v0.11.0

0.11.0 (2026-07-31)

⚠ BREAKING CHANGES

• ui: PasskeyVerify's fluent label()/loadingLabel()/separator() setters are gone — pass named arguments to make().
• client: the oidc-client.handlers and oidc-client.routes.* config keys are removed — the route table is fixed and oidc-client.enabled=false disables it; HandlerConfig and HandlerRegistrar are gone; OidcClientFake::issuer() and forUser() are removed (set the oidc-client.issuer config before fake(), use loginAs()).
• server: Oidc::issuer() and Oidc::handlerConfig() are removed (use Issuer::url() / Handler::config()); FactorProvider::verify() takes a plain array instead of FactorResponse; RegisterView::respond() and PasswordConfirmationView::respond() lost their prompt argument; EnvironmentStore is removed (type-hint EnvironmentFile); AuthorizationCodeResult::json() is removed (use ->response->json()); token-exchange audiences accept http(s) URLs or any urn: string.
• server: host user models must be uuid-keyed (e.g. HasUuids) — integer user ids no longer fit the uuid reference columns. The laravel/passkeys migration derives its user_id type from the user model automatically.
• server: the shipped migrations changed in place — existing installs must re-run them (fresh migrate) or convert the columns manually. The sid claim and all enrollment ids are now uuid-formatted strings. The vendor laravel/passkeys table keeps its own key scheme; publish its migration to change it.
• server: the FactorAuthenticatable contract is gone — user models only need to be Eloquent models (plus PasskeyUser for webauthn). Type hints against it become Model/PasskeyUser.
• ui: the oidc.passkey-registration component props changed from optionsUrl/submitUrl to beginUrl/confirmUrl.
• server: the three identity.passkey registration/destroy routes are gone (use identity.two-factor.enroll/confirm/revoke with provider=webauthn), and manually seeding only login.id into the session no longer yields a totp challenge — seed login.factor as well.
• ui: PasskeysTable (oidc.passkeys) and DeletePasskeyAction (oidc.passkeys.delete) are removed — compose TwoFactorMethodsTable (oidc.two-factor.methods) with RevokeFactorAction instead. The security.passkeys translation group is gone and the two-factor enable/disable copy changed shape ('Add :method' / 'Disable two-factor authentication').
• server: the TOTP-specific routes identity.two-factor.qr-code, identity.two-factor.secret-key, identity.two-factor.recovery-codes, and identity.two-factor.regenerate-recovery-codes and their controllers are removed. The QR code and secret ship in the TOTP begin-enrollment metadata (qr_svg, qr_url); recovery codes are read and regenerated by enrolling the recovery_code provider.
• server: the challenge_providers default now includes webauthn, so a password login by a user with an enrolled passkey is challenged with that passkey as second factor. Set the config to ['totp'] to restore the old behavior.

Features

• client: fixed route table, slimmer validator and testing internals (4813575)
• server: boot-safe Oidc facade, leaner internals, new auth APIs (0e57d32)
• server: enrollable webauthn and recovery-code providers, retire legacy TOTP endpoints (1dca842)
• server: native uuid columns for user references (b14b44a)
• server: offer every challengeable factor and allow switching mid-challenge (7cae8da)
• server: single passkey registration path and strict pending-challenge state (57f37ff)
• server: uuid primary keys for every package table (26f7455)
• ui: drive passkey registration through the generic webauthn ceremony (6fd44cb)
• ui: named-argument PasskeyVerify, inlined single-use seams (0cbafe5)
• ui: provider-parameterized MFA components and challenge factor picker (53d3323)
• ui: unified methods table, recovery-code display, per-enrollment picker (363fd24)

Refactoring

• server: providers own factor storage, drop FactorAuthenticatable (60b4e3d)

Documentation

• cover the remaining 0.11.0 breaking changes in the upgrade guide (16a071b)
• upgrade guide and self-SSO testing recipe (fdc9c7a)