@camstack/addon-auth 1.1.5 → 1.1.6

package/dist/{dist-BopfLZ9P.mjs → dist-BlBNW5nA.mjs}

@@ -16418,6 +16418,15 @@ method(_void(), array(TurnServerSchema).readonly());
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16491,6 +16500,15 @@ response: record(string(), unknown()) }), object({
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(object({ userId: string() }), object({ enabled: boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(object({
+			userId: string(),
+			enabled: boolean()
+		}), object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -23015,6 +23033,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -23027,6 +23051,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",
@@ -23279,4 +23309,4 @@ object({
 	schemaVersion: literal(1)
 });
 //#endregion
-export { loginMethodCapability as a, BaseAddon as c, string as d, buildAddonRouteProvider as i, array as l, addonWidgetsSourceCapability as n, userPasskeysCapability as o, authProviderCapability as r, errMsg as s, addonRoutesCapability as t, object as u };
+export { loginMethodCapability as a, BaseAddon as c, number as d, object as f, buildAddonRouteProvider as i, array as l, addonWidgetsSourceCapability as n, userPasskeysCapability as o, string as p, authProviderCapability as r, errMsg as s, addonRoutesCapability as t, boolean as u };

package/dist/{dist-biwV9TkV.js → dist-CS-GzG-v.js}

@@ -16418,6 +16418,15 @@ method(_void(), array(TurnServerSchema).readonly());
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16491,6 +16500,15 @@ response: record(string(), unknown()) }), object({
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(object({ userId: string() }), object({ enabled: boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(object({
+			userId: string(),
+			enabled: boolean()
+		}), object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -23015,6 +23033,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -23027,6 +23051,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",
@@ -23309,6 +23339,12 @@ Object.defineProperty(exports, "authProviderCapability", {
 		return authProviderCapability;
 	}
 });
+Object.defineProperty(exports, "boolean", {
+	enumerable: true,
+	get: function() {
+		return boolean;
+	}
+});
 Object.defineProperty(exports, "buildAddonRouteProvider", {
 	enumerable: true,
 	get: function() {
@@ -23327,6 +23363,12 @@ Object.defineProperty(exports, "loginMethodCapability", {
 		return loginMethodCapability;
 	}
 });
+Object.defineProperty(exports, "number", {
+	enumerable: true,
+	get: function() {
+		return number;
+	}
+});
 Object.defineProperty(exports, "object", {
 	enumerable: true,
 	get: function() {

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-biwV9TkV.js");
+const require_dist = require("../dist-CS-GzG-v.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BopfLZ9P.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BlBNW5nA.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-biwV9TkV.js");
+const require_dist = require("../dist-CS-GzG-v.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BopfLZ9P.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BlBNW5nA.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/_stub.js

@@ -414,7 +414,17 @@ function B(e) {
 	let n = a(), l = r({
 		queryKey: ["auth", "listOwnPasskeys"],
 		queryFn: () => n.listOwnPasskeys()
-	}), u = l.data ?? [], [d, f] = t(""), [p, m] = t(!1), [h, g] = t(null), S = async () => {
+	}), u = l.data ?? [], [d, f] = t(""), [p, m] = t(!1), [h, g] = t(null), S = r({
+		queryKey: ["auth", "getOwnPasskeySecondFactorPreference"],
+		queryFn: () => n.getOwnPasskeySecondFactorPreference(),
+		enabled: u.length > 0
+	}), C = S.data?.enabled ?? !1, w = i({
+		mutationFn: (e) => n.setOwnPasskeySecondFactorPreference({ enabled: e }),
+		onSuccess: () => {
+			g(null), S.refetch();
+		},
+		onError: (e) => g(e instanceof Error ? e.message : "Could not update the preference")
+	}), T = async () => {
 		g(null), m(!0);
 		try {
 			let e = await z((await n.beginOwnPasskeyRegistration()).optionsJSON);
@@ -427,7 +437,7 @@ function B(e) {
 		} finally {
 			m(!1);
 		}
-	}, C = i({
+	}, E = i({
 		mutationFn: (e) => n.removeOwnPasskey({ credentialId: e }),
 		onSuccess: () => {
 			g(null), l.refetch();
@@ -447,7 +457,7 @@ function B(e) {
 			children: [
 				/* @__PURE__ */ o("div", {
 					className: "text-xs text-foreground-subtle",
-					children: "Add a passkey (Touch ID, Windows Hello, or a security key) as a phishing-resistant second factor. You'll be prompted for it at every login."
+					children: "Add a passkey (Touch ID, Windows Hello, or a security key) to sign in directly — fast and phishing-resistant, no password needed."
 				}),
 				l.isLoading ? /* @__PURE__ */ s("div", {
 					className: "flex items-center gap-2 text-xs text-foreground-subtle",
@@ -473,8 +483,8 @@ function B(e) {
 								})]
 							}),
 							/* @__PURE__ */ s("button", {
-								onClick: () => C.mutate(e.credentialId),
-								disabled: C.isPending,
+								onClick: () => E.mutate(e.credentialId),
+								disabled: E.isPending,
 								className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[11px] text-danger hover:bg-danger/10 disabled:opacity-50",
 								children: [/* @__PURE__ */ o(x, { className: "h-3 w-3" }), "Remove"]
 							})
@@ -484,6 +494,28 @@ function B(e) {
 					className: "text-[11px] text-foreground-subtle",
 					children: "No passkeys enrolled yet."
 				}),
+				u.length > 0 && /* @__PURE__ */ s("div", {
+					className: "flex items-start justify-between gap-3 rounded-md border border-border px-3 py-2.5",
+					children: [/* @__PURE__ */ s("div", {
+						className: "min-w-0",
+						children: [/* @__PURE__ */ o("div", {
+							className: "text-xs font-medium text-foreground",
+							children: "Require passkey as second factor"
+						}), /* @__PURE__ */ o("div", {
+							className: "text-[10px] text-foreground-subtle mt-0.5",
+							children: "Also ask for a passkey after every password sign-in. Off by default — enrolling a passkey on its own only enables direct passkey sign-in."
+						})]
+					}), /* @__PURE__ */ o("button", {
+						type: "button",
+						role: "switch",
+						"aria-checked": C,
+						"aria-label": "Require passkey as second factor",
+						onClick: () => w.mutate(!C),
+						disabled: S.isLoading || w.isPending,
+						className: `relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors disabled:opacity-50 ${C ? "bg-primary" : "bg-foreground-subtle/30"}`,
+						children: /* @__PURE__ */ o("span", { className: `inline-block h-3.5 w-3.5 rounded-full bg-white shadow transition-transform ${C ? "translate-x-[18px]" : "translate-x-[3px]"}` })
+					})]
+				}),
 				h && /* @__PURE__ */ s("div", {
 					className: "text-[11px] text-danger flex items-center gap-1",
 					children: [/* @__PURE__ */ o(_, { className: "h-3 w-3" }), h]
@@ -503,7 +535,7 @@ function B(e) {
 							className: "w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground focus:outline-none focus:ring-1 focus:ring-primary"
 						})]
 					}), /* @__PURE__ */ o("button", {
-						onClick: S,
+						onClick: T,
 						disabled: p,
 						className: "inline-flex items-center gap-1.5 rounded-lg bg-primary px-3 py-2 text-xs font-semibold text-primary-foreground hover:opacity-90 disabled:opacity-50",
 						children: p ? /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(b, { className: "h-3.5 w-3.5 animate-spin" }), "Enrolling…"] }) : /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(v, { className: "h-3.5 w-3.5" }), "Add passkey"] })
@@ -564,12 +596,14 @@ var U = {
 	en: {
 		signInWithPasskey: "Sign in with a passkey",
 		unsupported: "This browser does not support passkeys.",
-		failed: "Passkey sign-in failed"
+		failed: "Passkey sign-in failed",
+		secondFactorRequired: "Additional verification is required — sign in with your password to continue."
 	},
 	it: {
 		signInWithPasskey: "Accedi con una passkey",
 		unsupported: "Questo browser non supporta le passkey.",
-		failed: "Accesso con passkey non riuscito"
+		failed: "Accesso con passkey non riuscito",
+		secondFactorRequired: "È richiesta una verifica aggiuntiva — accedi con la password per continuare."
 	}
 };
 function W(e) {
@@ -582,11 +616,12 @@ function G(e, t) {
 //#region src/webauthn/widgets/PasskeyDirectLogin.tsx
 function K(e) {
 	if (!e) return null;
-	let t = e.onComplete, n = e.onError, r = e.locale;
+	let t = e.onComplete, n = e.onSecondFactor, r = e.onError, i = e.locale;
 	return typeof t == "function" ? {
 		onComplete: t,
-		onError: typeof n == "function" ? n : void 0,
-		locale: typeof r == "string" ? r : void 0
+		onSecondFactor: typeof n == "function" ? n : void 0,
+		onError: typeof r == "function" ? r : void 0,
+		locale: typeof i == "string" ? i : void 0
 	} : null;
 }
 function q(e) {
@@ -599,7 +634,18 @@ function q(e) {
 			onClick: async () => {
 				u(null), c(!0);
 				try {
-					let e = await R((await n.passkeyLoginBegin()).optionsJSON), t = await n.passkeyLoginFinish(e);
+					let e = await R((await n.passkeyLoginBegin()).optionsJSON), t = await n.passkeyLoginFinish(e), i = t.secondFactors ?? (t.requiresTotp === !0 ? ["totp"] : []);
+					if (i.length > 0) {
+						if (r.onSecondFactor) r.onSecondFactor({
+							challengeToken: t.token,
+							factors: i
+						});
+						else {
+							let e = G(d, "secondFactorRequired");
+							u(e), r.onError?.(e);
+						}
+						return;
+					}
 					r.onComplete(t.token);
 				} catch (e) {
 					let t = e instanceof Error ? e.message : G(d, "failed");

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DW5sgIHW.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Du23U8IZ.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.1.21",
+		version: "1.1.22",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.1.37",
+		version: "1.1.39",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-biwV9TkV.js");
+const require_dist = require("../dist-CS-GzG-v.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");
@@ -12123,6 +12123,36 @@ async function verifyAuthenticationResponse(options) {
 * auth like Touch ID), `usb`, `nfc`, `ble`.
 */
 var COLLECTION = "user_passkeys";
+/**
+* Per-user passkey preferences — one row per userId, keyed upserts via
+* the settings-store `set` surface. Today a single flag: whether the
+* user OPTED IN to their passkey doubling as a mandatory second factor
+* after a password login (default OFF — enrolling a passkey only
+* enables passkey-first sign-in).
+*/
+var PREF_COLLECTION = "user_passkey_prefs";
+var PREF_COLUMNS = [
+	{
+		name: "userId",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "secondFactorEnabled",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var StoredPreferenceSchema = require_dist.object({
+	secondFactorEnabled: require_dist.boolean(),
+	updatedAt: require_dist.number()
+});
 var COLUMNS = [
 	{
 		name: "credentialId",
@@ -12173,6 +12203,10 @@ async function declarePasskeySchema(store) {
 			columns: ["userId"]
 		}]
 	});
+	await store.declareCollection.mutate({
+		collection: PREF_COLLECTION,
+		columns: PREF_COLUMNS
+	});
 }
 function parseRow(data) {
 	const credentialId = data["credentialId"];
@@ -12248,6 +12282,31 @@ var PasskeyStore = class {
 			key: credentialId
 		});
 	}
+	/**
+	* Whether `userId` opted in to the passkey-as-second-factor gate.
+	* Fail-safe: a missing or malformed row reads as `false` — the
+	* password login flow must never demand a factor the user did not
+	* explicitly enable.
+	*/
+	async getSecondFactorPreference(userId) {
+		const raw = await this.store.get.query({
+			collection: PREF_COLLECTION,
+			key: userId
+		});
+		const parsed = StoredPreferenceSchema.safeParse(raw);
+		return parsed.success ? parsed.data.secondFactorEnabled : false;
+	}
+	async setSecondFactorPreference(userId, enabled) {
+		const value = {
+			secondFactorEnabled: enabled,
+			updatedAt: Date.now()
+		};
+		await this.store.set.mutate({
+			collection: PREF_COLLECTION,
+			key: userId,
+			value
+		});
+	}
 };
 //#endregion
 //#region src/webauthn/widget-catalog.ts
@@ -12438,7 +12497,9 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 			beginDiscoverableAuthentication: async () => this.beginDiscoverableAuthentication(),
 			finishDiscoverableAuthentication: async ({ response }) => this.finishDiscoverableAuthentication(response),
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
-			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
+			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId),
+			getSecondFactorPreference: async ({ userId }) => this.getSecondFactorPreference(userId),
+			setSecondFactorPreference: async ({ userId, enabled }) => this.setSecondFactorPreference(userId, enabled)
 		};
 		const widgetsProvider = { listWidgets: async () => authWebauthnWidgets };
 		const loginMethodProvider = { getLoginMethods: async () => authWebauthnLoginMethods };
@@ -12794,6 +12855,20 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 			transports: [...r.transports]
 		}));
 	}
+	/**
+	* Second-factor preference (opt-in, default OFF). Enrolling a passkey
+	* only enables passkey-first sign-in; the password login flow demands
+	* the passkey second leg ONLY when this flag is explicitly enabled.
+	*/
+	async getSecondFactorPreference(userId) {
+		if (!this.store) return { enabled: false };
+		return { enabled: await this.store.getSecondFactorPreference(userId) };
+	}
+	async setSecondFactorPreference(userId, enabled) {
+		if (!this.store) throw new Error("passkey store unavailable");
+		await this.store.setSecondFactorPreference(userId, enabled);
+		return { success: true };
+	}
 	async removePasskey(userId, credentialId) {
 		if (!this.store) throw new Error("passkey store unavailable");
 		const existing = await this.store.findByCredentialId(credentialId);

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, d as string, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, u as object } from "../dist-BopfLZ9P.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-BlBNW5nA.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";
@@ -12149,6 +12149,36 @@ async function verifyAuthenticationResponse(options) {
 * auth like Touch ID), `usb`, `nfc`, `ble`.
 */
 var COLLECTION = "user_passkeys";
+/**
+* Per-user passkey preferences — one row per userId, keyed upserts via
+* the settings-store `set` surface. Today a single flag: whether the
+* user OPTED IN to their passkey doubling as a mandatory second factor
+* after a password login (default OFF — enrolling a passkey only
+* enables passkey-first sign-in).
+*/
+var PREF_COLLECTION = "user_passkey_prefs";
+var PREF_COLUMNS = [
+	{
+		name: "userId",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "secondFactorEnabled",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var StoredPreferenceSchema = object({
+	secondFactorEnabled: boolean(),
+	updatedAt: number()
+});
 var COLUMNS = [
 	{
 		name: "credentialId",
@@ -12199,6 +12229,10 @@ async function declarePasskeySchema(store) {
 			columns: ["userId"]
 		}]
 	});
+	await store.declareCollection.mutate({
+		collection: PREF_COLLECTION,
+		columns: PREF_COLUMNS
+	});
 }
 function parseRow(data) {
 	const credentialId = data["credentialId"];
@@ -12274,6 +12308,31 @@ var PasskeyStore = class {
 			key: credentialId
 		});
 	}
+	/**
+	* Whether `userId` opted in to the passkey-as-second-factor gate.
+	* Fail-safe: a missing or malformed row reads as `false` — the
+	* password login flow must never demand a factor the user did not
+	* explicitly enable.
+	*/
+	async getSecondFactorPreference(userId) {
+		const raw = await this.store.get.query({
+			collection: PREF_COLLECTION,
+			key: userId
+		});
+		const parsed = StoredPreferenceSchema.safeParse(raw);
+		return parsed.success ? parsed.data.secondFactorEnabled : false;
+	}
+	async setSecondFactorPreference(userId, enabled) {
+		const value = {
+			secondFactorEnabled: enabled,
+			updatedAt: Date.now()
+		};
+		await this.store.set.mutate({
+			collection: PREF_COLLECTION,
+			key: userId,
+			value
+		});
+	}
 };
 //#endregion
 //#region src/webauthn/widget-catalog.ts
@@ -12427,7 +12486,9 @@ var AuthWebauthnAddon = class extends BaseAddon {
 			beginDiscoverableAuthentication: async () => this.beginDiscoverableAuthentication(),
 			finishDiscoverableAuthentication: async ({ response }) => this.finishDiscoverableAuthentication(response),
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
-			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
+			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId),
+			getSecondFactorPreference: async ({ userId }) => this.getSecondFactorPreference(userId),
+			setSecondFactorPreference: async ({ userId, enabled }) => this.setSecondFactorPreference(userId, enabled)
 		};
 		const widgetsProvider = { listWidgets: async () => authWebauthnWidgets };
 		const loginMethodProvider = { getLoginMethods: async () => authWebauthnLoginMethods };
@@ -12783,6 +12844,20 @@ var AuthWebauthnAddon = class extends BaseAddon {
 			transports: [...r.transports]
 		}));
 	}
+	/**
+	* Second-factor preference (opt-in, default OFF). Enrolling a passkey
+	* only enables passkey-first sign-in; the password login flow demands
+	* the passkey second leg ONLY when this flag is explicitly enabled.
+	*/
+	async getSecondFactorPreference(userId) {
+		if (!this.store) return { enabled: false };
+		return { enabled: await this.store.getSecondFactorPreference(userId) };
+	}
+	async setSecondFactorPreference(userId, enabled) {
+		if (!this.store) throw new Error("passkey store unavailable");
+		await this.store.setSecondFactorPreference(userId, enabled);
+		return { success: true };
+	}
 	async removePasskey(userId, credentialId) {
 		if (!this.store) throw new Error("passkey store unavailable");
 		const existing = await this.store.findByCredentialId(credentialId);

package/dist/webauthn/{hostInit-DKNSGMxo.mjs → hostInit-Cq4HnxlU.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.1.37",
+				version: "1.1.39",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.1.21",
+				version: "1.1.22",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DW5sgIHW.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Du23U8IZ.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "description": "CamStack authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",