# Changelog

## 0.5.0

- Added `AuthEngineOptions.tokenUrl` for custom verification, reset, magic-link, and invitation page URLs without application-owned API handlers.

- Added framework-native password, identity, verification, recovery, magic-link, OTP, OAuth, passkey, session, trusted-device, risk, audit, and impersonation systems.
- Added MFA transactions using verified email OTP, verified SMS OTP, replay-safe TOTP, and one-use recovery codes.
- Added route-specific modules for all 30 package endpoints, eliminating shared-dispatcher path-rewrite `404` failures.
- Added automatic package browser schemas and optional `config.auth.schemas` overrides; default applications no longer copy `app/schemas` or API route files.
- Added `config.auth` feature-group route controls, fail-closed automatic discovery, CSRF protection, middleware, component, client-runtime, migration, and DevToolbar controls.
- Added ordered OTP-purpose migration and purpose-bound verification, login, and MFA challenges.
- Added account-state checks for recovery and verification, password-reset lock clearing, session revocation, and generic enumeration-resistant request responses.
- Added login timing hardening, adaptive risk checks, safe same-origin navigation, canonical Base64URL validation, passkey counter and ownership checks, and controlled missing-provider responses.
- Added a shared passkey-challenge-store contract for multi-process deployments.
- Added TOTP counter replay prevention, recovery-code replacement semantics, secret-purpose binding, and delivery-failure auditing.
- Aligned the memory store with SQL uniqueness and immutable credential constraints.
- Expanded package tests for routes, schemas, CSRF, stores, lock recovery, account status, verified MFA identities, passkeys, crypto, TOTP, risk, and browser components.