@byline/admin 6.7.2 → 6.9.0

package/dist/modules/auth/passkey-rate-limiter.js

@@ -0,0 +1,60 @@
+import { createHmac } from "node:crypto";
+import { signInNetwork } from "./sign-in-rate-limiter.js";
+function createPasskeyRequestLimiter(store, secret, now = Date.now) {
+    const bytes = 'string' == typeof secret ? new TextEncoder().encode(secret) : secret;
+    if (bytes.byteLength < 32) throw new Error('Passkey HMAC secret must contain at least 32 bytes');
+    const key = createHmac('sha256', bytes).update('byline:passkey-requests:v1').digest();
+    let active = 0;
+    const cleanupTask = {
+        name: 'auth.sign-in-counters.cleanup',
+        intervalMs: 60000,
+        leaseMs: 60000,
+        async run (context) {
+            const started = performance.now();
+            for(let n = 0; n < 32 && performance.now() - started < 30000; n++){
+                context.signal.throwIfAborted();
+                await context.heartbeat();
+                if (await store.purgeExpired(new Date(now() - 300000)) < 100) return {
+                    workRemaining: false
+                };
+            }
+            return {
+                workRemaining: true
+            };
+        }
+    };
+    return {
+        requiredCleanupTask: cleanupTask.name,
+        cleanupTask,
+        async acquire () {
+            if (active >= 4) return null;
+            active++;
+            const started = performance.now();
+            let released = false;
+            return ()=>{
+                if (released) return;
+                released = true;
+                setTimeout(()=>{
+                    active--;
+                }, Math.max(0, 100 - (performance.now() - started))).unref();
+            };
+        },
+        async consume ({ ip }) {
+            const network = signInNetwork(ip);
+            const time = now();
+            const end = (Math.floor(time / 60000) + 1) * 60000;
+            const digest = createHmac('sha256', key).update(JSON.stringify([
+                'network',
+                network,
+                end
+            ])).digest('hex');
+            await store.purgeExpired(new Date(time - 300000));
+            const allowed = await store.consume(digest, 60, new Date(end));
+            return {
+                allowed,
+                retryAfterSeconds: allowed ? 0 : Math.max(1, Math.ceil((end - time) / 1000))
+            };
+        }
+    };
+}
+export { createPasskeyRequestLimiter };

package/dist/modules/auth/passkey-rate-limiter.test.node.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};

package/dist/modules/auth/passkey-storage-validation.d.ts

@@ -0,0 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { PasskeyAttemptRow, PasskeyClaimInput } from './passkeys-repository.js';
+/** Canonical encoding makes string identity exactly equivalent to WebAuthn byte identity. */
+export declare function assertPasskeyBytes(value: string, maxBytes: number, exactBytes?: number): void;
+export declare function assertPasskeyTokenHash(value: string): void;
+export declare function assertPasskeyAttempt(input: Omit<PasskeyAttemptRow, 'consumed_at'>): void;
+/** Runtime callers must obey the same purpose/action boundary as typed callers. */
+export declare function assertPasskeyClaim(input: PasskeyClaimInput): void;

package/dist/modules/auth/passkey-storage-validation.js

@@ -0,0 +1,59 @@
+function assertPasskeyBytes(value, maxBytes, exactBytes) {
+    if ('string' != typeof value || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error('Invalid passkey byte encoding');
+    const bytes = Buffer.from(value, 'base64url');
+    if (bytes.length > maxBytes || void 0 !== exactBytes && bytes.length !== exactBytes || bytes.toString('base64url') !== value) throw new Error('Invalid passkey byte encoding');
+}
+function assertPasskeyTokenHash(value) {
+    if (!/^[a-f0-9]{64}$/.test(value)) throw new Error('Invalid passkey token hash');
+}
+function assertPasskeyAttempt(input) {
+    assertPasskeyTokenHash(input.token_hash);
+    const lifetime = input.expires_at.getTime() - input.created_at.getTime();
+    if (!Number.isFinite(lifetime) || lifetime <= 0 || lifetime > 300000) throw new Error('Invalid passkey attempt lifetime');
+    if (![
+        'sign-in',
+        'fresh-authentication',
+        'enrollment',
+        'grant'
+    ].includes(input.purpose)) throw new Error('Invalid passkey attempt purpose');
+    if ('grant' === input.purpose) {
+        if (null !== input.challenge) throw new Error('Grants cannot contain challenges');
+    } else assertPasskeyBytes(input.challenge ?? '', 32, 32);
+    if ('sign-in' === input.purpose) {
+        if ([
+            input.actor_user_id,
+            input.actor_login_id,
+            input.actor_generation,
+            input.action,
+            input.target_user_id,
+            input.credential_record_id,
+            input.proof_credential_id
+        ].some((value)=>null !== value)) throw new Error('Sign-in attempts cannot carry management authority');
+    } else {
+        if (!input.actor_user_id || !input.actor_login_id || !Number.isSafeInteger(input.actor_generation) || (input.actor_generation ?? -1) < 0) throw new Error('Management attempts require an acting login and generation');
+        if ('enroll' === input.action) {
+            if (input.target_user_id !== input.actor_user_id || null !== input.credential_record_id) throw new Error('Enrollment must target the actor');
+        } else if ('remove' === input.action) {
+            if (!input.target_user_id || !input.credential_record_id || 'enrollment' === input.purpose) throw new Error('Removal must bind its target account and credential');
+        } else throw new Error('Management attempts require an action');
+    }
+}
+function assertPasskeyClaim(input) {
+    assertPasskeyTokenHash(input.tokenHash);
+    if ('sign-in' === input.purpose) {
+        if (void 0 !== input.action || [
+            input.binding.actor_user_id,
+            input.binding.actor_login_id,
+            input.binding.actor_generation
+        ].some((value)=>null !== value)) throw new Error('Sign-in claims require anonymous binding and no action');
+    } else {
+        if (![
+            'fresh-authentication',
+            'enrollment',
+            'grant'
+        ].includes(input.purpose)) throw new Error('Invalid passkey claim purpose');
+        if ('enroll' !== input.action && 'remove' !== input.action) throw new Error('Authenticated claims require an action');
+        if (!input.binding.actor_user_id || !input.binding.actor_login_id || !Number.isSafeInteger(input.binding.actor_generation) || input.binding.actor_generation < 0) throw new Error('Authenticated claims require an acting login binding');
+    }
+}
+export { assertPasskeyAttempt, assertPasskeyBytes, assertPasskeyClaim, assertPasskeyTokenHash };

package/dist/modules/auth/passkeys-repository.d.ts

@@ -0,0 +1,96 @@
+/**
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Internal persistence records. Never return these through account/editor DTOs. */
+export interface PasskeyCredentialRow {
+    id: string;
+    /** Null after account deletion; the credential identity remains reserved. */
+    admin_user_id: string | null;
+    /** Canonical unpadded base64url; byte-exact uniqueness includes revoked records. */
+    credential_id: string;
+    public_key: string;
+    counter: number;
+    transports: string[];
+    backup_eligible: boolean;
+    backed_up: boolean;
+    name: string;
+    created_at: Date;
+    last_used_at: Date | null;
+    revoked_at: Date | null;
+}
+export interface PasskeyAttemptRow {
+    /** SHA-256 hex of the independent bearer identifier; never the identifier itself. */
+    token_hash: string;
+    purpose: 'sign-in' | 'fresh-authentication' | 'enrollment' | 'grant';
+    challenge: string | null;
+    actor_user_id: string | null;
+    actor_login_id: string | null;
+    actor_generation: number | null;
+    action: 'enroll' | 'remove' | null;
+    target_user_id: string | null;
+    credential_record_id: string | null;
+    /** Credential used for fresh proof, if any; revalidated at grant use. */
+    proof_credential_id: string | null;
+    created_at: Date;
+    expires_at: Date;
+    consumed_at: Date | null;
+}
+export type PasskeyClaimInput = {
+    tokenHash: string;
+    now: Date;
+} & ({
+    purpose: 'sign-in';
+    binding: {
+        actor_user_id: null;
+        actor_login_id: null;
+        actor_generation: null;
+    };
+    action?: never;
+} | {
+    purpose: 'fresh-authentication' | 'enrollment' | 'grant';
+    binding: {
+        actor_user_id: string;
+        actor_login_id: string;
+        actor_generation: number;
+    };
+    action: 'enroll' | 'remove';
+});
+export interface PasskeysRepository {
+    /** Target lock required; generation and native-login revocation commit together. */
+    invalidateAccountLogins(adminUserId: string, at: Date): Promise<void>;
+    /** Success requires both account locks; denial/failure records may be written separately. */
+    appendRemovalAudit(input: {
+        actorId: string;
+        targetId: string;
+        credentialId: string;
+        outcome: 'success' | 'denied' | 'failed';
+    }): Promise<void>;
+    getUserHandle(adminUserId: string): Promise<string | null>;
+    /** Requires the owning account lock. Allocates once; never resets on credential removal. */
+    ensureUserHandle(adminUserId: string, candidate: string): Promise<string>;
+    /** Includes tombstones: authentication must reject revoked or ownerless records. */
+    findCredential(id: string): Promise<PasskeyCredentialRow | null>;
+    /** Includes tombstones: authentication must reject revoked or ownerless records. */
+    findCredentialByCredentialId(credentialId: string): Promise<PasskeyCredentialRow | null>;
+    listCredentials(adminUserId: string): Promise<PasskeyCredentialRow[]>;
+    /** All credential writes require the owning account lock and share its transaction. */
+    createCredential(input: Omit<PasskeyCredentialRow, 'admin_user_id' | 'revoked_at'> & {
+        admin_user_id: string;
+    }): Promise<void>;
+    updateCredential(id: string, patch: Partial<Pick<PasskeyCredentialRow, 'counter' | 'backed_up' | 'name' | 'last_used_at'>>): Promise<void>;
+    revokeCredential(id: string, at: Date): Promise<void>;
+    /** Authenticated attempts require the actor lock; sign-in has no account yet. */
+    createAttempt(input: Omit<PasskeyAttemptRow, 'consumed_at'>): Promise<void>;
+    findAttempt(tokenHash: string): Promise<PasskeyAttemptRow | null>;
+    countPendingForLogin(loginId: string, now: Date): Promise<number>;
+    /**
+     * Root store only: commits consumption in its own short transaction BEFORE returning.
+     * Calling through an account-transaction store must throw, never create a savepoint.
+     * Exact purpose/binding, unconsumed state and expiry gate the sole winning claim.
+     * No automatic retries, even if commit acknowledgement is uncertain.
+     */
+    claimAttempt(input: PasskeyClaimInput): Promise<PasskeyAttemptRow | null>;
+}

package/dist/modules/auth/passkeys-repository.js

@@ -0,0 +1 @@
+export { };

package/dist/modules/auth/refresh-tokens-repository.d.ts

@@ -62,7 +62,7 @@ export interface RefreshTokensRepository {
     revokeChain(startId: string, at?: Date): Promise<number>;
     /** Revoke every non-revoked token for a user. Used on password change / sign-out everywhere. */
     revokeAllForUser(adminUserId: string, at?: Date): Promise<number>;
-    /** Remove rows whose `expires_at` is in the past. Housekeeping. */
+    /** Legacy housekeeping: at most 100 null-sid rows expired for 30 days. Native login members are retained. */
     purgeExpired(now?: Date): Promise<number>;
     /** All non-revoked tokens for a user. Primarily for tests. */
     listActiveForUser(adminUserId: string): Promise<RefreshTokenRow[]>;

package/dist/modules/auth/sign-in-rate-limiter.d.ts

@@ -38,6 +38,8 @@ export interface SignInLimiterOptions {
     /** Also bounds counter creation when the provider or a denial completes very quickly. */
     minimumSlotMs?: number;
 }
+/** IPv4 uses one address; IPv6 uses its /64. Mapped IPv4 shares its native IPv4 bucket. */
+export declare function signInNetwork(ip: string): string;
 /**
  * Instantiate once per process. Acquire before consume and release in finally after verification.
  * Network admission precedes account-plus-network admission. There is no account-wide lockout.

package/dist/modules/auth/sign-in-rate-limiter.js

@@ -226,4 +226,4 @@ function createPasswordSignInLimiter(store, secret, policy = DEFAULT_POLICY, now
         }
     };
 }
-export { createPasswordSignInLimiter };
+export { createPasswordSignInLimiter, signInNetwork };

package/dist/services/admin-services-context.d.ts

@@ -7,7 +7,7 @@
  */
 import { type ReactNode } from 'react';
 import type { BylineAdminServices } from './admin-services-types.js';
-export type { AdminServiceCall, BylineAdminServices, ChangeAccountPasswordInput, CreateAdminRoleInput, CreateAdminUserInput, SetAdminUserPasswordInput, SetRoleAbilitiesInput, SetUserRolesInput, SignInInput, SignInResult, UpdateAccountInput, UpdateAdminRoleInput, UpdateAdminUserInput, WhoHasAbilityInput, } from './admin-services-types.js';
+export type { AdminServiceCall, BylineAdminServices, ChangeAccountPasswordInput, CreateAdminRoleInput, CreateAdminUserInput, PasskeyAdminServices, PasskeyPageBinding, SetAdminUserPasswordInput, SetRoleAbilitiesInput, SetUserRolesInput, SignInInput, SignInResult, UpdateAccountInput, UpdateAdminRoleInput, UpdateAdminUserInput, WhoHasAbilityInput, } from './admin-services-types.js';
 interface BylineAdminServicesProviderProps {
     services: BylineAdminServices;
     children: ReactNode;

package/dist/services/admin-services-types.d.ts

@@ -23,6 +23,7 @@
  * server fns directly today and move into `@byline/host-tanstack-start`
  * in Phase 3 along with the route factories.
  */
+import type { PasskeyAuthenticationOptions, PasskeyCeremony, PasskeyCredentialSummary, PasskeyManagementAction, PasskeyManagementGrant, PasskeyRegistrationOptions } from '@byline/auth';
 import type { AccountResponse, ChangeAccountPasswordRequest, UpdateAccountRequest } from '../modules/admin-account/index.js';
 import type { SetRoleAbilitiesResponse, WhoHasAbilityResponse } from '../modules/admin-permissions/index.js';
 import type { AdminRoleResponse, UserRolesResponse } from '../modules/admin-roles/index.js';
@@ -46,6 +47,63 @@ export interface SignInInput {
  * supply whatever envelope it produces without forcing a public type.
  */
 export type SignInResult = unknown;
+/** Captured before any prompt; the host checks it again before submission. */
+export interface PasskeyPageBinding {
+    expectedSessionId: string | null;
+    assertCurrent(): void;
+}
+interface PasskeyBoundInput {
+    expectedSessionId: string;
+}
+export interface PasskeyAdminServices {
+    capability(): Promise<{
+        enabled: boolean;
+    }>;
+    captureLogin(signIn?: boolean): PasskeyPageBinding;
+    managementContext(binding: PasskeyPageBinding): Promise<{
+        id: string;
+        isSuperAdmin: boolean;
+        canManagePasskeys: boolean;
+    }>;
+    signInOptions: AdminServiceCall<Record<string, never>, PasskeyCeremony<PasskeyAuthenticationOptions>>;
+    signIn(args: {
+        data: {
+            ceremonyId: string;
+            response: unknown;
+        };
+    }, binding: PasskeyPageBinding): Promise<unknown>;
+    passwordProof: AdminServiceCall<PasskeyBoundInput & {
+        password: string;
+        action: PasskeyManagementAction;
+    }, PasskeyManagementGrant>;
+    proofOptions: AdminServiceCall<PasskeyBoundInput & {
+        action: PasskeyManagementAction;
+    }, PasskeyCeremony<PasskeyAuthenticationOptions>>;
+    proof: AdminServiceCall<PasskeyBoundInput & {
+        ceremonyId: string;
+        response: unknown;
+    }, PasskeyManagementGrant>;
+    enrollmentOptions: AdminServiceCall<PasskeyBoundInput & {
+        grantId: string;
+    }, PasskeyCeremony<PasskeyRegistrationOptions>>;
+    enrollment: AdminServiceCall<PasskeyBoundInput & {
+        ceremonyId: string;
+        response: unknown;
+        name: string;
+    }, PasskeyCredentialSummary>;
+    list: AdminServiceCall<PasskeyBoundInput & {
+        targetUserId?: string;
+    }, PasskeyCredentialSummary[]>;
+    rename: AdminServiceCall<PasskeyBoundInput & {
+        credentialRecordId: string;
+        name: string;
+    }, PasskeyCredentialSummary>;
+    remove: AdminServiceCall<PasskeyBoundInput & {
+        grantId: string;
+    }, {
+        signedOut: boolean;
+    }>;
+}
 /** Same shape as `UpdateAccountRequest` from `@byline/admin/admin-account`. */
 export type UpdateAccountInput = UpdateAccountRequest;
 /** Same shape as `ChangeAccountPasswordRequest` from `@byline/admin/admin-account`. */
@@ -119,6 +177,7 @@ export interface WhoHasAbilityInput {
 }
 export interface BylineAdminServices {
     adminSignIn: AdminServiceCall<SignInInput, SignInResult>;
+    passkeys?: PasskeyAdminServices;
     updateAccount: AdminServiceCall<UpdateAccountInput, AccountResponse>;
     changeAccountPassword: AdminServiceCall<ChangeAccountPasswordInput, AccountResponse>;
     setAdminLocale: AdminServiceCall<SetAdminLocaleInput, SetAdminLocaleResult>;
@@ -143,3 +202,4 @@ export interface BylineAdminServices {
      */
     getCollectionDocumentVersion: (collection: string, documentId: string, versionId: string, locale: string | undefined) => Promise<Record<string, unknown>>;
 }
+export {};

package/dist/store.d.ts

@@ -9,7 +9,9 @@ import type { AdminPermissionsRepository } from './modules/admin-permissions/rep
 import type { AdminPreferencesRepository } from './modules/admin-preferences/repository.js';
 import type { AdminRolesRepository } from './modules/admin-roles/repository.js';
 import type { AdminUsersRepository, AdminUserWithPasswordRow } from './modules/admin-users/repository.js';
+import type { AuthMaintenanceRepository } from './modules/auth/auth-maintenance-repository.js';
 import type { LoginSessionsRepository } from './modules/auth/login-sessions-repository.js';
+import type { PasskeysRepository } from './modules/auth/passkeys-repository.js';
 import type { RefreshTokensRepository } from './modules/auth/refresh-tokens-repository.js';
 import type { SignInRateLimitStore } from './modules/auth/sign-in-rate-limiter.js';
 /**
@@ -35,6 +37,8 @@ export interface AdminStore {
     withSessionLock<T>(adminUserId: string, work: (store: AdminStore, user: AdminUserWithPasswordRow | null) => Promise<T>): Promise<T>;
     /** Lock distinct account IDs in sorted order in one transaction for account-switch sign-in. */
     withSessionLocks<T>(adminUserIds: string[], work: (store: AdminStore) => Promise<T>): Promise<T>;
+    authMaintenance: AuthMaintenanceRepository;
+    passkeys: PasskeysRepository;
     loginSessions: LoginSessionsRepository;
     signInRateLimits: SignInRateLimitStore;
     adminUsers: AdminUsersRepository;

package/package.json

@@ -2,9 +2,9 @@
   "name": "@byline/admin",
   "private": false,
   "license": "MPL-2.0",
-  "version": "6.7.2",
+  "version": "6.9.0",
   "engines": {
-    "node": ">=20.9.0"
+    "node": ">=22.22.2"
   },
   "description": "Byline CMS admin subsystem — admin users, roles, permissions, account self-service, and the built-in JWT session provider",
   "keywords": [
@@ -157,19 +157,24 @@
       "import": "./dist/modules/auth/components/sign-in-form.js",
       "require": "./dist/modules/auth/components/sign-in-form.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./auth/components/passkey-manager": {
+      "types": "./dist/modules/auth/components/passkey-manager.d.ts",
+      "import": "./dist/modules/auth/components/passkey-manager.js",
+      "require": "./dist/modules/auth/components/passkey-manager.js"
+    }
   },
   "files": [
     "dist/",
     "src/"
   ],
   "dependencies": {
-    "@byline/analytics": "6.7.2",
-    "@byline/analytics-agent": "6.7.2",
-    "@byline/auth": "6.7.2",
-    "@byline/core": "6.7.2",
-    "@byline/i18n": "6.7.2",
-    "@byline/ui": "6.7.2",
+    "@byline/analytics": "6.9.0",
+    "@byline/analytics-agent": "6.9.0",
+    "@byline/auth": "6.9.0",
+    "@byline/core": "6.9.0",
+    "@byline/i18n": "6.9.0",
+    "@byline/ui": "6.9.0",
     "@codemirror/commands": "^6.11.1",
     "@codemirror/lang-css": "^6.3.1",
     "@codemirror/lang-html": "^6.4.12",
@@ -183,6 +188,8 @@
     "@codemirror/state": "^6.7.6",
     "@codemirror/view": "^6.43.14",
     "@lezer/highlight": "^1.2.5",
+    "@simplewebauthn/browser": "^14.0.0",
+    "@simplewebauthn/server": "^14.0.3",
     "@tanstack/react-form-start": "^1.33.5",
     "clsx": "^2.1.1",
     "jose": "^6.2.12",

package/src/fields/blocks/blocks-field.module.css

@@ -5,6 +5,7 @@
  *   .byline-field-blocks                — outer wrapper
  *   .byline-field-blocks-title          — block-list label heading
  *   .byline-field-blocks-stack          — vertical stack of blocks + add row
+ *   .byline-field-blocks-unavailable    — display-only unavailable-block warning
  *   .byline-field-blocks-add-row        — add-button row at the bottom
  *   .byline-field-blocks-add-label      — clickable text label in the add row
  *   .byline-field-blocks-modal-head     — picker modal header
@@ -33,6 +34,28 @@
   gap: var(--spacing-16);
 }
 
+.unavailable,
+:global(.byline-field-blocks-unavailable) {
+  display: flex;
+  align-items: flex-start;
+  gap: var(--spacing-8);
+  padding: var(--spacing-16);
+  border: 1px solid var(--stroke-warning);
+  border-radius: var(--border-radius-md);
+  background-color: oklch(from var(--fill-warning-weak) l c h / calc(alpha * 0.5));
+  color: var(--foreground);
+}
+
+.unavailable > :first-child,
+:global(.byline-field-blocks-unavailable) > :first-child {
+  flex-shrink: 0;
+}
+
+.unavailable p,
+:global(.byline-field-blocks-unavailable) p {
+  margin: var(--spacing-4) 0 0;
+}
+
 .add-row,
 :global(.byline-field-blocks-add-row) {
   display: flex;

package/src/fields/blocks/blocks-field.tsx

@@ -6,7 +6,7 @@
  * Copyright (c) Infonomic Company Limited
  */
 
-import { useEffect, useMemo, useState } from 'react'
+import { Fragment, useEffect, useMemo, useState } from 'react'
 
 import type {
   BlockAdminConfig,
@@ -25,6 +25,7 @@ import {
   Modal,
   moveItem,
   PlusIcon,
+  WarningIcon,
 } from '@byline/ui/react'
 import cx from 'clsx'
 
@@ -35,6 +36,7 @@ import { useFieldError, useFormContext } from '../../forms/form-context'
 import { useScopedDomId } from '../../forms/form-dom-scope'
 import { hasExistingIdTargets } from '../../forms/nested-path'
 import { moveRepeatingItems, repeatingItemId, repeatingItemPath } from '../../forms/repeating-items'
+import { useUnavailableBlocks } from '../../forms/unavailable-blocks'
 import styles from './blocks-field.module.css'
 
 // ---------------------------------------------------------------------------
@@ -61,6 +63,7 @@ export const BlocksField = ({
   const { appendPatch, getFieldValue, getFieldValues, removePendingUploadsUnder, setFieldStore } =
     useFormContext()
   const { t } = useTranslation('byline-admin')
+  const unavailableBlocks = useUnavailableBlocks(path)
   const fieldError = useFieldError(path)
   const htmlId = useScopedDomId(path)
   const [items, setItems] = useState<{ id: string; data: any }[]>([])
@@ -288,7 +291,28 @@ export const BlocksField = ({
         onDragEnd={handleDragEnd}
         className={cx('byline-field-blocks-stack', styles.stack)}
       >
-        {items.map((item, index) => renderItem(item, index))}
+        {Array.from({ length: items.length + 1 }, (_, index) => (
+          <Fragment key={items[index]?.id ?? 'end'}>
+            {unavailableBlocks.map((issue, removedBefore) =>
+              Math.min(issue.storedIndex - removedBefore, items.length) === index ? (
+                <div
+                  key={`${issue.storedIndex}-${issue.blockType}`}
+                  role="note"
+                  className={cx('byline-field-blocks-unavailable', styles.unavailable)}
+                >
+                  <WarningIcon width="24px" height="24px" />
+                  <div>
+                    <strong>
+                      {t('fields.blocks.unavailableTitle', { blockType: issue.blockType })}
+                    </strong>
+                    <p>{t('fields.blocks.unavailableBody')}</p>
+                  </div>
+                </div>
+              ) : null
+            )}
+            {index < items.length && renderItem(items[index]!, index)}
+          </Fragment>
+        ))}
         <div className={cx('byline-field-blocks-add-row', styles['add-row'])}>
           <IconButton
             onClick={() => {

package/src/forms/form-page-chrome.tsx

@@ -19,7 +19,12 @@
 
 import type { ReactNode, RefObject } from 'react'
 
-import type { SlugifierFn, StructuralMutationReceipt, WorkflowStatus } from '@byline/core'
+import type {
+  SlugifierFn,
+  StructuralMutationReceipt,
+  UnavailableBlock,
+  WorkflowStatus,
+} from '@byline/core'
 import { useTranslation } from '@byline/i18n/react'
 import { Alert, Button, ComboButton, LoaderEllipsis } from '@byline/ui/react'
 import cx from 'clsx'
@@ -263,6 +268,7 @@ export interface FormConcurrencyNoticesProps {
   onDiscardRequested: () => void
   scheduling: UseScheduledPublicationReturn
   restoreWarnings?: string[]
+  unavailableBlocks?: UnavailableBlock[]
 }
 
 export const FormConcurrencyNotices = ({
@@ -276,6 +282,7 @@ export const FormConcurrencyNotices = ({
   onDiscardRequested,
   scheduling,
   restoreWarnings,
+  unavailableBlocks,
 }: FormConcurrencyNoticesProps): ReactNode => {
   const { t } = useTranslation('byline-admin')
 
@@ -329,6 +336,17 @@ export const FormConcurrencyNotices = ({
         onCancel={scheduling.cancel}
       />
       {scheduling.modal}
+      {unavailableBlocks && unavailableBlocks.length > 0 && (
+        <Alert
+          className="m-0 mt-4"
+          intent="warning"
+          icon={true}
+          close={false}
+          title={t('forms.unavailableBlocks.title')}
+        >
+          <p>{t('forms.unavailableBlocks.body', { count: unavailableBlocks.length })}</p>
+        </Alert>
+      )}
       {restoreWarnings && restoreWarnings.length > 0 && (
         <Alert
           className="m-0 mt-4"

package/src/forms/form-renderer-capabilities.test.tsx

@@ -131,7 +131,7 @@ describe('FormRenderer capabilities', () => {
   })
 
   it('forwards adminConfig.lockPath to the path widget', () => {
-    render({ ...baseProps, adminConfig: { slug: 'pages', lockPath: true } })
+    render({ ...baseProps, adminConfig: { path: 'pages', lockPath: true } })
 
     const input = container.querySelector<HTMLInputElement>('input[name="__systemPath__"]')
     expect(input?.readOnly).toBe(true)
@@ -139,7 +139,7 @@ describe('FormRenderer capabilities', () => {
   })
 
   it('leaves the path widget editable when no lockPath is declared', () => {
-    render({ ...baseProps, adminConfig: { slug: 'pages' } })
+    render({ ...baseProps, adminConfig: { path: 'pages' } })
 
     const input = container.querySelector<HTMLInputElement>('input[name="__systemPath__"]')
     expect(input?.readOnly).toBe(false)
@@ -156,7 +156,7 @@ describe('FormRenderer capabilities', () => {
       fields: [{ name: 'ref', label: 'Ref', type: 'counter' as const }],
       useAsPath: 'ref',
       initialData: { id: 'doc-1', path: 'about-us', fields: { ref: 448 } },
-      adminConfig: { slug: 'pages' },
+      adminConfig: { path: 'pages' },
     })
 
     const input = container.querySelector<HTMLInputElement>('input[name="__systemPath__"]')
@@ -173,7 +173,7 @@ describe('FormRenderer capabilities', () => {
       mode: 'create' as const,
       useAsPath: undefined,
       initialData: { fields: {} },
-      adminConfig: { slug: 'pages', lockPath: true },
+      adminConfig: { path: 'pages', lockPath: true },
     })
 
     expect(container.querySelector('.byline-form-path')).not.toBeNull()
@@ -188,14 +188,14 @@ describe('FormRenderer capabilities', () => {
       mode: 'create' as const,
       useAsPath: undefined,
       initialData: { fields: {} },
-      adminConfig: { slug: 'pages' },
+      adminConfig: { path: 'pages' },
     })
 
     expect(container.querySelector('.byline-form-path')).toBeNull()
   })
 
   it('lets showPath: false override lockPath', () => {
-    render({ ...baseProps, showPath: false, adminConfig: { slug: 'pages', lockPath: true } })
+    render({ ...baseProps, showPath: false, adminConfig: { path: 'pages', lockPath: true } })
 
     expect(container.querySelector('.byline-form-path')).toBeNull()
   })