@aws-amplify/ui 6.12.1 → 6.14.0

package/dist/index.js

@@ -1117,7 +1117,7 @@ const esDict$1 = {
     'Sign Up with Google': 'Crear cuenta con Google',
     'Sign Up': 'Crear cuenta',
     'User already exists': 'El usuario ya existe',
-    'User does not exist': 'El usuario no existe',
+    'User does not exist.': 'El usuario no existe',
     'Username/client id combination not found.': 'El usuario no existe',
     'Username cannot be empty': 'El nombre de usuario no puede estar vacío',
     'Your passwords must match': 'Las contraseñas deben coincidir',
@@ -1244,7 +1244,7 @@ const frDict$1 = {
     'Sign Up': "S'inscrire",
     SMS: 'SMS',
     'User already exists': "L'utilisateur existe déjà",
-    'User does not exist': "L'utilisateur n'existe pas",
+    'User does not exist.': "L'utilisateur n'existe pas",
     'Username cannot be empty': "Le nom d'utilisateur doit être renseigné",
     'Username/client id combination not found.': "L'utilisateur n'existe pas",
     'We Emailed You': 'Nous vous avons envoyé un code',
@@ -2770,7 +2770,13 @@ const defaultTexts$1 = {
     CONFIRM: 'Confirm',
     CONFIRMATION_CODE: 'Confirmation Code',
     CONFIRMING: 'Confirming',
+    CONTINUE: 'Continue',
+    CONTINUE_WITHOUT_PASSKEY: 'Continue without a Passkey',
     CREATE_ACCOUNT: 'Create Account',
+    CREATE_ACCOUNT_WITH_EMAIL_OTP: 'Create account with Email OTP',
+    CREATE_ACCOUNT_WITH_PASSWORD: 'Create account with Password',
+    CREATE_ACCOUNT_WITH_SMS_OTP: 'Create account with SMS OTP',
+    CREATE_PASSKEY: 'Create a Passkey',
     CREATING_ACCOUNT: 'Creating Account',
     EMAIL_ADDRESS: 'Email',
     EMAIL_OTP: 'Email Message',
@@ -2787,6 +2793,8 @@ const defaultTexts$1 = {
     ENTER_PHONE_NUMBER: 'Enter your Phone Number',
     ENTER_PREFERRED_USERNAME: 'Enter your Preferred Username',
     ENTER_USERNAME: 'Enter your username',
+    ENTER_USERNAME_FIRST: 'Please enter your username first',
+    EXISTING_PASSKEYS: 'Existing Passkeys',
     FAMILY_NAME: 'Family Name',
     GIVEN_NAME: 'Given Name',
     FORGOT_PASSWORD: 'Forgot Password?',
@@ -2801,16 +2809,30 @@ const defaultTexts$1 = {
     NICKNAME: 'Nickname',
     NEW_PASSWORD: 'New password',
     OR: 'or',
+    OTHER_SIGN_IN_OPTIONS: 'Other sign-in options',
+    PASSKEY_AUTHENTICATION_CANCELED: 'Passkey authentication was canceled. Please try again or use a different sign-in method.',
+    PASSKEY_CREATED_SUCCESS: 'Passkey created successfully!',
+    PASSKEY_LABEL: 'Passkey',
+    PASSKEY_PROMPT_DESCRIPTION: 'Passkeys are WebAuthn credentials that validate your identity using biometric data like touch or facial recognition or device authentication like passwords or PINs, serving as a secure password replacement.',
+    PASSKEY_PROMPT_HEADING: 'Sign in faster with Passkey',
+    PASSKEY_REGISTERED: 'Your passkey has been successfully registered.',
+    PASSKEY_REGISTRATION_FAILED: 'Failed to create passkey. Please try again.',
     PASSWORD: 'Password',
+    PASSWORDLESS_NOT_ENABLED: 'Passwordless authentication is not enabled for this account. Please contact your administrator or use password sign-in.',
     PHONE_NUMBER: 'Phone Number',
     PREFERRED_USERNAME: 'Preferred Username',
     PROFILE: 'Profile',
+    REGISTERING: 'Registering',
     RESEND_CODE: 'Resend Code',
     RESET_PASSWORD_HEADING: 'Reset your password',
     RESET_PASSWORD: 'Reset Password',
     SEND_CODE: 'Send code',
+    CODE_DELIVERY_FAILED: 'Unable to send verification code. Please try again.',
+    VERIFICATION_CODE_EXPIRED: 'Your verification code has expired. Please request a new code.',
+    VERIFICATION_CODE_INVALID: 'The verification code you entered is incorrect. Please try again.',
     SENDING: 'Sending',
     SELECT_MFA_TYPE: 'Select MFA Type',
+    SETUP_ANOTHER_PASSKEY: 'Setup another Passkey',
     SETUP_EMAIL: 'Setup Email',
     SETUP_TOTP: 'Setup TOTP',
     SHOW_PASSWORD: 'Show password',
@@ -2818,8 +2840,12 @@ const defaultTexts$1 = {
     SIGN_IN_TAB: 'Sign In',
     SIGN_IN_WITH_AMAZON: 'Sign In with Amazon',
     SIGN_IN_WITH_APPLE: 'Sign In with Apple',
+    SIGN_IN_WITH_EMAIL: 'Sign In with Email',
     SIGN_IN_WITH_FACEBOOK: 'Sign In with Facebook',
     SIGN_IN_WITH_GOOGLE: 'Sign In with Google',
+    SIGN_IN_WITH_PASSKEY: 'Sign In with Passkey',
+    SIGN_IN_WITH_PASSWORD: 'Sign In with Password',
+    SIGN_IN_WITH_SMS: 'Sign In with SMS',
     SIGN_IN: 'Sign in to your account',
     SIGN_UP_BUTTON: 'Create a new account',
     SIGNING_IN_BUTTON: 'Signing in',
@@ -2829,6 +2855,7 @@ const defaultTexts$1 = {
     SUBMITTING: 'Submitting',
     SOFTWARE_TOKEN_MFA: 'Authenticator App (TOTP)',
     UPPERCASE_COPY: 'COPY',
+    USERNAME: 'Username',
     VERIFY_CONTACT: 'Verify Contact',
     VERIFY_HEADING: 'Account recovery requires verified contact information',
     VERIFY: 'Verify',
@@ -3100,6 +3127,14 @@ const getRoute = (state, actorState) => {
         case actorState?.matches('setupTotp.edit'):
         case actorState?.matches('setupTotp.submit'):
             return 'setupTotp';
+        case actorState?.matches('signIn.submit'):
+            return actorState?.context.selectedAuthMethod != null
+                ? 'signInSelectAuthFactor'
+                : 'signIn';
+        case actorState?.matches('signIn.selectMethod'):
+            return 'signInSelectAuthFactor';
+        case actorState?.matches('passkeyPrompt'):
+            return 'passkeyPrompt';
         case actorState?.matches('signIn'):
             return 'signIn';
         case actorState?.matches('signUp'):
@@ -3157,8 +3192,10 @@ const getSendEventAliases = (send) => {
     return {
         initializeMachine: sendToMachine('INIT'),
         resendCode: sendToMachine('RESEND'),
+        selectAuthMethod: sendToMachine('SELECT_METHOD'),
         signOut: sendToMachine('SIGN_OUT'),
         submitForm: sendToMachine('SUBMIT'),
+        toShowAuthMethods: sendToMachine('SHOW_AUTH_METHODS'),
         updateForm: sendToMachine('CHANGE'),
         updateBlur: sendToMachine('BLUR'),
         // Actions that don't immediately invoke a service but instead transition to a screen
@@ -3183,8 +3220,9 @@ const getNextSendEventAliases = (send) => {
 };
 const getServiceContextFacade = (state) => {
     const actorContext = (getActorContext$1(state) ?? {});
-    const { allowedMfaTypes, challengeName, codeDeliveryDetails, remoteError: error, validationError: validationErrors, totpSecretCode = null, unverifiedUserAttributes, username, } = actorContext;
-    const { socialProviders = [] } = state.context?.config ?? {};
+    const { allowedMfaTypes, availableAuthMethods, challengeName, codeDeliveryDetails, preferredChallenge, remoteError: error, selectedAuthMethod, validationError: validationErrors, totpSecretCode = null, unverifiedUserAttributes, username, } = actorContext;
+    const { socialProviders = [], loginMechanisms } = state.context?.config ?? {};
+    const loginMechanism = loginMechanisms?.[0];
     // check for user in actorContext prior to state context. actorContext is more "up to date",
     // but is not available on all states
     const user = actorContext?.user ?? state.context?.user;
@@ -3208,12 +3246,16 @@ const getServiceContextFacade = (state) => {
     const facade = {
         allowedMfaTypes,
         authStatus,
+        availableAuthMethods,
         challengeName,
         codeDeliveryDetails,
         error,
         hasValidationErrors,
         isPending,
+        loginMechanism,
+        preferredChallenge,
         route,
+        selectedAuthMethod,
         socialProviders,
         totpSecretCode,
         unverifiedUserAttributes,
@@ -3682,16 +3724,32 @@ const getConfirmationCodeFormFields = (_) => ({
         placeholder: 'Code',
     },
 });
-const getSignInFormFields = (state) => ({
-    username: { ...getAliasDefaultFormField(state) },
-    password: {
-        ...getDefaultFormField('password'),
-        autocomplete: 'current-password',
-    },
-});
+const getSignInFormFields = (state) => {
+    const actorContext = state.context.actorRef?.getSnapshot()?.context;
+    const availableAuthMethods = actorContext?.availableAuthMethods;
+    const preferredChallenge = actorContext?.preferredChallenge;
+    const shouldShowPassword = !availableAuthMethods?.length ||
+        (availableAuthMethods.length === 1 &&
+            availableAuthMethods[0] === 'PASSWORD') ||
+        (availableAuthMethods.length > 1 &&
+            (!preferredChallenge || preferredChallenge === 'PASSWORD'));
+    const fields = {
+        username: { ...getAliasDefaultFormField(state) },
+    };
+    if (shouldShowPassword) {
+        fields.password = {
+            ...getDefaultFormField('password'),
+            autocomplete: 'current-password',
+        };
+    }
+    return fields;
+};
 const getSignUpFormFields = (state) => {
     const { loginMechanisms, signUpAttributes } = state.context.config;
     const primaryAlias = getPrimaryAlias(state);
+    const actorContext = state.context.actorRef?.getSnapshot()?.context;
+    const availableAuthMethods = actorContext?.availableAuthMethods;
+    const hasMultipleMethods = availableAuthMethods && availableAuthMethods.length > 1;
     /**
      * @migration signUp Fields created here
      */
@@ -3707,7 +3765,17 @@ const getSignUpFormFields = (state) => {
             const fieldAttrs = fieldName === primaryAlias
                 ? getAliasDefaultFormField(state)
                 : getDefaultFormField(fieldName);
-            formField[fieldName] = { ...fieldAttrs };
+            // Make email, phone_number, password, and confirm_password optional when multiple auth methods available
+            // Validation will check based on selected method
+            const isOptional = hasMultipleMethods &&
+                (fieldName === 'email' ||
+                    fieldName === 'phone_number' ||
+                    fieldName === 'password' ||
+                    fieldName === 'confirm_password');
+            formField[fieldName] = {
+                ...fieldAttrs,
+                ...(isOptional && { isRequired: false }),
+            };
         }
         else {
             // There's a `custom:*` attribute or one we don't already have an implementation for
@@ -3903,6 +3971,17 @@ const getSelectMfaTypeByChallengeName = (challengeName) => {
     }
     return translate(DefaultTexts.MFA_SELECTION);
 };
+const getUsernameLabelByLoginMechanism = (loginMechanism) => {
+    switch (loginMechanism) {
+        case 'email':
+            return translate(DefaultTexts.EMAIL_ADDRESS);
+        case 'phone_number':
+            return translate(DefaultTexts.PHONE_NUMBER);
+        case 'username':
+        default:
+            return translate(DefaultTexts.USERNAME);
+    }
+};
 const getMfaTypeLabelByValue = (mfaType) => {
     switch (mfaType) {
         case 'EMAIL':
@@ -3922,6 +4001,7 @@ const authenticatorTextUtil = {
     getChangingText: () => translate(DefaultTexts.CHANGING_PASSWORD),
     getConfirmText: () => translate(DefaultTexts.CONFIRM),
     getConfirmingText: () => translate(DefaultTexts.CONFIRMING),
+    getContinueText: () => translate(DefaultTexts.CONTINUE),
     getCopyText: () => translate(DefaultTexts.UPPERCASE_COPY),
     getHidePasswordText: () => translate(DefaultTexts.HIDE_PASSWORD),
     getLoadingText: () => translate(DefaultTexts.LOADING),
@@ -3944,6 +4024,9 @@ const authenticatorTextUtil = {
     /** SignUp */
     getCreatingAccountText: () => translate(DefaultTexts.CREATING_ACCOUNT),
     getCreateAccountText: () => translate(DefaultTexts.CREATE_ACCOUNT),
+    getCreateAccountWithEmailText: () => translate(DefaultTexts.CREATE_ACCOUNT_WITH_EMAIL_OTP),
+    getCreateAccountWithPasswordText: () => translate(DefaultTexts.CREATE_ACCOUNT_WITH_PASSWORD),
+    getCreateAccountWithSmsText: () => translate(DefaultTexts.CREATE_ACCOUNT_WITH_SMS_OTP),
     /** ConfirmSignUp */
     getDeliveryMessageText,
     getDeliveryMethodText,
@@ -3970,6 +4053,25 @@ const authenticatorTextUtil = {
     getVerifyText: () => translate(DefaultTexts.VERIFY),
     getVerifyContactText: () => translate(DefaultTexts.VERIFY_CONTACT),
     getAccountRecoveryInfoText: () => translate(DefaultTexts.VERIFY_HEADING),
+    /** Passwordless */
+    getPasskeyPromptHeadingText: () => translate(DefaultTexts.PASSKEY_PROMPT_HEADING),
+    getPasskeyPromptDescriptionText: () => translate(DefaultTexts.PASSKEY_PROMPT_DESCRIPTION),
+    getCreatePasskeyText: () => translate(DefaultTexts.CREATE_PASSKEY),
+    getRegisteringText: () => translate(DefaultTexts.REGISTERING),
+    getContinueWithoutPasskeyText: () => translate(DefaultTexts.CONTINUE_WITHOUT_PASSKEY),
+    getPasskeyCreatedSuccessText: () => translate(DefaultTexts.PASSKEY_CREATED_SUCCESS),
+    getPasskeyRegisteredText: () => translate(DefaultTexts.PASSKEY_REGISTERED),
+    getPasskeyRegistrationFailedText: () => translate(DefaultTexts.PASSKEY_REGISTRATION_FAILED),
+    getPasskeyLabelText: () => translate(DefaultTexts.PASSKEY_LABEL),
+    getExistingPasskeysText: () => translate(DefaultTexts.EXISTING_PASSKEYS),
+    getSetupAnotherPasskeyText: () => translate(DefaultTexts.SETUP_ANOTHER_PASSKEY),
+    getSignInWithPasswordText: () => translate(DefaultTexts.SIGN_IN_WITH_PASSWORD),
+    getSignInWithEmailText: () => translate(DefaultTexts.SIGN_IN_WITH_EMAIL),
+    getSignInWithSmsText: () => translate(DefaultTexts.SIGN_IN_WITH_SMS),
+    getSignInWithPasskeyText: () => translate(DefaultTexts.SIGN_IN_WITH_PASSKEY),
+    getOtherSignInOptionsText: () => translate(DefaultTexts.OTHER_SIGN_IN_OPTIONS),
+    getEnterUsernameFirstText: () => translate(DefaultTexts.ENTER_USERNAME_FIRST),
+    getUsernameLabelByLoginMechanism,
     /** Validations */
     // TODO: add defaultText
     getInvalidEmailText: () => translate('Please enter a valid email'),
@@ -4162,35 +4264,99 @@ const getUserAttributes = (formValues) => {
     }
     return userAttributes;
 };
-const getSignUpInput = (username, formValues, loginMechanism) => {
+const getSignUpInput = (username, formValues, loginMechanism, authMethod) => {
     const { password, ...values } = formValues;
     const attributes = getUserAttributes(values);
+    const isPasswordless = authMethod && authMethod !== 'PASSWORD';
+    // For SMS OTP, set the email channel to empty string if present to force account creation with phone number
+    let userAttributes = attributes;
+    if (authMethod === 'SMS_OTP' && attributes.email) {
+        userAttributes = { ...attributes, email: '' };
+    }
     const options = {
-        autoSignIn: DEFAULT_AUTO_SIGN_IN,
+        autoSignIn: isPasswordless
+            ? {
+                enabled: true,
+                authFlowType: 'USER_AUTH',
+                preferredChallenge: authMethod,
+            }
+            : DEFAULT_AUTO_SIGN_IN,
         userAttributes: {
             // use `username` value for `phone_number`
             ...(loginMechanism === 'phone_number'
-                ? { ...attributes, phone_number: username }
-                : attributes),
+                ? { ...userAttributes, phone_number: username }
+                : userAttributes),
         },
     };
-    return { username, password, options };
+    return { username, password: isPasswordless ? undefined : password, options };
 };
 const getUsernameSignUp = ({ formValues, loginMechanisms, }) => {
+    // Check if a specific auth method was selected via form data
+    const authMethod = formValues.__authMethod;
+    // For SMS_OTP, always use phone_number as username
+    if (authMethod === 'SMS_OTP') {
+        const { country_code, phone_number } = formValues;
+        return sanitizePhoneNumber(country_code, phone_number);
+    }
+    // For EMAIL_OTP, always use email as username
+    if (authMethod === 'EMAIL_OTP') {
+        return formValues.email;
+    }
+    // When 'username' is in loginMechanisms, always use the username field for the Username parameter.
+    // This handles both username-only mode and alias mode (username + email/phone as sign-in options).
+    // See: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-aliases
+    if (loginMechanisms.includes('username')) {
+        return formValues.username;
+    }
     const loginMechanism = loginMechanisms[0];
     if (loginMechanism === 'phone_number') {
         const { country_code, phone_number } = formValues;
         return sanitizePhoneNumber(country_code, phone_number);
     }
+    // Otherwise, use the primary login mechanism (email as username)
     return formValues[loginMechanism];
 };
+/**
+ * Get available authentication methods based on backend capabilities and hidden methods
+ */
+const getAvailableAuthMethods = (passwordlessCapabilities, hiddenAuthMethods) => {
+    const allMethods = [];
+    // If hiddenAuthMethods is explicitly provided (even as empty array),
+    // assume all methods are available and let hiddenAuthMethods filter them
+    const assumeAllAvailable = hiddenAuthMethods !== undefined;
+    // PASSWORD is always available by default
+    allMethods.push('PASSWORD');
+    // Add passwordless methods if backend supports them OR if hiddenAuthMethods is explicitly set
+    if (assumeAllAvailable || passwordlessCapabilities?.emailOtpEnabled) {
+        allMethods.push('EMAIL_OTP');
+    }
+    if (assumeAllAvailable || passwordlessCapabilities?.smsOtpEnabled) {
+        allMethods.push('SMS_OTP');
+    }
+    if (assumeAllAvailable || passwordlessCapabilities?.webAuthnEnabled) {
+        allMethods.push('WEB_AUTHN');
+    }
+    // Filter out hidden methods
+    const hidden = hiddenAuthMethods ?? [];
+    const availableMethods = allMethods.filter((method) => !hidden.includes(method));
+    // Validate that at least one method remains
+    if (availableMethods.length === 0) {
+        throw new Error('InvalidPasswordlessSettings: All authentication methods are hidden');
+    }
+    return availableMethods;
+};
 
 const { assign } = xstate.actions;
 const clearActorDoneData = assign({ actorDoneData: undefined });
 const clearChallengeName = assign({ challengeName: undefined });
 const clearMissingAttributes = assign({ missingAttributes: undefined });
 const clearError = assign({ remoteError: undefined });
-const clearFormValues = assign({ formValues: {} });
+const clearFormValues = assign({
+    formValues: (context) => ({
+        // Preserve username for passwordless flows to avoid "username is required" errors
+        username: context.formValues?.username,
+    }),
+});
 const clearTouched = assign({ touched: {} });
 const clearUser = assign({ user: undefined });
 const clearValidationError = assign({ validationError: {} });
@@ -4291,7 +4457,28 @@ const setRemoteError = assign({
         if (data.name === 'NoUserPoolError') {
             return `Configuration error (see console) – please contact the administrator`;
         }
-        return data?.message || data;
+        const message = data?.message || '';
+        // Handle USER_AUTH flow not enabled error
+        if (message.includes('USER_AUTH flow not enabled')) {
+            return translate(DefaultTexts.PASSWORDLESS_NOT_ENABLED);
+        }
+        // Handle cannot send code error
+        if (message.includes('Cannot send code to either')) {
+            return translate(DefaultTexts.CODE_DELIVERY_FAILED);
+        }
+        // Handle invalid/wrong verification code
+        if (message.includes('Invalid code or auth state')) {
+            return translate(DefaultTexts.VERIFICATION_CODE_INVALID);
+        }
+        // Handle expired verification code
+        if (message.includes('session is expired')) {
+            return translate(DefaultTexts.VERIFICATION_CODE_EXPIRED);
+        }
+        // Handle passkey authentication canceled
+        if (message.includes('ceremony has been canceled')) {
+            return translate(DefaultTexts.PASSKEY_AUTHENTICATION_CANCELED);
+        }
+        return message || data;
     },
 });
 const setUser = assign({ user: (_, { data }) => data });
@@ -4328,8 +4515,12 @@ const handleBlur = assign({
     }),
 });
 const setUnverifiedUserAttributes = assign({
-    unverifiedUserAttributes: (_, { data }) => {
-        const { email, phone_number } = data;
+    unverifiedUserAttributes: (context, { data }) => {
+        // Use fetchedUserAttributes from context if data is not provided
+        const attributes = data || context.fetchedUserAttributes;
+        if (!attributes)
+            return {};
+        const { email, phone_number } = attributes;
         const unverifiedUserAttributes = {
             ...(email && { email }),
             ...(phone_number && { phone_number }),
@@ -4343,11 +4534,34 @@ const setSelectedUserAttribute = assign({
 });
 // Maps to unexposed `ConfirmSignUpSignUpStep`
 const setConfirmSignUpSignUpStep = assign({ step: 'CONFIRM_SIGN_UP' });
+// Passwordless actions
+const setSelectedAuthMethod = assign({
+    selectedAuthMethod: (_, { data }) => data.method,
+});
+const setSelectedAuthMethodFromForm = assign({
+    selectedAuthMethod: (_, { data }) => {
+        // Extract method from form data if present, default to PASSWORD for form submissions
+        return data?.__authMethod || 'PASSWORD';
+    },
+});
+const setSelectAuthMethodStep = assign({
+    step: 'SELECT_AUTH_METHOD',
+});
+const setFetchedUserAttributes = assign({
+    fetchedUserAttributes: (_, event) => event.data,
+});
+const setHasExistingPasskeys = assign({
+    hasExistingPasskeys: (_, event) => event.data,
+});
+const clearHasExistingPasskeys = assign({
+    hasExistingPasskeys: false,
+});
 const ACTIONS = {
     clearActorDoneData,
     clearChallengeName,
     clearError,
     clearFormValues,
+    clearHasExistingPasskeys,
     clearMissingAttributes,
     clearSelectedUserAttribute,
     clearTouched,
@@ -4359,7 +4573,9 @@ const ACTIONS = {
     setAllowedMfaTypes,
     setChallengeName,
     setCodeDeliveryDetails,
+    setFetchedUserAttributes,
     setFieldErrors,
+    setHasExistingPasskeys,
     setMissingAttributes,
     setNextResetPasswordStep,
     setNextSignInStep,
@@ -4367,6 +4583,9 @@ const ACTIONS = {
     setRemoteError,
     setConfirmAttributeCompleteStep,
     setConfirmSignUpSignUpStep,
+    setSelectAuthMethodStep,
+    setSelectedAuthMethod,
+    setSelectedAuthMethodFromForm,
     setShouldVerifyUserAttributeStep,
     setSelectedUserAttribute,
     setSignInStep,
@@ -4410,7 +4629,11 @@ const shouldResetPassword = ({ step }) => step === 'RESET_PASSWORD';
 const shouldConfirmResetPassword = ({ step }) => step === 'CONFIRM_RESET_PASSWORD_WITH_CODE';
 const shouldConfirmSignUp = ({ step }) => step === 'CONFIRM_SIGN_UP';
 // miscellaneous guards
-const shouldVerifyAttribute = (_, { data }) => {
+const shouldVerifyAttribute = (context, event) => {
+    // Try to get data from event first (for backward compatibility), then from context
+    const data = (event.data || context.fetchedUserAttributes);
+    if (!data)
+        return false;
     const { email, phone_number, phone_number_verified, email_verified } = data;
     // if neither email nor phone_number exist
     // there is nothing to verify
@@ -4435,11 +4658,51 @@ const shouldVerifyAttribute = (_, { data }) => {
  * https://github.com/aws-amplify/amplify-ui/issues/219
  */
 const isUserAlreadyConfirmed = (_, { data }) => data.message === 'User is already confirmed.';
+// passwordless guards
+const shouldSelectAuthMethod = ({ availableAuthMethods, preferredChallenge, selectedAuthMethod, }) => {
+    // Show selection if:
+    // 1. Multiple methods available
+    // 2. AND either no preferredChallenge OR selectedAuthMethod is explicitly cleared (null)
+    const hasMultipleMethods = availableAuthMethods && availableAuthMethods.length > 1;
+    const shouldShowSelection = !preferredChallenge || selectedAuthMethod === null;
+    return hasMultipleMethods && shouldShowSelection;
+};
+const shouldPromptPasskeyRegistration = ({ passwordless, hasExistingPasskeys, }) => {
+    const { passkeyRegistrationPrompts } = passwordless || {};
+    if (!passkeyRegistrationPrompts) {
+        return false;
+    }
+    // Don't prompt if user already has passkeys
+    if (hasExistingPasskeys) {
+        return false;
+    }
+    if (typeof passkeyRegistrationPrompts === 'boolean') {
+        return passkeyRegistrationPrompts;
+    }
+    return passkeyRegistrationPrompts.afterSignin === 'ALWAYS';
+};
+const shouldPromptPasskeyRegistrationAfterSignup = ({ passwordless, hasExistingPasskeys, }) => {
+    const { passkeyRegistrationPrompts } = passwordless || {};
+    if (!passkeyRegistrationPrompts) {
+        return false;
+    }
+    // Don't prompt if user already has passkeys
+    if (hasExistingPasskeys) {
+        return false;
+    }
+    if (typeof passkeyRegistrationPrompts === 'boolean') {
+        return passkeyRegistrationPrompts;
+    }
+    return passkeyRegistrationPrompts.afterSignup === 'ALWAYS';
+};
+const hasPasskeyRegistrationPrompts = ({ passwordless }) => passwordless?.passkeyRegistrationPrompts != null;
+const shouldReturnToSelectMethod = ({ selectedAuthMethod, step, }) => selectedAuthMethod != null && step === 'SELECT_AUTH_METHOD';
 const GUARDS = {
     hasCompletedAttributeConfirmation,
     hasCompletedResetPassword,
     hasCompletedSignIn,
     hasCompletedSignUp,
+    hasPasskeyRegistrationPrompts,
     isConfirmSignUpStep,
     isConfirmUserAttributeStep,
     isResetPasswordStep,
@@ -4453,10 +4716,14 @@ const GUARDS = {
     shouldConfirmSignUpFromSignIn,
     shouldResetPassword,
     shouldResetPasswordFromSignIn,
+    shouldReturnToSelectMethod,
+    shouldSelectAuthMethod,
     shouldSetupTotp,
     shouldSetupEmail,
     shouldSelectMfaType,
     shouldVerifyAttribute,
+    shouldPromptPasskeyRegistration,
+    shouldPromptPasskeyRegistrationAfterSignup,
 };
 
 // Runs all validators given. Resolves if there are no error. Rejects otherwise.
@@ -4504,11 +4771,24 @@ const defaultServices = {
         const parsedSocialProviders = loginWith?.oauth?.providers
             ? loginWith.oauth.providers?.map((provider) => provider.toString().toLowerCase())
             : undefined;
+        // Detect passwordless capabilities from amplify_outputs.json
+        // Support both snake_case (legacy) and camelCase (current) formats
+        const passwordlessConfig = result.Auth?.Cognito?.passwordless;
+        const passwordlessCapabilities = {
+            emailOtpEnabled: passwordlessConfig?.emailOtpEnabled ??
+                passwordlessConfig?.email_otp_enabled === true,
+            smsOtpEnabled: passwordlessConfig?.smsOtpEnabled ??
+                passwordlessConfig?.sms_otp_enabled === true,
+            webAuthnEnabled: !!(passwordlessConfig?.webAuthn ?? passwordlessConfig?.web_authn),
+            preferredChallenge: passwordlessConfig?.preferredChallenge ??
+                passwordlessConfig?.preferred_challenge,
+        };
         return {
             ...cliConfig,
             loginMechanisms: parsedLoginMechanisms,
             signUpAttributes: parsedSignupAttributes,
             socialProviders: parsedSocialProviders,
+            passwordlessCapabilities,
         };
     },
     getCurrentUser: auth.getCurrentUser,
@@ -4571,6 +4851,30 @@ const defaultServices = {
         }
     },
     async validatePreferredUsername(_, __) { },
+    async validateRequiredFieldsForAuthMethod(formData) {
+        const authMethod = formData.__authMethod;
+        // If no auth method specified, skip validation (will use default required fields)
+        if (!authMethod)
+            return null;
+        // Check required fields based on auth method
+        if (authMethod === 'EMAIL_OTP' && !formData.email) {
+            return { email: 'Email is required for Email OTP sign up' };
+        }
+        if (authMethod === 'SMS_OTP' && !formData.phone_number) {
+            return { phone_number: 'Phone number is required for SMS OTP sign up' };
+        }
+        if (authMethod === 'PASSWORD') {
+            const errors = {};
+            if (!formData.password) {
+                errors.password = 'Password is required';
+            }
+            if (!formData.confirm_password) {
+                errors.confirm_password = 'Confirm Password is required';
+            }
+            return Object.keys(errors).length > 0 ? errors : null;
+        }
+        return null;
+    },
 };
 
 function forgotPasswordActor({ services, }) {
@@ -4800,32 +5104,13 @@ const handleSignInResponse = {
                 'setNextSignInStep',
                 'setTotpSecretCode',
                 'setAllowedMfaTypes',
+                'setCodeDeliveryDetails',
             ],
             target: '#signInActor.init',
         },
     ],
     onError: { actions: 'setRemoteError', target: 'edit' },
 };
-const handleFetchUserAttributesResponse$1 = {
-    onDone: [
-        {
-            cond: 'shouldVerifyAttribute',
-            actions: [
-                'setShouldVerifyUserAttributeStep',
-                'setUnverifiedUserAttributes',
-            ],
-            target: '#signInActor.resolved',
-        },
-        {
-            actions: 'setConfirmAttributeCompleteStep',
-            target: '#signInActor.resolved',
-        },
-    ],
-    onError: {
-        actions: 'setConfirmAttributeCompleteStep',
-        target: '#signInActor.resolved',
-    },
-};
 const getDefaultConfirmSignInState = (exit) => ({
     initial: 'edit',
     exit,
@@ -4836,6 +5121,7 @@ const getDefaultConfirmSignInState = (exit) => ({
                 SUBMIT: { actions: 'handleSubmit', target: 'submit' },
                 SIGN_IN: '#signInActor.signIn',
                 CHANGE: { actions: 'handleInput' },
+                RESEND: { target: 'resend' },
             },
         },
         submit: {
@@ -4843,6 +5129,21 @@ const getDefaultConfirmSignInState = (exit) => ({
             entry: ['sendUpdate', 'clearError'],
             invoke: { src: 'confirmSignIn', ...handleSignInResponse },
         },
+        resend: {
+            tags: 'pending',
+            entry: ['sendUpdate', 'clearError'],
+            invoke: {
+                src: 'resendSignInCode',
+                onDone: {
+                    actions: ['setCodeDeliveryDetails', 'sendUpdate'],
+                    target: 'edit',
+                },
+                onError: {
+                    actions: 'setRemoteError',
+                    target: 'edit',
+                },
+            },
+        },
     },
 });
 function signInActor({ services }) {
@@ -4877,13 +5178,68 @@ function signInActor({ services }) {
                     { target: 'signIn' },
                 ],
             },
-            federatedSignIn: getFederatedSignInState('signIn'),
+            federatedSignIn: { ...getFederatedSignInState('signIn') },
             fetchUserAttributes: {
                 invoke: {
                     src: 'fetchUserAttributes',
-                    ...handleFetchUserAttributesResponse$1,
+                    onDone: [
+                        {
+                            cond: 'hasPasskeyRegistrationPrompts',
+                            actions: 'setFetchedUserAttributes',
+                            target: 'checkPasskeys',
+                        },
+                        {
+                            actions: 'setFetchedUserAttributes',
+                            target: 'evaluatePasskeyPrompt',
+                        },
+                    ],
+                    onError: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signInActor.resolved',
+                    },
+                },
+            },
+            checkPasskeys: {
+                invoke: {
+                    src: async () => {
+                        try {
+                            const result = await auth.listWebAuthnCredentials();
+                            return result.credentials && result.credentials.length > 0;
+                        }
+                        catch {
+                            return false;
+                        }
+                    },
+                    onDone: {
+                        actions: 'setHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
+                    onError: {
+                        actions: 'clearHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
                 },
             },
+            evaluatePasskeyPrompt: {
+                always: [
+                    {
+                        cond: 'shouldPromptPasskeyRegistration',
+                        target: '#signInActor.passkeyPrompt',
+                    },
+                    {
+                        cond: 'shouldVerifyAttribute',
+                        actions: [
+                            'setShouldVerifyUserAttributeStep',
+                            'setUnverifiedUserAttributes',
+                        ],
+                        target: '#signInActor.resolved',
+                    },
+                    {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signInActor.resolved',
+                    },
+                ],
+            },
             resendSignUpCode: {
                 invoke: {
                     src: 'handleResendSignUpCode',
@@ -4918,23 +5274,70 @@ function signInActor({ services }) {
                         on: {
                             CHANGE: { actions: 'handleInput' },
                             FEDERATED_SIGN_IN: { target: '#signInActor.federatedSignIn' },
-                            SUBMIT: { actions: 'handleSubmit', target: 'submit' },
+                            SHOW_AUTH_METHODS: {
+                                actions: 'setUsernameSignIn',
+                                target: 'selectMethod',
+                            },
+                            SUBMIT: [
+                                {
+                                    cond: 'shouldSelectAuthMethod',
+                                    actions: 'handleSubmit',
+                                    target: 'selectMethod',
+                                },
+                                {
+                                    actions: 'handleSubmit',
+                                    target: 'submit',
+                                },
+                            ],
+                        },
+                    },
+                    selectMethod: {
+                        entry: [
+                            'sendUpdate',
+                            'setSelectAuthMethodStep',
+                            'setUsernameSignIn',
+                        ],
+                        on: {
+                            SELECT_METHOD: {
+                                actions: 'setSelectedAuthMethod',
+                                target: 'submit',
+                            },
+                            SUBMIT: {
+                                actions: ['handleSubmit', 'setSelectedAuthMethodFromForm'],
+                                target: 'submit',
+                            },
+                            SIGN_IN: {
+                                target: 'edit',
+                            },
                         },
                     },
                     submit: {
                         tags: 'pending',
                         entry: ['clearError', 'sendUpdate', 'setUsernameSignIn'],
                         exit: 'clearFormValues',
-                        invoke: { src: 'handleSignIn', ...handleSignInResponse },
+                        invoke: {
+                            src: 'handleSignIn',
+                            onDone: handleSignInResponse.onDone,
+                            onError: [
+                                {
+                                    cond: 'shouldReturnToSelectMethod',
+                                    actions: 'setRemoteError',
+                                    target: 'selectMethod',
+                                },
+                                handleSignInResponse.onError,
+                            ],
+                        },
                     },
                 },
             },
-            confirmSignIn: getDefaultConfirmSignInState([
-                'clearChallengeName',
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
+            confirmSignIn: {
+                ...getDefaultConfirmSignInState([
+                    'clearChallengeName',
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
             forceChangePassword: {
                 entry: 'sendUpdate',
                 type: 'parallel',
@@ -5007,21 +5410,40 @@ function signInActor({ services }) {
                     },
                 },
             },
-            setupTotp: getDefaultConfirmSignInState([
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
-            setupEmail: getDefaultConfirmSignInState([
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
-            selectMfaType: getDefaultConfirmSignInState([
-                'clearFormValues',
-                'clearError',
-                'clearTouched',
-            ]),
+            setupTotp: {
+                ...getDefaultConfirmSignInState([
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
+            setupEmail: {
+                ...getDefaultConfirmSignInState([
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
+            selectMfaType: {
+                ...getDefaultConfirmSignInState([
+                    'clearFormValues',
+                    'clearError',
+                    'clearTouched',
+                ]),
+            },
+            passkeyPrompt: {
+                entry: 'sendUpdate',
+                on: {
+                    SUBMIT: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: 'resolved',
+                    },
+                    SKIP: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: 'resolved',
+                    },
+                },
+            },
             resolved: {
                 type: 'final',
                 data: (context) => ({
@@ -5047,9 +5469,41 @@ function signInActor({ services }) {
             handleResendSignUpCode({ username }) {
                 return services.handleResendSignUpCode({ username });
             },
-            handleSignIn({ formValues, username }) {
-                const { password } = formValues;
-                return services.handleSignIn({ username, password });
+            resendSignInCode({ username, selectedAuthMethod, availableAuthMethods, preferredChallenge, }) {
+                // Resend code by calling signIn again with the same parameters
+                const method = selectedAuthMethod ??
+                    preferredChallenge ??
+                    availableAuthMethods?.[0] ??
+                    'PASSWORD';
+                return services.handleSignIn({
+                    username,
+                    options: {
+                        authFlowType: 'USER_AUTH',
+                        preferredChallenge: method,
+                    },
+                });
+            },
+            handleSignIn({ formValues, username, selectedAuthMethod, availableAuthMethods, preferredChallenge, }) {
+                // Determine which method to use
+                const method = selectedAuthMethod ??
+                    preferredChallenge ??
+                    availableAuthMethods?.[0] ??
+                    'PASSWORD';
+                if (method === 'PASSWORD') {
+                    // Traditional password flow
+                    const { password } = formValues;
+                    return services.handleSignIn({ username, password });
+                }
+                else {
+                    // Passwordless flow using USER_AUTH
+                    return services.handleSignIn({
+                        username,
+                        options: {
+                            authFlowType: 'USER_AUTH',
+                            preferredChallenge: method,
+                        },
+                    });
+                }
             },
             confirmSignIn({ formValues, step }) {
                 const formValuesKey = getConfirmSignInFormValuesKey(step);
@@ -5133,26 +5587,6 @@ const handleAutoSignInResponse = {
         target: '#signUpActor.resolved',
     },
 };
-const handleFetchUserAttributesResponse = {
-    onDone: [
-        {
-            cond: 'shouldVerifyAttribute',
-            actions: [
-                'setShouldVerifyUserAttributeStep',
-                'setUnverifiedUserAttributes',
-            ],
-            target: '#signUpActor.resolved',
-        },
-        {
-            actions: 'setConfirmAttributeCompleteStep',
-            target: '#signUpActor.resolved',
-        },
-    ],
-    onError: {
-        actions: 'setConfirmAttributeCompleteStep',
-        target: '#signUpActor.resolved',
-    },
-};
 function signUpActor({ services }) {
     return xstate.createMachine({
         id: 'signUpActor',
@@ -5172,10 +5606,65 @@ function signUpActor({ services }) {
             fetchUserAttributes: {
                 invoke: {
                     src: 'fetchUserAttributes',
-                    ...handleFetchUserAttributesResponse,
+                    onDone: [
+                        {
+                            cond: 'hasPasskeyRegistrationPrompts',
+                            actions: 'setFetchedUserAttributes',
+                            target: 'checkPasskeys',
+                        },
+                        {
+                            actions: 'setFetchedUserAttributes',
+                            target: 'evaluatePasskeyPrompt',
+                        },
+                    ],
+                    onError: {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signUpActor.resolved',
+                    },
+                },
+            },
+            checkPasskeys: {
+                invoke: {
+                    src: async () => {
+                        try {
+                            const result = await auth.listWebAuthnCredentials();
+                            return result.credentials && result.credentials.length > 0;
+                        }
+                        catch {
+                            return false;
+                        }
+                    },
+                    onDone: {
+                        actions: 'setHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
+                    onError: {
+                        actions: 'clearHasExistingPasskeys',
+                        target: 'evaluatePasskeyPrompt',
+                    },
                 },
             },
-            federatedSignIn: getFederatedSignInState('signUp'),
+            evaluatePasskeyPrompt: {
+                always: [
+                    {
+                        cond: 'shouldPromptPasskeyRegistrationAfterSignup',
+                        target: '#signUpActor.passkeyPrompt',
+                    },
+                    {
+                        cond: 'shouldVerifyAttribute',
+                        actions: [
+                            'setShouldVerifyUserAttributeStep',
+                            'setUnverifiedUserAttributes',
+                        ],
+                        target: '#signUpActor.resolved',
+                    },
+                    {
+                        actions: 'setConfirmAttributeCompleteStep',
+                        target: '#signUpActor.resolved',
+                    },
+                ],
+            },
+            federatedSignIn: { ...getFederatedSignInState('signUp') },
             resetPassword: {
                 invoke: { src: 'resetPassword', ...handleResetPasswordResponse },
             },
@@ -5194,7 +5683,10 @@ function signUpActor({ services }) {
                             cond: 'isUserAlreadyConfirmed',
                             target: '#signUpActor.resolved',
                         },
-                        { actions: ['setRemoteError', 'sendUpdate'] },
+                        {
+                            actions: ['setRemoteError', 'sendUpdate'],
+                            target: '#signUpActor.confirmSignUp',
+                        },
                     ],
                 },
             },
@@ -5232,7 +5724,13 @@ function signUpActor({ services }) {
                             idle: {
                                 entry: ['sendUpdate'],
                                 on: {
-                                    SUBMIT: { actions: 'handleSubmit', target: 'validate' },
+                                    SUBMIT: {
+                                        actions: [
+                                            'setSelectedAuthMethodFromForm',
+                                            'handleSubmit',
+                                        ],
+                                        target: 'validate',
+                                    },
                                 },
                             },
                             validate: {
@@ -5317,6 +5815,13 @@ function signUpActor({ services }) {
                     },
                 },
             },
+            passkeyPrompt: {
+                entry: 'sendUpdate',
+                on: {
+                    SKIP: { target: 'resolved' },
+                    SUBMIT: { target: 'resolved' },
+                },
+            },
             resolved: {
                 type: 'final',
                 data: (context) => ({
@@ -5354,9 +5859,10 @@ function signUpActor({ services }) {
                 return auth.signInWithRedirect(data);
             },
             handleSignUp(context) {
-                const { formValues, loginMechanisms, username } = context;
+                const { formValues, loginMechanisms, username, selectedAuthMethod, preferredChallenge, } = context;
                 const loginMechanism = loginMechanisms[0];
-                const input = getSignUpInput(username, formValues, loginMechanism);
+                const authMethod = selectedAuthMethod ?? preferredChallenge;
+                const input = getSignUpInput(username, formValues, loginMechanism, authMethod);
                 return services.handleSignUp(input);
             },
             async validateSignUp(context) {
@@ -5367,6 +5873,8 @@ function signUpActor({ services }) {
                     // Validation for default form fields
                     services.validateConfirmPassword,
                     services.validatePreferredUsername,
+                    // Validation for required fields based on auth method
+                    services.validateRequiredFieldsForAuthMethod,
                     // Validation for any custom Sign Up fields
                     services.validateCustomSignUp,
                 ]);
@@ -5498,20 +6006,29 @@ function verifyUserAttributesActor() {
     });
 }
 
-const getActorContext = (context, defaultStep) => ({
-    ...context.actorDoneData,
-    step: context?.actorDoneData?.step ?? defaultStep,
-    // initialize empty objects on actor start
-    formValues: {},
-    touched: {},
-    validationError: {},
-    // values included on `context.config` that should be available in actors
-    formFields: context.config?.formFields,
-    loginMechanisms: context.config?.loginMechanisms,
-    passwordSettings: context.config?.passwordSettings,
-    signUpAttributes: context.config?.signUpAttributes,
-    socialProviders: context.config?.socialProviders,
-});
+const getActorContext = (context, defaultStep) => {
+    const availableAuthMethods = getAvailableAuthMethods(context.passwordlessCapabilities, context.config?.passwordless?.hiddenAuthMethods);
+    // Determine effective preferred challenge: component prop takes precedence over backend config
+    const preferredChallenge = context.config?.passwordless?.preferredAuthMethod ??
+        context.passwordlessCapabilities?.preferredChallenge;
+    return {
+        ...context.actorDoneData,
+        step: context?.actorDoneData?.step ?? defaultStep,
+        // initialize empty objects on actor start
+        formValues: {},
+        touched: {},
+        validationError: {},
+        // values included on `context.config` that should be available in actors
+        formFields: context.config?.formFields,
+        loginMechanisms: context.config?.loginMechanisms,
+        passwordSettings: context.config?.passwordSettings,
+        signUpAttributes: context.config?.signUpAttributes,
+        socialProviders: context.config?.socialProviders,
+        availableAuthMethods,
+        preferredChallenge,
+        passwordless: context.config?.passwordless,
+    };
+};
 const { choose, stop } = xstate.actions;
 const stopActor = (machineId) => stop(machineId);
 // setup step waits for ui to emit INIT action to proceed to configure
@@ -5609,6 +6126,8 @@ function createAuthenticatorMachine(options) {
                 },
                 on: {
                     FORGOT_PASSWORD: 'forgotPasswordActor',
+                    SELECT_METHOD: { actions: 'forwardToActor' },
+                    SHOW_AUTH_METHODS: { actions: 'forwardToActor' },
                     SIGN_IN: 'signInActor',
                     SIGN_UP: 'signUpActor',
                     'done.invoke.signInActor': [
@@ -5775,10 +6294,11 @@ function createAuthenticatorMachine(options) {
                 }),
             }),
             applyAmplifyConfig: xstate.assign({
+                passwordlessCapabilities: (_, { data: cliConfig }) => cliConfig.passwordlessCapabilities,
                 config(context, { data: cliConfig }) {
                     // Prefer explicitly configured settings over default CLI values\
                     const { loginMechanisms = cliConfig.loginMechanisms ?? [], signUpAttributes = cliConfig.signUpAttributes ?? [], socialProviders = cliConfig.socialProviders ?? [], initialState, formFields: _formFields, passwordSettings = cliConfig.passwordFormat ??
-                        {}, } = context.config;
+                        {}, passwordless, } = context.config;
                     // By default, Cognito assumes `username`, so there isn't a different username attribute like `email`.
                     // We explicitly add it as a login mechanism to be consistent with Admin UI's language.
                     if (loginMechanisms.length === 0) {
@@ -5790,6 +6310,7 @@ function createAuthenticatorMachine(options) {
                         initialState,
                         loginMechanisms,
                         passwordSettings,
+                        passwordless,
                         signUpAttributes,
                         socialProviders,
                     };