Changelog for shomei-servant

All notable changes to shomei-servant are documented here. This package adheres to the PVP and is versioned independently of the other Shōmei packages.

0.1.0.0 — 2026-08-24

Initial release. The HTTP layer of the Shōmei authentication toolkit.

• ShomeiAPI as a NamedRoutes record with typed MultiVerb results, organized by concept, covering signup, login, refresh, logout, email verification, password reset/change, MFA, passkeys, OAuth 2.0 and OpenID Connect, audit, and admin routes.
• Application routes live under /v1; the root keeps the health and readiness probes and the .well-known documents.
• Every error path returns an RFC 7807 problem+json envelope, backed by a documented error catalog.
• Enforcing auth combinators for guarding your own routes: Authenticated, RequireRole, RequireScope, and RequirePermission. Verification runs through Shomei.Workflow.verifyToken, so sessionCheckMode = VerifyTokenAndSession genuinely re-reads the session on every request.
• Cookie token transport with CSRF defenses, alongside bearer tokens.
• OAuth/OIDC endpoints: discovery, authorize, token (authorization code, refresh, client_credentials, and RFC 8693 token exchange), userinfo, introspect, and revoke.
• An OpenAPI 3.1 document generated from the same types, served at /openapi.json and emitted by the shomei-openapi executable, with a conformance test suite.