@byline/cli 6.7.2 → 6.9.0

package/dist/phases/preflight-runtime.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=preflight-runtime.test.d.ts.map

package/dist/phases/preflight-runtime.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-runtime.test.d.ts","sourceRoot":"","sources":["../../src/phases/preflight-runtime.test.ts"],"names":[],"mappings":""}

package/dist/phases/preflight-runtime.test.js

@@ -0,0 +1,53 @@
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createTestContext } from '../test-helpers.js';
+import { preflightPhase } from './preflight.js';
+const originalNode = Object.getOwnPropertyDescriptor(process.versions, 'node');
+const roots = [];
+afterEach(() => {
+    Object.defineProperty(process.versions, 'node', originalNode);
+    for (const root of roots.splice(0))
+        rmSync(root, { recursive: true, force: true });
+});
+function context(version) {
+    Object.defineProperty(process.versions, 'node', { ...originalNode, value: version });
+    const ctx = createTestContext({ pm: 'pnpm' });
+    roots.push(ctx.cwd);
+    mkdirSync(ctx.resolve('.git'));
+    writeFileSync(ctx.resolve('package.json'), '{"name":"runtime-fixture"}\n');
+    return ctx;
+}
+describe('CLI minimum Node runtime', () => {
+    it.each([
+        '18.20.2',
+        '20.9.0',
+        '20.20.0',
+        '21.7.3',
+        '22.0.0',
+        '22.11.9',
+        '22.12.0',
+        '22.22.0',
+        '22.22.1',
+    ])('blocks Node %s before installation work', async (version) => {
+        const ctx = context(version);
+        const error = vi.spyOn(ctx.logger, 'error');
+        expect(await preflightPhase.apply(await preflightPhase.plan(ctx), ctx)).toEqual({
+            state: 'blocked',
+        });
+        expect(error).toHaveBeenCalledWith(`Node 22.22.2+ required (found ${version})`);
+        error.mockRestore();
+    });
+    it.each(['22.22.2', '22.23.0', '24.18.0'])('accepts Node %s', async (version) => {
+        const ctx = context(version);
+        expect(await preflightPhase.apply(await preflightPhase.plan(ctx), ctx)).toEqual({
+            state: 'done',
+        });
+    });
+    it('rechecks a previously completed preflight after a runtime downgrade', async () => {
+        const ctx = context('22.22.1');
+        ctx.state.markPhaseComplete('preflight');
+        expect(await preflightPhase.detect(ctx)).toBe('pending');
+        expect((await preflightPhase.apply(await preflightPhase.plan(ctx), ctx)).state).toBe('blocked');
+    });
+});
+//# sourceMappingURL=preflight-runtime.test.js.map

package/dist/phases/preflight-runtime.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-runtime.test.js","sourceRoot":"","sources":["../../src/phases/preflight-runtime.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE1D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAE,CAAA;AAC/E,MAAM,KAAK,GAAa,EAAE,CAAA;AAE1B,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA;AAEF,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACpF,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnB,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9B,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,CAAA;IAC1E,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,IAAI,CAAC;QACN,SAAS;QACT,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,SAAS;QACT,SAAS;QACT,SAAS;KACV,CAAC,CAAC,yCAAyC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC3C,MAAM,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9E,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,iCAAiC,OAAO,GAAG,CAAC,CAAA;QAC/E,KAAK,CAAC,WAAW,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9E,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;QAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACxC,MAAM,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACxD,MAAM,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/phases/preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/phases/preflight.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAExD,eAAO,MAAM,cAAc,EAAE,KA2C5B,CAAA;AAoDD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CA2BhE"}
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/phases/preflight.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAExD,eAAO,MAAM,cAAc,EAAE,KA0C5B,CAAA;AAwDD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CA2BhE"}

package/dist/phases/preflight.js

@@ -1,12 +1,13 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { gte } from 'semver';
 import { ancestors, resolveWorkspaceOwnership, validateWorkspacePackageManager, workspaceManagerConstraint, } from '../lib/workspace-root.js';
 export const preflightPhase = {
     id: 'preflight',
     title: 'Preflight — environment checks',
     defaultMode: 'auto',
     async detect(ctx) {
-        if (!ctx.state.isComplete('preflight'))
+        if (!supportsNodeRuntime() || !ctx.state.isComplete('preflight'))
             return 'pending';
         const selected = ctx.cliFlags.pm ?? ctx.state.get().answers.pm;
         const constraint = workspaceManagerConstraint(ctx.cwd);
@@ -20,9 +21,8 @@ export const preflightPhase = {
         return { writes: [], commands: [], notes: ['check Node version, git repo, package manager'] };
     },
     async apply(_plan, ctx) {
-        const major = Number(process.versions.node.split('.')[0]);
-        if (major < 20) {
-            ctx.logger.error(`Node 20.9+ required (found ${process.versions.node})`);
+        if (!supportsNodeRuntime()) {
+            ctx.logger.error(`Node 22.22.2+ required (found ${process.versions.node})`);
             return { state: 'blocked' };
         }
         if (!existsSync(ctx.resolve('.git'))) {
@@ -43,6 +43,9 @@ export const preflightPhase = {
         return { state: 'done' };
     },
 };
+function supportsNodeRuntime() {
+    return gte(process.versions.node, '22.22.2');
+}
 async function resolvePackageManager(ctx) {
     const fromFlag = ctx.cliFlags.pm;
     const persisted = ctx.state.get().answers.pm;

package/dist/phases/preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/phases/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EACL,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAA;AAIjC,MAAM,CAAC,MAAM,cAAc,GAAU;IACnC,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,MAAM;IAEnB,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAA;QACxD,MAAM,QAAQ,GAAI,GAAG,CAAC,QAAQ,CAAC,EAAiC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;QAC9F,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAA;QAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5F,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAA;QACjB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAI;QACb,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,+CAA+C,CAAC,EAAE,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzD,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAA;YACxE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC7B,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;YACrF,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,uBAAuB;gBAChC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YACF,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACtC,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACpC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAA;QACX,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;QAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAC1B,CAAC;CACF,CAAA;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAY;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAgC,CAAA;IAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;IAC5C,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,iDAAiD,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAA;QACtC,IAAI,QAAQ,IAAI,QAAQ,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,yBAAyB,UAAU,CAAC,OAAO,cAAc,UAAU,CAAC,OAAO,EAAE,CAC9E,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;QAChF,OAAO,UAAU,CAAC,OAAO,CAAA;IAC3B,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAA;QACzC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,SAAS,EAAE,CAAC,CAAA;QAC1E,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,mFAAmF,CACpF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAA;IAE5B,uEAAuE;IACvE,uEAAuE;IACvE,uCAAuC;IACvC,MAAM,MAAM,GAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAA;IACjG,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAiB;QACzC,OAAO,EAAE,qCAAqC;QAC9C,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;YACtD,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SAC/C;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,UAAU,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,UAAU,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,OAAO,CAAA;IACjD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAA;IAChD,MAAM,mBAAmB,GACvB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC7B,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAgC,CAAA;YACpF,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAA;YACzD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAA;YACzD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACvD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;QACrE,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;QAChE,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;QAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IACpE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/phases/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAE5B,OAAO,EACL,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAA;AAIjC,MAAM,CAAC,MAAM,cAAc,GAAU;IACnC,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,MAAM;IAEnB,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAA;QAClF,MAAM,QAAQ,GAAI,GAAG,CAAC,QAAQ,CAAC,EAAiC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;QAC9F,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAA;QAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5F,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAA;QACjB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAI;QACb,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,+CAA+C,CAAC,EAAE,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG;QACpB,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAA;YAC3E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC7B,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;YACrF,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,uBAAuB;gBAChC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YACF,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACtC,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACpC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAA;QACX,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;QAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAC1B,CAAC;CACF,CAAA;AAED,SAAS,mBAAmB;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAY;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAgC,CAAA;IAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;IAC5C,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,iDAAiD,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAA;QACtC,IAAI,QAAQ,IAAI,QAAQ,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,yBAAyB,UAAU,CAAC,OAAO,cAAc,UAAU,CAAC,OAAO,EAAE,CAC9E,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;QAChF,OAAO,UAAU,CAAC,OAAO,CAAA;IAC3B,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAA;QACzC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,SAAS,EAAE,CAAC,CAAA;QAC1E,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,mFAAmF,CACpF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAA;IAE5B,uEAAuE;IACvE,uEAAuE;IACvE,uCAAuC;IACvC,MAAM,MAAM,GAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAA;IACjG,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAiB;QACzC,OAAO,EAAE,qCAAqC;QAC9C,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;YACtD,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SAC/C;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,UAAU,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,UAAU,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,OAAO,CAAA;IACjD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAA;IAChD,MAAM,mBAAmB,GACvB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC7B,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAgC,CAAA;YACpF,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAA;YACzD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAA;YACzD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACvD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;QACrE,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;QAChE,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;QAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IACpE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/templates/dialects/mysql/byline/server.config.ts

@@ -14,7 +14,7 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { createAuthMaintenanceTasks, createPasswordSignInLimiter, createPasskeyRequestLimiter, JwtSessionProvider } from '@byline/admin/auth'
 import { getRequestIP } from '@tanstack/react-start/server'
 import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { getAdminBylineClient } from '@byline/client/server'
@@ -71,7 +71,29 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
 
   const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
 
+  // Passkeys remain disabled until explicit site trust is configured. Never infer
+  // relying-party identity or origins from request headers.
+  const passkeys = [process.env.BYLINE_PASSKEY_RP_ID, process.env.BYLINE_PASSKEY_RP_NAME,
+    process.env.BYLINE_PASSKEY_ORIGINS, process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST]
+    .some((value) => value !== undefined) ? {
+      rpId: process.env.BYLINE_PASSKEY_RP_ID ?? '',
+      rpName: process.env.BYLINE_PASSKEY_RP_NAME ?? '',
+      origins: process.env.BYLINE_PASSKEY_ORIGINS?.split(',').map((origin) => origin.trim()) ?? [],
+      allowInsecureLocalhost: process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST === 'true',
+    } : undefined
+  const resolveClientIp = createClientIpResolver({
+    // Opt in only when the proxy overwrites this header and direct access is blocked.
+    trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+    resolvePeerIp: () => getRequestIP() ??
+      (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      })
+  const passkeyRequests = passkeys ? {
+    limiter: createPasskeyRequestLimiter(adminStore.signInRateLimits, signingSecret),
+    resolveClientIp,
+  } : undefined
+
   const sessionProvider = new JwtSessionProvider({
+    passkeys,
     store: adminStore,
     signingSecret,
   })
@@ -90,15 +112,12 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
       baseUrl: '/uploads',
     }),
     sessionProvider,
-    recurringTasks: [signInLimiter.cleanupTask],
+    passkeys,
+    passkeyRequests,
+    recurringTasks: [...createAuthMaintenanceTasks(adminStore), signInLimiter.cleanupTask],
     passwordSignIn: {
       limiter: signInLimiter,
-      resolveClientIp: createClientIpResolver({
-        // Opt in only when the proxy overwrites this header and direct access is blocked.
-        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
-        resolvePeerIp: () => getRequestIP() ??
-          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
-      }),
+      resolveClientIp,
     },
     fields: {
       richText: {

package/dist/templates/dialects/mysql/byline-examples/server.config.ts

@@ -11,7 +11,7 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { createAuthMaintenanceTasks, createPasswordSignInLimiter, createPasskeyRequestLimiter, JwtSessionProvider } from '@byline/admin/auth'
 import { getRequestIP } from '@tanstack/react-start/server'
 import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { getAdminBylineClient } from '@byline/client/server'
@@ -79,7 +79,29 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
 
   const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
 
+  // Passkeys remain disabled until explicit site trust is configured. Never infer
+  // relying-party identity or origins from request headers.
+  const passkeys = [process.env.BYLINE_PASSKEY_RP_ID, process.env.BYLINE_PASSKEY_RP_NAME,
+    process.env.BYLINE_PASSKEY_ORIGINS, process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST]
+    .some((value) => value !== undefined) ? {
+      rpId: process.env.BYLINE_PASSKEY_RP_ID ?? '',
+      rpName: process.env.BYLINE_PASSKEY_RP_NAME ?? '',
+      origins: process.env.BYLINE_PASSKEY_ORIGINS?.split(',').map((origin) => origin.trim()) ?? [],
+      allowInsecureLocalhost: process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST === 'true',
+    } : undefined
+  const resolveClientIp = createClientIpResolver({
+    // Opt in only when the proxy overwrites this header and direct access is blocked.
+    trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+    resolvePeerIp: () => getRequestIP() ??
+      (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      })
+  const passkeyRequests = passkeys ? {
+    limiter: createPasskeyRequestLimiter(adminStore.signInRateLimits, signingSecret),
+    resolveClientIp,
+  } : undefined
+
   const sessionProvider = new JwtSessionProvider({
+    passkeys,
     store: adminStore,
     signingSecret,
   })
@@ -98,15 +120,12 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
       baseUrl: '/uploads',
     }),
     sessionProvider,
-    recurringTasks: [signInLimiter.cleanupTask],
+    passkeys,
+    passkeyRequests,
+    recurringTasks: [...createAuthMaintenanceTasks(adminStore), signInLimiter.cleanupTask],
     passwordSignIn: {
       limiter: signInLimiter,
-      resolveClientIp: createClientIpResolver({
-        // Opt in only when the proxy overwrites this header and direct access is blocked.
-        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
-        resolvePeerIp: () => getRequestIP() ??
-          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
-      }),
+      resolveClientIp,
     },
     fields: {
       richText: {

package/dist/templates/dialects/postgres/byline/server.config.ts

@@ -18,7 +18,7 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { createAuthMaintenanceTasks, createPasswordSignInLimiter, createPasskeyRequestLimiter, JwtSessionProvider } from '@byline/admin/auth'
 import { getRequestIP } from '@tanstack/react-start/server'
 import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { type BylineCore, initBylineCore } from '@byline/core'
@@ -86,7 +86,29 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
 
   const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
 
+  // Passkeys remain disabled until explicit site trust is configured. Never infer
+  // relying-party identity or origins from request headers.
+  const passkeys = [process.env.BYLINE_PASSKEY_RP_ID, process.env.BYLINE_PASSKEY_RP_NAME,
+    process.env.BYLINE_PASSKEY_ORIGINS, process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST]
+    .some((value) => value !== undefined) ? {
+      rpId: process.env.BYLINE_PASSKEY_RP_ID ?? '',
+      rpName: process.env.BYLINE_PASSKEY_RP_NAME ?? '',
+      origins: process.env.BYLINE_PASSKEY_ORIGINS?.split(',').map((origin) => origin.trim()) ?? [],
+      allowInsecureLocalhost: process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST === 'true',
+    } : undefined
+  const resolveClientIp = createClientIpResolver({
+    // Opt in only when the proxy overwrites this header and direct access is blocked.
+    trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+    resolvePeerIp: () => getRequestIP() ??
+      (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      })
+  const passkeyRequests = passkeys ? {
+    limiter: createPasskeyRequestLimiter(adminStore.signInRateLimits, signingSecret),
+    resolveClientIp,
+  } : undefined
+
   const sessionProvider = new JwtSessionProvider({
+    passkeys,
     store: adminStore,
     signingSecret,
   })
@@ -140,15 +162,12 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     //   cacheControl: 'public, max-age=31536000, immutable',
     // }),
     sessionProvider,
-    recurringTasks: [signInLimiter.cleanupTask],
+    passkeys,
+    passkeyRequests,
+    recurringTasks: [...createAuthMaintenanceTasks(adminStore), signInLimiter.cleanupTask],
     passwordSignIn: {
       limiter: signInLimiter,
-      resolveClientIp: createClientIpResolver({
-        // Opt in only when the proxy overwrites this header and direct access is blocked.
-        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
-        resolvePeerIp: () => getRequestIP() ??
-          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
-      }),
+      resolveClientIp,
     },
     fields: {
       richText: {

package/dist/templates/dialects/postgres/byline-examples/server.config.ts

@@ -15,7 +15,7 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { createAuthMaintenanceTasks, createPasswordSignInLimiter, createPasskeyRequestLimiter, JwtSessionProvider } from '@byline/admin/auth'
 import { getRequestIP } from '@tanstack/react-start/server'
 import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { type BylineCore, initBylineCore } from '@byline/core'
@@ -134,7 +134,29 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
 
   const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
 
+  // Passkeys remain disabled until explicit site trust is configured. Never infer
+  // relying-party identity or origins from request headers.
+  const passkeys = [process.env.BYLINE_PASSKEY_RP_ID, process.env.BYLINE_PASSKEY_RP_NAME,
+    process.env.BYLINE_PASSKEY_ORIGINS, process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST]
+    .some((value) => value !== undefined) ? {
+      rpId: process.env.BYLINE_PASSKEY_RP_ID ?? '',
+      rpName: process.env.BYLINE_PASSKEY_RP_NAME ?? '',
+      origins: process.env.BYLINE_PASSKEY_ORIGINS?.split(',').map((origin) => origin.trim()) ?? [],
+      allowInsecureLocalhost: process.env.BYLINE_PASSKEY_ALLOW_HTTP_LOCALHOST === 'true',
+    } : undefined
+  const resolveClientIp = createClientIpResolver({
+    // Opt in only when the proxy overwrites this header and direct access is blocked.
+    trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+    resolvePeerIp: () => getRequestIP() ??
+      (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      })
+  const passkeyRequests = passkeys ? {
+    limiter: createPasskeyRequestLimiter(adminStore.signInRateLimits, signingSecret),
+    resolveClientIp,
+  } : undefined
+
   const sessionProvider = new JwtSessionProvider({
+    passkeys,
     store: adminStore,
     signingSecret,
   })
@@ -194,15 +216,12 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     //   cacheControl: 'public, max-age=31536000, immutable',
     // }),
     sessionProvider,
-    recurringTasks: [signInLimiter.cleanupTask],
+    passkeys,
+    passkeyRequests,
+    recurringTasks: [...createAuthMaintenanceTasks(adminStore), signInLimiter.cleanupTask],
     passwordSignIn: {
       limiter: signInLimiter,
-      resolveClientIp: createClientIpResolver({
-        // Opt in only when the proxy overwrites this header and direct access is blocked.
-        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
-        resolvePeerIp: () => getRequestIP() ??
-          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
-      }),
+      resolveClientIp,
     },
     fields: {
       // Server-side richtext adapter — refreshes embedded relation

package/dist/templates/migrations/mysql/{0000_kind_exodus.sql → 0000_volatile_agent_brand.sql}

@@ -7,6 +7,40 @@ CREATE TABLE `byline_admin_login_sessions` (
 	CONSTRAINT `byline_admin_login_sessions_id` PRIMARY KEY(`id`)
 );
 --> statement-breakpoint
+CREATE TABLE `byline_admin_passkey_attempts` (
+	`token_hash` varbinary(64) NOT NULL,
+	`purpose` varchar(24) NOT NULL,
+	`challenge` varchar(43),
+	`actor_user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin,
+	`actor_login_id` char(36) CHARACTER SET ascii COLLATE ascii_bin,
+	`actor_generation` int,
+	`action` varchar(8),
+	`target_user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin,
+	`credential_record_id` char(36) CHARACTER SET ascii COLLATE ascii_bin,
+	`proof_credential_id` char(36) CHARACTER SET ascii COLLATE ascii_bin,
+	`created_at` datetime(6) NOT NULL,
+	`expires_at` datetime(6) NOT NULL,
+	`consumed_at` datetime(6),
+	CONSTRAINT `byline_admin_passkey_attempts_token_hash` PRIMARY KEY(`token_hash`)
+);
+--> statement-breakpoint
+CREATE TABLE `byline_admin_passkey_credentials` (
+	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`admin_user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin,
+	`credential_id` varbinary(1366) NOT NULL,
+	`public_key` text NOT NULL,
+	`counter` bigint NOT NULL,
+	`transports` json NOT NULL,
+	`backup_eligible` boolean NOT NULL,
+	`backed_up` boolean NOT NULL,
+	`name` varchar(80) NOT NULL,
+	`created_at` datetime(6) NOT NULL,
+	`last_used_at` datetime(6),
+	`revoked_at` datetime(6),
+	CONSTRAINT `byline_admin_passkey_credentials_id` PRIMARY KEY(`id`),
+	CONSTRAINT `byline_admin_passkey_credentials_credential_id_unique` UNIQUE(`credential_id`)
+);
+--> statement-breakpoint
 CREATE TABLE `byline_admin_permissions` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`vid` int NOT NULL DEFAULT 1,
@@ -75,6 +109,7 @@ CREATE TABLE `byline_admin_user_preferences` (
 --> statement-breakpoint
 CREATE TABLE `byline_admin_users` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`webauthn_user_handle` varbinary(43),
 	`session_version` int NOT NULL DEFAULT 0,
 	`vid` int NOT NULL DEFAULT 1,
 	`given_name` varchar(100),
@@ -93,6 +128,7 @@ CREATE TABLE `byline_admin_users` (
 	`created_at` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
 	`updated_at` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
 	CONSTRAINT `byline_admin_users_id` PRIMARY KEY(`id`),
+	CONSTRAINT `byline_admin_users_webauthn_user_handle_unique` UNIQUE(`webauthn_user_handle`),
 	CONSTRAINT `byline_admin_users_username_unique` UNIQUE(`username`),
 	CONSTRAINT `byline_admin_users_email_unique` UNIQUE(`email`)
 );
@@ -397,6 +433,7 @@ CREATE TABLE `byline_store_text` (
 );
 --> statement-breakpoint
 ALTER TABLE `byline_admin_login_sessions` ADD CONSTRAINT `fk_admin_login_sessions_user` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `byline_admin_passkey_credentials` ADD CONSTRAINT `fk_admin_passkeys_user` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_permissions` ADD CONSTRAINT `fk_admin_permissions_admin_role_id` FOREIGN KEY (`admin_role_id`) REFERENCES `byline_admin_roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_refresh_tokens` ADD CONSTRAINT `fk_admin_refresh_tokens_sid` FOREIGN KEY (`sid`) REFERENCES `byline_admin_login_sessions`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_refresh_tokens` ADD CONSTRAINT `fk_admin_refresh_tokens_admin_user_id` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
@@ -436,8 +473,15 @@ ALTER TABLE `byline_singleton_documents` ADD CONSTRAINT `fk_singleton_documents_
 ALTER TABLE `byline_store_text` ADD CONSTRAINT `fk_store_text_document_version_id` FOREIGN KEY (`document_version_id`) REFERENCES `byline_document_versions`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_store_text` ADD CONSTRAINT `fk_store_text_collection_id` FOREIGN KEY (`collection_id`) REFERENCES `byline_collections`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 CREATE INDEX `idx_admin_login_sessions_user` ON `byline_admin_login_sessions` (`admin_user_id`);--> statement-breakpoint
+CREATE INDEX `idx_admin_login_sessions_expiry` ON `byline_admin_login_sessions` (`expires_at`);--> statement-breakpoint
+CREATE INDEX `idx_admin_login_sessions_revoked` ON `byline_admin_login_sessions` (`revoked_at`);--> statement-breakpoint
+CREATE INDEX `idx_admin_passkey_attempts_expiry` ON `byline_admin_passkey_attempts` (`expires_at`);--> statement-breakpoint
+CREATE INDEX `idx_admin_passkey_attempts_consumed` ON `byline_admin_passkey_attempts` (`consumed_at`);--> statement-breakpoint
+CREATE INDEX `idx_admin_passkey_attempts_login` ON `byline_admin_passkey_attempts` (`actor_login_id`);--> statement-breakpoint
+CREATE INDEX `idx_admin_passkeys_user` ON `byline_admin_passkey_credentials` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_permissions_role` ON `byline_admin_permissions` (`admin_role_id`);--> statement-breakpoint
 CREATE INDEX `idx_admin_refresh_tokens_sid` ON `byline_admin_refresh_tokens` (`sid`);--> statement-breakpoint
+CREATE INDEX `idx_admin_refresh_tokens_legacy_expiry` ON `byline_admin_refresh_tokens` (`sid`,`expires_at`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_refresh_tokens_user` ON `byline_admin_refresh_tokens` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_refresh_tokens_token_hash` ON `byline_admin_refresh_tokens` (`token_hash`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_role_admin_user_user` ON `byline_admin_role_admin_user` (`admin_user_id`);--> statement-breakpoint

package/dist/templates/migrations/mysql/meta/_journal.json

@@ -5,8 +5,8 @@
     {
       "idx": 0,
       "version": "5",
-      "when": 1788879988783,
-      "tag": "0000_kind_exodus",
+      "when": 1792124008486,
+      "tag": "0000_volatile_agent_brand",
       "breakpoints": true
     }
   ]

package/dist/templates/migrations/postgres/{0000_lively_talisman.sql → 0000_superb_ben_parker.sql}

@@ -6,6 +6,38 @@ CREATE TABLE "byline_admin_login_sessions" (
 	"revoked_at" timestamp (6) with time zone
 );
 --> statement-breakpoint
+CREATE TABLE "byline_admin_passkey_attempts" (
+	"token_hash" varchar(64) COLLATE "C" PRIMARY KEY NOT NULL,
+	"purpose" varchar(24) NOT NULL,
+	"challenge" varchar(43),
+	"actor_user_id" uuid,
+	"actor_login_id" uuid,
+	"actor_generation" integer,
+	"action" varchar(8),
+	"target_user_id" uuid,
+	"credential_record_id" uuid,
+	"proof_credential_id" uuid,
+	"created_at" timestamp (6) with time zone NOT NULL,
+	"expires_at" timestamp (6) with time zone NOT NULL,
+	"consumed_at" timestamp (6) with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "byline_admin_passkey_credentials" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"admin_user_id" uuid,
+	"credential_id" varchar(1366) COLLATE "C" NOT NULL,
+	"public_key" text NOT NULL,
+	"counter" bigint NOT NULL,
+	"transports" jsonb NOT NULL,
+	"backup_eligible" boolean NOT NULL,
+	"backed_up" boolean NOT NULL,
+	"name" varchar(80) NOT NULL,
+	"created_at" timestamp (6) with time zone NOT NULL,
+	"last_used_at" timestamp (6) with time zone,
+	"revoked_at" timestamp (6) with time zone,
+	CONSTRAINT "byline_admin_passkey_credentials_credential_id_unique" UNIQUE("credential_id")
+);
+--> statement-breakpoint
 CREATE TABLE "byline_admin_permissions" (
 	"id" uuid PRIMARY KEY NOT NULL,
 	"vid" integer DEFAULT 1 NOT NULL,
@@ -70,6 +102,7 @@ CREATE TABLE "byline_admin_user_preferences" (
 --> statement-breakpoint
 CREATE TABLE "byline_admin_users" (
 	"id" uuid PRIMARY KEY NOT NULL,
+	"webauthn_user_handle" varchar(43) COLLATE "C",
 	"session_version" integer DEFAULT 0 NOT NULL,
 	"vid" integer DEFAULT 1 NOT NULL,
 	"given_name" varchar(100),
@@ -87,6 +120,7 @@ CREATE TABLE "byline_admin_users" (
 	"preferred_locale" varchar(16),
 	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
 	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "byline_admin_users_webauthn_user_handle_unique" UNIQUE("webauthn_user_handle"),
 	CONSTRAINT "byline_admin_users_username_unique" UNIQUE("username"),
 	CONSTRAINT "byline_admin_users_email_unique" UNIQUE("email")
 );
@@ -374,6 +408,7 @@ CREATE TABLE "byline_store_text" (
 );
 --> statement-breakpoint
 ALTER TABLE "byline_admin_login_sessions" ADD CONSTRAINT "byline_admin_login_sessions_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "byline_admin_passkey_credentials" ADD CONSTRAINT "byline_admin_passkey_credentials_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_permissions" ADD CONSTRAINT "byline_admin_permissions_admin_role_id_byline_admin_roles_id_fk" FOREIGN KEY ("admin_role_id") REFERENCES "public"."byline_admin_roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_refresh_tokens" ADD CONSTRAINT "byline_admin_refresh_tokens_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_refresh_tokens" ADD CONSTRAINT "byline_admin_refresh_tokens_sid_byline_admin_login_sessions_id_fk" FOREIGN KEY ("sid") REFERENCES "public"."byline_admin_login_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
@@ -413,8 +448,15 @@ ALTER TABLE "byline_singleton_documents" ADD CONSTRAINT "fk_singleton_documents_
 ALTER TABLE "byline_store_text" ADD CONSTRAINT "byline_store_text_document_version_id_byline_document_versions_id_fk" FOREIGN KEY ("document_version_id") REFERENCES "public"."byline_document_versions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_store_text" ADD CONSTRAINT "byline_store_text_collection_id_byline_collections_id_fk" FOREIGN KEY ("collection_id") REFERENCES "public"."byline_collections"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 CREATE INDEX "idx_admin_login_sessions_user" ON "byline_admin_login_sessions" USING btree ("admin_user_id");--> statement-breakpoint
+CREATE INDEX "idx_admin_login_sessions_expiry" ON "byline_admin_login_sessions" USING btree ("expires_at");--> statement-breakpoint
+CREATE INDEX "idx_admin_login_sessions_revoked" ON "byline_admin_login_sessions" USING btree ("revoked_at");--> statement-breakpoint
+CREATE INDEX "idx_admin_passkey_attempts_expiry" ON "byline_admin_passkey_attempts" USING btree ("expires_at");--> statement-breakpoint
+CREATE INDEX "idx_admin_passkey_attempts_consumed" ON "byline_admin_passkey_attempts" USING btree ("consumed_at");--> statement-breakpoint
+CREATE INDEX "idx_admin_passkey_attempts_login" ON "byline_admin_passkey_attempts" USING btree ("actor_login_id");--> statement-breakpoint
+CREATE INDEX "idx_admin_passkeys_user" ON "byline_admin_passkey_credentials" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_permissions_role" ON "byline_admin_permissions" USING btree ("admin_role_id");--> statement-breakpoint
 CREATE INDEX "idx_admin_refresh_tokens_sid" ON "byline_admin_refresh_tokens" USING btree ("sid");--> statement-breakpoint
+CREATE INDEX "idx_admin_refresh_tokens_legacy_expiry" ON "byline_admin_refresh_tokens" USING btree ("sid","expires_at");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_refresh_tokens_user" ON "byline_admin_refresh_tokens" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_refresh_tokens_token_hash" ON "byline_admin_refresh_tokens" USING btree ("token_hash");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_role_admin_user_user" ON "byline_admin_role_admin_user" USING btree ("admin_user_id");--> statement-breakpoint

package/dist/templates/migrations/postgres/meta/_journal.json

@@ -5,8 +5,8 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1788880329240,
-      "tag": "0000_lively_talisman",
+      "when": 1792123994697,
+      "tag": "0000_superb_ben_parker",
       "breakpoints": true
     }
   ]

package/package.json

@@ -2,9 +2,9 @@
   "name": "@byline/cli",
   "private": false,
   "license": "MPL-2.0",
-  "version": "6.7.2",
+  "version": "6.9.0",
   "engines": {
-    "node": ">=20.9.0"
+    "node": ">=22.22.2"
   },
   "description": "Guided installer for Byline CMS into an existing TanStack Start application",
   "keywords": [
@@ -49,7 +49,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.15",
-    "@byline/core": "6.7.2",
+    "@byline/core": "6.9.0",
     "@types/mdast": "^4.0.4",
     "@types/node": "^26.6.5",
     "@types/pg": "^8.23.1",