file mode 100644
index 000000000..07c68ed45
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited/commenting_test.rb
@@ -0,0 +1,44 @@
+require "test_helper"
+
+class Card::StorageLimited::CommentingTest < ActionDispatch::IntegrationTest
+  test "cannot create comments when storage limit exceeded" do
+    sign_in_as :david
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+    Identity.any_instance.stubs(:staff?).returns(false)
+
+    assert_no_difference -> { Comment.count } do
+      post card_comments_path(cards(:logo), script_name: accounts(:"37s").slug),
+        params: { comment: { body: "Blocked comment" } },
+        as: :turbo_stream
+    end
+
+    assert_response :forbidden
+  end
+
+  test "can create comments when under storage limit" do
+    sign_in_as :david
+
+    assert_difference -> { Comment.count } do
+      post card_comments_path(cards(:logo), script_name: accounts(:"37s").slug),
+        params: { comment: { body: "Allowed comment" } },
+        as: :turbo_stream
+    end
+
+    assert_response :success
+  end
+
+  test "staff can create comments even when storage limit exceeded" do
+    sign_in_as :david
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert_difference -> { Comment.count } do
+      post card_comments_path(cards(:logo), script_name: accounts(:"37s").slug),
+        params: { comment: { body: "Staff comment" } },
+        as: :turbo_stream
+    end
+
+    assert_response :success
+  end
+end
diff --git a/saas/test/controllers/card/storage_limited/creation_test.rb b/saas/test/controllers/card/storage_limited/creation_test.rb
new file mode 100644
index 000000000..ef364b6eb
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited/creation_test.rb
@@ -0,0 +1,63 @@
+require "test_helper"
+
+class Card::StorageLimited::CreationTest < ActionDispatch::IntegrationTest
+  test "cannot create cards via JSON when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert_no_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug),
+        params: { card: { title: "Blocked card" } },
+        as: :json
+    end
+
+    assert_response :forbidden
+  end
+
+  test "can create cards via HTML when storage limit exceeded since they become drafts" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+    accounts(:initech).update_column(:cards_count, 100)
+    boards(:miltons_wish_list).cards.drafted.where(creator: users(:mike)).destroy_all
+
+    assert_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug)
+    end
+
+    assert_response :redirect
+    assert Card.last.drafted?
+  end
+
+  test "can create cards via JSON when under storage limit" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(500.megabytes)
+    accounts(:initech).update_column(:cards_count, 100)
+
+    assert_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug),
+        params: { card: { title: "Allowed card" } },
+        as: :json
+    end
+
+    assert_response :created
+  end
+
+  test "staff can create cards via JSON even when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+    Identity.any_instance.stubs(:staff?).returns(true)
+    accounts(:initech).update_column(:cards_count, 100)
+
+    assert_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug),
+        params: { card: { title: "Staff card" } },
+        as: :json
+    end
+
+    assert_response :created
+  end
+end
diff --git a/saas/test/controllers/card/storage_limited/publishing_test.rb b/saas/test/controllers/card/storage_limited/publishing_test.rb
new file mode 100644
index 000000000..5ee9ed318
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited/publishing_test.rb
@@ -0,0 +1,35 @@
+require "test_helper"
+
+class Card::StorageLimited::PublishingTest < ActionDispatch::IntegrationTest
+  test "cannot publish cards when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :forbidden
+    assert cards(:unfinished_thoughts).reload.drafted?
+  end
+
+  test "can publish cards when under storage limit" do
+    sign_in_as :mike
+
+    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :redirect
+    assert cards(:unfinished_thoughts).reload.published?
+  end
+
+  test "staff can publish cards even when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+    Identity.any_instance.stubs(:staff?).returns(true)
+
+    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :redirect
+    assert cards(:unfinished_thoughts).reload.published?
+  end
+end
diff --git a/saas/test/controllers/card/storage_limited_test.rb b/saas/test/controllers/card/storage_limited_test.rb
new file mode 100644
index 000000000..24078a964
--- /dev/null
+++ b/saas/test/controllers/card/storage_limited_test.rb
@@ -0,0 +1,39 @@
+require "test_helper"
+
+class Card::StorageLimitedTest < ActionDispatch::IntegrationTest
+  test "draft card shows storage limit notice instead of create buttons when limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :success
+    assert_select ".card-perma__notch" do
+      assert_select "strong", text: /used all/
+      assert_select "a[href='https://github.com/basecamp/fizzy']", text: "Self-host Fizzy"
+    end
+    assert_select ".card-perma__notch-new-card-buttons", count: 0
+  end
+
+  test "draft card shows create buttons when under storage limit" do
+    sign_in_as :mike
+
+    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :success
+    assert_select ".card-perma__notch-new-card-buttons"
+  end
+
+  test "staff sees create buttons even when storage limit exceeded" do
+    sign_in_as :mike
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+    Identity.any_instance.stubs(:staff?).returns(true)
+
+    get card_draft_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :success
+    assert_select ".card-perma__notch-new-card-buttons"
+  end
+end
diff --git a/saas/test/controllers/comment/storage_limited_test.rb b/saas/test/controllers/comment/storage_limited_test.rb
new file mode 100644
index 000000000..a771902e5
--- /dev/null
+++ b/saas/test/controllers/comment/storage_limited_test.rb
@@ -0,0 +1,37 @@
+require "test_helper"
+
+class Comment::StorageLimitedTest < ActionDispatch::IntegrationTest
+  test "published card shows storage limit notice instead of comment form when limit exceeded" do
+    sign_in_as :david
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+    Identity.any_instance.stubs(:staff?).returns(false)
+
+    get card_path(cards(:logo), script_name: accounts(:"37s").slug)
+
+    assert_response :success
+    assert_select "strong", text: /used all/
+    assert_select "a[href='https://github.com/basecamp/fizzy']", text: "Self-host Fizzy"
+    assert_select "##{dom_id(cards(:logo), :new_comment)}", count: 0
+  end
+
+  test "published card shows comment form when under storage limit" do
+    sign_in_as :david
+
+    get card_path(cards(:logo), script_name: accounts(:"37s").slug)
+
+    assert_response :success
+    assert_select "##{dom_id(cards(:logo), :new_comment)}"
+  end
+
+  test "staff sees comment form even when storage limit exceeded" do
+    sign_in_as :david
+
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    get card_path(cards(:logo), script_name: accounts(:"37s").slug)
+
+    assert_response :success
+    assert_select "##{dom_id(cards(:logo), :new_comment)}"
+  end
+end
diff --git a/saas/test/models/account/storage_limited_test.rb b/saas/test/models/account/storage_limited_test.rb
new file mode 100644
index 000000000..f587d9ef1
--- /dev/null
+++ b/saas/test/models/account/storage_limited_test.rb
@@ -0,0 +1,39 @@
+require "test_helper"
+
+class Account::StorageLimitedTest < ActiveSupport::TestCase
+  test "exceeding storage limit when bytes used exceeds 1 GB" do
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert accounts(:initech).exceeding_storage_limit?
+  end
+
+  test "not exceeding storage limit when bytes used equals 1 GB" do
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte)
+
+    assert_not accounts(:initech).exceeding_storage_limit?
+  end
+
+  test "not exceeding storage limit when under 1 GB" do
+    Account.any_instance.stubs(:bytes_used).returns(500.megabytes)
+
+    assert_not accounts(:initech).exceeding_storage_limit?
+  end
+
+  test "nearing storage limit when within 500 MB of the limit" do
+    Account.any_instance.stubs(:bytes_used).returns(600.megabytes)
+
+    assert accounts(:initech).nearing_storage_limit?
+  end
+
+  test "not nearing storage limit when well under the threshold" do
+    Account.any_instance.stubs(:bytes_used).returns(400.megabytes)
+
+    assert_not accounts(:initech).nearing_storage_limit?
+  end
+
+  test "not nearing storage limit when already exceeding it" do
+    Account.any_instance.stubs(:bytes_used).returns(1.gigabyte + 1)
+
+    assert_not accounts(:initech).nearing_storage_limit?
+  end
+end