hanko-auth: user permanently stuck on passkey onboarding when navigator.credentials.create() never settles (Skip button unusable)

Checklist

• I could not find a solution in the existing issues or docs.
• I agree to follow this project's Code of Conduct.

Describe the bug

Environment: Hanko Cloud, @teamhanko/hanko-elements 2.7.0. Observed with Safari (macOS and iOS); the underlying trigger is browser-specific but the recovery flaw is in the component.

Description

On the onboarding_create_passkey step, pressing "Create a passkey" runs the webauthn_generate_creation_options action and the flow moves to webauthn_credential_verification. The component keeps the previous page rendered with all controls disabled while the state's auto-step awaits navigator.credentials.create() (via the WebauthnManager).

If the promise rejects, recovery works: the auto-step runs back and shows an error. But if the promise never settles, the component stays disabled forever — the Skip button is visible but dead, and the user cannot proceed, skip, or leave the step.

A never-settling create() is not hypothetical: Safari's platform authenticator can get stuck (for example right after a passkey was used in another app), and only fully quitting and restarting Safari clears it. We lost a real signup to this before disabling passkey onboarding from our Cloud console as a workaround.

Reproducing the bug

Steps to reproduce (deterministic simulation)

Open a registration flow and proceed to the "Create a passkey" onboarding step. In the console, stub the ceremony so it hangs: navigator.credentials.create = () => new Promise(() => {}) Click "Create a passkey". Observe: the page stays on the passkey step with every control disabled; Skip never becomes clickable again. No timeout ever fires.

Expected behavior

Either Skip/Back remain usable during the ceremony, or the ceremony has a deadline (e.g. AbortController + timeout in the auto-step) after which the flow returns to onboarding_create_passkey with an error and the controls re-enable.

Workaround we applied: disabled passkey acquisition at registration/login in the Cloud console ("Prompt during registration/login: Never"), keeping passkey creation available from the profile.

Logs

Configuration

Hanko Version

hanko-elements 2.7.0 (backend: Hanko Cloud SaaS)

OS Hanko Backend

None

OS Version Hanko Backend

Hanko Cloud (SaaS)

OS

Other

OS Version

iOS (recent; exact version not recorded). Also observed on macOS Safari.

Browser Version

Safari (iOS and macOS). The hang requires Safari's platform authenticator; the missing recovery/timeout is browser-independent.

Environment

None

Additional Context

Reported first via Hanko Cloud support (they asked us to file this issue). We verified the mechanism by reading the bundled elements 2.7.0 code. A restart of Safari clears the stuck authenticator. A separate related issue about the login flow resetting mid-passcode is being filed next.