chore(repo): Build and publish native passkeys binaries on production releases

.changeset/config.json

@@ -8,7 +8,15 @@
   ],
   "commit": false,
   "ignore": [],
-  "fixed": [],
+  "fixed": [
+    [
+      "@clerk/electron-passkeys",
+      "@clerk/electron-passkeys-darwin-arm64",
+      "@clerk/electron-passkeys-darwin-x64",
+      "@clerk/electron-passkeys-win32-arm64-msvc",
+      "@clerk/electron-passkeys-win32-x64-msvc"
+    ]
+  ],
   "linked": [],
   "access": "public",
   "baseBranch": "origin/main",

.changeset/electron-passkeys-native-binaries.md

@@ -0,0 +1,5 @@
+---
+'@clerk/electron-passkeys': patch
+---
+
+Introduce native passkey (WebAuthn) support for Clerk's Electron SDK, with prebuilt binaries for macOS (arm64 and x64) and Windows (arm64 and x64).

.github/workflows/electron-passkeys.yml

@@ -0,0 +1,105 @@
+name: Electron Passkeys Native Build
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: electron-passkeys-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build ${{ matrix.settings.target }}
+    runs-on: ${{ matrix.settings.host }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - host: macos-14
+            target: aarch64-apple-darwin
+          - host: macos-14
+            target: x86_64-apple-darwin
+          - host: windows-latest
+            target: x86_64-pc-windows-msvc
+          - host: windows-latest
+            target: aarch64-pc-windows-msvc
+    defaults:
+      run:
+        working-directory: packages/electron-passkeys
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.settings.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: packages/electron-passkeys
+
+      - name: Install dependencies
+        run: pnpm install --filter @clerk/electron-passkeys... --frozen-lockfile --ignore-scripts
+        working-directory: .
+
+      - name: Build native module
+        run: pnpm build:native --target ${{ matrix.settings.target }}
+
+      - name: Smoke test (host-native targets only)
+        if: matrix.settings.target == 'aarch64-apple-darwin' || matrix.settings.target == 'x86_64-pc-windows-msvc'
+        run: node -e "const m = require('./index.js'); console.log('isAvailable:', m.isAvailable(), 'capabilities:', JSON.stringify(m.capabilities())); if (!m.isAvailable()) throw new Error('the loader did not find the freshly built native binary');"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bindings-${{ matrix.settings.target }}
+          path: packages/electron-passkeys/electron-passkeys.*.node
+          if-no-files-found: error
+
+  package:
+    name: Assemble platform packages
+    needs: build
+    runs-on: blacksmith-8vcpu-ubuntu-2204
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: packages/electron-passkeys
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - uses: pnpm/action-setup@v4
+
+      - name: Install dependencies
+        run: pnpm install --filter @clerk/electron-passkeys... --frozen-lockfile --ignore-scripts
+        working-directory: .
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: packages/electron-passkeys/artifacts
+
+      - name: Move binaries into per-platform npm packages
+        run: pnpm artifacts
+
+      - name: Verify every platform package contains its binary
+        run: node scripts/check-electron-passkeys-binaries.mjs packages/electron-passkeys/npm
+        working-directory: .
+
+      - name: Upload assembled platform binaries
+        uses: actions/upload-artifact@v4
+        with:
+          name: electron-passkeys-npm
+          path: packages/electron-passkeys/npm/**/*.node
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/release.yml

@@ -27,6 +27,7 @@ jobs:
     timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}
 
     permissions:
+      actions: read
       contents: write
       id-token: write
       packages: write
@@ -64,9 +65,31 @@ jobs:
       - name: Upgrade npm for trusted publishing
         run: npx npm@11 install -g npm@11
 
+      - name: Determine whether electron-passkeys is about to publish
+        id: detect-native
+        run: node scripts/detect-electron-passkeys-publish.mjs >> "$GITHUB_OUTPUT"
+
       - name: Build release
         run: pnpm turbo build $TURBO_ARGS --force
 
+      - name: Download electron-passkeys native binaries
+        if: ${{ steps.detect-native.outputs.should-build == 'true' }}
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
+        with:
+          github_token: ${{ github.token }}
+          workflow: electron-passkeys.yml
+          name: electron-passkeys-npm
+          path: packages/electron-passkeys/npm
+          branch: ${{ github.ref_name }}
+          event: workflow_dispatch
+          workflow_conclusion: success
+          search_artifacts: true
+          allow_forks: false
+
+      - name: Verify electron-passkeys binaries are present
+        if: ${{ steps.detect-native.outputs.should-build == 'true' }}
+        run: node scripts/check-electron-passkeys-binaries.mjs packages/electron-passkeys/npm
+
       - name: Create Release PR
         id: changesets
         uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1

scripts/canary.mjs

@@ -2,10 +2,18 @@
 
 import { $, echo } from 'zx';
 
-import { constants, getChangesetIgnoredPackages, getPackageNames, pinWorkspaceDeps } from './common.mjs';
+import {
+  constants,
+  getChangesetIgnoredPackages,
+  getPackageNames,
+  isElectronPasskeysPackage,
+  pinWorkspaceDeps,
+} from './common.mjs';
 
 const ignoredPackages = await getChangesetIgnoredPackages();
-const packageNames = (await getPackageNames()).filter(name => !ignoredPackages.has(name));
+const packageNames = (await getPackageNames()).filter(
+  name => !ignoredPackages.has(name) && !isElectronPasskeysPackage(name),
+);
 const packageEntries = packageNames.map(name => `'${name}': patch`).join('\n');
 
 const snapshot = `---

scripts/check-electron-passkeys-binaries.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+
+import { readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const DEFAULT_NPM_DIR = 'packages/electron-passkeys/npm';
+
+export async function findMissingBinaries(npmDir) {
+  const entries = await readdir(npmDir, { withFileTypes: true });
+  const missing = [];
+
+  for (const entry of entries.filter(entry => entry.isDirectory()).sort((a, b) => a.name.localeCompare(b.name))) {
+    const dir = resolve(npmDir, entry.name);
+    const files = await readdir(dir, { withFileTypes: true });
+    const count = files.filter(file => file.isFile() && file.name.endsWith('.node')).length;
+
+    if (count !== 1) {
+      missing.push({ dir, count });
+    }
+  }
+
+  return missing;
+}
+
+export function formatBinaryCountError(dir, count) {
+  const packageType = count === 0 ? 'empty' : 'invalid';
+
+  return `::error::${dir} has ${count} .node binaries (expected exactly 1); publishing it would ship an ${packageType} package`;
+}
+
+async function main() {
+  const npmDir = process.argv[2] || DEFAULT_NPM_DIR;
+  let missing;
+
+  try {
+    missing = await findMissingBinaries(npmDir);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`::error::Failed to scan ${npmDir}: ${message}`);
+    process.exit(1);
+  }
+
+  if (missing.length > 0) {
+    for (const { dir, count } of missing) {
+      console.error(formatBinaryCountError(dir, count));
+    }
+
+    process.exit(1);
+  }
+
+  console.log('All electron-passkeys platform packages contain exactly one .node binary.');
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  await main();
+}

scripts/check-electron-passkeys-binaries.test.mjs

@@ -0,0 +1,64 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { afterEach, describe, expect, test } from 'vitest';
+
+import { findMissingBinaries, formatBinaryCountError } from './check-electron-passkeys-binaries.mjs';
+
+const roots = [];
+
+async function createRoot() {
+  const root = await mkdtemp(join(tmpdir(), 'electron-passkeys-binaries-'));
+  roots.push(root);
+  return root;
+}
+
+async function createPlatformDir(root, name, nodeFiles) {
+  const dir = join(root, name);
+  await mkdir(dir, { recursive: true });
+
+  await Promise.all(nodeFiles.map(file => writeFile(join(dir, file), '')));
+
+  return dir;
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map(root => rm(root, { force: true, recursive: true })));
+});
+
+describe('findMissingBinaries', () => {
+  test('returns [] when every platform dir has exactly one .node', async () => {
+    const root = await createRoot();
+    await createPlatformDir(root, 'darwin-arm64', ['passkeys.node']);
+    await createPlatformDir(root, 'linux-x64', ['passkeys.node']);
+
+    await expect(findMissingBinaries(root)).resolves.toEqual([]);
+  });
+
+  test('flags a dir with no .node files', async () => {
+    const root = await createRoot();
+    await createPlatformDir(root, 'darwin-arm64', ['README.md']);
+
+    await expect(findMissingBinaries(root)).resolves.toEqual([{ dir: join(root, 'darwin-arm64'), count: 0 }]);
+  });
+
+  test('flags a dir with more than one .node file', async () => {
+    const root = await createRoot();
+    await createPlatformDir(root, 'darwin-arm64', ['passkeys.node', 'other.node']);
+
+    await expect(findMissingBinaries(root)).resolves.toEqual([{ dir: join(root, 'darwin-arm64'), count: 2 }]);
+  });
+});
+
+describe('formatBinaryCountError', () => {
+  test('describes missing and duplicate binaries accurately', () => {
+    expect(formatBinaryCountError('/tmp/darwin-arm64', 0)).toBe(
+      '::error::/tmp/darwin-arm64 has 0 .node binaries (expected exactly 1); publishing it would ship an empty package',
+    );
+
+    expect(formatBinaryCountError('/tmp/darwin-arm64', 2)).toBe(
+      '::error::/tmp/darwin-arm64 has 2 .node binaries (expected exactly 1); publishing it would ship an invalid package',
+    );
+  });
+});

scripts/common.mjs

@@ -34,6 +34,10 @@ export async function getPackageNames() {
   return packageNames.sort();
 }
 
+export function isElectronPasskeysPackage(name) {
+  return name === '@clerk/electron-passkeys' || name.startsWith('@clerk/electron-passkeys-');
+}
+
 /**
  * Converts `workspace:^` to `workspace:*` for all @clerk/* dependencies.
  * This ensures that snapshot/canary releases use exact versions instead of

scripts/detect-electron-passkeys-publish.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+
+import { execFile } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+const WRAPPER_PACKAGE = '@clerk/electron-passkeys';
+const WRAPPER_MANIFEST = 'packages/electron-passkeys/package.json';
+
+async function readInTreeVersion() {
+  const manifest = JSON.parse(await readFile(WRAPPER_MANIFEST, 'utf8'));
+  return manifest.version;
+}
+
+async function readLatestPublishedVersion() {
+  try {
+    const { stdout } = await execFileAsync('npm', ['view', WRAPPER_PACKAGE, 'version']);
+    return stdout.trim();
+  } catch {
+    return '';
+  }
+}
+
+async function main() {
+  const inTreeVersion = await readInTreeVersion();
+  const latestPublishedVersion = await readLatestPublishedVersion();
+  // npm versions are immutable, so a differing in-tree version means a publish is pending and needs binaries.
+  const shouldBuild = inTreeVersion !== latestPublishedVersion;
+
+  console.log(`should-build=${shouldBuild}`);
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  await main();
+}

scripts/snapshot.mjs

@@ -2,10 +2,18 @@
 
 import { $, argv, echo } from 'zx';
 
-import { constants, getChangesetIgnoredPackages, getPackageNames, pinWorkspaceDeps } from './common.mjs';
+import {
+  constants,
+  getChangesetIgnoredPackages,
+  getPackageNames,
+  isElectronPasskeysPackage,
+  pinWorkspaceDeps,
+} from './common.mjs';
 
 const ignoredPackages = await getChangesetIgnoredPackages();
-const packageNames = (await getPackageNames()).filter(name => !ignoredPackages.has(name));
+const packageNames = (await getPackageNames()).filter(
+  name => !ignoredPackages.has(name) && !isElectronPasskeysPackage(name),
+);
 const packageEntries = packageNames.map(name => `'${name}': patch`).join('\n');
 
 const snapshot = `---