# Auth schemas and route configuration

`@wrnexus/auth` registers its browser validation schemas automatically. Applications using packaged components do not create default files under `app/schemas` and do not duplicate package API routes.

## Default use

```ts
import type { AuthConfig } from "@wrnexus/auth";
import type { AppConfig } from "@wrnexus/styles";
import { auth } from "./app/lib/auth.ts";

const config = {
  auth: {
    engine: auth,
    routes: true,
    middleware: true,
    migrations: false,
  },
} satisfies AppConfig & { auth: AuthConfig };

export default config;
```

Keep behavioral hooks such as `delivery`, `tokenUrl`, `onSignedIn`, and
`onSignedOut` in the application's `createAuthEngine(...)` call. `config.auth`
selects framework integration features such as routes, middleware, migrations,
components, schemas, base URL, CSRF, and passkey HTTP settings.

Components such as `<SignUp />`, `<SignIn />`, and `<ForgotPassword />` use built-in schemas in the browser and the same resolved schemas on the server.

## Route groups

```ts
routes: {
  enabled: true,
  registration: true,
  login: true,
  verification: true,
  password: true,
  invitations: true,
  magicLink: true,
  otp: true,
  mfa: true,
  sessions: true,
  impersonation: false,
  passkeys: true,
}
```

Set `routes: false` to disable every package route. Set a route group to `false` only when the application intentionally owns that feature's endpoints. No explicit exclusion list is required.

## Customize one schema

Create a file only when application behavior differs from the package default:

```ts
// app/schemas/custom-password-request.ts
import { authSchemas } from "@wrnexus/auth";
import { v } from "@wrnexus/validation";

export default authSchemas.passwordResetRequest.extend({
  identifier: v
    .string()
    .trim()
    .required("Enter your registered email address")
    .email("Enter a valid registered email address"),
});
```

```ts
// wrnexus.config.ts
import customPasswordRequest from "./app/schemas/custom-password-request.ts";

export default {
  auth: {
    engine: auth,
    schemas: {
      passwordResetRequest: customPasswordRequest,
    },
  },
};
```

The override is used by both the package API handler and the package browser runtime. `<ForgotPassword />` keeps its normal `schema="auth-password-request"`; all other auth schemas continue using package defaults.