@absolutejs/auth 0.80.0 → 0.81.0

package/CHANGELOG.md

@@ -6,6 +6,26 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.81.0 — 2026-09-22
+
+### Added
+
+- **Provide fixed-route credentials APIs with inferred Eden request types and a package-owned manifest integration recipe** (`createCredentialsApi`)
+
+### Changed
+
+- **Delegate configurable credential routes through shared literal-path factories while retaining the same configuration and default endpoints** (`credentialsLogin`, `credentialsRegister`, `credentialsEmailVerification`, `credentialsPasswordReset`)
+
+### Fixed
+
+- **Document the required auth context session binding and protected account route**
+
+## 0.80.1 — 2026-09-22
+
+### Fixed
+
+- **Document verified persistent credentials integration and correct Drizzle and migration APIs**
+
 ## 0.80.0 — 2026-09-22
 
 ### Added

package/README.md

@@ -440,3 +440,5 @@ Studio's `absolute-auth setup` reads the selected adapter from
 migrations and warns that sessions reset on restart. The Neon adapter requires
 a real `DATABASE_URL` and runs migrations. Missing or unknown selections fail
 with an actionable error; custom adapters must configure their own migrations.
+
+For a complete credentials-only Bun setup, see [Persistent email/password sign-in](docs/PERSISTENT-CREDENTIALS.md). It includes real migration and auth configuration APIs, durable user records, and driver settings.

package/changelog.json

@@ -2,6 +2,43 @@
 	"contract": 1,
 	"name": "@absolutejs/auth",
 	"releases": [
+		{
+			"version": "0.81.0",
+			"date": "2026-09-22",
+			"changes": [
+				{
+					"kind": "added",
+					"summary": "Provide fixed-route credentials APIs with inferred Eden request types and a package-owned manifest integration recipe",
+					"symbols": [
+						"createCredentialsApi"
+					]
+				},
+				{
+					"kind": "fixed",
+					"summary": "Document the required auth context session binding and protected account route"
+				},
+				{
+					"kind": "changed",
+					"summary": "Delegate configurable credential routes through shared literal-path factories while retaining the same configuration and default endpoints",
+					"symbols": [
+						"credentialsLogin",
+						"credentialsRegister",
+						"credentialsEmailVerification",
+						"credentialsPasswordReset"
+					]
+				}
+			]
+		},
+		{
+			"changes": [
+				{
+					"kind": "fixed",
+					"summary": "Document verified persistent credentials integration and correct Drizzle and migration APIs"
+				}
+			],
+			"date": "2026-09-22",
+			"version": "0.80.1"
+		},
 		{
 			"changes": [
 				{

package/dist/credentials/api.d.ts

@@ -0,0 +1,214 @@
+import { Elysia } from 'elysia';
+import type { CredentialRouteProps } from './config';
+/** Fixed routes preserve Eden's route and body inference. The application owns
+ * users, durable stores and email delivery; all credential policy stays in the
+ * existing package handlers. Mount this instead of auth's credentials block. */
+export declare const createCredentialsApi: <UserType>(configuration: Omit<CredentialRouteProps<UserType>, "loginRoute" | "registerRoute" | "verifyEmailRoute" | "resetPasswordRoute">) => Elysia<"", "local", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+}, {
+    typebox: {};
+    error: [];
+}, import("elysia/types").DefaultMetadata, {
+    auth: {
+        register: {
+            post: {
+                body: {
+                    email: string;
+                    password: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response | import("..").StatusReturn;
+                    422: {
+                        type: "validation";
+                        title: "Validation Error";
+                        status: 422;
+                        detail?: string;
+                        on: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+                error: never;
+            };
+        };
+    };
+} & {
+    auth: {
+        login: {
+            post: {
+                body: {
+                    email: string;
+                    password: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    401: "Invalid email or password";
+                    403: "Request origin is not allowed" | {
+                        readonly status: "email_not_verified";
+                    };
+                    200: {
+                        readonly status: "mfa_required";
+                    } | {
+                        readonly passwordCompromised: boolean;
+                        readonly status: "authenticated";
+                    };
+                    422: {
+                        type: "validation";
+                        title: "Validation Error";
+                        status: 422;
+                        detail?: string;
+                        on: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                    429: {
+                        readonly retryAfterMs: number | undefined;
+                        readonly status: "account_locked";
+                    };
+                };
+                error: never;
+            };
+        };
+    };
+} & {
+    auth: {
+        "verify-email": {
+            post: {
+                body: {
+                    token: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response | import("..").StatusReturn;
+                    422: {
+                        type: "validation";
+                        title: "Validation Error";
+                        status: 422;
+                        detail?: string;
+                        on: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+                error: never;
+            };
+        };
+    };
+} & {
+    auth: {
+        "verify-email": {
+            request: {
+                post: {
+                    body: {
+                        email: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly status: "verification_requested";
+                        };
+                        422: {
+                            type: "validation";
+                            title: "Validation Error";
+                            status: 422;
+                            detail?: string;
+                            on: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                    error: never;
+                };
+            };
+        };
+    };
+} & {
+    auth: {
+        "reset-password": {
+            request: {
+                post: {
+                    body: {
+                        email: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly status: "reset_requested";
+                        };
+                        422: {
+                            type: "validation";
+                            title: "Validation Error";
+                            status: 422;
+                            detail?: string;
+                            on: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                    error: never;
+                };
+            };
+        };
+    };
+} & {
+    auth: {
+        "reset-password": {
+            post: {
+                body: {
+                    token: string;
+                    password: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    400: "Invalid or expired reset token" | {
+                        readonly message: "Password does not meet the policy";
+                        readonly violations: import("./passwordPolicy").PasswordPolicyViolation[];
+                    };
+                    200: {
+                        readonly status: "password_reset";
+                    };
+                    422: {
+                        type: "validation";
+                        title: "Validation Error";
+                        status: 422;
+                        detail?: string;
+                        on: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+                error: never;
+            };
+        };
+    };
+}, import("elysia/types").DefaultEphemeral, {
+    derive: {};
+    schema: {};
+    schemas: {};
+    response: {};
+    error: [];
+}>;

package/dist/credentials/emailVerification.d.ts

@@ -1,5 +1,6 @@
+import type { RouteString } from '../types';
 import { type CredentialsConfig } from './config';
-export declare const credentialsEmailVerification: <UserType>({ credentialStore, getUserByEmail, onCreateCredentialUser, onEmailVerified, onRegistrationSuccess, onSendEmail, requireEmailVerification, verificationTokenDurationMs, verifyEmailRoute }: CredentialsConfig<UserType>) => import("elysia/types").AddRoute<"", "local", import("elysia/types").DefaultSingleton, {
+export declare const credentialsEmailVerification: <UserType>(configuration: CredentialsConfig<UserType>) => import("elysia/types").AddRoute<"", "local", import("elysia/types").DefaultSingleton, {
     typebox: {};
     error: [];
 }, import("elysia/types").DefaultMetadata, {
@@ -186,3 +187,190 @@ export declare const credentialsEmailVerification: <UserType>({ credentialStore,
 }) => Promise<import("elysia").ElysiaStatus<"OK", {
     readonly status: "verification_requested";
 }, 200>>>;
+export declare const credentialsEmailVerificationRoute: <UserType, const Route extends RouteString = RouteString>({ credentialStore, getUserByEmail, onCreateCredentialUser, onEmailVerified, onRegistrationSuccess, onSendEmail, requireEmailVerification, verificationTokenDurationMs, verifyEmailRoute }: Omit<CredentialsConfig<UserType>, "verifyEmailRoute"> & {
+    verifyEmailRoute: Route;
+}) => import("elysia/types").AddRoute<"", "local", import("elysia/types").DefaultSingleton, {
+    typebox: {};
+    error: [];
+}, import("elysia/types").DefaultMetadata, {} & import("elysia/types").CreateEden<import("elysia/types").JoinPath<"", Route>, {
+    post: {
+        body: {
+            token: string;
+        };
+        params: import("elysia/types").IsNever<keyof import("elysia/types").IntersectIfObject<import("elysia/types").ResolvePath<import("elysia/types").JoinPath<"", Route>>, unknown>> extends true ? import("elysia/types").ResolvePath<Route> : import("elysia/types").IntersectIfObject<import("elysia/types").ResolvePath<import("elysia/types").JoinPath<"", Route>>, unknown>;
+        query: unknown;
+        headers: unknown;
+        response: {
+            200: Response | import("..").StatusReturn;
+            422: {
+                type: "validation";
+                title: "Validation Error";
+                status: 422;
+                detail?: string;
+                on: string;
+                found?: unknown;
+                property?: string;
+                expected?: string;
+            };
+        };
+        error: never;
+    };
+}>, import("elysia/types").DefaultEphemeral, import("elysia/types").DefaultEphemeral, "post", `${Route}/request`, import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
+    body: import("typebox").TObject<{
+        email: import("typebox").TString;
+    }>;
+}, {}, import("elysia/types").JoinPath<"", `${Route}/request`>>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>, {}, ({ body: { email }, status }: {
+    body: {
+        email: string;
+    };
+    query: Record<string, string | undefined>;
+    params: undefined extends import("elysia/types").IntersectIfObject<import("elysia/types").ResolvePath<import("elysia/types").JoinPath<"", `${Route}/request`>>, unknown> ? Record<string, string> : import("elysia/types").IntersectIfObject<import("elysia/types").ResolvePath<import("elysia/types").JoinPath<"", `${Route}/request`>>, unknown> extends infer T ? T extends import("elysia/types").IntersectIfObject<import("elysia/types").ResolvePath<import("elysia/types").JoinPath<"", `${Route}/request`>>, unknown> ? T extends object ? { [K in keyof T]: T[K]; } : T : never : never;
+    headers: Record<string, string | undefined>;
+    cookie: Record<string, import("elysia").Cookie<unknown>>;
+    server: import("elysia").Server | null;
+    redirect: import("elysia").redirect;
+    set: {
+        headers: import("elysia").HTTPHeaders;
+        status?: number | keyof import("elysia").StatusMap;
+        cookie?: Record<string, import("elysia").BaseCookie>;
+    };
+    status: <const Code extends number | keyof import("elysia").StatusMap, const T_1 = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
+        readonly 100: "Continue";
+        readonly 101: "Switching Protocols";
+        readonly 102: "Processing";
+        readonly 103: "Early Hints";
+        readonly 200: "OK";
+        readonly 201: "Created";
+        readonly 202: "Accepted";
+        readonly 203: "Non-Authoritative Information";
+        readonly 204: "No Content";
+        readonly 205: "Reset Content";
+        readonly 206: "Partial Content";
+        readonly 207: "Multi-Status";
+        readonly 208: "Already Reported";
+        readonly 300: "Multiple Choices";
+        readonly 301: "Moved Permanently";
+        readonly 302: "Found";
+        readonly 303: "See Other";
+        readonly 304: "Not Modified";
+        readonly 307: "Temporary Redirect";
+        readonly 308: "Permanent Redirect";
+        readonly 400: "Bad Request";
+        readonly 401: "Unauthorized";
+        readonly 402: "Payment Required";
+        readonly 403: "Forbidden";
+        readonly 404: "Not Found";
+        readonly 405: "Method Not Allowed";
+        readonly 406: "Not Acceptable";
+        readonly 407: "Proxy Authentication Required";
+        readonly 408: "Request Timeout";
+        readonly 409: "Conflict";
+        readonly 410: "Gone";
+        readonly 411: "Length Required";
+        readonly 412: "Precondition Failed";
+        readonly 413: "Payload Too Large";
+        readonly 414: "URI Too Long";
+        readonly 415: "Unsupported Media Type";
+        readonly 416: "Range Not Satisfiable";
+        readonly 417: "Expectation Failed";
+        readonly 418: "I'm a teapot";
+        readonly 420: "Enhance Your Calm";
+        readonly 421: "Misdirected Request";
+        readonly 422: "Unprocessable Content";
+        readonly 423: "Locked";
+        readonly 424: "Failed Dependency";
+        readonly 425: "Too Early";
+        readonly 426: "Upgrade Required";
+        readonly 428: "Precondition Required";
+        readonly 429: "Too Many Requests";
+        readonly 431: "Request Header Fields Too Large";
+        readonly 451: "Unavailable For Legal Reasons";
+        readonly 500: "Internal Server Error";
+        readonly 501: "Not Implemented";
+        readonly 502: "Bad Gateway";
+        readonly 503: "Service Unavailable";
+        readonly 504: "Gateway Timeout";
+        readonly 505: "HTTP Version Not Supported";
+        readonly 506: "Variant Also Negotiates";
+        readonly 507: "Insufficient Storage";
+        readonly 508: "Loop Detected";
+        readonly 510: "Not Extended";
+        readonly 511: "Network Authentication Required";
+    }[Code] : Code>(code: Code, response?: T_1) => import("elysia").ElysiaStatus<Code, T_1, Code extends "Continue" | "Switching Protocols" | "Processing" | "Early Hints" | "OK" | "Created" | "Accepted" | "Non-Authoritative Information" | "No Content" | "Reset Content" | "Partial Content" | "Multi-Status" | "Already Reported" | "Multiple Choices" | "Moved Permanently" | "Found" | "See Other" | "Not Modified" | "Temporary Redirect" | "Permanent Redirect" | "Bad Request" | "Unauthorized" | "Payment Required" | "Forbidden" | "Not Found" | "Method Not Allowed" | "Not Acceptable" | "Proxy Authentication Required" | "Request Timeout" | "Conflict" | "Gone" | "Length Required" | "Precondition Failed" | "Payload Too Large" | "URI Too Long" | "Unsupported Media Type" | "Range Not Satisfiable" | "Expectation Failed" | "I'm a teapot" | "Enhance Your Calm" | "Misdirected Request" | "Unprocessable Content" | "Locked" | "Failed Dependency" | "Too Early" | "Upgrade Required" | "Precondition Required" | "Too Many Requests" | "Request Header Fields Too Large" | "Unavailable For Legal Reasons" | "Internal Server Error" | "Not Implemented" | "Bad Gateway" | "Service Unavailable" | "Gateway Timeout" | "HTTP Version Not Supported" | "Variant Also Negotiates" | "Insufficient Storage" | "Loop Detected" | "Not Extended" | "Network Authentication Required" ? {
+        readonly Continue: 100;
+        readonly "Switching Protocols": 101;
+        readonly Processing: 102;
+        readonly "Early Hints": 103;
+        readonly OK: 200;
+        readonly Created: 201;
+        readonly Accepted: 202;
+        readonly "Non-Authoritative Information": 203;
+        readonly "No Content": 204;
+        readonly "Reset Content": 205;
+        readonly "Partial Content": 206;
+        readonly "Multi-Status": 207;
+        readonly "Already Reported": 208;
+        readonly "Multiple Choices": 300;
+        readonly "Moved Permanently": 301;
+        readonly Found: 302;
+        readonly "See Other": 303;
+        readonly "Not Modified": 304;
+        readonly "Temporary Redirect": 307;
+        readonly "Permanent Redirect": 308;
+        readonly "Bad Request": 400;
+        readonly Unauthorized: 401;
+        readonly "Payment Required": 402;
+        readonly Forbidden: 403;
+        readonly "Not Found": 404;
+        readonly "Method Not Allowed": 405;
+        readonly "Not Acceptable": 406;
+        readonly "Proxy Authentication Required": 407;
+        readonly "Request Timeout": 408;
+        readonly Conflict: 409;
+        readonly Gone: 410;
+        readonly "Length Required": 411;
+        readonly "Precondition Failed": 412;
+        readonly "Payload Too Large": 413;
+        readonly "URI Too Long": 414;
+        readonly "Unsupported Media Type": 415;
+        readonly "Range Not Satisfiable": 416;
+        readonly "Expectation Failed": 417;
+        readonly "I'm a teapot": 418;
+        readonly "Enhance Your Calm": 420;
+        readonly "Misdirected Request": 421;
+        readonly "Unprocessable Content": 422;
+        readonly Locked: 423;
+        readonly "Failed Dependency": 424;
+        readonly "Too Early": 425;
+        readonly "Upgrade Required": 426;
+        readonly "Precondition Required": 428;
+        readonly "Too Many Requests": 429;
+        readonly "Request Header Fields Too Large": 431;
+        readonly "Unavailable For Legal Reasons": 451;
+        readonly "Internal Server Error": 500;
+        readonly "Not Implemented": 501;
+        readonly "Bad Gateway": 502;
+        readonly "Service Unavailable": 503;
+        readonly "Gateway Timeout": 504;
+        readonly "HTTP Version Not Supported": 505;
+        readonly "Variant Also Negotiates": 506;
+        readonly "Insufficient Storage": 507;
+        readonly "Loop Detected": 508;
+        readonly "Not Extended": 510;
+        readonly "Network Authentication Required": 511;
+    }[Code] : Code>;
+    defer: (fn: import("elysia/types").AfterResponseHandler<NoInfer<import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
+        body: import("typebox").TObject<{
+            email: import("typebox").TString;
+        }>;
+    }, {}, import("elysia/types").JoinPath<"", `${Route}/request`>>, import("elysia/types").MergeScopedSchemas<{}, {}, {}>>>, NoInfer<import("elysia/types").DefaultSingleton & {
+        derive: {};
+    }>>) => import("elysia/types").MaybePromise<void>;
+    readonly path: string;
+    route?: string | undefined;
+    rid?: string | undefined;
+    request: Request;
+    store: {};
+}) => Promise<import("elysia").ElysiaStatus<"OK", {
+    readonly status: "verification_requested";
+}, 200>>>;

package/dist/credentials/integration.d.ts

@@ -0,0 +1,3 @@
+/** Package-owned source recipe. Host bindings are explicit: no generated user
+ * database, placeholder mailer, secret value or in-memory production fallback. */
+export declare const credentialsIntegrationSource = "import { Elysia } from 'elysia';\nimport { createAuthContext, createCredentialsApi } from '@absolutejs/auth/server';\nimport { credentialsConfiguration } from './credentials.config';\n\nexport const credentialsApi = createCredentialsApi(credentialsConfiguration);\nexport const accountApi = new Elysia()\n  .use(createAuthContext({ authSessionStore: credentialsConfiguration.authSessionStore }))\n  .get('/api/account', ({ absoluteAuthStatus, status }) => {\n    if (!absoluteAuthStatus.user) return status(401, { error: 'Sign in required' });\n    return { user: absoluteAuthStatus.user };\n  });\n// Mount both subapps on the application server. Use auth without a credentials\n// block for OAuth/sign-out to avoid duplicate credential routes.\n// Browser: treaty<typeof credentialsApi>(origin).auth.login.post({email,password})\n// Execute that directly typed call in a React Query mutationFn.\n";