@jskit-ai/auth-provider-local-core 0.1.60 → 0.1.61

package/package.json

@@ -1,18 +1,17 @@
 {
   "name": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.60",
+  "version": "0.1.61",
   "type": "module",
   "scripts": {
     "test": "node --test"
   },
   "exports": {
-    "./server/providers/AuthLocalServiceProvider": "./src/server/providers/AuthLocalServiceProvider.js",
-    "./server/providers/AuthProviderServiceProvider": "./src/server/providers/AuthProviderServiceProvider.js",
+    "./server/providers/AuthLocalProvider": "./src/server/providers/AuthLocalProvider.js",
     "./server/lib/index": "./src/server/lib/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.157",
-    "@jskit-ai/kernel": "0.1.159",
+    "@jskit-ai/auth-core": "0.1.158",
+    "@jskit-ai/kernel": "0.1.160",
     "nodemailer": "^9.0.3"
   },
   "description": "Local auth provider with a file backend default and no database requirement.",
@@ -20,24 +19,22 @@
     "kind": "runtime",
     "capabilities": {
       "provides": [
-        "auth.provider.local",
-        "auth.provider"
+        "auth.service"
       ],
       "requires": [
-        "auth.access"
+        "auth.extensions",
+        "runtime.app-root",
+        "runtime.env",
+        "runtime.logger"
       ]
     },
     "runtime": {
       "server": {
-        "providerEntrypoint": "src/server/providers/AuthLocalServiceProvider.js",
+        "providerEntrypoint": "src/server/providers/AuthLocalProvider.js",
         "providers": [
           {
-            "entrypoint": "src/server/providers/AuthLocalServiceProvider.js",
-            "export": "AuthLocalServiceProvider"
-          },
-          {
-            "entrypoint": "src/server/providers/AuthProviderServiceProvider.js",
-            "export": "AuthProviderServiceProvider"
+            "entrypoint": "src/server/providers/AuthLocalProvider.js",
+            "export": "AuthLocalProvider"
           }
         ]
       }
@@ -46,76 +43,21 @@
       "apiSummary": {
         "surfaces": [
           {
-            "subpath": "./server/providers/AuthLocalServiceProvider",
-            "summary": "Exports the local auth provider service provider."
+            "subpath": "./server/providers/AuthLocalProvider",
+            "summary": "Provides the selected local authentication service through explicit runtime capabilities."
           },
           {
             "subpath": "./server/lib/index",
             "summary": "Exports local auth service, file backend helpers, password strategy helpers, and local auth register hook decorators."
           }
         ],
-        "containerTokens": {
-          "server": [
-            "authService",
-            "auth.local.backend",
-            "auth.local.passwordStrategy"
-          ],
-          "client": []
-        }
+        "extensionCapabilities": [
+          "auth.invitation-context",
+          "auth.local.backend",
+          "auth.local.password-strategy",
+          "auth.profile.projector"
+        ]
       }
-    },
-    "ci": {
-      "environment": {
-        "AUTH_PROVIDER": "local"
-      },
-      "services": [],
-      "steps": []
-    },
-    "mutations": {
-      "dependencies": {
-        "runtime": {
-          "@jskit-ai/auth-core": "0.1.157",
-          "@jskit-ai/kernel": "0.1.159",
-          "nodemailer": "^9.0.3",
-          "dotenv": "^16.4.5"
-        },
-        "dev": {}
-      },
-      "packageJson": {
-        "scripts": {}
-      },
-      "procfile": {},
-      "files": [],
-      "text": [
-        {
-          "file": ".env",
-          "op": "upsert-env",
-          "key": "AUTH_PROVIDER",
-          "value": "local",
-          "reason": "Select local auth as the auth provider.",
-          "category": "runtime-config",
-          "id": "auth-provider"
-        },
-        {
-          "file": ".env",
-          "op": "upsert-env",
-          "key": "AUTH_LOCAL_BACKEND",
-          "value": "file",
-          "reason": "Use the built-in local file auth backend.",
-          "category": "runtime-config",
-          "id": "auth-local-backend"
-        },
-        {
-          "file": ".gitignore",
-          "op": "append-text",
-          "position": "bottom",
-          "skipIfContains": ".jskit/auth/",
-          "value": "\n.jskit/auth/\n",
-          "reason": "Ignore local auth runtime state.",
-          "category": "runtime-state",
-          "id": "auth-local-store-gitignore"
-        }
-      ]
     }
   }
 }

package/src/server/providers/AuthLocalProvider.js

@@ -0,0 +1,129 @@
+import { parseBooleanFlag } from "@jskit-ai/auth-core/server/booleanFlag";
+import { assertDevAuthPolicy, resolveDevAuthPolicyFromEnv } from "@jskit-ai/auth-core/server/devAuth";
+import {
+  attachDeferredAuthService,
+  createDeferredAuthService
+} from "@jskit-ai/auth-core/server/deferredAuthService";
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { createLocalFileBackend } from "../lib/fileBackend.js";
+import { createLocalAuthService } from "../lib/service.js";
+
+const DEFAULT_STORE_DIR = ".jskit/auth";
+function resolveStoreDir(env, appRoot) {
+  const configured = String(env.AUTH_LOCAL_STORE_DIR || DEFAULT_STORE_DIR).trim() || DEFAULT_STORE_DIR;
+  return path.resolve(appRoot, configured);
+}
+
+function resolveSessionSecret(env, { storeDir, isProduction }) {
+  const explicit = String(env.AUTH_LOCAL_SESSION_SECRET || "").trim();
+  if (explicit) return explicit;
+  if (isProduction) throw new Error("AUTH_LOCAL_SESSION_SECRET is required for local auth in production.");
+
+  const secretPath = path.join(storeDir, "session.secret");
+  try {
+    const existing = fs.readFileSync(secretPath, "utf8").trim();
+    if (existing) return existing;
+  } catch (error) {
+    if (!error || error.code !== "ENOENT") throw error;
+  }
+  fs.mkdirSync(storeDir, { recursive: true, mode: 0o700 });
+  const generated = randomBytes(32).toString("base64url");
+  fs.writeFileSync(secretPath, `${generated}\n`, { mode: 0o600 });
+  return generated;
+}
+
+function resolveSmtpConfig(env) {
+  const host = String(env.AUTH_LOCAL_SMTP_HOST || "").trim();
+  if (!host) return { smtpConfigured: false, smtp: null };
+  const from = String(env.AUTH_LOCAL_SMTP_FROM || "").trim();
+  if (!from) throw new Error("AUTH_LOCAL_SMTP_FROM is required when AUTH_LOCAL_SMTP_HOST is set.");
+  return {
+    smtpConfigured: true,
+    smtp: {
+      host,
+      port: Number(env.AUTH_LOCAL_SMTP_PORT || 587),
+      secure: parseBooleanFlag(env.AUTH_LOCAL_SMTP_SECURE, false),
+      user: String(env.AUTH_LOCAL_SMTP_USER || "").trim(),
+      password: String(env.AUTH_LOCAL_SMTP_PASSWORD || ""),
+      from,
+      replyTo: String(env.AUTH_LOCAL_SMTP_REPLY_TO || "").trim()
+    }
+  };
+}
+
+function resolveAppPublicUrl(env, { smtpConfigured }) {
+  const configured = String(env.APP_PUBLIC_URL || "").trim();
+  if (!configured) {
+    if (smtpConfigured) throw new Error("APP_PUBLIC_URL is required when local auth SMTP recovery is configured.");
+    return "http://localhost:5173";
+  }
+  let parsed;
+  try {
+    parsed = new URL(configured);
+  } catch {
+    throw new Error("APP_PUBLIC_URL must be a valid URL when local auth SMTP recovery is configured.");
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error("APP_PUBLIC_URL must use http or https when local auth SMTP recovery is configured.");
+  }
+  return parsed.toString().replace(/\/$/u, "");
+}
+
+function resolveConfig({ appRoot, backend, env, logger }) {
+  const nodeEnv = String(env.NODE_ENV || "development").trim() || "development";
+  const isProduction = nodeEnv === "production";
+  const storeDir = resolveStoreDir(env, appRoot);
+  if (!backend && isProduction && !parseBooleanFlag(env.AUTH_LOCAL_FILE_PRODUCTION_ACK, false)) {
+    throw new Error("AUTH_LOCAL_FILE_PRODUCTION_ACK is required to use the local file auth backend in production.");
+  }
+  const smtp = resolveSmtpConfig(env);
+  const devAuth = resolveDevAuthPolicyFromEnv(env);
+  assertDevAuthPolicy(devAuth);
+  return {
+    storeDir,
+    nodeEnv,
+    logger,
+    appPublicUrl: resolveAppPublicUrl(env, smtp),
+    sessionSecret: resolveSessionSecret(env, { storeDir, isProduction }),
+    recoveryDevOutput: String(env.AUTH_LOCAL_RECOVERY_DEV_OUTPUT || "log").trim().toLowerCase() || "log",
+    devAuth,
+    ...smtp
+  };
+}
+
+const AuthLocalProvider = defineProvider({
+  id: "auth.local",
+  requires: {
+    appRoot: "runtime.app-root",
+    env: "runtime.env",
+    extensions: "auth.extensions",
+    logger: "runtime.logger"
+  },
+  optional: {
+    backend: "auth.local.backend",
+    passwordStrategy: "auth.local.password-strategy"
+  },
+  provides: {
+    authService: "auth.service"
+  },
+  setup() {
+    return { authService: createDeferredAuthService() };
+  },
+  boot(dependencies, { outputs }) {
+    const { appRoot, backend, env, extensions, logger, passwordStrategy } = dependencies;
+    const config = resolveConfig({ appRoot, backend, env, logger });
+    const baseService = createLocalAuthService({
+      backend: backend || createLocalFileBackend({ storeDir: config.storeDir }),
+      config,
+      profileProjector: extensions.resolveProfileProjector(),
+      passwordStrategy,
+      invitationContextResolver: extensions.resolveInvitationContextResolver()
+    });
+    attachDeferredAuthService(outputs.authService, extensions.decorateService(baseService));
+  }
+});
+
+export { AuthLocalProvider, resolveConfig };

package/test/packageMetadata.test.js

@@ -1,25 +1,14 @@
 import assert from "node:assert/strict";
-import { readFile } from "node:fs/promises";
 import test from "node:test";
 import packageJson from "../package.json" with { type: "json" };
 
 const packageMetadata = packageJson.jskit;
 
-test("local auth contributes only its provider selection to CI", () => {
-  assert.deepEqual(packageMetadata.ci, {
-    environment: {
-      AUTH_PROVIDER: "local"
-    },
-    services: [],
-    steps: []
-  });
+test("local auth has no package mutation or CI recipe", () => {
+  assert.equal(Object.hasOwn(packageMetadata, "ci"), false);
+  assert.equal(Object.hasOwn(packageMetadata, "mutations"), false);
 });
 
-test("local auth scaffolds the Nodemailer version used by the package", async () => {
-  const packageJson = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
-
-  assert.equal(
-    packageMetadata.mutations.dependencies.runtime.nodemailer,
-    packageJson.dependencies.nodemailer
-  );
+test("local auth declares Nodemailer as its own runtime dependency", () => {
+  assert.equal(typeof packageJson.dependencies.nodemailer, "string");
 });

package/test/providerRuntime.test.js

@@ -3,13 +3,12 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
-import { createApplication } from "@jskit-ai/kernel/_testable";
-import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
-import { registerAuthServiceDecorator } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
+import { createActionProvider } from "@jskit-ai/kernel/server/actions";
+import { createCapabilityRuntime, defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { createAuthExtensions } from "@jskit-ai/auth-core/server/authExtensions";
 import { DEV_AUTH_SECRET_HEADER } from "@jskit-ai/auth-core/server/devAuth";
-import { AuthActionsServiceProvider } from "@jskit-ai/auth-core/server/providers/AuthActionsServiceProvider";
-import { AuthLocalServiceProvider } from "../src/server/providers/AuthLocalServiceProvider.js";
-import { AuthProviderServiceProvider } from "../src/server/providers/AuthProviderServiceProvider.js";
+import { AuthFeature } from "@jskit-ai/auth-core/server/providers/AuthFeature";
+import { AuthLocalProvider } from "../src/server/providers/AuthLocalProvider.js";
 import {
   createLocalAuthRegisterHookDecorator,
   createLocalAuthService,
@@ -21,23 +20,6 @@ import {
 
 const DEV_AUTH_SECRET = "local-preview-exchange-secret";
 
-function createAppConfigFixture() {
-  return {
-    surfaceModeAll: "all",
-    surfaceDefaultId: "home",
-    surfaceDefinitions: {
-      home: { id: "home", pagesRoot: "", enabled: true, requiresAuth: false, requiresWorkspace: false },
-      console: {
-        id: "console",
-        pagesRoot: "console",
-        enabled: true,
-        requiresAuth: true,
-        requiresWorkspace: false
-      }
-    }
-  };
-}
-
 function createReplyFixture() {
   const cookies = {};
   const cookieOptions = {};
@@ -94,67 +76,82 @@ function devAuthEnv() {
 async function createStartedApp({
   env = {},
   profileProjector = null,
-  profileProjectorFactory = null,
   passwordStrategy = null,
   invitationContextResolver = null,
   logger = null,
-  configureApp = null
+  configureExtensions = null
 } = {}) {
   const storeDir = await fs.mkdtemp(path.join(os.tmpdir(), "jskit-auth-local-"));
-  const app = createApplication();
-  app.instance("appConfig", createAppConfigFixture());
-  app.instance("jskit.env", {
-    AUTH_PROVIDER: "local",
+  const backend = createLocalFileBackend({ storeDir });
+  const extensions = createAuthExtensions();
+  const runtimeLogger = logger || {
+    info() {},
+    warn() {},
+    error() {},
+    debug() {}
+  };
+  if (typeof configureExtensions === "function") configureExtensions(extensions, runtimeLogger);
+  if (profileProjector) {
+    extensions.registerProfileProjector({
+      projectorId: "test.profile",
+      ...profileProjector
+    });
+  }
+  if (invitationContextResolver) {
+    extensions.registerInvitationContextResolver({
+      resolverId: "test.invitation",
+      ...invitationContextResolver
+    });
+  }
+  let authService = null;
+  let actionExecutor = null;
+  const probe = defineProvider({
+    id: "test.auth.probe",
+    requires: {
+      actions: "runtime.actions",
+      service: "auth.service"
+    },
+    setup({ actions, service }) {
+      actionExecutor = actions;
+      authService = service;
+      return {};
+    }
+  });
+  const inputs = {
+    "runtime.app-root": storeDir,
+    "runtime.env": {
     AUTH_LOCAL_STORE_DIR: storeDir,
     AUTH_LOCAL_RECOVERY_DEV_OUTPUT: "response",
     APP_PUBLIC_URL: "http://localhost:5173",
     NODE_ENV: "test",
     ...env
-  });
-  app.instance(
-    "jskit.logger",
-    logger || {
-      info() {},
-      warn() {},
-      error() {},
-      debug() {}
-    }
-  );
-  app.instance("domainEvents", {
-    async publish() {}
-  });
-  if (profileProjector) {
-    app.instance("auth.profile.projector", profileProjector);
-  }
-  if (profileProjectorFactory) {
-    app.singleton("auth.profile.projector", profileProjectorFactory);
-  }
-  if (passwordStrategy) {
-    app.instance("auth.local.passwordStrategy", passwordStrategy);
-  }
-  if (invitationContextResolver) {
-    app.instance("auth.invitationContextResolver", invitationContextResolver);
-  }
-  if (typeof configureApp === "function") {
-    configureApp(app);
-  }
-  await app.start({
+    },
+    "runtime.logger": runtimeLogger,
+    "auth.extensions": extensions,
+    "auth.local.backend": backend,
+    ...(passwordStrategy ? { "auth.local.password-strategy": passwordStrategy } : {}),
+  };
+  const runtime = createCapabilityRuntime({
+    inputs,
     providers: [
-      ActionRuntimeServiceProvider,
-      AuthLocalServiceProvider,
-      AuthProviderServiceProvider,
-      AuthActionsServiceProvider
+      createActionProvider(),
+      AuthLocalProvider,
+      AuthFeature,
+      probe
     ]
   });
+  await runtime.start();
   return {
-    app,
+    actionExecutor,
+    authService,
+    backend,
+    runtime,
     storeDir
   };
 }
 
 test("local auth provider registers, logs in, reads session, and logs out with file backend", async () => {
-  const { app, storeDir } = await createStartedApp();
-  const authService = app.make("authService");
+  const { actionExecutor, authService, storeDir } = await createStartedApp();
   const capabilities = authService.getCapabilities();
   assert.equal(capabilities.provider.id, "local");
   assert.equal(capabilities.features.password.login, true);
@@ -178,7 +175,6 @@ test("local auth provider registers, logs in, reads session, and logs out with f
   assert.equal(session.authenticated, true);
   assert.equal(session.actor.email, "ada@example.com");
 
-  const actionExecutor = app.make("actionExecutor");
   const definitions = actionExecutor.listDefinitions();
   assert.equal(definitions.some((definition) => definition.id === "auth.login.password"), true);
   const actionSession = await actionExecutor.execute({
@@ -204,10 +200,9 @@ test("local auth provider registers, logs in, reads session, and logs out with f
 });
 
 test("local file auth login-as issues native cookies for an existing user", async () => {
-  const { app } = await createStartedApp({
+  const { authService } = await createStartedApp({
     env: devAuthEnv()
   });
-  const authService = app.make("authService");
   await authService.register({
     displayName: "Ada",
     email: "ada@example.com",
@@ -244,7 +239,7 @@ test("local login-as never invokes the mutating profile projector", async () =>
   };
   let findCalls = 0;
   let syncCalls = 0;
-  const { app } = await createStartedApp({
+  const { authService } = await createStartedApp({
     env: devAuthEnv(),
     profileProjector: {
       async findByIdentity() {
@@ -260,7 +255,6 @@ test("local login-as never invokes the mutating profile projector", async () =>
       }
     }
   });
-  const authService = app.make("authService");
   const registered = await authService.register({
     displayName: "Ada",
     email: "ada@example.com",
@@ -286,7 +280,7 @@ test("local login-as never invokes the mutating profile projector", async () =>
 });
 
 test("local login-as rejects missing, disabled, and unprojected users", async () => {
-  const { app } = await createStartedApp({
+  const { authService, backend } = await createStartedApp({
     env: devAuthEnv(),
     profileProjector: {
       async findByIdentity() {
@@ -297,7 +291,6 @@ test("local login-as rejects missing, disabled, and unprojected users", async ()
       }
     }
   });
-  const backend = app.make("auth.local.backend");
   const password = await hashPassword("stored password value");
   await backend.withTransaction(async (tx) => {
     await tx.users.create({
@@ -315,7 +308,6 @@ test("local login-as rejects missing, disabled, and unprojected users", async ()
       password
     });
   });
-  const authService = app.make("authService");
 
   for (const email of [
     "missing@example.com",
@@ -330,10 +322,9 @@ test("local login-as rejects missing, disabled, and unprojected users", async ()
 });
 
 test("local login-as rejects missing, incorrect, and non-loopback exchange authorization", async () => {
-  const { app } = await createStartedApp({
+  const { authService } = await createStartedApp({
     env: devAuthEnv()
   });
-  const authService = app.make("authService");
   await authService.register({
     displayName: "Ada",
     email: "ada@example.com",
@@ -379,7 +370,7 @@ test("local auth provider rejects dev login-as enablement in production", async
 test("local auth provider applies auth service decorators for blocking and non-blocking hooks", async () => {
   const calls = [];
   const errors = [];
-  const { app } = await createStartedApp({
+  const { authService } = await createStartedApp({
     logger: {
       info() {},
       warn(payload, message) {
@@ -388,12 +379,11 @@ test("local auth provider applies auth service decorators for blocking and non-b
       error() {},
       debug() {}
     },
-    configureApp(app) {
-      registerAuthServiceDecorator(app, "test.auth.local.nonBlockingHook", (scope) => ({
-        ...createLocalAuthRegisterHookDecorator({
+    configureExtensions(extensions, runtimeLogger) {
+      extensions.registerServiceDecorator(createLocalAuthRegisterHookDecorator({
           decoratorId: "test.auth.local.nonBlockingHook",
           order: 20,
-          logger: scope.make("jskit.logger"),
+          logger: runtimeLogger,
           hook: {
             hookId: "audit",
             blocking: false,
@@ -402,10 +392,8 @@ test("local auth provider applies auth service decorators for blocking and non-b
               throw new Error("audit unavailable");
             }
           }
-        })
-      }));
-      registerAuthServiceDecorator(app, "test.auth.local.blockingHook", () =>
-        createLocalAuthRegisterHookDecorator({
+        }));
+      extensions.registerServiceDecorator(createLocalAuthRegisterHookDecorator({
           decoratorId: "test.auth.local.blockingHook",
           order: 10,
           hook: {
@@ -418,11 +406,9 @@ test("local auth provider applies auth service decorators for blocking and non-b
               }
             }
           }
-        })
-      );
+        }));
     }
   });
-  const authService = app.make("authService");
 
   const registered = await authService.register({
     email: "hooks@example.com",
@@ -472,7 +458,7 @@ test("local auth register hook decorators require explicit blocking mode", () =>
   );
 });
 
-test("local auth provider resolves a custom password strategy from the container", async () => {
+test("local auth provider accepts a custom password strategy capability", async () => {
   const passwordStrategy = {
     prefix: "strategy",
     async hashPassword(password) {
@@ -487,8 +473,7 @@ test("local auth provider resolves a custom password strategy from the container
       return record?.algorithm === "test-password" && record?.hash === `${this.prefix}-${password}`;
     }
   };
-  const { app } = await createStartedApp({ passwordStrategy });
-  const authService = app.make("authService");
+  const { authService } = await createStartedApp({ passwordStrategy });
 
   await authService.register({
     email: "strategy@example.com",
@@ -751,8 +736,7 @@ test("local auth password strategy handles register, reset, login, and change pa
       );
     }
   };
-  const { app } = await createStartedApp({ passwordStrategy });
-  const authService = app.make("authService");
+  const { authService } = await createStartedApp({ passwordStrategy });
 
   await authService.register({
     email: "strategy-paths@example.com",
@@ -817,8 +801,7 @@ test("local auth password strategy handles register, reset, login, and change pa
 });
 
 test("local auth provider completes recovery through a recovery-scoped session", async () => {
-  const { app } = await createStartedApp();
-  const authService = app.make("authService");
+  const { authService } = await createStartedApp();
   await authService.register({
     email: "Recovery@example.com",
     password: "correct horse battery staple",
@@ -890,8 +873,7 @@ test("local auth provider completes recovery through a recovery-scoped session",
 });
 
 test("local auth reset invalidates other outstanding recovery tokens for the user", async () => {
-  const { app } = await createStartedApp();
-  const authService = app.make("authService");
+  const { authService } = await createStartedApp();
   await authService.register({
     email: "recovery-tokens@example.com",
     password: "correct horse battery staple",
@@ -933,8 +915,7 @@ test("local auth reset invalidates other outstanding recovery tokens for the use
 });
 
 test("local auth provider changes password through the account-security contract", async () => {
-  const { app } = await createStartedApp();
-  const authService = app.make("authService");
+  const { authService } = await createStartedApp();
   const registered = await authService.register({
     email: "Security@example.com",
     password: "correct horse battery staple",
@@ -982,36 +963,9 @@ test("local auth provider changes password through the account-security contract
   assert.equal(login.actor.email, "security@example.com");
 });
 
-test("local auth provider defers profile projector resolution until projection is needed", async () => {
-  let projectorFactoryCalls = 0;
-  const { app } = await createStartedApp({
-    profileProjectorFactory() {
-      projectorFactoryCalls += 1;
-      return {
-        async syncIdentityProfile(profile) {
-          return {
-            ...profile,
-            id: "projected-user",
-            profileSource: "users"
-          };
-        }
-      };
-    }
-  });
-  assert.equal(projectorFactoryCalls, 0);
-  const authService = app.make("authService");
-  assert.equal(projectorFactoryCalls, 0);
-  const registered = await authService.register({
-    email: "projected@example.com",
-    password: "correct horse battery staple",
-    displayName: "Projected User"
-  });
-  assert.equal(projectorFactoryCalls, 1);
-  assert.equal(registered.actor.appUserId, "projected-user");
-});
 test("local auth provider projects app profile when auth.profile.projector is installed", async () => {
   const projectedProfiles = [];
-  const { app } = await createStartedApp({
+  const { authService } = await createStartedApp({
     profileProjector: {
       async syncIdentityProfile(profile) {
         projectedProfiles.push(profile);
@@ -1023,7 +977,6 @@ test("local auth provider projects app profile when auth.profile.projector is in
       }
     }
   });
-  const authService = app.make("authService");
   assert.equal(authService.getCapabilities().features.appProfileProjection, true);
 
   const registered = await authService.register({
@@ -1041,7 +994,7 @@ test("local auth provider projects app profile when auth.profile.projector is in
 test("local auth provider passes resolved invitation context into profile projection during registration", async () => {
   const resolverCalls = [];
   const projectionCalls = [];
-  const { app } = await createStartedApp({
+  const { authService } = await createStartedApp({
     invitationContextResolver: {
       async resolveInvitationContext(invitation) {
         resolverCalls.push(invitation);
@@ -1067,7 +1020,6 @@ test("local auth provider passes resolved invitation context into profile projec
       }
     }
   });
-  const authService = app.make("authService");
 
   const registered = await authService.register({
     email: "Invitee@Example.com",
@@ -1103,44 +1055,16 @@ test("local auth provider passes resolved invitation context into profile projec
   assert.equal(registered.actor.appUserId, "invited-app-user");
 });
 
-test("local auth provider rejects AUTH_PROVIDER mismatches", async () => {
-  const app = createApplication();
-  app.instance("appConfig", createAppConfigFixture());
-  app.instance("jskit.env", {
-    AUTH_PROVIDER: "supabase",
-    NODE_ENV: "test"
-  });
-
-  await assert.rejects(
-    () =>
-      app.start({
-        providers: [ActionRuntimeServiceProvider, AuthLocalServiceProvider]
-      }),
-    (error) => /AUTH_PROVIDER is "supabase"/.test(String(error.details?.cause?.message || error.message || ""))
-  );
-});
-
 test("local auth provider requires an explicit public URL for SMTP recovery", async () => {
-  const storeDir = await fs.mkdtemp(path.join(os.tmpdir(), "jskit-auth-local-"));
-  const app = createApplication();
-  app.instance("appConfig", createAppConfigFixture());
-  app.instance("jskit.env", {
-    AUTH_PROVIDER: "local",
-    AUTH_LOCAL_STORE_DIR: storeDir,
-    AUTH_LOCAL_SMTP_HOST: "smtp.example.com",
-    AUTH_LOCAL_SMTP_FROM: "support@example.com",
-    NODE_ENV: "test"
-  });
-
   await assert.rejects(
-    () =>
-      app.start({
-        providers: [ActionRuntimeServiceProvider, AuthLocalServiceProvider]
-      }),
-    (error) =>
-      /APP_PUBLIC_URL is required when local auth SMTP recovery is configured/.test(
-        String(error.details?.cause?.message || error.message || "")
-      )
+    () => createStartedApp({
+      env: {
+        APP_PUBLIC_URL: "",
+        AUTH_LOCAL_SMTP_HOST: "smtp.example.com",
+        AUTH_LOCAL_SMTP_FROM: "support@example.com"
+      }
+    }),
+    /APP_PUBLIC_URL is required when local auth SMTP recovery is configured/
   );
 });
 

package/src/server/providers/AuthLocalServiceProvider.js

@@ -1,233 +0,0 @@
-import { applyAuthServiceDecorators } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
-import { parseBooleanFlag } from "@jskit-ai/auth-core/server/booleanFlag";
-import {
-  assertDevAuthPolicy,
-  resolveDevAuthPolicyFromEnv
-} from "@jskit-ai/auth-core/server/devAuth";
-import fs from "node:fs";
-import path from "node:path";
-import { randomBytes } from "node:crypto";
-import { createLocalAuthService } from "../lib/service.js";
-import { createLocalFileBackend } from "../lib/fileBackend.js";
-
-const DEFAULT_STORE_DIR = ".jskit/auth";
-
-function resolveLocalBackendMode(scope) {
-  const env = resolveRuntimeEnv(scope);
-  return String(env.AUTH_LOCAL_BACKEND || "file").trim().toLowerCase() || "file";
-}
-
-function resolveRuntimeEnv(scope) {
-  const env = scope && typeof scope.has === "function" && scope.has("jskit.env") ? scope.make("jskit.env") : {};
-  return {
-    ...process.env,
-    ...(env && typeof env === "object" ? env : {})
-  };
-}
-
-function assertSelectedAuthProvider(env) {
-  const selectedProvider = String(env?.AUTH_PROVIDER || "").trim().toLowerCase();
-  if (selectedProvider && selectedProvider !== "local") {
-    throw new Error(
-      `AUTH_PROVIDER is "${selectedProvider}", but @jskit-ai/auth-provider-local-core is installed as the selected auth provider.`
-    );
-  }
-}
-
-function resolveStoreDir(env) {
-  return path.resolve(String(env.AUTH_LOCAL_STORE_DIR || DEFAULT_STORE_DIR).trim() || DEFAULT_STORE_DIR);
-}
-
-function resolveSessionSecret(env, { storeDir, isProduction }) {
-  const explicit = String(env.AUTH_LOCAL_SESSION_SECRET || "").trim();
-  if (explicit) {
-    return explicit;
-  }
-  if (isProduction) {
-    throw new Error("AUTH_LOCAL_SESSION_SECRET is required for local auth in production.");
-  }
-
-  const secretPath = path.join(storeDir, "session.secret");
-  try {
-    const existing = fs.readFileSync(secretPath, "utf8").trim();
-    if (existing) {
-      return existing;
-    }
-  } catch (error) {
-    if (!error || error.code !== "ENOENT") {
-      throw error;
-    }
-  }
-
-  fs.mkdirSync(storeDir, { recursive: true, mode: 0o700 });
-  const generated = randomBytes(32).toString("base64url");
-  fs.writeFileSync(secretPath, `${generated}\n`, { mode: 0o600 });
-  return generated;
-}
-
-function resolveSmtpConfig(env) {
-  const host = String(env.AUTH_LOCAL_SMTP_HOST || "").trim();
-  if (!host) {
-    return {
-      smtpConfigured: false,
-      smtp: null
-    };
-  }
-  const from = String(env.AUTH_LOCAL_SMTP_FROM || "").trim();
-  if (!from) {
-    throw new Error("AUTH_LOCAL_SMTP_FROM is required when AUTH_LOCAL_SMTP_HOST is set.");
-  }
-  return {
-    smtpConfigured: true,
-    smtp: {
-      host,
-      port: Number(env.AUTH_LOCAL_SMTP_PORT || 587),
-      secure: parseBooleanFlag(env.AUTH_LOCAL_SMTP_SECURE, false),
-      user: String(env.AUTH_LOCAL_SMTP_USER || "").trim(),
-      password: String(env.AUTH_LOCAL_SMTP_PASSWORD || ""),
-      from,
-      replyTo: String(env.AUTH_LOCAL_SMTP_REPLY_TO || "").trim()
-    }
-  };
-}
-
-function resolveAppPublicUrl(env, { smtpConfigured }) {
-  const configured = String(env.APP_PUBLIC_URL || "").trim();
-  if (!configured) {
-    if (smtpConfigured) {
-      throw new Error("APP_PUBLIC_URL is required when local auth SMTP recovery is configured.");
-    }
-    return "http://localhost:5173";
-  }
-
-  let parsed;
-  try {
-    parsed = new URL(configured);
-  } catch {
-    throw new Error("APP_PUBLIC_URL must be a valid URL when local auth SMTP recovery is configured.");
-  }
-
-  if (!["http:", "https:"].includes(parsed.protocol)) {
-    throw new Error("APP_PUBLIC_URL must use http or https when local auth SMTP recovery is configured.");
-  }
-
-  return parsed.toString().replace(/\/$/, "");
-}
-
-function resolveConfig(scope) {
-  const env = resolveRuntimeEnv(scope);
-  assertSelectedAuthProvider(env);
-  const nodeEnv = String(env.NODE_ENV || "development").trim() || "development";
-  const isProduction = nodeEnv === "production";
-  const backend = String(env.AUTH_LOCAL_BACKEND || "file").trim().toLowerCase() || "file";
-  const storeDir = resolveStoreDir(env);
-  if (backend === "file" && isProduction && !parseBooleanFlag(env.AUTH_LOCAL_FILE_PRODUCTION_ACK, false)) {
-    throw new Error("AUTH_LOCAL_FILE_PRODUCTION_ACK is required to use the local file auth backend in production.");
-  }
-  const smtp = resolveSmtpConfig(env);
-  const devAuth = resolveDevAuthPolicyFromEnv(env);
-  assertDevAuthPolicy(devAuth);
-  return {
-    backend,
-    storeDir,
-    nodeEnv,
-    logger: scope.has("jskit.logger") ? scope.make("jskit.logger") : console,
-    appPublicUrl: resolveAppPublicUrl(env, smtp),
-    sessionSecret: resolveSessionSecret(env, {
-      storeDir,
-      isProduction
-    }),
-    recoveryDevOutput: String(env.AUTH_LOCAL_RECOVERY_DEV_OUTPUT || "log").trim().toLowerCase() || "log",
-    devAuth,
-    ...smtp
-  };
-}
-
-function createLazyProfileProjector(scope) {
-  if (!scope.has("auth.profile.projector")) {
-    return null;
-  }
-  const resolveMethod = (methodName) => {
-    const projector = scope.make("auth.profile.projector");
-    if (!projector || typeof projector[methodName] !== "function") {
-      throw new Error(`auth.profile.projector.${methodName}() must be a function.`);
-    }
-    return projector[methodName].bind(projector);
-  };
-  return {
-    findByIdentity(identity, options = {}) {
-      return resolveMethod("findByIdentity")(identity, options);
-    },
-    syncIdentityProfile(profile, options = {}) {
-      return resolveMethod("syncIdentityProfile")(profile, options);
-    }
-  };
-}
-
-class AuthLocalServiceProvider {
-  static id = "auth.provider.local";
-
-  register(app) {
-    if (!app || typeof app.singleton !== "function" || typeof app.has !== "function") {
-      throw new Error("AuthLocalServiceProvider requires application singleton()/has().");
-    }
-
-    assertSelectedAuthProvider(resolveRuntimeEnv(app));
-
-    if (app.has("authService")) {
-      throw new Error("AuthLocalServiceProvider cannot register authService because another auth provider already registered it.");
-    }
-
-    if (!app.has("auth.local.backend") && resolveLocalBackendMode(app) === "file") {
-      app.singleton("auth.local.backend", (scope) => {
-        const config = resolveConfig(scope);
-        return createLocalFileBackend({
-          storeDir: config.storeDir
-        });
-      });
-    }
-
-    app.singleton("authService", (scope) => {
-      const config = resolveConfig(scope);
-      if (!scope.has("auth.local.backend")) {
-        throw new Error(`AUTH_LOCAL_BACKEND="${config.backend}" requires a package or app provider that registers auth.local.backend.`);
-      }
-      const backend = scope.make("auth.local.backend");
-      const profileProjector = createLazyProfileProjector(scope);
-      const invitationContextResolver = scope.has("auth.invitationContextResolver")
-        ? {
-            async resolveInvitationContext(invitation, options = {}) {
-              const resolver = scope.make("auth.invitationContextResolver");
-              if (typeof resolver === "function") {
-                return resolver(invitation, options);
-              }
-              if (!resolver || typeof resolver.resolveInvitationContext !== "function") {
-                throw new Error("auth.invitationContextResolver.resolveInvitationContext() must be a function.");
-              }
-              return resolver.resolveInvitationContext(invitation, options);
-            }
-          }
-        : null;
-      const passwordStrategy = scope.has("auth.local.passwordStrategy")
-        ? scope.make("auth.local.passwordStrategy")
-        : null;
-      const authService = createLocalAuthService({
-        backend,
-        config,
-        profileProjector,
-        passwordStrategy,
-        invitationContextResolver
-      });
-      return applyAuthServiceDecorators(scope, authService);
-    });
-  }
-
-  boot(app) {
-    if (!app || typeof app.make !== "function") {
-      throw new Error("AuthLocalServiceProvider requires application make().");
-    }
-    app.make("authService");
-  }
-}
-
-export { AuthLocalServiceProvider, resolveLocalBackendMode };

package/src/server/providers/AuthProviderServiceProvider.js

@@ -1,7 +0,0 @@
-class AuthProviderServiceProvider {
-  static id = "auth.provider";
-
-  register() {}
-}
-
-export { AuthProviderServiceProvider };