Add React hooks for the passkey provider

[Nicolapps]

Adds the React client for the passkey provider, exported at @convex-dev/auth/providers/passkey/react. This is the first browser-side WebAuthn code in the repo.

• useSignInWithPasskey({ startSignIn, finishSignIn, finishSignUp }) → { signIn({ username }), pending }: orchestrates start → credentials.create()/get() → finish → setSession.
• usePasskeyAutofill({ startAutofillSignIn, finishSignIn }) → { available, status, lastError, cancel }: keeps a conditional-mediation request pending and refreshes the challenge every ~8 minutes (server TTL is 10). One async loop per effect run, StrictMode-safe by construction; abort reasons (STOP/REFRESH/PAUSE) drive the state machine.
• A module-scoped coordinator lets the modal flow pause the pending autofill request and resume it afterwards — browsers reject a modal ceremony while a conditional request is pending on the same page. The residual double-setSession race is harmless and commented.
• Client-side failures fold into the result union (CEREMONY_ABORTED, WEBAUTHN_UNSUPPORTED, OTHER_ERROR with cause), extending the password provider's OTHER_ERROR pattern, so callers handle every failure through one userError switch.
• WebAuthn details: raw bytes end to end (no base64), rawId as the credential id, pubKeyCredParams exactly ES256/RS256, discoverable credentials + user verification required.

Part 4/5 of the username+passkey provider stack.

Test plan

• pnpm typecheck / pnpm lint green.
• Exercised in the react-passkey example (PR 5/5), including the modal-while-autofill interleaving.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
auth-v2	Ready	Preview	Aug 14, 2026 11:15pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
convex-auth-docs	Ignored		Aug 14, 2026 11:15pm

[Nicolapps]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Add the react-passkey example app #464
• Add React hooks for the passkey provider #463 👈 (View in Graphite)
• Add the UsernamePasskey provider #462
• Passkey component: add a checkRegistration readonly function #461
• Add tests for passkey handles #467
• Passkey component: add an indirection for the ID used in the passkey (“handle”) #460
• Erase expired passkey challenges in the background #445
• Extract a shared signUpWithUsername helper #471
• reboot

This stack of pull requests is managed by Graphite. Learn more about stacking.

[pkg-pr-new]

npm i https://pkg.pr.new/@convex-dev/auth@463

commit: 486c809