refactor: remove the deprecated auth options

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/auth/src/engine.ts

@@ -160,10 +160,6 @@ export interface AuthEngine {
       key: string;
       response: unknown;
       name?: string;
-      /** @deprecated Verification uses the RP ID bound to the issued challenge. */
-      rpId?: string;
-      /** @deprecated Verification uses the origin bound to the issued challenge. */
-      origin?: string;
     },
   ): Promise<boolean>;
   beginPasskeyAuthentication(input: {
@@ -176,10 +172,6 @@ export interface AuthEngine {
     response: unknown;
     /** Request metadata used only for the resulting session. */
     session?: Partial<AuthSession>;
-    /** @deprecated Verification uses the RP ID bound to the issued challenge. */
-    rpId?: string;
-    /** @deprecated Verification uses the origin bound to the issued challenge. */
-    origin?: string;
   }): Promise<AuthResult>;
   changePassword(
     userId: string,
@@ -832,7 +824,7 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
     store,
     onSignedIn: options.onSignedIn,
     onSignedOut: options.onSignedOut,
-    onSuccessfulSignUp: options.onSuccessfulSignUp ?? options.onSuccessfullSignUp,
+    onSuccessfulSignUp: options.onSuccessfulSignUp,
 
     async register(input) {
       try {

packages/auth/src/http/index.ts

@@ -9,11 +9,7 @@ import {
   getAuthUser,
 } from "../middleware.ts";
 import { resolveAuthSchemas, type AuthSchemaOverrides, type AuthSchemaSet } from "../validation.ts";
-import type {
-  AuthSessionVerificationHandler,
-  AuthSignedInHandler,
-  AuthSignedOutHandler,
-} from "../types.ts";
+import type { AuthSessionVerificationHandler } from "../types.ts";
 
 function text(value: unknown): string {
   return typeof value === "string" ? value : value == null ? "" : String(value);
@@ -53,18 +49,14 @@ export interface AuthHttpOptions {
   baseUrl?: string;
   schemas?: AuthSchemaOverrides | AuthSchemaSet;
   passkey?: AuthPasskeyHttpOptions;
-  /** @deprecated Prefer createAuthEngine({ onSignedIn }). */
-  onSignedIn?: AuthSignedInHandler;
-  /** @deprecated Prefer createAuthEngine({ onSignedOut }). */
-  onSignedOut?: AuthSignedOutHandler;
   onSessionVerification?: AuthSessionVerificationHandler;
 }
 
 export function createAuthHttpHandlers(options: AuthHttpOptions) {
   const engine = options.engine;
   const schemas = resolveAuthSchemas(options.schemas);
-  const onSignedIn = options.onSignedIn ?? engine.onSignedIn;
-  const onSignedOut = options.onSignedOut ?? engine.onSignedOut;
+  const onSignedIn = engine.onSignedIn;
+  const onSignedOut = engine.onSignedOut;
   const onSuccessfulSignUp = engine.onSuccessfulSignUp;
 
   function signupRedirect(ctx: Context, value: string | undefined, fallback: string): Response {

packages/auth/src/plugin.ts

@@ -4,11 +4,7 @@ import { fileURLToPath } from "node:url";
 import { definePlugin, type PluginContext } from "@wrnexus/plugin";
 import type { AuthEngine } from "./engine.ts";
 import type { AuthPasskeyHttpOptions } from "./http/index.ts";
-import type {
-  AuthSessionVerificationHandler,
-  AuthSignedInHandler,
-  AuthSignedOutHandler,
-} from "./types.ts";
+import type { AuthSessionVerificationHandler } from "./types.ts";
 import { AUTH_ROUTE_DEFINITIONS, type AuthRouteGroup } from "./routes/definitions.ts";
 import {
   clearDefaultAuthEngine,
@@ -52,10 +48,6 @@ export interface AuthConfig {
   baseUrl?: string;
   csrf?: boolean;
   passkey?: AuthPasskeyHttpOptions;
-  /** @deprecated Prefer createAuthEngine({ onSignedIn }). */
-  onSignedIn?: AuthSignedInHandler;
-  /** @deprecated Prefer createAuthEngine({ onSignedOut }). */
-  onSignedOut?: AuthSignedOutHandler;
   /** Shared SSO cookie whose value is an AuthEngine session id. */
   sessionCookieName?: string;
   /** Customize the package forward-auth verification response. */
@@ -94,8 +86,6 @@ interface ResolvedAuthConfig {
   baseUrl?: string;
   csrf: boolean;
   passkey?: AuthPasskeyHttpOptions;
-  onSignedIn?: AuthSignedInHandler;
-  onSignedOut?: AuthSignedOutHandler;
   sessionCookieName?: string;
   onSessionVerification?: AuthSessionVerificationHandler;
 }
@@ -156,8 +146,6 @@ function resolveConfig(
     baseUrl: raw.baseUrl,
     csrf: raw.csrf ?? true,
     passkey: raw.passkey,
-    onSignedIn: raw.onSignedIn ?? raw.engine?.onSignedIn,
-    onSignedOut: raw.onSignedOut ?? raw.engine?.onSignedOut,
     sessionCookieName: raw.sessionCookieName,
     onSessionVerification: raw.onSessionVerification,
   };
@@ -392,10 +380,6 @@ export function authPlugin(options: AuthPluginOptions = {}) {
 
         passkey: value.passkey,
 
-        onSignedIn: value.onSignedIn,
-
-        onSignedOut: value.onSignedOut,
-
         sessionCookieName: value.sessionCookieName,
 
         onSessionVerification: value.onSessionVerification,

packages/auth/src/routes/api.ts

@@ -60,8 +60,6 @@ function handlersFor(ctx: Context): AuthHttpHandlers | undefined {
     schemas: getDefaultAuthSchemas(),
     baseUrl: routeOptions.baseUrl ?? ctx.url.origin,
     passkey: routeOptions.passkey,
-    onSignedIn: routeOptions.onSignedIn,
-    onSignedOut: routeOptions.onSignedOut,
     onSessionVerification: routeOptions.onSessionVerification,
   });
 }

packages/auth/src/runtime.ts

@@ -1,4 +1,3 @@
-import type { Context } from "@wrnexus/core";
 import type { AuthEngine } from "./engine.ts";
 import type { AuthPasskeyHttpOptions } from "./http/index.ts";
 import type { AuthSessionVerificationHandler } from "./types.ts";
@@ -8,10 +7,6 @@ export interface DefaultAuthRouteOptions {
   baseUrl?: string;
   csrf?: boolean;
   passkey?: AuthPasskeyHttpOptions;
-
-  onSignedIn?: (ctx: Context, returnTo?: string) => Response | Promise<Response>;
-
-  onSignedOut?: (ctx: Context) => Response | Promise<Response>;
   sessionCookieName?: string;
   onSessionVerification?: AuthSessionVerificationHandler;
 }

packages/auth/src/types.ts

@@ -420,8 +420,6 @@ export interface AuthEngineOptions {
    * redirects to /sign-in.
    */
   onSuccessfulSignUp?: AuthSuccessfulSignUpHandler;
-  /** @deprecated Misspelled alias; use onSuccessfulSignUp. */
-  onSuccessfullSignUp?: AuthSuccessfulSignUpHandler;
   breachProvider?: PasswordBreachProvider;
   passkeys?: PasskeyProvider;
   passkeyChallengeStore?: import("./passkeys/index.ts").PasskeyChallengeStore;

packages/auth/test/engine.test.ts

@@ -579,8 +579,6 @@ describe("authentication engine", () => {
       await engine.finishPasskeyRegistration(registered.user!.id, {
         key: start.key,
         response: {},
-        rpId: "example.test",
-        origin: "https://example.test",
       }),
     ).toBe(true);
     const auth = await engine.beginPasskeyAuthentication({
@@ -595,8 +593,6 @@ describe("authentication engine", () => {
         await engine.finishPasskeyAuthentication({
           key: auth.key,
           response: { id: "cred-1" },
-          rpId: "example.test",
-          origin: "https://example.test",
         })
       ).ok,
     ).toBe(true);

packages/auth/test/plugin.test.ts

@@ -3,7 +3,6 @@ import { createPluginRunner } from "@wrnexus/plugin";
 import { authPlugin } from "../src/plugin.ts";
 import { AUTH_ROUTE_DEFINITIONS } from "../src/routes/definitions.ts";
 import { readFileSync } from "node:fs";
-import { getDefaultAuthRouteOptions } from "../src/runtime.ts";
 
 test("plugin contributes components, runtime, styles, migration, and toolbar", async () => {
   const metadata = new Map<string, unknown>();
@@ -70,28 +69,6 @@ test("config.auth controls route groups and migrations without explicit plugin o
   expect(contributions.routes.some((route) => route.path === "/api/auth/login")).toBe(true);
 });
 
-test("config.auth resolves navigation hooks from the configured engine", async () => {
-  const onSignedIn = () => new Response(null, { status: 204 });
-  const onSignedOut = () => new Response(null, { status: 204 });
-  const runner = createPluginRunner(authPlugin(), {
-    root: process.cwd(),
-    mode: "development",
-    command: "dev",
-    metadata: new Map(),
-    warn() {},
-  });
-
-  await runner.configure({
-    auth: {
-      engine: { onSignedIn, onSignedOut } as never,
-      routes: true,
-    },
-  });
-
-  expect(getDefaultAuthRouteOptions().onSignedIn).toBe(onSignedIn);
-  expect(getDefaultAuthRouteOptions().onSignedOut).toBe(onSignedOut);
-});
-
 test("auth runtime contains built-in browser schemas", async () => {
   const metadata = new Map<string, unknown>();
   const runner = createPluginRunner(authPlugin({ includeMigrations: false }), {