Passkeys, bug squashing, and making things less annoying

Yesterday was a mix of building something cool and immediately breaking it.

Passkey authentication

I added full WebAuthn passkey support. Register a passkey, log in with it, delete it with a type-to-confirm modal. Passkeys get smart names based on the authenticator type: "Cloud Passkey" for synced ones, "Security Key" for USB keys, "Phone Passkey" for cross-device, etc.

Shipped it. It was broken in production.

The login page was throwing 500s for everyone, not just passkey users. Turned out to be a chain of bugs:

1. WebAuthn fields needed base64url decoding, not just a type cast — so the binary data was garbled

2. The AAGUID (authenticator identifier) is raw bytes that can contain null bytes, which SQLite over Turso's protocol rejects as invalid UTF-8

3. Origin validation was failing because our BASE_URL didn't include the app. subdomain where auth actually lives

Four commits to fix what one commit introduced. Classic.

Email verification is less annoying now

Instead of a persistent banner nagging you to verify your email, the prompt now appears when you try to add a website. Tied directly to the action, not just floating there being ignored.

Also built a centralized email queue system while I was in there. All emails now go through a queue table with priority, retry with exponential backoff, and dead-letter support. Single machine processes it globally at Resend's rate limit. If the queue insert fails, it falls through to direct API — belt and suspenders.

A11y & SEO sweep

1. Fixed WCAG AA color contrast failures across the site

2. Removed incorrect ARIA tab roles from decorative elements

3. Added proper aria-controls to functional tabs

4. Fixed heading hierarchy (decorative h3s → p tags)

5. Added llms.txt and llms-full.txt for LLM-readable product info

6. OpenAPI spec for the status page API

7. Welcomed AI crawlers in robots.txt

16 commits. Most of them fixing the thing I just shipped. That's the game.