Changelog for shomei-core

All notable changes to shomei-core are documented here. This package adheres to the PVP and is versioned independently of the other Shōmei packages.

0.1.0.0 — 2026-08-24

Initial release. The transport-agnostic heart of the Shōmei authentication toolkit.

• Domain model for accounts, sessions, credentials, and audit events. The principal is a free-form, case-insensitive loginId with email as an optional attribute; email-first callers keep working because loginId defaults to the email when only an email is supplied.
• effectful port interfaces for every side effect — user, credential, session, refresh-token, one-time-token, role, service-account, OAuth client and authorization-code, MFA, passkey, and signing-key stores, plus the clock, token generator, audit publisher/reader, notifier, and breach checker — with an in-memory interpreter (Shomei.Test.InMemory) for tests.
• Account lifecycle workflows: signup, login, refresh, logout, email verification, and password reset/change. One-time token consumption and refresh-token rotation are compare-and-swap operations, and the write tails are made atomic by an AuthUnitOfWork port.
• Password policy with configurable rules, context-aware validation, an embedded common-password dictionary, and a PasswordBreached violation backed by a PasswordBreachChecker port.
• Authorization: a role registry, role-permission tables, expiring role grants, claims enrichment from the role catalog at every mint, and a reserved permissions claim.
• OAuth 2.0 / OpenID Connect: authorization-code, refresh, and client_credentials grants, ID tokens, database-backed service accounts, and the RFC 8693 token-exchange (delegation and impersonation) workflow with an act actor claim.
• Multi-factor authentication: RFC 6238 TOTP, recovery codes, and the WebAuthn passkey ceremony port for enrollment, step-up, and passwordless login.
• Abuse protection: brute-force account lockout and per-IP/per-account throttling. Absolute session expiry is enforced in refresh and token verification, and login is free of an account-enumeration timing oracle.