@byline/core 6.7.2 → 6.9.0

package/dist/@types/admin-types.d.ts

@@ -251,14 +251,14 @@ export interface FormAdminConfig {
  * Admin UI configuration for a collection.
  * This is the presentation/UI layer — separate from the data schema.
  *
- * Linked to a `CollectionDefinition` by `slug` matching the collection's
+ * Linked to a `CollectionDefinition` by `path` matching the collection's
  * `path`.
  */
 export interface CollectionAdminConfig<T = any> extends FormAdminConfig {
     /** Explicit resource discriminator. Stamped by `defineAdmin`. */
     singleton?: false;
     /** Must match the `path` of the corresponding `CollectionDefinition`. */
-    slug: string;
+    path: string;
     /**
      * Dashboard group this collection belongs to. Must name an entry in
      * `AdminConfig.collectionGroups`; an unknown name throws at startup.
@@ -447,7 +447,7 @@ export interface SingletonAdminConfig<T = any> extends FormAdminConfig {
     /** Explicit resource discriminator. Stamped by `defineSingletonAdmin`. */
     singleton: true;
     /** Must match the `path` of the corresponding `SingletonDefinition`. */
-    slug: string;
+    path: string;
     /**
      * Dashboard group this resource belongs to. The registry remains named
      * `AdminConfig.collectionGroups` for backwards compatibility.
@@ -487,14 +487,14 @@ export interface ListActionComponentProps {
 }
 /**
  * Type-safe factory for creating a `CollectionAdminConfig` linked to a schema.
- * Sets `slug` from the schema's `path`.
+ * Sets `path` from the schema's `path`.
  */
-export declare function defineAdmin<T = any>(schema: MultiCollectionDefinition, config: Omit<CollectionAdminConfig<T>, 'slug' | 'singleton'>): CollectionAdminConfig<T>;
+export declare function defineAdmin<T = any>(schema: MultiCollectionDefinition, config: Omit<CollectionAdminConfig<T>, 'path' | 'singleton'>): CollectionAdminConfig<T>;
 /**
  * Type-safe factory for a `SingletonAdminConfig` linked to a singleton schema.
  * Sets both the schema path and resource discriminator for authors.
  */
-export declare function defineSingletonAdmin<T = any>(schema: SingletonDefinition, config: Omit<SingletonAdminConfig<T>, 'slug' | 'singleton'>): SingletonAdminConfig<T>;
+export declare function defineSingletonAdmin<T = any>(schema: SingletonDefinition, config: Omit<SingletonAdminConfig<T>, 'path' | 'singleton'>): SingletonAdminConfig<T>;
 /**
  * Admin UI configuration for a block — the block-scoped analogue of
  * `CollectionAdminConfig`, carrying **rendering overrides only**.

package/dist/@types/admin-types.js

@@ -7,13 +7,13 @@
  */
 /**
  * Type-safe factory for creating a `CollectionAdminConfig` linked to a schema.
- * Sets `slug` from the schema's `path`.
+ * Sets `path` from the schema's `path`.
  */
 export function defineAdmin(schema, config) {
     return {
         ...config,
         singleton: false,
-        slug: schema.path,
+        path: schema.path,
     };
 }
 /**
@@ -24,7 +24,7 @@ export function defineSingletonAdmin(schema, config) {
     return {
         ...config,
         singleton: true,
-        slug: schema.path,
+        path: schema.path,
     };
 }
 /**

package/dist/@types/form-admin-config.test.node.js

@@ -17,7 +17,7 @@ describe('FormAdminConfig', () => {
     });
     it('is satisfied by a full CollectionAdminConfig', () => {
         const collection = {
-            slug: 'pages',
+            path: 'pages',
             layout: { main: [] },
         };
         const asForm = collection;

package/dist/@types/singleton-admin-config.test.node.js

@@ -24,19 +24,22 @@ describe('singleton admin config', () => {
         const singletonAdmin = defineSingletonAdmin(settings, {});
         expect(collectionAdmin.singleton).toBe(false);
         expect(singletonAdmin.singleton).toBe(true);
-        expect(singletonAdmin.slug).toBe(settings.path);
+        expect(collectionAdmin.path).toBe(pages.path);
+        expect(singletonAdmin.path).toBe(settings.path);
+        expect(collectionAdmin).not.toHaveProperty('slug');
+        expect(singletonAdmin).not.toHaveProperty('slug');
     });
     it('does not let untyped config input override factory-owned identity', () => {
         const collectionAdmin = defineAdmin(pages, {
             singleton: true,
-            slug: 'wrong-collection',
+            path: 'wrong-collection',
         });
         const singletonAdmin = defineSingletonAdmin(settings, {
             singleton: false,
-            slug: 'wrong-singleton',
+            path: 'wrong-singleton',
         });
-        expect(collectionAdmin).toMatchObject({ singleton: false, slug: pages.path });
-        expect(singletonAdmin).toMatchObject({ singleton: true, slug: settings.path });
+        expect(collectionAdmin).toMatchObject({ singleton: false, path: pages.path });
+        expect(singletonAdmin).toMatchObject({ singleton: true, path: settings.path });
     });
     it('shares the reusable form composition contract', () => {
         const singletonAdmin = defineSingletonAdmin(settings, {

package/dist/@types/site-config.d.ts

@@ -5,7 +5,7 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import type { PasswordSignInProtection, SessionProvider } from '@byline/auth';
+import type { PasskeyRequestProtection, PasswordSignInProtection, SessionProvider } from '@byline/auth';
 import type { RecurringTaskDefinition } from '../scheduler/types.js';
 import type { SlugifierFn } from '../utils/slugify.js';
 import type { FilenameSlugifierFn } from '../utils/slugify-filename.js';
@@ -351,6 +351,10 @@ export interface ServerConfig<TAdminStore = unknown> extends BaseConfig {
      * ```
      */
     sessionProvider?: SessionProvider;
+    /** Explicit WebAuthn trust configuration; never inferred from request headers. */
+    passkeys?: PasskeyConfig;
+    /** Shared WebAuthn network admission and independent process capacity; required when enabled. */
+    passkeyRequests?: PasskeyRequestProtection;
     /** Required by the host password sign-in endpoint; shared limiter and trusted IP resolver. */
     passwordSignIn?: PasswordSignInProtection;
     /**
@@ -476,3 +480,13 @@ export interface ServerConfig<TAdminStore = unknown> extends BaseConfig {
 export type ResolvedServerConfig<TAdminStore = unknown> = Omit<ServerConfig<TAdminStore>, 'routes'> & {
     routes: RoutesConfig;
 };
+/** Server-owned WebAuthn trust configuration. No related-origin expansion is supported. */
+export interface PasskeyConfig {
+    /** Canonical lowercase DNS name, without scheme, port or path. */
+    rpId: string;
+    rpName: string;
+    /** Exact canonical origins, including a non-default port when needed. */
+    origins: readonly string[];
+    /** Explicit local-development exception, restricted to http://localhost origins. */
+    allowInsecureLocalhost?: boolean;
+}

package/dist/config/config.d.ts

@@ -11,8 +11,8 @@ import type { AdminConfig, CollectionAdminConfig, CollectionDefinition, Resolved
  * still throw the loud "Byline has not been configured" error.
  */
 export declare const getCollectionDefinition: (path: string) => CollectionDefinition | null;
-export declare const getCollectionAdminConfig: (slug: string) => CollectionAdminConfig | null;
-export declare const getSingletonAdminConfig: (slug: string) => SingletonAdminConfig | null;
+export declare const getCollectionAdminConfig: (path: string) => CollectionAdminConfig | null;
+export declare const getSingletonAdminConfig: (path: string) => SingletonAdminConfig | null;
 export declare function defineAdminConfig(config: AdminConfig): ResolvedAdminConfig;
 export declare function defineServerConfig<TAdminStore = unknown>(config: ServerConfig<TAdminStore>): ResolvedServerConfig<TAdminStore>;
 /** Resolve and validate server config without replacing the registered singleton. */

package/dist/config/config.js

@@ -2,6 +2,7 @@ import { commitHookAttachment, prepareHookAttachment, } from './attach-hooks.js'
 import { resolveRoutes } from './routes.js';
 import { validateAdminConfigs, validateBlockAdminConfigs } from './validate-admin-configs.js';
 import { validateCollections } from './validate-collections.js';
+import { resolvePasskeyConfig } from './validate-passkey-config.js';
 // ---------------------------------------------------------------------------
 // Global config storage
 // ---------------------------------------------------------------------------
@@ -51,18 +52,18 @@ export const getCollectionDefinition = (path) => {
         return null;
     return config.collections.find((collection) => collection.path === path) ?? null;
 };
-const getAdminResourceConfig = (slug) => {
+const getAdminResourceConfig = (path) => {
     const adminConfig = getAdminConfigInstance();
     if (adminConfig == null)
         return null;
-    return adminConfig.admin?.find((admin) => admin.slug === slug) ?? null;
+    return adminConfig.admin?.find((admin) => admin.path === path) ?? null;
 };
-export const getCollectionAdminConfig = (slug) => {
-    const admin = getAdminResourceConfig(slug);
+export const getCollectionAdminConfig = (path) => {
+    const admin = getAdminResourceConfig(path);
     return admin?.singleton === true ? null : admin;
 };
-export const getSingletonAdminConfig = (slug) => {
-    const admin = getAdminResourceConfig(slug);
+export const getSingletonAdminConfig = (path) => {
+    const admin = getAdminResourceConfig(path);
     return admin?.singleton === true ? admin : null;
 };
 export function defineAdminConfig(config) {
@@ -79,7 +80,13 @@ export function defineServerConfig(config) {
 /** Resolve and validate server config without replacing the registered singleton. */
 export function resolveServerConfig(config) {
     validateCollections(config.collections);
-    const resolved = { ...config, routes: resolveRoutes(config.routes) };
+    const passkeys = resolvePasskeyConfig(config.passkeys, config.sessionProvider);
+    if (passkeys &&
+        (typeof config.passkeyRequests?.resolveClientIp !== 'function' ||
+            typeof config.passkeyRequests.limiter?.acquire !== 'function' ||
+            typeof config.passkeyRequests.limiter?.consume !== 'function'))
+        throw new Error('Passkeys require passkeyRequests with trusted client IP resolution and admission');
+    const resolved = { ...config, passkeys, routes: resolveRoutes(config.routes) };
     preparedHookAttachments.set(resolved, prepareHookAttachment(resolved));
     return resolved;
 }

package/dist/config/group-collections.js

@@ -33,7 +33,7 @@ export function groupCollectionsForAdmin(collections, admin, collectionGroups) {
     const groupByCollectionPath = new Map();
     for (const entry of admin ?? []) {
         if (entry.group != null)
-            groupByCollectionPath.set(entry.slug, entry.group);
+            groupByCollectionPath.set(entry.path, entry.group);
     }
     const membersByGroup = new Map();
     for (const group of collectionGroups ?? []) {

package/dist/config/group-collections.test.node.js

@@ -29,9 +29,9 @@ const groups = [
     { name: 'taxonomy', label: 'Taxonomies' },
 ];
 const admin = [
-    { slug: 'images', group: 'media' },
-    { slug: 'authors', group: 'authorities' },
-    { slug: 'categories', group: 'taxonomy' },
+    { path: 'images', group: 'media' },
+    { path: 'authors', group: 'authorities' },
+    { path: 'categories', group: 'taxonomy' },
 ];
 describe('groupCollectionsForAdmin', () => {
     it('returns one ungrouped bucket when no registry is declared', () => {
@@ -67,13 +67,13 @@ describe('groupCollectionsForAdmin', () => {
     });
     it('preserves collection declaration order within a bucket', () => {
         const more = define('videos');
-        const result = groupCollectionsForAdmin([more, images], [...admin, { slug: 'videos', group: 'media' }], groups);
+        const result = groupCollectionsForAdmin([more, images], [...admin, { path: 'videos', group: 'media' }], groups);
         expect(result[0]?.collections).toEqual([more, images]);
     });
     it('groups singleton and multi-collection resources together in declaration order', () => {
         const resourceAdmin = [
             ...admin,
-            { singleton: true, slug: settings.path, group: 'media' },
+            { singleton: true, path: settings.path, group: 'media' },
         ];
         const result = groupCollectionsForAdmin([images, settings], resourceAdmin, groups);
         expect(result[0]?.collections).toEqual([images, settings]);
@@ -85,7 +85,7 @@ describe('groupCollectionsForAdmin', () => {
     it('treats an undeclared group name as ungrouped rather than throwing', () => {
         // Boot validation rejects this configuration, but the function stays total
         // so a renderer can never crash on a stale or hand-built config object.
-        const result = groupCollectionsForAdmin([pages], [{ slug: 'pages', group: 'ghost' }], groups);
+        const result = groupCollectionsForAdmin([pages], [{ path: 'pages', group: 'ghost' }], groups);
         expect(result).toEqual([{ name: null, label: null, collections: [pages] }]);
     });
     it('ignores admin configs whose collection is not registered', () => {

package/dist/config/validate-admin-configs.d.ts

@@ -25,7 +25,7 @@ export declare function validateCollectionGroups(collectionGroups: readonly Coll
  * Validate every admin config in a configuration.
  *
  * Enforced rules (per admin config):
- *  1. Slug pairing — `admin.slug` matches exactly one `collection.path`.
+ *  1. Path pairing — `admin.path` matches exactly one `collection.path`.
  *  2. Placement — when `layout` is present, every top-level schema field
  *     name appears exactly once across the union of all `tabSet.tabs[].fields`,
  *     all `row.fields`, all `group.fields`, `layout.main`, and `layout.sidebar`.

package/dist/config/validate-admin-configs.js

@@ -91,14 +91,14 @@ export function validateCollectionGroups(collectionGroups, admins) {
         const known = declared.size === 0
             ? '`collectionGroups` was not declared, or is empty'
             : `declared groups: ${[...declared].map((name) => `"${name}"`).join(', ')}`;
-        throw new Error(`Admin resource "${admin.slug}": \`group: '${admin.group}'\` does not name a declared collection group (${known}). Add it to \`AdminConfig.collectionGroups\`, or remove the \`group\` property.`);
+        throw new Error(`Admin config for path "${admin.path}": \`group: '${admin.group}'\` does not name a declared collection group (${known}). Add it to \`AdminConfig.collectionGroups\`, or remove the \`group\` property.`);
     }
 }
 /**
  * Validate every admin config in a configuration.
  *
  * Enforced rules (per admin config):
- *  1. Slug pairing — `admin.slug` matches exactly one `collection.path`.
+ *  1. Path pairing — `admin.path` matches exactly one `collection.path`.
  *  2. Placement — when `layout` is present, every top-level schema field
  *     name appears exactly once across the union of all `tabSet.tabs[].fields`,
  *     all `row.fields`, all `group.fields`, `layout.main`, and `layout.sidebar`.
@@ -210,24 +210,24 @@ export function validateBlockAdminConfigs(blockAdmins, collections) {
     }
 }
 function validateOne(admin, collectionsByPath) {
-    // Rule 1 — slug pairing.
-    const collection = collectionsByPath.get(admin.slug);
+    // Rule 1 — path pairing.
+    const collection = collectionsByPath.get(admin.path);
     if (collection == null) {
         if (admin.singleton === true) {
-            throw new Error(`Singleton admin config "${admin.slug}" has no matching singleton definition (no singleton with \`path: '${admin.slug}'\` was registered).`);
+            throw new Error(`Singleton admin config "${admin.path}" has no matching singleton definition (no singleton with \`path: '${admin.path}'\` was registered).`);
         }
-        throw new Error(`Admin config "${admin.slug}" has no matching collection (no collection with \`path: '${admin.slug}'\` was registered).`);
+        throw new Error(`Admin config "${admin.path}" has no matching collection (no collection with \`path: '${admin.path}'\` was registered).`);
     }
     if (admin.singleton === true && !isSingleton(collection)) {
-        throw new Error(`Singleton admin config "${admin.slug}" targets a collection definition. Register it with \`defineAdmin\`, or point it at a singleton definition.`);
+        throw new Error(`Singleton admin config "${admin.path}" targets a collection definition. Register it with \`defineAdmin\`, or point it at a singleton definition.`);
     }
     if (admin.singleton !== true && isSingleton(collection)) {
-        throw new Error(`Collection admin config "${admin.slug}" targets a singleton definition. Register it with \`defineSingletonAdmin\`, or point it at a multi-collection definition.`);
+        throw new Error(`Collection admin config "${admin.path}" targets a singleton definition. Register it with \`defineSingletonAdmin\`, or point it at a multi-collection definition.`);
     }
-    const slug = admin.slug;
+    const path = admin.path;
     const fail = (msg) => {
         const resource = admin.singleton === true ? 'Singleton' : 'Collection';
-        throw new Error(`${resource} "${slug}": ${msg}`);
+        throw new Error(`${resource} "${path}": ${msg}`);
     };
     if (admin.singleton === true) {
         for (const key of COLLECTION_ONLY_ADMIN_KEYS) {

package/dist/config/validate-admin-configs.test.node.js

@@ -21,7 +21,7 @@ const collection = {
     ],
 };
 const baseAdmin = {
-    slug: 'news',
+    path: 'news',
     tabSets: [
         {
             name: 'main',
@@ -80,20 +80,20 @@ describe('validateAdminConfigs', () => {
         expect(() => validateAdminConfigs([admin], [collection, singleton])).toThrow(/lockPath.*not allowed on a singleton admin config/);
     });
     it('rejects a singleton admin config targeting a multi-collection', () => {
-        const admin = { ...defineSingletonAdmin(singleton, {}), slug: collection.path };
+        const admin = { ...defineSingletonAdmin(singleton, {}), path: collection.path };
         expect(() => validateAdminConfigs([admin], [collection, singleton])).toThrow(/targets a collection definition/);
     });
     it('rejects a singleton admin config with no matching definition', () => {
-        const admin = { ...defineSingletonAdmin(singleton, {}), slug: 'missing-settings' };
+        const admin = { ...defineSingletonAdmin(singleton, {}), path: 'missing-settings' };
         expect(() => validateAdminConfigs([admin], [collection, singleton])).toThrow(/no matching singleton definition/);
     });
     it('rejects a multi-collection admin config targeting a singleton', () => {
-        const admin = { slug: singleton.path };
+        const admin = { path: singleton.path };
         expect(() => validateAdminConfigs([admin], [collection, singleton])).toThrow(/targets a singleton definition/);
     });
-    // Rule 1 — slug pairing.
-    it('rejects an admin config whose slug has no matching collection', () => {
-        const orphan = { slug: 'nonexistent', layout: { main: [] } };
+    // Rule 1 — path pairing.
+    it('rejects an admin config whose path has no matching collection', () => {
+        const orphan = { path: 'nonexistent', layout: { main: [] } };
         expect(() => validateAdminConfigs([orphan], [collection])).toThrow(/no matching collection/);
     });
     // Rule 2 — placement bookkeeping.
@@ -177,7 +177,7 @@ describe('validateAdminConfigs', () => {
     // Rule 5 — nesting.
     it('rejects a row whose fields include a non-field primitive', () => {
         const admin = {
-            slug: 'news',
+            path: 'news',
             tabSets: [
                 {
                     name: 'main',
@@ -198,7 +198,7 @@ describe('validateAdminConfigs', () => {
     });
     it('rejects a tab set referenced from inside a tab', () => {
         const admin = {
-            slug: 'news',
+            path: 'news',
             tabSets: [
                 {
                     name: 'inner',
@@ -226,7 +226,7 @@ describe('validateAdminConfigs', () => {
     });
     it('rejects a group nested inside another group', () => {
         const admin = {
-            slug: 'news',
+            path: 'news',
             tabSets: [
                 {
                     name: 'main',
@@ -290,7 +290,7 @@ describe('validateAdminConfigs', () => {
         ],
     };
     const nestedAdmin = (fields) => ({
-        slug: 'library',
+        path: 'library',
         fields: fields,
     });
     it('accepts a dotted fields key through array and group declarations', () => {
@@ -386,14 +386,14 @@ describe('validateAdminConfigs', () => {
     // Layout omitted — bookkeeping skipped, primitive declarations still checked.
     it('skips placement bookkeeping when layout is omitted', () => {
         const admin = {
-            slug: 'news',
+            path: 'news',
             // No layout — renderer will synthesise a default.
         };
         expect(() => validateAdminConfigs([admin], [collection])).not.toThrow();
     });
     it('still rejects a primitive collision when layout is omitted', () => {
         const admin = {
-            slug: 'news',
+            path: 'news',
             rows: [
                 { name: 'titles', fields: ['text1', 'text2'] },
                 // 'title' is also a schema field — collision still caught.
@@ -518,34 +518,34 @@ describe('validateAdminConfigs — collection groups', () => {
         { name: 'taxonomy', label: 'Taxonomies' },
     ];
     it('accepts a valid registry and a valid reference', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news', group: 'media' }], [collection], groups)).not.toThrow();
+        expect(() => validateAdminConfigs([{ path: 'news', group: 'media' }], [collection], groups)).not.toThrow();
     });
     it('accepts a collection with no group when a registry is declared', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news' }], [collection], groups)).not.toThrow();
+        expect(() => validateAdminConfigs([{ path: 'news' }], [collection], groups)).not.toThrow();
     });
     it('is a no-op when no registry and no group references are present', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news' }], [collection])).not.toThrow();
+        expect(() => validateAdminConfigs([{ path: 'news' }], [collection])).not.toThrow();
     });
     it('rejects a duplicate group name', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news' }], [collection], [
+        expect(() => validateAdminConfigs([{ path: 'news' }], [collection], [
             { name: 'media', label: 'Media' },
             { name: 'media', label: 'Media Library' },
         ])).toThrow(/declared more than once/);
     });
     it('rejects a blank group name', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news' }], [collection], [{ name: '  ', label: 'Media' }])).toThrow(/blank `name`/);
+        expect(() => validateAdminConfigs([{ path: 'news' }], [collection], [{ name: '  ', label: 'Media' }])).toThrow(/blank `name`/);
     });
     it('rejects a blank group label', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news' }], [collection], [{ name: 'media', label: '' }])).toThrow(/blank `label`/);
+        expect(() => validateAdminConfigs([{ path: 'news' }], [collection], [{ name: 'media', label: '' }])).toThrow(/blank `label`/);
     });
     it('rejects a group reference that names no declared group', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news', group: 'medai' }], [collection], groups)).toThrow(/does not name a declared collection group/);
+        expect(() => validateAdminConfigs([{ path: 'news', group: 'medai' }], [collection], groups)).toThrow(/does not name a declared collection group/);
     });
     it('names the declared groups in the unresolved-reference error', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news', group: 'medai' }], [collection], groups)).toThrow(/"media", "taxonomy"/);
+        expect(() => validateAdminConfigs([{ path: 'news', group: 'medai' }], [collection], groups)).toThrow(/"media", "taxonomy"/);
     });
     it('rejects a group reference when no registry was declared at all', () => {
-        expect(() => validateAdminConfigs([{ slug: 'news', group: 'media' }], [collection])).toThrow(/was not declared/);
+        expect(() => validateAdminConfigs([{ path: 'news', group: 'media' }], [collection])).toThrow(/was not declared/);
     });
     // Registry sanity must not be skipped by the `admins` early return.
     it('validates the registry even when there are no admin configs', () => {

package/dist/config/validate-passkey-config.d.ts

@@ -0,0 +1,4 @@
+import type { SessionProvider } from '@byline/auth';
+import type { PasskeyConfig } from '../@types/site-config.js';
+/** Pure boot-time validation; deliberately contains no Node or cryptographic imports. */
+export declare function resolvePasskeyConfig(config: PasskeyConfig | undefined, provider: Pick<SessionProvider, 'capabilities' | 'passkeys'> | undefined): PasskeyConfig | undefined;

package/dist/config/validate-passkey-config.js

@@ -0,0 +1,89 @@
+const methods = [
+    'signInOptions',
+    'verifySignIn',
+    'passwordProof',
+    'proofOptions',
+    'verifyProof',
+    'enrollmentOptions',
+    'verifyEnrollment',
+    'listCredentials',
+    'renameCredential',
+    'removeCredential',
+];
+function invalid(reason) {
+    throw new Error(`Invalid passkey configuration: ${reason}`);
+}
+/** Pure boot-time validation; deliberately contains no Node or cryptographic imports. */
+export function resolvePasskeyConfig(config, provider) {
+    const supported = provider?.capabilities.passkeys;
+    if (supported !== undefined && typeof supported !== 'boolean') {
+        invalid('provider capability must be a boolean');
+    }
+    if (config === undefined) {
+        if (supported === true || provider?.passkeys !== undefined) {
+            invalid('an enabled provider requires explicit relying-party configuration');
+        }
+        return undefined;
+    }
+    if (!config || typeof config !== 'object' || Array.isArray(config))
+        invalid('expected an object');
+    if (supported !== true || !provider?.passkeys)
+        invalid('provider does not support passkeys');
+    for (const method of methods) {
+        if (typeof provider.passkeys[method] !== 'function')
+            invalid(`provider is missing ${method}`);
+    }
+    const allowed = new Set(['rpId', 'rpName', 'origins', 'allowInsecureLocalhost']);
+    if (Object.keys(config).some((key) => !allowed.has(key)))
+        invalid('unknown configuration option');
+    if (typeof config.rpId !== 'string' ||
+        config.rpId.length > 253 ||
+        !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(config.rpId) ||
+        (config.rpId !== 'localhost' && !config.rpId.includes('.')) ||
+        /^[\d.]+$/.test(config.rpId)) {
+        invalid('rpId must be a canonical DNS name or localhost');
+    }
+    if (typeof config.rpName !== 'string' || !config.rpName.trim() || config.rpName.length > 200) {
+        invalid('rpName must contain 1–200 characters');
+    }
+    if (config.allowInsecureLocalhost !== undefined &&
+        typeof config.allowInsecureLocalhost !== 'boolean') {
+        invalid('allowInsecureLocalhost must be a boolean');
+    }
+    if (!Array.isArray(config.origins) || config.origins.length === 0)
+        invalid('origins are required');
+    const origins = [];
+    for (const origin of config.origins) {
+        if (typeof origin !== 'string')
+            invalid('origins must be strings');
+        let url;
+        try {
+            url = new URL(origin);
+        }
+        catch {
+            invalid('origin is not a URL');
+        }
+        if (url.origin !== origin || url.username || url.password)
+            invalid('origins must be exact origins');
+        const local = config.allowInsecureLocalhost === true &&
+            config.rpId === 'localhost' &&
+            url.hostname === 'localhost' &&
+            url.protocol === 'http:';
+        if (url.protocol !== 'https:' && !local)
+            invalid('origins require HTTPS outside explicit localhost development');
+        if (url.hostname !== config.rpId && !url.hostname.endsWith(`.${config.rpId}`)) {
+            invalid('origin must belong to the configured relying party');
+        }
+        if (origins.includes(origin))
+            invalid('origins must be unique');
+        origins.push(origin);
+    }
+    return Object.freeze({
+        rpId: config.rpId,
+        rpName: config.rpName,
+        origins: Object.freeze(origins),
+        ...(config.allowInsecureLocalhost === undefined
+            ? {}
+            : { allowInsecureLocalhost: config.allowInsecureLocalhost }),
+    });
+}

package/dist/config/validate-passkey-config.test.node.d.ts

@@ -0,0 +1 @@
+export {};