WRNexusJS authentication system 0.5 alpha

@wrnexus/auth is a framework-native system built on the WRNexusJS package-runtime architecture.

Architecture

AuthEngine owns identity, credentials, tokens, sessions, recovery, MFA, invitations, OAuth, passkeys, risk, and auditing.
AuthStore isolates persistence. MemoryAuthStore is for development and SqlAuthStore targets WRNexusJS database drivers.
config.auth activates package routes, auth-session middleware, components, browser schemas, client runtime, ordered migrations, and DevToolbar checks.
Every package endpoint has a route-specific module; path rewriting cannot make an endpoint fall through a shared dispatcher.
createAuthHttpHandlers() remains available for intentionally custom HTTP surfaces.
createAuthSecretProtector() protects TOTP and OAuth secrets with a versioned encryption keyring.

Password, OTP, token, CAPTCHA, passkey, and MFA verification are server-side.
Browser schemas improve usability; resolved server schemas remain authoritative.
Unsafe package routes verify CSRF by default.
CAPTCHA success is accepted only from server-populated request locals.
OAuth email linking requires a verified provider email and can be disabled.
Impersonation is deny-by-default and requires an application policy.
One-time credentials are expiring, purpose-bound, and single-use.
Sessions rotate at establishment and support idle and absolute expiration.
Multi-process passkey deployments provide a shared PasskeyChallengeStore.

The package is 0.5.0. Run bun run validate:auth before publishing and read packages/auth/SECURITY.md before production deployment.