feat(sep10-auth): validate middleware options at creation time (closes #39)

[dchaudhari7177]

Closes #39.

createSep10Middleware accepted VerifyChallengeOptions but never checked them until the first request came in. An empty homeDomains or serverAccountId silently 401'd every request — with a reason that reads like the client's challenge was bad, rather than the server being misconfigured.

assertValidOptions now throws a TypeError from the factory for:

• an empty or blank serverAccountId
• a homeDomains / webAuthDomain that is empty, or contains a blank entry — in both the string and array forms

Messages are prefixed createSep10Middleware: so the misconfigured call site is obvious in the stack.

Scope kept narrow on purpose

Only emptiness is checked. Whether serverAccountId is a real Stellar key, or a home domain resolves, stays verifyChallenge's business — otherwise this quietly becomes a second, drifting validation layer. test('does not validate the shape of a serverAccountId, only that it is present') pins that a non-key string is still accepted.

Blast radius

No existing test or example passes empty options, so nothing regresses (checked every createSep10Middleware( call site in sep10-auth/test, sep10-auth/examples, and examples/).

One behaviour change worth naming: examples/full-stack-demo and examples/sep10-sanctions-gate build their options from env vars. With this change an unset var throws at wiring time instead of 401ing every request — which is the intended improvement, but it is a startup-time failure where there wasn't one before.

⚠️ Tests not executed — npm ci is broken on main

Same blocker as #219: npm ci and npm install both fail on a clean checkout with

npm error code EUNSUPPORTEDPROTOCOL
npm error Unsupported URL Type "workspace:": workspace:*

because e2e-tests/package.json uses the pnpm/yarn-only workspace: protocol and e2e-tests is in the root workspaces array. CI on main has been red with this since 2026-07-30, so I could not run jest.

Instead I transliterated assertValidOptions into plain node and ran the full case matrix — valid options, array forms, empty/blank serverAccountId, empty/blank/blank-entry homeDomains and webAuthDomain, and the non-key-but-present case — confirming all 10 behave as intended and that every thrown error is a TypeError whose message starts with createSep10Middleware: .

The 11 added jest cases cover the same matrix and should pass once npm ci works again.

🤖 Generated with Claude Code