chore(release): 0.5.1 - #47

A patch release: nothing here breaks. Credentials registered under 0.5.0 keep working, the derived did:key is unchanged, and no peer has to move in step with another — unlike 0.4.0 and 0.5.0, both of which did.

What is in it

• The WebAuthn user handle is random (user.id is built from the typed user name, which the spec forbids and which silently replaces passkeys #45, fix: stop deriving the WebAuthn user handle from the typed name #46). It was the UTF-8 of whatever the caller passed as userId, so an authenticator — which keeps one credential per (rp.id, user.id) and replaces it when both match — silently destroyed the first passkey when a second person on the same device used the same name, taking the DID and everything signed under it. 64 random bytes now; the typed value stays as user.name, the label the picker shows.
• largeBlob keystores actually persist their secret key (fix: record what the authenticator agreed to, not just what the browser offers #43). The record carried secretKey: sk, // Will be moved to largeBlob and nothing ever moved it, so choosing largeBlob produced a keystore that worked for exactly one session.
• The credential carries the authenticator's own answer on extension support (fix: record what the authenticator agreed to, not just what the browser offers #43), not the browser's guess. A client can support largeBlob while the key in front of it does not, and only the ceremony settles that.
• Extension detection asks getClientCapabilities() (WebAuthn demo fails: hmac-secret output missing + largeBlob unavailable when WebAuthnInterceptor popup closes #9, fix: detect WebAuthn extensions by asking the browser #42) instead of probing a prototype that never carried the properties. The old test returned false in every browser ever shipped, which had the encrypted-keystore demo disabling its own headline feature everywhere.

For consumers

One behavioural difference worth naming in your own UI: re-registering under a name used before now adds a passkey instead of replacing one. That is the point — a replaced passkey is data loss, a second entry is a choice — but a picker can now show several, so labels want to be distinguishable.

Three consumer PRs are already open as drafts waiting on this release: simple-todo#198, simple-todo#199, yogasuci#85.

Version choice

0.5.1, not 0.6.0. In this repo's 0.x history the minor slot has been the breaking one — 0.4.0 and 0.5.0 both changed bytes that peers had to agree on, while 0.4.1 and 0.4.2 carried features and fixes as patches. Nothing in this release forces a coordinated upgrade.

Verification

67 node tests pass against the bumped version; prettier clean.

After merge, publishing is a tag push: git tag v0.5.1 && git push origin v0.5.1 runs the full suite in release.yml and publishes via OIDC.