@camstack/addon-auth 1.1.3 → 1.1.5

package/dist/{dist-suALViLT.mjs → dist-BopfLZ9P.mjs}

@@ -7052,6 +7052,123 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* Build an `IAddonRouteProvider` from a list of routes. Implements
+* both the operator-facing `getRoutes` (returning route descriptors
+* minus the handlers, which can't cross JSON) and the framework-
+* private `invoke` method that the hub calls when this provider lives
+* in a forked worker.
+*
+* Co-located addons use the returned `getRoutes` directly because
+* their handlers don't need to cross any wire. The `invoke` method
+* is present anyway so the bridge code on the hub is uniform — it
+* doesn't need to switch on "local vs remote provider" at the call
+* site.
+*
+* Example:
+*   const routes: IAddonHttpRoute[] = [
+*     { method: 'GET', path: '/start', access: 'public', handler: this.handleStart },
+*   ]
+*   return [
+*     {
+*       capability: addonRoutesCapability,
+*       provider: buildAddonRouteProvider('auth-oidc', routes),
+*     },
+*   ]
+*/
+function buildAddonRouteProvider(id, routes) {
+	return {
+		id,
+		getRoutes: () => routes,
+		invoke: async (input) => {
+			const match = matchRoute(routes, input.method, input.path);
+			if (!match) return {
+				status: 404,
+				headers: {},
+				redirectUrl: null,
+				body: { error: `No route matches ${input.method} ${input.path}` }
+			};
+			const envelope = {
+				status: 200,
+				headers: {},
+				redirectUrl: null
+			};
+			const reply = buildCapturingReply(envelope);
+			const request = {
+				params: {
+					...input.params,
+					...match.params
+				},
+				query: input.query,
+				body: input.body,
+				headers: input.headers,
+				...input.user ? { user: input.user } : {},
+				...input.scopedToken !== void 0 ? { scopedToken: input.scopedToken } : {}
+			};
+			await match.route.handler(request, reply);
+			return envelope;
+		}
+	};
+}
+/**
+* Pattern matcher: same semantics as `AddonRouteRegistry.matchRoute`
+* but operating on a flat list and bypassing the `/addon/<id>/` prefix
+* — the bridge sends the post-prefix path directly so we don't need
+* to round-trip it through normalization.
+*/
+function matchRoute(routes, method, path) {
+	const normalizedMethod = method.toUpperCase();
+	for (const route of routes) {
+		if (route.method !== normalizedMethod) continue;
+		const params = matchPath(route.path, path);
+		if (params !== null) return {
+			route,
+			params
+		};
+	}
+	return null;
+}
+function matchPath(pattern, p) {
+	const patternParts = pattern.split("/").filter(Boolean);
+	const pathParts = p.split("/").filter(Boolean);
+	if (patternParts.length !== pathParts.length) return null;
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const a = patternParts[i];
+		const b = pathParts[i];
+		if (a.startsWith(":")) params[a.slice(1)] = b;
+		else if (a !== b) return null;
+	}
+	return params;
+}
+function buildCapturingReply(envelope) {
+	const wrapper = {
+		status(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		code(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		send(data) {
+			envelope.body = data;
+		},
+		redirect(url) {
+			envelope.redirectUrl = url;
+			if (envelope.status === 200) envelope.status = 302;
+		},
+		header(name, value) {
+			envelope.headers[name.toLowerCase()] = value;
+			return wrapper;
+		},
+		type(mime) {
+			envelope.contentType = mime;
+			return wrapper;
+		}
+	};
+	return wrapper;
+}
+/**
 * Numeric day-of-week: 0 = Sunday … 6 = Saturday (matches `Date.getDay`).
 * Named `RecordingWeekday` to avoid collision with the string-union
 * `Weekday` exported from `interfaces/timezones.ts`.
@@ -16284,6 +16401,19 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -16340,6 +16470,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+			verified: boolean(),
+			userId: string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
 			userId: string(),
@@ -22842,6 +22985,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22854,6 +23003,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -23124,4 +23279,4 @@ object({
 	schemaVersion: literal(1)
 });
 //#endregion
-export { userPasskeysCapability as a, array as c, loginMethodCapability as i, object as l, addonWidgetsSourceCapability as n, errMsg as o, authProviderCapability as r, BaseAddon as s, addonRoutesCapability as t, string as u };
+export { loginMethodCapability as a, BaseAddon as c, string as d, buildAddonRouteProvider as i, array as l, addonWidgetsSourceCapability as n, userPasskeysCapability as o, authProviderCapability as r, errMsg as s, addonRoutesCapability as t, object as u };

package/dist/{dist-mmJDfwXE.js → dist-biwV9TkV.js}

@@ -7052,6 +7052,123 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* Build an `IAddonRouteProvider` from a list of routes. Implements
+* both the operator-facing `getRoutes` (returning route descriptors
+* minus the handlers, which can't cross JSON) and the framework-
+* private `invoke` method that the hub calls when this provider lives
+* in a forked worker.
+*
+* Co-located addons use the returned `getRoutes` directly because
+* their handlers don't need to cross any wire. The `invoke` method
+* is present anyway so the bridge code on the hub is uniform — it
+* doesn't need to switch on "local vs remote provider" at the call
+* site.
+*
+* Example:
+*   const routes: IAddonHttpRoute[] = [
+*     { method: 'GET', path: '/start', access: 'public', handler: this.handleStart },
+*   ]
+*   return [
+*     {
+*       capability: addonRoutesCapability,
+*       provider: buildAddonRouteProvider('auth-oidc', routes),
+*     },
+*   ]
+*/
+function buildAddonRouteProvider(id, routes) {
+	return {
+		id,
+		getRoutes: () => routes,
+		invoke: async (input) => {
+			const match = matchRoute(routes, input.method, input.path);
+			if (!match) return {
+				status: 404,
+				headers: {},
+				redirectUrl: null,
+				body: { error: `No route matches ${input.method} ${input.path}` }
+			};
+			const envelope = {
+				status: 200,
+				headers: {},
+				redirectUrl: null
+			};
+			const reply = buildCapturingReply(envelope);
+			const request = {
+				params: {
+					...input.params,
+					...match.params
+				},
+				query: input.query,
+				body: input.body,
+				headers: input.headers,
+				...input.user ? { user: input.user } : {},
+				...input.scopedToken !== void 0 ? { scopedToken: input.scopedToken } : {}
+			};
+			await match.route.handler(request, reply);
+			return envelope;
+		}
+	};
+}
+/**
+* Pattern matcher: same semantics as `AddonRouteRegistry.matchRoute`
+* but operating on a flat list and bypassing the `/addon/<id>/` prefix
+* — the bridge sends the post-prefix path directly so we don't need
+* to round-trip it through normalization.
+*/
+function matchRoute(routes, method, path) {
+	const normalizedMethod = method.toUpperCase();
+	for (const route of routes) {
+		if (route.method !== normalizedMethod) continue;
+		const params = matchPath(route.path, path);
+		if (params !== null) return {
+			route,
+			params
+		};
+	}
+	return null;
+}
+function matchPath(pattern, p) {
+	const patternParts = pattern.split("/").filter(Boolean);
+	const pathParts = p.split("/").filter(Boolean);
+	if (patternParts.length !== pathParts.length) return null;
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const a = patternParts[i];
+		const b = pathParts[i];
+		if (a.startsWith(":")) params[a.slice(1)] = b;
+		else if (a !== b) return null;
+	}
+	return params;
+}
+function buildCapturingReply(envelope) {
+	const wrapper = {
+		status(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		code(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		send(data) {
+			envelope.body = data;
+		},
+		redirect(url) {
+			envelope.redirectUrl = url;
+			if (envelope.status === 200) envelope.status = 302;
+		},
+		header(name, value) {
+			envelope.headers[name.toLowerCase()] = value;
+			return wrapper;
+		},
+		type(mime) {
+			envelope.contentType = mime;
+			return wrapper;
+		}
+	};
+	return wrapper;
+}
+/**
 * Numeric day-of-week: 0 = Sunday … 6 = Saturday (matches `Date.getDay`).
 * Named `RecordingWeekday` to avoid collision with the string-union
 * `Weekday` exported from `interfaces/timezones.ts`.
@@ -16284,6 +16401,19 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -16340,6 +16470,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+			verified: boolean(),
+			userId: string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
 			userId: string(),
@@ -22842,6 +22985,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22854,6 +23003,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -23154,6 +23309,12 @@ Object.defineProperty(exports, "authProviderCapability", {
 		return authProviderCapability;
 	}
 });
+Object.defineProperty(exports, "buildAddonRouteProvider", {
+	enumerable: true,
+	get: function() {
+		return buildAddonRouteProvider;
+	}
+});
 Object.defineProperty(exports, "errMsg", {
 	enumerable: true,
 	get: function() {

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mmJDfwXE.js");
+const require_dist = require("../dist-biwV9TkV.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -30,6 +30,7 @@ const require_dist = require("../dist-mmJDfwXE.js");
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
 var DEFAULT_CONFIG = {
+	enabled: false,
 	displayName: "Email magic link",
 	icon: "mail",
 	publicOrigin: "",
@@ -52,7 +53,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routes = [
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -74,11 +75,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 				description: "Click target embedded in the magic-link email",
 				handler: async (req, reply) => this.handleLogin(req, reply)
 			}
-		];
-		const routeProvider = {
-			id: "auth-magic-link",
-			getRoutes: () => routes
-		};
+		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
 		return [
@@ -97,6 +94,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 		];
 	}
 	buildLoginMethods() {
+		if (!this.config.enabled) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
@@ -113,6 +111,13 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
+				this.field({
+					type: "boolean",
+					key: "enabled",
+					label: "Enabled",
+					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
+					default: DEFAULT_CONFIG.enabled
+				}),
 				this.field({
 					type: "text",
 					key: "displayName",

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { i as loginMethodCapability, o as errMsg, r as authProviderCapability, s as BaseAddon, t as addonRoutesCapability } from "../dist-suALViLT.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BopfLZ9P.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -25,6 +25,7 @@ import { i as loginMethodCapability, o as errMsg, r as authProviderCapability, s
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
 var DEFAULT_CONFIG = {
+	enabled: false,
 	displayName: "Email magic link",
 	icon: "mail",
 	publicOrigin: "",
@@ -47,7 +48,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routes = [
+		const routeProvider = buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -69,11 +70,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				description: "Click target embedded in the magic-link email",
 				handler: async (req, reply) => this.handleLogin(req, reply)
 			}
-		];
-		const routeProvider = {
-			id: "auth-magic-link",
-			getRoutes: () => routes
-		};
+		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
 		return [
@@ -92,6 +89,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		];
 	}
 	buildLoginMethods() {
+		if (!this.config.enabled) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
@@ -108,6 +106,13 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
+				this.field({
+					type: "boolean",
+					key: "enabled",
+					label: "Enabled",
+					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
+					default: DEFAULT_CONFIG.enabled
+				}),
 				this.field({
 					type: "text",
 					key: "displayName",

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mmJDfwXE.js");
+const require_dist = require("../dist-biwV9TkV.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -1237,7 +1237,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routes = [{
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -1249,11 +1249,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			access: "public",
 			description: "OIDC redirect callback for a configured provider",
 			handler: async (req, reply) => this.handleCallbackRoute(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-oidc",
-			getRoutes: () => routes
-		};
+		}]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
 		return [

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { i as loginMethodCapability, o as errMsg, r as authProviderCapability, s as BaseAddon, t as addonRoutesCapability } from "../dist-suALViLT.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BopfLZ9P.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();
@@ -1231,7 +1231,7 @@ var AuthOidcAddon = class extends BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routes = [{
+		const routeProvider = buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -1243,11 +1243,7 @@ var AuthOidcAddon = class extends BaseAddon {
 			access: "public",
 			description: "OIDC redirect callback for a configured provider",
 			handler: async (req, reply) => this.handleCallbackRoute(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-oidc",
-			getRoutes: () => routes
-		};
+		}]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
 		return [

package/dist/webauthn/_stub.js

@@ -559,10 +559,76 @@ function H(e) {
 	});
 }
 //#endregion
-//#region src/webauthn/widgets/index.tsx
+//#region src/webauthn/widgets/direct-login-i18n.ts
 var U = {
+	en: {
+		signInWithPasskey: "Sign in with a passkey",
+		unsupported: "This browser does not support passkeys.",
+		failed: "Passkey sign-in failed"
+	},
+	it: {
+		signInWithPasskey: "Accedi con una passkey",
+		unsupported: "Questo browser non supporta le passkey.",
+		failed: "Accesso con passkey non riuscito"
+	}
+};
+function W(e) {
+	return (e ?? globalThis.navigator?.language ?? "en").toLowerCase().split("-")[0] === "it" ? "it" : "en";
+}
+function G(e, t) {
+	return U[e][t];
+}
+//#endregion
+//#region src/webauthn/widgets/PasskeyDirectLogin.tsx
+function K(e) {
+	if (!e) return null;
+	let t = e.onComplete, n = e.onError, r = e.locale;
+	return typeof t == "function" ? {
+		onComplete: t,
+		onError: typeof n == "function" ? n : void 0,
+		locale: typeof r == "string" ? r : void 0
+	} : null;
+}
+function q(e) {
+	let n = a(), r = K(e.config), [i, c] = t(!1), [l, u] = t(null), d = W(r?.locale);
+	return r ? L() ? /* @__PURE__ */ s("div", {
+		className: "space-y-2",
+		children: [/* @__PURE__ */ s("button", {
+			type: "button",
+			"data-testid": "login-passkey-direct",
+			onClick: async () => {
+				u(null), c(!0);
+				try {
+					let e = await R((await n.passkeyLoginBegin()).optionsJSON), t = await n.passkeyLoginFinish(e);
+					r.onComplete(t.token);
+				} catch (e) {
+					let t = e instanceof Error ? e.message : G(d, "failed");
+					u(t), r.onError?.(t);
+				} finally {
+					c(!1);
+				}
+			},
+			disabled: i,
+			className: "w-full flex items-center justify-center gap-2 rounded-lg border border-border bg-surface px-4 py-2.5 text-sm font-medium text-foreground hover:bg-surface-hover disabled:opacity-50 transition-colors",
+			children: [i ? /* @__PURE__ */ o(b, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ o(v, { className: "h-4 w-4 text-primary" }), G(d, "signInWithPasskey")]
+		}), l && /* @__PURE__ */ o("div", {
+			className: "rounded-md bg-danger/10 border border-danger/20 px-3 py-2 text-xs text-danger",
+			children: l
+		})]
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-border bg-surface px-3 py-2 text-xs text-foreground-subtle",
+		children: G(d, "unsupported")
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning",
+		children: "Passkey direct-login widget requires an onComplete callback."
+	});
+}
+//#endregion
+//#region src/webauthn/widgets/index.tsx
+var J = {
 	"passkey-enrollment": B,
-	"passkey-login": H
+	"passkey-login": H,
+	"passkey-direct-login": q
 };
 //#endregion
-export { U as default };
+export { J as default };

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Bg_T1-iY.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DW5sgIHW.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.1.20",
+		version: "1.1.21",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.1.36",
+		version: "1.1.37",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mmJDfwXE.js");
+const require_dist = require("../dist-biwV9TkV.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");
@@ -12257,61 +12257,97 @@ var AUTH_WEBAUTHN_REMOTE_NAME = "addon_auth_webauthn_widgets";
 var AUTH_WEBAUTHN_BUNDLE = "remoteEntry.js";
 /** Manifest addon id — the public bundle namespace + login-method addonId. */
 var AUTH_WEBAUTHN_ADDON_ID = "auth-webauthn";
-var authWebauthnWidgets = [{
-	tab: "dashboard",
-	label: "Passkeys",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-enrollment"
-	},
-	stableId: "passkey-enrollment",
-	description: "Enroll and manage passkeys (WebAuthn) for your account.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
-	},
-	defaultSize: "lg",
-	allowedSizes: [
-		"md",
-		"lg",
-		"xl"
-	],
-	defaultColumns: 12,
-	defaultRows: 3,
-	preAuth: false
-}, {
-	tab: "dashboard",
-	label: "Passkey login",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-login"
+var authWebauthnWidgets = [
+	{
+		tab: "dashboard",
+		label: "Passkeys",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-enrollment"
+		},
+		stableId: "passkey-enrollment",
+		description: "Enroll and manage passkeys (WebAuthn) for your account.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "lg",
+		allowedSizes: [
+			"md",
+			"lg",
+			"xl"
+		],
+		defaultColumns: 12,
+		defaultRows: 3,
+		preAuth: false
 	},
-	stableId: "passkey-login",
-	description: "Login-page passkey second-factor ceremony.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
+	{
+		tab: "dashboard",
+		label: "Passkey login",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-login"
+		},
+		stableId: "passkey-login",
+		description: "Login-page passkey second-factor ceremony.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
 	},
-	defaultSize: "sm",
-	allowedSizes: ["sm"],
-	defaultColumns: 4,
-	defaultRows: 1,
-	preAuth: true
-}];
+	{
+		tab: "dashboard",
+		label: "Passkey sign-in",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-direct-login"
+		},
+		stableId: "passkey-direct-login",
+		description: "Login-page usernameless (discoverable-credential) passkey sign-in.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
+	}
+];
 /**
-* Login-method contribution — the `passkey-login` widget, second-factor
-* stage. Aggregated by the public `auth.listLoginMethods` procedure,
-* which stamps a public `bundleUrl` from `addonId` + `bundle`.
+* Login-method contributions — aggregated by the public
+* `auth.listLoginMethods` procedure, which stamps a public `bundleUrl`
+* from `addonId` + `bundle`.
+*
+*   - `passkey-login` (second-factor) — the post-password 2FA ceremony,
+*     mounted only when the challenged user has the `passkey` factor.
+*   - `passkey-direct-login` (primary) — usernameless sign-in via the
+*     standard WebAuthn discoverable-credentials flow. Contributed
+*     unconditionally while the addon is registered: the browser's own
+*     passkey picker is the honest gate (it simply offers nothing when
+*     no resident credential matches the RP) — probing the server for
+*     "does anyone have a passkey" pre-auth would leak enrollment state.
 */
 var authWebauthnLoginMethods = [{
 	kind: "widget",
@@ -12324,6 +12360,17 @@ var authWebauthnLoginMethods = [{
 		componentKey: "passkey-login"
 	},
 	stage: "second-factor"
+}, {
+	kind: "widget",
+	id: `${AUTH_WEBAUTHN_ADDON_ID}/passkey-direct-login`,
+	addonId: AUTH_WEBAUTHN_ADDON_ID,
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-direct-login"
+	},
+	stage: "primary"
 }];
 //#endregion
 //#region src/webauthn/auth-webauthn.addon.ts
@@ -12388,6 +12435,8 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 			finishRegistration: async ({ userId, response, label }) => this.finishRegistration(userId, response, label),
 			beginAuthentication: async ({ userId }) => this.beginAuthentication(userId),
 			finishAuthentication: async ({ userId, response }) => this.finishAuthentication(userId, response),
+			beginDiscoverableAuthentication: async () => this.beginDiscoverableAuthentication(),
+			finishDiscoverableAuthentication: async ({ response }) => this.finishDiscoverableAuthentication(response),
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
 			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
 		};
@@ -12505,9 +12554,12 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 		if (this.config.origin && this.config.origin.trim()) return this.config.origin.trim().replace(/\/+$/, "");
 		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "http://localhost:4443").replace(/\/+$/, "");
 	}
+	challengeTtlMs() {
+		return (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+	}
 	pruneExpiredChallenges() {
 		const now = Date.now();
-		const ttlMs = (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+		const ttlMs = this.challengeTtlMs();
 		for (const [k, v] of this.pending.entries()) if (now - v.createdAt > ttlMs) this.pending.delete(k);
 	}
 	base64urlEncode(bytes) {
@@ -12633,6 +12685,105 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
 		return { verified: true };
 	}
+	/**
+	* Usernameless (discoverable-credential) login — leg 1. Issues
+	* assertion options with an EMPTY `allowCredentials` list so the
+	* browser offers every resident passkey it holds for this RP, and
+	* `userVerification: 'required'` because the passkey is the ONLY
+	* factor (it replaces both username/password and the 2FA leg).
+	* The challenge is stored server-side keyed by its own value and is
+	* NOT bound to any user — `finishDiscoverableAuthentication` resolves
+	* the owner from the asserted credential id.
+	*/
+	async beginDiscoverableAuthentication() {
+		if (!this.store) throw new Error("passkey store unavailable");
+		this.pruneExpiredChallenges();
+		const options = await generateAuthenticationOptions({
+			rpID: this.resolveRpID(),
+			allowCredentials: [],
+			userVerification: "required"
+		});
+		this.pending.set(options.challenge, {
+			challenge: options.challenge,
+			userId: "",
+			kind: "discoverable-authentication",
+			createdAt: Date.now()
+		});
+		return { optionsJSON: options };
+	}
+	/**
+	* Usernameless login — leg 2. Resolves the credential by the
+	* response's credential id, verifies the assertion against the stored
+	* challenge + that credential's public key/counter, and returns the
+	* OWNING userId. Fail-closed: every anomaly returns
+	* `{ verified: false, userId: null }`.
+	*
+	* Replay protection: the pending challenge is consumed (deleted)
+	* BEFORE verification, so an assertion can be spent exactly once.
+	* The TTL is enforced here too — pruning alone only runs on begin
+	* legs, which an attacker controls the timing of.
+	*/
+	async finishDiscoverableAuthentication(response) {
+		if (!this.store) return {
+			verified: false,
+			userId: null
+		};
+		const challenge = this.decodeClientData(response)?.challenge;
+		if (!challenge) return {
+			verified: false,
+			userId: null
+		};
+		const pending = this.pending.get(challenge);
+		if (!pending || pending.kind !== "discoverable-authentication") return {
+			verified: false,
+			userId: null
+		};
+		this.pending.delete(challenge);
+		if (Date.now() - pending.createdAt > this.challengeTtlMs()) return {
+			verified: false,
+			userId: null
+		};
+		const credentialId = typeof response["id"] === "string" ? response["id"] : "";
+		const stored = await this.store.findByCredentialId(credentialId);
+		if (!stored) return {
+			verified: false,
+			userId: null
+		};
+		let verification;
+		try {
+			verification = await verifyAuthenticationResponse({
+				response,
+				expectedChallenge: challenge,
+				expectedRPID: this.resolveRpID(),
+				expectedOrigin: this.resolveOrigin(),
+				requireUserVerification: true,
+				credential: {
+					id: stored.credentialId,
+					publicKey: this.base64urlDecode(stored.publicKey),
+					counter: stored.counter,
+					transports: stored.transports
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("Discoverable passkey verification threw", { meta: {
+				credentialId,
+				err: err instanceof Error ? err.message : String(err)
+			} });
+			return {
+				verified: false,
+				userId: null
+			};
+		}
+		if (!verification.verified || !verification.authenticationInfo) return {
+			verified: false,
+			userId: null
+		};
+		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
+		return {
+			verified: true,
+			userId: stored.userId
+		};
+	}
 	async listPasskeys(userId) {
 		if (!this.store) return [];
 		return (await this.store.findByUserId(userId)).map((r) => ({

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as userPasskeysCapability, c as array, i as loginMethodCapability, l as object, n as addonWidgetsSourceCapability, s as BaseAddon, u as string } from "../dist-suALViLT.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as string, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, u as object } from "../dist-BopfLZ9P.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";
@@ -12283,61 +12283,97 @@ var AUTH_WEBAUTHN_REMOTE_NAME = "addon_auth_webauthn_widgets";
 var AUTH_WEBAUTHN_BUNDLE = "remoteEntry.js";
 /** Manifest addon id — the public bundle namespace + login-method addonId. */
 var AUTH_WEBAUTHN_ADDON_ID = "auth-webauthn";
-var authWebauthnWidgets = [{
-	tab: "dashboard",
-	label: "Passkeys",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-enrollment"
-	},
-	stableId: "passkey-enrollment",
-	description: "Enroll and manage passkeys (WebAuthn) for your account.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
-	},
-	defaultSize: "lg",
-	allowedSizes: [
-		"md",
-		"lg",
-		"xl"
-	],
-	defaultColumns: 12,
-	defaultRows: 3,
-	preAuth: false
-}, {
-	tab: "dashboard",
-	label: "Passkey login",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-login"
+var authWebauthnWidgets = [
+	{
+		tab: "dashboard",
+		label: "Passkeys",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-enrollment"
+		},
+		stableId: "passkey-enrollment",
+		description: "Enroll and manage passkeys (WebAuthn) for your account.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "lg",
+		allowedSizes: [
+			"md",
+			"lg",
+			"xl"
+		],
+		defaultColumns: 12,
+		defaultRows: 3,
+		preAuth: false
 	},
-	stableId: "passkey-login",
-	description: "Login-page passkey second-factor ceremony.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
+	{
+		tab: "dashboard",
+		label: "Passkey login",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-login"
+		},
+		stableId: "passkey-login",
+		description: "Login-page passkey second-factor ceremony.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
 	},
-	defaultSize: "sm",
-	allowedSizes: ["sm"],
-	defaultColumns: 4,
-	defaultRows: 1,
-	preAuth: true
-}];
+	{
+		tab: "dashboard",
+		label: "Passkey sign-in",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-direct-login"
+		},
+		stableId: "passkey-direct-login",
+		description: "Login-page usernameless (discoverable-credential) passkey sign-in.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
+	}
+];
 /**
-* Login-method contribution — the `passkey-login` widget, second-factor
-* stage. Aggregated by the public `auth.listLoginMethods` procedure,
-* which stamps a public `bundleUrl` from `addonId` + `bundle`.
+* Login-method contributions — aggregated by the public
+* `auth.listLoginMethods` procedure, which stamps a public `bundleUrl`
+* from `addonId` + `bundle`.
+*
+*   - `passkey-login` (second-factor) — the post-password 2FA ceremony,
+*     mounted only when the challenged user has the `passkey` factor.
+*   - `passkey-direct-login` (primary) — usernameless sign-in via the
+*     standard WebAuthn discoverable-credentials flow. Contributed
+*     unconditionally while the addon is registered: the browser's own
+*     passkey picker is the honest gate (it simply offers nothing when
+*     no resident credential matches the RP) — probing the server for
+*     "does anyone have a passkey" pre-auth would leak enrollment state.
 */
 var authWebauthnLoginMethods = [{
 	kind: "widget",
@@ -12350,6 +12386,17 @@ var authWebauthnLoginMethods = [{
 		componentKey: "passkey-login"
 	},
 	stage: "second-factor"
+}, {
+	kind: "widget",
+	id: `${AUTH_WEBAUTHN_ADDON_ID}/passkey-direct-login`,
+	addonId: AUTH_WEBAUTHN_ADDON_ID,
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-direct-login"
+	},
+	stage: "primary"
 }];
 var EndpointsSchema = array(object({
 	hostname: string(),
@@ -12377,6 +12424,8 @@ var AuthWebauthnAddon = class extends BaseAddon {
 			finishRegistration: async ({ userId, response, label }) => this.finishRegistration(userId, response, label),
 			beginAuthentication: async ({ userId }) => this.beginAuthentication(userId),
 			finishAuthentication: async ({ userId, response }) => this.finishAuthentication(userId, response),
+			beginDiscoverableAuthentication: async () => this.beginDiscoverableAuthentication(),
+			finishDiscoverableAuthentication: async ({ response }) => this.finishDiscoverableAuthentication(response),
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
 			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
 		};
@@ -12494,9 +12543,12 @@ var AuthWebauthnAddon = class extends BaseAddon {
 		if (this.config.origin && this.config.origin.trim()) return this.config.origin.trim().replace(/\/+$/, "");
 		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "http://localhost:4443").replace(/\/+$/, "");
 	}
+	challengeTtlMs() {
+		return (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+	}
 	pruneExpiredChallenges() {
 		const now = Date.now();
-		const ttlMs = (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+		const ttlMs = this.challengeTtlMs();
 		for (const [k, v] of this.pending.entries()) if (now - v.createdAt > ttlMs) this.pending.delete(k);
 	}
 	base64urlEncode(bytes) {
@@ -12622,6 +12674,105 @@ var AuthWebauthnAddon = class extends BaseAddon {
 		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
 		return { verified: true };
 	}
+	/**
+	* Usernameless (discoverable-credential) login — leg 1. Issues
+	* assertion options with an EMPTY `allowCredentials` list so the
+	* browser offers every resident passkey it holds for this RP, and
+	* `userVerification: 'required'` because the passkey is the ONLY
+	* factor (it replaces both username/password and the 2FA leg).
+	* The challenge is stored server-side keyed by its own value and is
+	* NOT bound to any user — `finishDiscoverableAuthentication` resolves
+	* the owner from the asserted credential id.
+	*/
+	async beginDiscoverableAuthentication() {
+		if (!this.store) throw new Error("passkey store unavailable");
+		this.pruneExpiredChallenges();
+		const options = await generateAuthenticationOptions({
+			rpID: this.resolveRpID(),
+			allowCredentials: [],
+			userVerification: "required"
+		});
+		this.pending.set(options.challenge, {
+			challenge: options.challenge,
+			userId: "",
+			kind: "discoverable-authentication",
+			createdAt: Date.now()
+		});
+		return { optionsJSON: options };
+	}
+	/**
+	* Usernameless login — leg 2. Resolves the credential by the
+	* response's credential id, verifies the assertion against the stored
+	* challenge + that credential's public key/counter, and returns the
+	* OWNING userId. Fail-closed: every anomaly returns
+	* `{ verified: false, userId: null }`.
+	*
+	* Replay protection: the pending challenge is consumed (deleted)
+	* BEFORE verification, so an assertion can be spent exactly once.
+	* The TTL is enforced here too — pruning alone only runs on begin
+	* legs, which an attacker controls the timing of.
+	*/
+	async finishDiscoverableAuthentication(response) {
+		if (!this.store) return {
+			verified: false,
+			userId: null
+		};
+		const challenge = this.decodeClientData(response)?.challenge;
+		if (!challenge) return {
+			verified: false,
+			userId: null
+		};
+		const pending = this.pending.get(challenge);
+		if (!pending || pending.kind !== "discoverable-authentication") return {
+			verified: false,
+			userId: null
+		};
+		this.pending.delete(challenge);
+		if (Date.now() - pending.createdAt > this.challengeTtlMs()) return {
+			verified: false,
+			userId: null
+		};
+		const credentialId = typeof response["id"] === "string" ? response["id"] : "";
+		const stored = await this.store.findByCredentialId(credentialId);
+		if (!stored) return {
+			verified: false,
+			userId: null
+		};
+		let verification;
+		try {
+			verification = await verifyAuthenticationResponse({
+				response,
+				expectedChallenge: challenge,
+				expectedRPID: this.resolveRpID(),
+				expectedOrigin: this.resolveOrigin(),
+				requireUserVerification: true,
+				credential: {
+					id: stored.credentialId,
+					publicKey: this.base64urlDecode(stored.publicKey),
+					counter: stored.counter,
+					transports: stored.transports
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("Discoverable passkey verification threw", { meta: {
+				credentialId,
+				err: err instanceof Error ? err.message : String(err)
+			} });
+			return {
+				verified: false,
+				userId: null
+			};
+		}
+		if (!verification.verified || !verification.authenticationInfo) return {
+			verified: false,
+			userId: null
+		};
+		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
+		return {
+			verified: true,
+			userId: stored.userId
+		};
+	}
 	async listPasskeys(userId) {
 		if (!this.store) return [];
 		return (await this.store.findByUserId(userId)).map((r) => ({

package/dist/webauthn/{hostInit-Boe91Eeg.mjs → hostInit-DKNSGMxo.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.1.36",
+				version: "1.1.37",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.1.20",
+				version: "1.1.21",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Bg_T1-iY.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DW5sgIHW.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "CamStack authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",