@camstack/addon-auth 1.1.4 → 1.1.5

package/dist/{dist-JUeAGU3c.mjs → dist-BopfLZ9P.mjs}

@@ -16401,6 +16401,19 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -16457,6 +16470,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+			verified: boolean(),
+			userId: string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
 			userId: string(),
@@ -22959,6 +22985,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22971,6 +23003,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",

package/dist/{dist-BLBS0d1z.js → dist-biwV9TkV.js}

@@ -16401,6 +16401,19 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -16457,6 +16470,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+			verified: boolean(),
+			userId: string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
 			userId: string(),
@@ -22959,6 +22985,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22971,6 +23003,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BLBS0d1z.js");
+const require_dist = require("../dist-biwV9TkV.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BopfLZ9P.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BLBS0d1z.js");
+const require_dist = require("../dist-biwV9TkV.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BopfLZ9P.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/_stub.js

@@ -559,10 +559,76 @@ function H(e) {
 	});
 }
 //#endregion
-//#region src/webauthn/widgets/index.tsx
+//#region src/webauthn/widgets/direct-login-i18n.ts
 var U = {
+	en: {
+		signInWithPasskey: "Sign in with a passkey",
+		unsupported: "This browser does not support passkeys.",
+		failed: "Passkey sign-in failed"
+	},
+	it: {
+		signInWithPasskey: "Accedi con una passkey",
+		unsupported: "Questo browser non supporta le passkey.",
+		failed: "Accesso con passkey non riuscito"
+	}
+};
+function W(e) {
+	return (e ?? globalThis.navigator?.language ?? "en").toLowerCase().split("-")[0] === "it" ? "it" : "en";
+}
+function G(e, t) {
+	return U[e][t];
+}
+//#endregion
+//#region src/webauthn/widgets/PasskeyDirectLogin.tsx
+function K(e) {
+	if (!e) return null;
+	let t = e.onComplete, n = e.onError, r = e.locale;
+	return typeof t == "function" ? {
+		onComplete: t,
+		onError: typeof n == "function" ? n : void 0,
+		locale: typeof r == "string" ? r : void 0
+	} : null;
+}
+function q(e) {
+	let n = a(), r = K(e.config), [i, c] = t(!1), [l, u] = t(null), d = W(r?.locale);
+	return r ? L() ? /* @__PURE__ */ s("div", {
+		className: "space-y-2",
+		children: [/* @__PURE__ */ s("button", {
+			type: "button",
+			"data-testid": "login-passkey-direct",
+			onClick: async () => {
+				u(null), c(!0);
+				try {
+					let e = await R((await n.passkeyLoginBegin()).optionsJSON), t = await n.passkeyLoginFinish(e);
+					r.onComplete(t.token);
+				} catch (e) {
+					let t = e instanceof Error ? e.message : G(d, "failed");
+					u(t), r.onError?.(t);
+				} finally {
+					c(!1);
+				}
+			},
+			disabled: i,
+			className: "w-full flex items-center justify-center gap-2 rounded-lg border border-border bg-surface px-4 py-2.5 text-sm font-medium text-foreground hover:bg-surface-hover disabled:opacity-50 transition-colors",
+			children: [i ? /* @__PURE__ */ o(b, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ o(v, { className: "h-4 w-4 text-primary" }), G(d, "signInWithPasskey")]
+		}), l && /* @__PURE__ */ o("div", {
+			className: "rounded-md bg-danger/10 border border-danger/20 px-3 py-2 text-xs text-danger",
+			children: l
+		})]
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-border bg-surface px-3 py-2 text-xs text-foreground-subtle",
+		children: G(d, "unsupported")
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning",
+		children: "Passkey direct-login widget requires an onComplete callback."
+	});
+}
+//#endregion
+//#region src/webauthn/widgets/index.tsx
+var J = {
 	"passkey-enrollment": B,
-	"passkey-login": H
+	"passkey-login": H,
+	"passkey-direct-login": q
 };
 //#endregion
-export { U as default };
+export { J as default };

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Bg_T1-iY.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DW5sgIHW.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.1.20",
+		version: "1.1.21",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.1.36",
+		version: "1.1.37",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BLBS0d1z.js");
+const require_dist = require("../dist-biwV9TkV.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");
@@ -12257,61 +12257,97 @@ var AUTH_WEBAUTHN_REMOTE_NAME = "addon_auth_webauthn_widgets";
 var AUTH_WEBAUTHN_BUNDLE = "remoteEntry.js";
 /** Manifest addon id — the public bundle namespace + login-method addonId. */
 var AUTH_WEBAUTHN_ADDON_ID = "auth-webauthn";
-var authWebauthnWidgets = [{
-	tab: "dashboard",
-	label: "Passkeys",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-enrollment"
-	},
-	stableId: "passkey-enrollment",
-	description: "Enroll and manage passkeys (WebAuthn) for your account.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
-	},
-	defaultSize: "lg",
-	allowedSizes: [
-		"md",
-		"lg",
-		"xl"
-	],
-	defaultColumns: 12,
-	defaultRows: 3,
-	preAuth: false
-}, {
-	tab: "dashboard",
-	label: "Passkey login",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-login"
+var authWebauthnWidgets = [
+	{
+		tab: "dashboard",
+		label: "Passkeys",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-enrollment"
+		},
+		stableId: "passkey-enrollment",
+		description: "Enroll and manage passkeys (WebAuthn) for your account.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "lg",
+		allowedSizes: [
+			"md",
+			"lg",
+			"xl"
+		],
+		defaultColumns: 12,
+		defaultRows: 3,
+		preAuth: false
 	},
-	stableId: "passkey-login",
-	description: "Login-page passkey second-factor ceremony.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
+	{
+		tab: "dashboard",
+		label: "Passkey login",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-login"
+		},
+		stableId: "passkey-login",
+		description: "Login-page passkey second-factor ceremony.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
 	},
-	defaultSize: "sm",
-	allowedSizes: ["sm"],
-	defaultColumns: 4,
-	defaultRows: 1,
-	preAuth: true
-}];
+	{
+		tab: "dashboard",
+		label: "Passkey sign-in",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-direct-login"
+		},
+		stableId: "passkey-direct-login",
+		description: "Login-page usernameless (discoverable-credential) passkey sign-in.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
+	}
+];
 /**
-* Login-method contribution — the `passkey-login` widget, second-factor
-* stage. Aggregated by the public `auth.listLoginMethods` procedure,
-* which stamps a public `bundleUrl` from `addonId` + `bundle`.
+* Login-method contributions — aggregated by the public
+* `auth.listLoginMethods` procedure, which stamps a public `bundleUrl`
+* from `addonId` + `bundle`.
+*
+*   - `passkey-login` (second-factor) — the post-password 2FA ceremony,
+*     mounted only when the challenged user has the `passkey` factor.
+*   - `passkey-direct-login` (primary) — usernameless sign-in via the
+*     standard WebAuthn discoverable-credentials flow. Contributed
+*     unconditionally while the addon is registered: the browser's own
+*     passkey picker is the honest gate (it simply offers nothing when
+*     no resident credential matches the RP) — probing the server for
+*     "does anyone have a passkey" pre-auth would leak enrollment state.
 */
 var authWebauthnLoginMethods = [{
 	kind: "widget",
@@ -12324,6 +12360,17 @@ var authWebauthnLoginMethods = [{
 		componentKey: "passkey-login"
 	},
 	stage: "second-factor"
+}, {
+	kind: "widget",
+	id: `${AUTH_WEBAUTHN_ADDON_ID}/passkey-direct-login`,
+	addonId: AUTH_WEBAUTHN_ADDON_ID,
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-direct-login"
+	},
+	stage: "primary"
 }];
 //#endregion
 //#region src/webauthn/auth-webauthn.addon.ts
@@ -12388,6 +12435,8 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 			finishRegistration: async ({ userId, response, label }) => this.finishRegistration(userId, response, label),
 			beginAuthentication: async ({ userId }) => this.beginAuthentication(userId),
 			finishAuthentication: async ({ userId, response }) => this.finishAuthentication(userId, response),
+			beginDiscoverableAuthentication: async () => this.beginDiscoverableAuthentication(),
+			finishDiscoverableAuthentication: async ({ response }) => this.finishDiscoverableAuthentication(response),
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
 			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
 		};
@@ -12505,9 +12554,12 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 		if (this.config.origin && this.config.origin.trim()) return this.config.origin.trim().replace(/\/+$/, "");
 		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "http://localhost:4443").replace(/\/+$/, "");
 	}
+	challengeTtlMs() {
+		return (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+	}
 	pruneExpiredChallenges() {
 		const now = Date.now();
-		const ttlMs = (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+		const ttlMs = this.challengeTtlMs();
 		for (const [k, v] of this.pending.entries()) if (now - v.createdAt > ttlMs) this.pending.delete(k);
 	}
 	base64urlEncode(bytes) {
@@ -12633,6 +12685,105 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
 		return { verified: true };
 	}
+	/**
+	* Usernameless (discoverable-credential) login — leg 1. Issues
+	* assertion options with an EMPTY `allowCredentials` list so the
+	* browser offers every resident passkey it holds for this RP, and
+	* `userVerification: 'required'` because the passkey is the ONLY
+	* factor (it replaces both username/password and the 2FA leg).
+	* The challenge is stored server-side keyed by its own value and is
+	* NOT bound to any user — `finishDiscoverableAuthentication` resolves
+	* the owner from the asserted credential id.
+	*/
+	async beginDiscoverableAuthentication() {
+		if (!this.store) throw new Error("passkey store unavailable");
+		this.pruneExpiredChallenges();
+		const options = await generateAuthenticationOptions({
+			rpID: this.resolveRpID(),
+			allowCredentials: [],
+			userVerification: "required"
+		});
+		this.pending.set(options.challenge, {
+			challenge: options.challenge,
+			userId: "",
+			kind: "discoverable-authentication",
+			createdAt: Date.now()
+		});
+		return { optionsJSON: options };
+	}
+	/**
+	* Usernameless login — leg 2. Resolves the credential by the
+	* response's credential id, verifies the assertion against the stored
+	* challenge + that credential's public key/counter, and returns the
+	* OWNING userId. Fail-closed: every anomaly returns
+	* `{ verified: false, userId: null }`.
+	*
+	* Replay protection: the pending challenge is consumed (deleted)
+	* BEFORE verification, so an assertion can be spent exactly once.
+	* The TTL is enforced here too — pruning alone only runs on begin
+	* legs, which an attacker controls the timing of.
+	*/
+	async finishDiscoverableAuthentication(response) {
+		if (!this.store) return {
+			verified: false,
+			userId: null
+		};
+		const challenge = this.decodeClientData(response)?.challenge;
+		if (!challenge) return {
+			verified: false,
+			userId: null
+		};
+		const pending = this.pending.get(challenge);
+		if (!pending || pending.kind !== "discoverable-authentication") return {
+			verified: false,
+			userId: null
+		};
+		this.pending.delete(challenge);
+		if (Date.now() - pending.createdAt > this.challengeTtlMs()) return {
+			verified: false,
+			userId: null
+		};
+		const credentialId = typeof response["id"] === "string" ? response["id"] : "";
+		const stored = await this.store.findByCredentialId(credentialId);
+		if (!stored) return {
+			verified: false,
+			userId: null
+		};
+		let verification;
+		try {
+			verification = await verifyAuthenticationResponse({
+				response,
+				expectedChallenge: challenge,
+				expectedRPID: this.resolveRpID(),
+				expectedOrigin: this.resolveOrigin(),
+				requireUserVerification: true,
+				credential: {
+					id: stored.credentialId,
+					publicKey: this.base64urlDecode(stored.publicKey),
+					counter: stored.counter,
+					transports: stored.transports
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("Discoverable passkey verification threw", { meta: {
+				credentialId,
+				err: err instanceof Error ? err.message : String(err)
+			} });
+			return {
+				verified: false,
+				userId: null
+			};
+		}
+		if (!verification.verified || !verification.authenticationInfo) return {
+			verified: false,
+			userId: null
+		};
+		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
+		return {
+			verified: true,
+			userId: stored.userId
+		};
+	}
 	async listPasskeys(userId) {
 		if (!this.store) return [];
 		return (await this.store.findByUserId(userId)).map((r) => ({

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, d as string, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, u as object } from "../dist-JUeAGU3c.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as string, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, u as object } from "../dist-BopfLZ9P.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";
@@ -12283,61 +12283,97 @@ var AUTH_WEBAUTHN_REMOTE_NAME = "addon_auth_webauthn_widgets";
 var AUTH_WEBAUTHN_BUNDLE = "remoteEntry.js";
 /** Manifest addon id — the public bundle namespace + login-method addonId. */
 var AUTH_WEBAUTHN_ADDON_ID = "auth-webauthn";
-var authWebauthnWidgets = [{
-	tab: "dashboard",
-	label: "Passkeys",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-enrollment"
-	},
-	stableId: "passkey-enrollment",
-	description: "Enroll and manage passkeys (WebAuthn) for your account.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
-	},
-	defaultSize: "lg",
-	allowedSizes: [
-		"md",
-		"lg",
-		"xl"
-	],
-	defaultColumns: 12,
-	defaultRows: 3,
-	preAuth: false
-}, {
-	tab: "dashboard",
-	label: "Passkey login",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-login"
+var authWebauthnWidgets = [
+	{
+		tab: "dashboard",
+		label: "Passkeys",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-enrollment"
+		},
+		stableId: "passkey-enrollment",
+		description: "Enroll and manage passkeys (WebAuthn) for your account.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "lg",
+		allowedSizes: [
+			"md",
+			"lg",
+			"xl"
+		],
+		defaultColumns: 12,
+		defaultRows: 3,
+		preAuth: false
 	},
-	stableId: "passkey-login",
-	description: "Login-page passkey second-factor ceremony.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
+	{
+		tab: "dashboard",
+		label: "Passkey login",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-login"
+		},
+		stableId: "passkey-login",
+		description: "Login-page passkey second-factor ceremony.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
 	},
-	defaultSize: "sm",
-	allowedSizes: ["sm"],
-	defaultColumns: 4,
-	defaultRows: 1,
-	preAuth: true
-}];
+	{
+		tab: "dashboard",
+		label: "Passkey sign-in",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-direct-login"
+		},
+		stableId: "passkey-direct-login",
+		description: "Login-page usernameless (discoverable-credential) passkey sign-in.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
+	}
+];
 /**
-* Login-method contribution — the `passkey-login` widget, second-factor
-* stage. Aggregated by the public `auth.listLoginMethods` procedure,
-* which stamps a public `bundleUrl` from `addonId` + `bundle`.
+* Login-method contributions — aggregated by the public
+* `auth.listLoginMethods` procedure, which stamps a public `bundleUrl`
+* from `addonId` + `bundle`.
+*
+*   - `passkey-login` (second-factor) — the post-password 2FA ceremony,
+*     mounted only when the challenged user has the `passkey` factor.
+*   - `passkey-direct-login` (primary) — usernameless sign-in via the
+*     standard WebAuthn discoverable-credentials flow. Contributed
+*     unconditionally while the addon is registered: the browser's own
+*     passkey picker is the honest gate (it simply offers nothing when
+*     no resident credential matches the RP) — probing the server for
+*     "does anyone have a passkey" pre-auth would leak enrollment state.
 */
 var authWebauthnLoginMethods = [{
 	kind: "widget",
@@ -12350,6 +12386,17 @@ var authWebauthnLoginMethods = [{
 		componentKey: "passkey-login"
 	},
 	stage: "second-factor"
+}, {
+	kind: "widget",
+	id: `${AUTH_WEBAUTHN_ADDON_ID}/passkey-direct-login`,
+	addonId: AUTH_WEBAUTHN_ADDON_ID,
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-direct-login"
+	},
+	stage: "primary"
 }];
 var EndpointsSchema = array(object({
 	hostname: string(),
@@ -12377,6 +12424,8 @@ var AuthWebauthnAddon = class extends BaseAddon {
 			finishRegistration: async ({ userId, response, label }) => this.finishRegistration(userId, response, label),
 			beginAuthentication: async ({ userId }) => this.beginAuthentication(userId),
 			finishAuthentication: async ({ userId, response }) => this.finishAuthentication(userId, response),
+			beginDiscoverableAuthentication: async () => this.beginDiscoverableAuthentication(),
+			finishDiscoverableAuthentication: async ({ response }) => this.finishDiscoverableAuthentication(response),
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
 			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
 		};
@@ -12494,9 +12543,12 @@ var AuthWebauthnAddon = class extends BaseAddon {
 		if (this.config.origin && this.config.origin.trim()) return this.config.origin.trim().replace(/\/+$/, "");
 		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "http://localhost:4443").replace(/\/+$/, "");
 	}
+	challengeTtlMs() {
+		return (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+	}
 	pruneExpiredChallenges() {
 		const now = Date.now();
-		const ttlMs = (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+		const ttlMs = this.challengeTtlMs();
 		for (const [k, v] of this.pending.entries()) if (now - v.createdAt > ttlMs) this.pending.delete(k);
 	}
 	base64urlEncode(bytes) {
@@ -12622,6 +12674,105 @@ var AuthWebauthnAddon = class extends BaseAddon {
 		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
 		return { verified: true };
 	}
+	/**
+	* Usernameless (discoverable-credential) login — leg 1. Issues
+	* assertion options with an EMPTY `allowCredentials` list so the
+	* browser offers every resident passkey it holds for this RP, and
+	* `userVerification: 'required'` because the passkey is the ONLY
+	* factor (it replaces both username/password and the 2FA leg).
+	* The challenge is stored server-side keyed by its own value and is
+	* NOT bound to any user — `finishDiscoverableAuthentication` resolves
+	* the owner from the asserted credential id.
+	*/
+	async beginDiscoverableAuthentication() {
+		if (!this.store) throw new Error("passkey store unavailable");
+		this.pruneExpiredChallenges();
+		const options = await generateAuthenticationOptions({
+			rpID: this.resolveRpID(),
+			allowCredentials: [],
+			userVerification: "required"
+		});
+		this.pending.set(options.challenge, {
+			challenge: options.challenge,
+			userId: "",
+			kind: "discoverable-authentication",
+			createdAt: Date.now()
+		});
+		return { optionsJSON: options };
+	}
+	/**
+	* Usernameless login — leg 2. Resolves the credential by the
+	* response's credential id, verifies the assertion against the stored
+	* challenge + that credential's public key/counter, and returns the
+	* OWNING userId. Fail-closed: every anomaly returns
+	* `{ verified: false, userId: null }`.
+	*
+	* Replay protection: the pending challenge is consumed (deleted)
+	* BEFORE verification, so an assertion can be spent exactly once.
+	* The TTL is enforced here too — pruning alone only runs on begin
+	* legs, which an attacker controls the timing of.
+	*/
+	async finishDiscoverableAuthentication(response) {
+		if (!this.store) return {
+			verified: false,
+			userId: null
+		};
+		const challenge = this.decodeClientData(response)?.challenge;
+		if (!challenge) return {
+			verified: false,
+			userId: null
+		};
+		const pending = this.pending.get(challenge);
+		if (!pending || pending.kind !== "discoverable-authentication") return {
+			verified: false,
+			userId: null
+		};
+		this.pending.delete(challenge);
+		if (Date.now() - pending.createdAt > this.challengeTtlMs()) return {
+			verified: false,
+			userId: null
+		};
+		const credentialId = typeof response["id"] === "string" ? response["id"] : "";
+		const stored = await this.store.findByCredentialId(credentialId);
+		if (!stored) return {
+			verified: false,
+			userId: null
+		};
+		let verification;
+		try {
+			verification = await verifyAuthenticationResponse({
+				response,
+				expectedChallenge: challenge,
+				expectedRPID: this.resolveRpID(),
+				expectedOrigin: this.resolveOrigin(),
+				requireUserVerification: true,
+				credential: {
+					id: stored.credentialId,
+					publicKey: this.base64urlDecode(stored.publicKey),
+					counter: stored.counter,
+					transports: stored.transports
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("Discoverable passkey verification threw", { meta: {
+				credentialId,
+				err: err instanceof Error ? err.message : String(err)
+			} });
+			return {
+				verified: false,
+				userId: null
+			};
+		}
+		if (!verification.verified || !verification.authenticationInfo) return {
+			verified: false,
+			userId: null
+		};
+		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
+		return {
+			verified: true,
+			userId: stored.userId
+		};
+	}
 	async listPasskeys(userId) {
 		if (!this.store) return [];
 		return (await this.store.findByUserId(userId)).map((r) => ({

package/dist/webauthn/{hostInit-Boe91Eeg.mjs → hostInit-DKNSGMxo.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.1.36",
+				version: "1.1.37",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.1.20",
+				version: "1.1.21",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Bg_T1-iY.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DW5sgIHW.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "CamStack authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",