WRNexusJS/packages/auth/CHANGELOG.md

Changelog

0.5.0

• Added AuthEngineOptions.tokenUrl for custom verification, reset, magic-link, and invitation page URLs without application-owned API handlers.

• Added framework-native password, identity, verification, recovery, magic-link, OTP, OAuth, passkey, session, trusted-device, risk, audit, and impersonation systems.

• Added MFA transactions using verified email OTP, verified SMS OTP, replay-safe TOTP, and one-use recovery codes.

• Added route-specific modules for all 30 package endpoints, eliminating shared-dispatcher path-rewrite 404 failures.

• Added automatic package browser schemas and optional config.auth.schemas overrides; default applications no longer copy app/schemas or API route files.

• Added config.auth feature-group route controls, fail-closed automatic discovery, CSRF protection, middleware, component, client-runtime, migration, and DevToolbar controls.

• Added ordered OTP-purpose migration and purpose-bound verification, login, and MFA challenges.

• Added account-state checks for recovery and verification, password-reset lock clearing, session revocation, and generic enumeration-resistant request responses.

• Added login timing hardening, adaptive risk checks, safe same-origin navigation, canonical Base64URL validation, passkey counter and ownership checks, and controlled missing-provider responses.

• Added a shared passkey-challenge-store contract for multi-process deployments.

• Added TOTP counter replay prevention, recovery-code replacement semantics, secret-purpose binding, and delivery-failure auditing.

• Aligned the memory store with SQL uniqueness and immutable credential constraints.

• Expanded package tests for routes, schemas, CSRF, stores, lock recovery, account status, verified MFA identities, passkeys, crypto, TOTP, risk, and browser components.