Remove redundant code relating to v1 endpoints

thobson · thobson · commit 02dbcb6202fe · 2026-06-25T13:58:18.000+01:00
Cleanup Sveltekit demo

Prepare for 2.9.2
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.9.2] - 2026-06-25
+
+### Removed
+
+- Legacy code relating to old V1 endpoints
+
 ## [2.9.1] - 2026-06-25
 
 ### Changed
@@ -63,6 +69,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
   await passlock.authorizePasskeyRegistration({
     rpId: 'example.com',
+    rpName: 'Example App',
     ...
   });
 
diff --git a/README.md b/README.md
@@ -61,7 +61,7 @@ Framework agnostic. Standards compliant.
 Works out of the box with sensible defaults.
 
 **:arrow_right: Related origins**  
-Migrate user passkeys to a new domain.
+Migrate passkeys with backend-selected RP IDs and WebAuthn related-origin files.
 
 **:iphone: Credential management**  
 Manage passkeys on end-user devices.
@@ -103,6 +103,7 @@ const passlock = new Passlock({ tenancyId, apiKey });
 const result = await passlock.authorizePasskeyRegistration(
   {
     rpId: "example.com",
+    rpName: "Example App",
     userId: "user_123",
     username: "jdoe@gmail.com",
     displayName: "Jane Doe",
@@ -118,6 +119,9 @@ if (result.failure) {
 console.log("registration token: %s", result.value.registrationToken);
 ```
 
+Choose `rpId` in your backend for each prepared passkey ceremony. Passlock no
+longer uses a separate tenancy-level passkey settings RP ID.
+
 ```typescript
 // frontend/register.ts
 import { Passlock } from "@passlock/browser";
diff --git a/README.template.md b/README.template.md
@@ -61,7 +61,7 @@ Framework agnostic. Standards compliant.
 Works out of the box with sensible defaults.
 
 **:arrow_right: Related origins**  
-Migrate user passkeys to a new domain.
+Migrate passkeys with backend-selected RP IDs and WebAuthn related-origin files.
 
 **:iphone: Credential management**  
 Manage passkeys on end-user devices.
@@ -103,6 +103,7 @@ const passlock = new Passlock({ tenancyId, apiKey });
 const result = await passlock.authorizePasskeyRegistration(
   {
     rpId: "example.com",
+    rpName: "Example App",
     userId: "user_123",
     username: "jdoe@gmail.com",
     displayName: "Jane Doe",
@@ -118,6 +119,9 @@ if (result.failure) {
 console.log("registration token: %s", result.value.registrationToken);
 ```
 
+Choose `rpId` in your backend for each prepared passkey ceremony. Passlock no
+longer uses a separate tenancy-level passkey settings RP ID.
+
 ```typescript
 // frontend/register.ts
 import { Passlock } from "@passlock/browser";
diff --git a/examples/sveltekit/README.md b/examples/sveltekit/README.md
@@ -57,7 +57,9 @@ Follow the prompts and take note of your `Tenancy ID` and `API Key`.
 ### 4. Set environment variables
 
 Copy the `.env.example` to `.env` and set the `PUBLIC_PASSLOCK_TENANCY_ID`,
-`PASSLOCK_API_KEY`, and `PASSLOCK_RP_ID` variables.
+`PASSLOCK_API_KEY`, and `PASSLOCK_RP_ID` variables. `PASSLOCK_RP_ID` is the
+backend-selected relying party ID sent when the example authorizes passkey
+registration and authentication.
 
 ### 5. Setup the database
 
diff --git a/examples/sveltekit/package.json b/examples/sveltekit/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@passlock/sveltekit-example",
-	"version": "2.9.1",
+	"version": "2.9.2",
 	"private": true,
 	"description": "SvelteKit app making full use of passkeys along with email based one time login codes",
 	"type": "module",
@@ -29,14 +29,14 @@
 		"@eslint/compat": "^2.1.0",
 		"@eslint/js": "^10.0.1",
 		"@lucide/svelte": "^1.21.0",
-		"@passlock/browser": "workspace:^",
-		"@passlock/server": "workspace:^",
+		"@passlock/browser": "^2.9.2",
+		"@passlock/server": "^2.9.2",
 		"@sveltejs/adapter-auto": "^7.0.1",
 		"@sveltejs/adapter-node": "^5.5.6",
 		"@sveltejs/kit": "^2.67.0",
 		"@sveltejs/vite-plugin-svelte": "^7.1.2",
 		"@tailwindcss/vite": "4.3.1",
-		"@types/node": "^26.0.0",
+		"@types/node": "^24.1.0",
 		"daisyui": "^5.5.23",
 		"dotenv": "^17.4.2",
 		"drizzle-kit": "^0.31.10",
@@ -50,7 +50,7 @@
 		"prettier-plugin-tailwindcss": "^0.8.0",
 		"sort-package-json": "catalog:",
 		"svelte": "^5.56.4",
-		"svelte-check": "^4.7.0",
+		"svelte-check": "^4.7.1",
 		"sveltekit-superforms": "^2.30.1",
 		"tailwindcss": "^4.3.1",
 		"typescript": "^6.0.3",
diff --git a/examples/sveltekit/src/lib/server/passlock.ts b/examples/sveltekit/src/lib/server/passlock.ts
@@ -14,7 +14,9 @@ export const getPasslockConfig = () => {
 	const apiKey = PASSLOCK_API_KEY;
 	const tenancyId = PUBLIC_PASSLOCK_TENANCY_ID;
 	const endpoint = PUBLIC_PASSLOCK_ENDPOINT;
+	// Backend-selected RP ID for prepared passkey ceremonies.
 	const rpId = PASSLOCK_RP_ID || 'localhost';
+	const rpName = 'Passlock SvelteKit Example';
 
 	if (!apiKey || !tenancyId) {
 		console.error('Passlock not configured');
@@ -25,6 +27,7 @@ export const getPasslockConfig = () => {
 		tenancyId,
 		apiKey,
 		rpId,
+		rpName,
 		endpoint: endpoint || undefined
 	} as const;
 };
@@ -34,9 +37,9 @@ export const getPasslockConfig = () => {
  *
  * Client code needs the tenancy and optional endpoint so it can talk to
  * Passlock via `@passlock/browser`. It MUST NOT receive the API key.
- * It SHOULD NOT receive the RP ID, as this is selected by server-side authorization calls.
+ * It SHOULD NOT receive RP metadata, as this is selected by server-side authorization calls.
  */
 export const getPasslockClientConfig = () => {
-	const { apiKey: _apiKey, rpId: _rpId, ...rest } = getPasslockConfig();
+	const { apiKey: _apiKey, rpId: _rpId, rpName: _rpName, ...rest } = getPasslockConfig();
 	return rest;
 };
diff --git a/examples/sveltekit/src/routes/passkeys/registration/+server.ts b/examples/sveltekit/src/routes/passkeys/registration/+server.ts
@@ -22,6 +22,7 @@ export const POST: RequestHandler = async (event) => {
 	const authorizedRegistration = await PasslockServer.authorizePasskeyRegistration(
 		{
 			rpId: config.rpId,
+			rpName: config.rpName,
 			userId: String(event.locals.user.userId),
 			username: event.locals.user.email,
 			displayName: displayName || undefined,
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "passlock",
-  "version": "2.9.1",
+  "version": "2.9.2",
   "private": true,
   "description": "Passlock monorepo root",
   "keywords": [
@@ -28,7 +28,7 @@
   "type": "module",
   "scripts": {
     "build:readme": "VERSION=${npm_package_version} tsx ./scripts/replace-readme-tokens.ts .",
-    "ncu": "pnpm exec ncu -c 25h -x vite -w -u --peer",
+    "ncu": "pnpm exec ncu -c 25h -x vite -x @types/node -w -u --peer",
     "sort-package-json": "sort-package-json"
   },
   "devDependencies": {
diff --git a/packages/browser/README.md b/packages/browser/README.md
@@ -40,7 +40,7 @@ Powerful passkey features for browser applications.
 Framework agnostic. Standards compliant.
 
 2. **🔑 Domain migration**  
-Use backend-authorized RP IDs with WebAuthn related-origin support.
+Use backend-authorized RP IDs with WebAuthn `/.well-known/webauthn` support.
 
 3. **🚀 Zero config passkeys**  
 Works out of the box with sensible defaults.
@@ -82,9 +82,9 @@ the result with Passlock.
 
 Your backend chooses the RP ID when it authorizes registration or authentication.
 The browser library does not accept an RP ID directly; it uses the WebAuthn
-options returned by Passlock. During domain migration, configure WebAuthn
-related origins for the browser platform if the current origin needs to use
-passkeys for a different RP ID.
+options returned by Passlock. During domain migration, publish the RP ID
+domain's `/.well-known/webauthn` file so browsers and authenticators can enforce
+related-origin eligibility.
 
 ## More information
 
diff --git a/packages/browser/README.template.md b/packages/browser/README.template.md
@@ -40,7 +40,7 @@ Powerful passkey features for browser applications.
 Framework agnostic. Standards compliant.
 
 2. **🔑 Domain migration**  
-Use backend-authorized RP IDs with WebAuthn related-origin support.
+Use backend-authorized RP IDs with WebAuthn `/.well-known/webauthn` support.
 
 3. **🚀 Zero config passkeys**  
 Works out of the box with sensible defaults.
@@ -82,9 +82,9 @@ the result with Passlock.
 
 Your backend chooses the RP ID when it authorizes registration or authentication.
 The browser library does not accept an RP ID directly; it uses the WebAuthn
-options returned by Passlock. During domain migration, configure WebAuthn
-related origins for the browser platform if the current origin needs to use
-passkeys for a different RP ID.
+options returned by Passlock. During domain migration, publish the RP ID
+domain's `/.well-known/webauthn` file so browsers and authenticators can enforce
+related-origin eligibility.
 
 ## More information
 
diff --git a/packages/browser/package.json b/packages/browser/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@passlock/browser",
-  "version": "2.9.1",
+  "version": "2.9.2",
   "description": "Flexible passkey authentication for Astro, SvelteKit, NextJS and other frameworks",
   "keywords": [
     "passkey",
@@ -85,7 +85,7 @@
     "typedoc": "catalog:",
     "typedoc-plugin-markdown": "catalog:",
     "typescript": "catalog:",
-    "vitest": "^4.1.9"
+    "vitest": "catalog:"
   },
   "packageManager": "pnpm@11.9.0"
 }
diff --git a/packages/browser/src/passkey/authentication/authentication.ts b/packages/browser/src/passkey/authentication/authentication.ts
@@ -21,9 +21,10 @@ import { OrphanedPasskeyError, OtherPasskeyError, PasskeyUnsupportedError } from
  * policy are all decided by the backend during authorization. The browser
  * redeems the token and uses the returned WebAuthn options as-is.
  *
- * If the current origin differs from the authorized RP ID, the browser's
- * WebAuthn related-origin policy must allow the ceremony. The browser library
- * does not accept or override the RP ID.
+ * If the current origin differs from the authorized RP ID, the RP ID domain's
+ * `/.well-known/webauthn` file must allow the ceremony. Browsers and
+ * authenticators enforce that related-origin policy; the browser library does
+ * not accept or override the RP ID.
  *
  * @see {@link authenticatePasskey}
  *
@@ -39,9 +40,9 @@ export type AuthenticationOptions = AuthorizedAuthenticationOptions
  * browser, then pass that token to {@link authenticatePasskey}.
  *
  * The authorized token already carries the RP ID chosen by your backend. For
- * domain migration, the browser/WebAuthn platform must still allow the current
- * origin to use that RP ID. Passlock does not require this origin to match a
- * separate tenancy related-origin setting when the token is redeemed.
+ * domain migration, the RP ID domain's `/.well-known/webauthn` file must allow
+ * the current origin to use that RP ID. The browser library never reads or
+ * supplies tenancy-level RP ID or related-origin settings.
  *
  * For discoverable login and autofill, authorize the token with
  * `discoverable: true` and, for autofill, `mediation: "conditional"`.
diff --git a/packages/browser/src/passkey/registration/registration.ts b/packages/browser/src/passkey/registration/registration.ts
@@ -17,9 +17,10 @@ import { DuplicatePasskeyError, OtherPasskeyError, PasskeyUnsupportedError } fro
  * The backend chooses the WebAuthn RP ID when it authorizes the token; the
  * browser redeems the token and uses the returned WebAuthn options as-is.
  *
- * If the current origin differs from the authorized RP ID, the browser's
- * WebAuthn related-origin policy must allow the ceremony. The browser library
- * does not accept or override the RP ID.
+ * If the current origin differs from the authorized RP ID, the RP ID domain's
+ * `/.well-known/webauthn` file must allow the ceremony. Browsers and
+ * authenticators enforce that related-origin policy; the browser library does
+ * not accept or override the RP ID.
  *
  * @see {@link registerPasskey}
  *
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@passlock/cli",
-  "version": "2.9.1",
+  "version": "2.9.2",
   "description": "CLI tooling support for the Passlock authentication framework",
   "keywords": [
     "passkey",
@@ -71,7 +71,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "catalog:",
-    "@effect/vitest": "^0.29.0",
+    "@effect/vitest": "catalog:",
     "@types/node": "catalog:",
     "globals": "catalog:",
     "npm-check-updates": "catalog:",
@@ -80,7 +80,7 @@
     "sort-package-json": "catalog:",
     "tsx": "catalog:",
     "typescript": "catalog:",
-    "vitest": "^4.1.8"
+    "vitest": "catalog:"
   },
   "packageManager": "pnpm@11.9.0",
   "engines": {
diff --git a/packages/server/README.md b/packages/server/README.md
@@ -44,16 +44,20 @@ Node 20+ (If running Node)
 
 Create passkey registrations from your backend after you have authenticated the
 user and decided they are allowed to add a passkey. The server authorizes a
-short-lived `registrationToken` for the `rpId` your backend supplies; send only
-that token to the browser and use it with `registerPasskey` from
-`@passlock/browser`.
+short-lived `registrationToken` for the `rpId` and `rpName` your backend
+supplies; send only that token to the browser and use it with `registerPasskey`
+from `@passlock/browser`.
+
+Choose `rpId` in your backend for each prepared ceremony. It is not configured
+through tenancy passkey settings.
 
 ```ts
 import { authorizePasskeyRegistration } from "@passlock/server"
 
 const result = await authorizePasskeyRegistration(
   {
     rpId: "example.com",
+    rpName: "Example App",
     userId: "user_123",
     username: "user@example.com",
     displayName: "User Example",
diff --git a/packages/server/README.template.md b/packages/server/README.template.md
@@ -44,16 +44,20 @@ Node 20+ (If running Node)
 
 Create passkey registrations from your backend after you have authenticated the
 user and decided they are allowed to add a passkey. The server authorizes a
-short-lived `registrationToken` for the `rpId` your backend supplies; send only
-that token to the browser and use it with `registerPasskey` from
-`@passlock/browser`.
+short-lived `registrationToken` for the `rpId` and `rpName` your backend
+supplies; send only that token to the browser and use it with `registerPasskey`
+from `@passlock/browser`.
+
+Choose `rpId` in your backend for each prepared ceremony. It is not configured
+through tenancy passkey settings.
 
 ```ts
 import { authorizePasskeyRegistration } from "@passlock/server"
 
 const result = await authorizePasskeyRegistration(
   {
     rpId: "example.com",
+    rpName: "Example App",
     userId: "user_123",
     username: "user@example.com",
     displayName: "User Example",
diff --git a/packages/server/package.json b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@passlock/server",
-  "version": "2.9.1",
+  "version": "2.9.2",
   "description": "Passkey authentication library for Fetch capable backends (Node, Bun, Vercel, Cloudflare workers etc.)",
   "keywords": [
     "passkey",
@@ -72,7 +72,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "catalog:",
-    "@effect/vitest": "^0.29.0",
+    "@effect/vitest": "catalog:",
     "globals": "catalog:",
     "npm-check-updates": "catalog:",
     "publint": "catalog:",
@@ -82,7 +82,7 @@
     "typedoc": "catalog:",
     "typedoc-plugin-markdown": "catalog:",
     "typescript": "catalog:",
-    "vitest": "^4.1.8"
+    "vitest": "catalog:"
   },
   "packageManager": "pnpm@11.9.0"
 }
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
diff --git a/packages/server/src/passkey/passkey.test.ts b/packages/server/src/passkey/passkey.test.ts
diff --git a/packages/server/src/passkey/passkey.ts b/packages/server/src/passkey/passkey.ts
diff --git a/packages/server/src/schemas/passkey.ts b/packages/server/src/schemas/passkey.ts
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml

Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,7 @@ export const POST: RequestHandler = async (event) => {`
`22`	`22`	`const authorizedRegistration = await PasslockServer.authorizePasskeyRegistration(`
`23`	`23`	`{`
`24`	`24`	`rpId: config.rpId,`
	`25`	`+ rpName: config.rpName,`
`25`	`26`	`userId: String(event.locals.user.userId),`
`26`	`27`	`username: event.locals.user.email,`
`27`	`28`	`displayName: displayName \|\| undefined,`