feat(login): usernameless passkey sign-in

.env.example

@@ -80,6 +80,11 @@ AUTH_PROVIDER=fake
 # the email sign-in link + password-reset (fail-safe; Zitadel SMTP is NOT the signal here).
 # AUTH_EMAIL_DELIVERY_ENABLED=false
 
+# Usernameless passkey discovery kill switch — INVERSE polarity (default ON): unset keeps
+# the /login discovery arm + /login/passkey-discover live; only 'false'/'0' disables.
+# Exists for incident mitigation by config instead of a revert deploy.
+# AUTH_PASSKEY_DISCOVERY_ENABLED=true
+
 # Require email verification on signup. Unset/false = verification is skipped.
 # KNOWN GAP: read raw from process.env in app/server/env.ts — NOT in the validated Zod schema,
 # so it has no typed default and a typo silently means "off". See docs/operations/configuration.md.

.gitignore

@@ -10,6 +10,8 @@ node_modules
 /cypress/videos
 /cypress/screenshots
 .claude/settings.local.json
+.claude/settings.json
+.superpowers/
 app/modules/i18n/locales/*.ts
 app/modules/i18n/locales/*.js
 /.lighthouseci

CONTRIBUTING.md

@@ -72,5 +72,4 @@ See [Testing](docs/development/testing.md) for the full test strategy.
 
 ## License
 
-By contributing, you agree that your contributions will be licensed under the
-[Apache License 2.0](LICENSE).
+By contributing, you agree that your contributions will be licensed under the MIT License, the same as this project.

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in auth-ui, please report it responsibly by emailing the Datum Cloud security team rather than opening a public issue. This allows us to address the vulnerability before it is disclosed publicly.
+
+For details on Datum Cloud's security policy and how to report vulnerabilities, please see the [Datum Cloud Security Policy](https://github.com/datum-cloud/.github/blob/main/SECURITY.md).
+
+## Security Considerations
+
+This project handles authentication and authorization. Security is a critical concern. When contributing, please:
+
+- Review the [Architecture Security Documentation](docs/architecture/session-and-security.md) for security design principles
+- Run the full test suite before submitting changes
+- Be mindful of authentication and authorization boundaries
+- Report suspected security issues privately, not in issues or pull requests
+
+## Supported Versions
+
+Security updates are provided for the current major version only. Users are encouraged to keep their deployment up to date with the latest releases.

app/components/back-link/previous-step.ts

@@ -14,6 +14,7 @@ const PREVIOUS_STEP: Array<[match: (p: string) => boolean, target: string]> = [
   // instead (matches "Not you?" semantics) — 2+-factor users still reach the real
   // picker via forward navigation from /login/password, which is unaffected.
   [(p) => p.startsWith('/login/verify/'), '/login'],
+  [(p) => p === '/login/passkey', '/login'],
   [(p) => p === '/login/security-key', '/login'],
   [(p) => p === '/signup/password', '/signup'],
   [(p) => p === '/signup/method', '/signup'],

app/components/webauthn-button/webauthn-button.tsx

@@ -25,7 +25,10 @@ export const CYPRESS_CREDENTIAL = {
     authenticatorData: 'ZmFrZS1hdXRoZW50aWNhdG9yLWRhdGE',
     clientDataJSON: 'ZmFrZS1jbGllbnQtZGF0YS1qc29u',
     signature: 'ZmFrZS1zaWduYXR1cmU',
-    userHandle: null,
+    // base64url('u5') — the fake singleton's passkey user. The verify path ignores
+    // userHandle; the /login/passkey-discover action reads it to resolve identity,
+    // so the pre-baked credential must claim a real seeded passkey user.
+    userHandle: 'dTU',
   },
 };