@jskit-ai/auth-web 0.1.159 → 0.1.161

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-web",
-  "version": "0.1.159",
+  "version": "0.1.161",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -9,6 +9,8 @@
     "./server/controllers/AuthController": "./src/server/controllers/AuthController.js",
     "./server/services/AuthWebService": "./src/server/services/AuthWebService.js",
     "./server/routes/authRoutes": "./src/server/routes/authRoutes.js",
+    "./server/AuthWebFeature": "./src/server/AuthWebFeature.js",
+    "./server/managedPreviewIdentity": "./src/server/managedPreviewIdentity.js",
     "./client": "./src/client/index.js",
     "./client/views/DefaultLoginView": "./src/client/views/DefaultLoginView.vue",
     "./client/views/DefaultResetPasswordView": "./src/client/views/DefaultResetPasswordView.vue",
@@ -20,10 +22,10 @@
     "./test/playwright": "./src/test/playwright.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.157",
-    "@jskit-ai/http-runtime": "0.1.157",
-    "@jskit-ai/kernel": "0.1.159",
-    "@jskit-ai/shell-web": "0.1.163",
+    "@jskit-ai/auth-core": "0.1.159",
+    "@jskit-ai/http-runtime": "0.1.159",
+    "@jskit-ai/kernel": "0.1.161",
+    "@jskit-ai/shell-web": "0.1.165",
     "@mdi/js": "^7.4.47"
   },
   "peerDependencies": {
@@ -38,28 +40,23 @@
     "kind": "runtime",
     "capabilities": {
       "provides": [
-        "auth.server-routes",
+        "auth.web",
         "auth.web-login"
       ],
       "requires": [
-        "auth.access",
-        "auth.provider",
-        "validators.http",
-        "auth.policy",
-        "runtime.web-placement"
+        "auth.service",
+        "runtime.actions",
+        "runtime.env",
+        "runtime.http"
       ]
     },
     "runtime": {
       "server": {
-        "providerEntrypoint": "src/server/providers/AuthWebServiceProvider.js",
+        "providerEntrypoint": "src/server/AuthWebFeature.js",
         "providers": [
           {
-            "entrypoint": "src/server/providers/AuthWebServiceProvider.js",
-            "export": "AuthWebServiceProvider"
-          },
-          {
-            "entrypoint": "src/server/providers/AuthRouteServiceProvider.js",
-            "export": "AuthRouteServiceProvider"
+            "entrypoint": "src/server/AuthWebFeature.js",
+            "export": "AuthWebFeature"
           }
         ]
       },
@@ -86,20 +83,19 @@
           {
             "subpath": "./test/playwright",
             "summary": "Exports the localhost-only Playwright helper for creating a dev-auth session in the tested browser context."
+          },
+          {
+            "subpath": "./server/managedPreviewIdentity",
+            "summary": "Runs the app-owned managed-preview identity command against JSKIT's development auth routes."
           }
         ],
-        "containerTokens": {
-          "server": [
-            "auth.web.service"
-          ],
-          "client": [
-            "runtime.auth-guard.client",
-            "auth.login.component",
-            "auth.login.useLoginView",
-            "auth.web.profile.widget",
-            "auth.web.profile.menu.link-item"
-          ]
-        }
+        "clientCapabilities": [
+          "runtime.auth-guard.client",
+          "auth.login.component",
+          "auth.login.useLoginView",
+          "auth.web.profile.widget",
+          "auth.web.profile.menu.link-item"
+        ]
       },
       "server": {
         "routes": [
@@ -268,7 +264,7 @@
               ],
               "order": 1000,
               "componentToken": "auth.web.profile.widget",
-              "source": "mutations.text#auth-web-placement-block"
+              "source": "src/client/views/AuthProfileWidget.vue"
             },
             {
               "id": "auth.profile.menu.sign-in",
@@ -279,7 +275,7 @@
               ],
               "order": 200,
               "when": "auth.authenticated !== true",
-              "source": "mutations.text#auth-web-placement-block"
+              "source": "patterns/auth-surface/example/src/pages/auth/login.vue"
             },
             {
               "id": "auth.profile.menu.sign-out",
@@ -290,113 +286,11 @@
               ],
               "order": 1000,
               "when": "auth.authenticated === true",
-              "source": "mutations.text#auth-web-placement-block"
+              "source": "patterns/auth-surface/example/src/pages/auth/signout.vue"
             }
           ]
         }
       }
-    },
-    "mutations": {
-      "dependencies": {
-        "runtime": {
-          "@mdi/js": "^7.4.47",
-          "@jskit-ai/auth-core": "0.1.157",
-          "@jskit-ai/http-runtime": "0.1.157",
-          "@jskit-ai/kernel": "0.1.159",
-          "@jskit-ai/shell-web": "0.1.163"
-        },
-        "dev": {}
-      },
-      "packageJson": {
-        "scripts": {
-          "server:auth": "SERVER_SURFACE=auth node ./bin/server.js",
-          "dev:auth": "VITE_SURFACE=auth vite",
-          "build:auth": "VITE_SURFACE=auth vite build"
-        }
-      },
-      "procfile": {},
-      "files": [
-        {
-          "from": "templates/src/views/auth/LoginView.vue",
-          "to": "src/views/auth/LoginView.vue",
-          "ownership": "app",
-          "reason": "Install minimal login container that renders the module-provided DefaultLoginView by default.",
-          "category": "auth-web",
-          "id": "auth-view-login"
-        },
-        {
-          "from": "templates/src/views/auth/SignOutView.vue",
-          "to": "src/views/auth/SignOutView.vue",
-          "ownership": "app",
-          "reason": "Install minimal sign-out container that renders the module-provided SignOutView by default (edit the scaffolded file to customize).",
-          "category": "auth-web",
-          "id": "auth-view-signout"
-        },
-        {
-          "from": "templates/src/views/auth/ResetPasswordView.vue",
-          "to": "src/views/auth/ResetPasswordView.vue",
-          "ownership": "app",
-          "reason": "Install minimal password reset container that renders the module-provided DefaultResetPasswordView by default.",
-          "category": "auth-web",
-          "id": "auth-view-reset-password"
-        },
-        {
-          "from": "templates/src/pages/auth/login.vue",
-          "to": "src/pages/auth/login.vue",
-          "ownership": "app",
-          "reason": "Provide an auth-surface /auth/login wrapper that renders the package login view.",
-          "category": "auth-web",
-          "id": "auth-page-login"
-        },
-        {
-          "from": "templates/src/pages/auth/signout.vue",
-          "to": "src/pages/auth/signout.vue",
-          "ownership": "app",
-          "reason": "Provide an auth-surface /auth/signout wrapper that renders the package sign-out view.",
-          "category": "auth-web",
-          "id": "auth-page-signout"
-        },
-        {
-          "from": "templates/src/pages/auth/reset-password.vue",
-          "to": "src/pages/auth/reset-password.vue",
-          "ownership": "app",
-          "reason": "Provide an auth-surface /auth/reset-password wrapper that renders the package password reset view.",
-          "category": "auth-web",
-          "id": "auth-page-reset-password"
-        }
-      ],
-      "text": [
-        {
-          "op": "append-text",
-          "file": "config/public.js",
-          "position": "bottom",
-          "skipIfContains": "config.surfaceDefinitions.auth = {",
-          "value": "\nconfig.surfaceDefinitions.auth = {\n  id: \"auth\",\n  label: \"Auth\",\n  pagesRoot: \"auth\",\n  enabled: true,\n  requiresAuth: false,\n  requiresWorkspace: false,\n  origin: \"\"\n};\n",
-          "reason": "Register auth surface definition in public surface config.",
-          "category": "auth-web",
-          "id": "auth-web-surface-config-auth"
-        },
-        {
-          "op": "append-text",
-          "file": "src/placement.js",
-          "position": "bottom",
-          "skipIfContains": "id: \"auth.profile.widget\"",
-          "value": "\naddPlacement({\n  id: \"auth.profile.widget\",\n  target: \"shell.status\",\n  kind: \"component\",\n  surfaces: [\"*\"],\n  order: 1000,\n  componentToken: \"auth.web.profile.widget\"\n});\n\naddPlacement({\n  id: \"auth.profile.menu.sign-in\",\n  target: \"auth.profile-menu\",\n  kind: \"link\",\n  surfaces: [\"*\"],\n  order: 200,\n  props: {\n    label: \"Sign in\",\n    to: \"/auth/login\"\n  },\n  when: ({ auth }) => auth?.authenticated !== true\n});\n\naddPlacement({\n  id: \"auth.profile.menu.sign-out\",\n  target: \"auth.profile-menu\",\n  kind: \"link\",\n  surfaces: [\"*\"],\n  order: 1000,\n  props: {\n    label: \"Sign out\",\n    to: \"/auth/signout\"\n  },\n  when: ({ auth }) => auth?.authenticated === true\n});\n",
-          "reason": "Append auth profile placement entries into app-owned placement registry.",
-          "category": "auth-web",
-          "id": "auth-web-placement-block"
-        },
-        {
-          "op": "append-text",
-          "file": "src/placementTopology.js",
-          "position": "bottom",
-          "skipIfContains": "id: \"auth.profile-menu\"",
-          "value": "\naddPlacementTopology({\n  id: \"auth.profile-menu\",\n  description: \"Authenticated profile menu actions.\",\n  surfaces: [\"*\"],\n  variants: {\n    compact: {\n      outlet: \"auth-profile-menu:primary-menu\",\n      renderers: {\n        link: \"auth.web.profile.menu.link-item\"\n      }\n    },\n    medium: {\n      outlet: \"auth-profile-menu:primary-menu\",\n      renderers: {\n        link: \"auth.web.profile.menu.link-item\"\n      }\n    },\n    expanded: {\n      outlet: \"auth-profile-menu:primary-menu\",\n      renderers: {\n        link: \"auth.web.profile.menu.link-item\"\n      }\n    }\n  }\n});\n",
-          "reason": "Append auth profile menu topology into the app-owned placement topology.",
-          "category": "auth-web",
-          "id": "auth-web-profile-menu-topology"
-        }
-      ]
     }
   }
 }

package/patterns/auth-surface/PATTERN.md

@@ -0,0 +1,84 @@
+---
+id: auth/auth-surface
+title: Authentication surface
+summary: Compose JSKIT authentication routes, views, profile controls, and public surface configuration without generated source.
+keywords: account, auth, login, logout, password, placement, profile, reset, surface
+requires: @jskit-ai/auth-core, @jskit-ai/auth-web, @jskit-ai/shell-web
+---
+
+# Authentication surface
+
+## Use when
+
+Use this pattern when an application needs browser login, sign-out, password
+reset, and authenticated profile controls through JSKIT's auth runtime.
+
+## Do not use when
+
+Do not use this pattern for an API-only service, an application that delegates
+all authentication UI to another product, or a second auth stack beside JSKIT.
+
+## Product decisions
+
+Choose the auth provider, permitted login methods, public routes, post-login
+destination, account language, and which profile actions belong in the shell.
+Those choices must be known before adapting the example.
+
+## Framework APIs
+
+Use the views, auth guard, HTTP client integration, sign-out runtime, providers,
+and Playwright auth helper exported by `@jskit-ai/auth-web`. Use auth policies
+from `@jskit-ai/auth-core` for server authorization.
+
+For a Vibe64-managed preview, copy the app-owned
+`.vibe64/bin/preview-identity` executable and declare it in the project's
+Genesis Launch target. The executable calls the exported managed-preview
+identity library directly; it does not require a JSKIT CLI.
+
+Choose local-auth storage through the installed capability provider. A
+database-backed application installs `@jskit-ai/auth-provider-local-db-core`,
+which provides `auth.local.backend`; no environment switch selects it. When no
+backend package provides that capability, local auth deliberately uses its file
+store. Managed preview selectors name an existing auth-backend user whose
+application profile already exists; preview identity never creates or projects
+a user as a side effect.
+
+## Invariants
+
+- Credentials and provider secrets come from environment values.
+- Auth backend selection comes from the installed provider graph, not an
+  `AUTH_LOCAL_BACKEND` environment value.
+- The selected auth backend and the storage containing the application's users
+  agree before registration, login, session bootstrap, or preview identity is
+  exercised.
+- Public auth routes do not require an existing session.
+- Protected routes use the framework auth policy rather than page-local checks.
+- Login, sign-out, and reset views use the public auth components/composables.
+- Profile placements are conditional on the current authenticated state.
+- Transient mutation failures use the application toast; initial load failures
+  remain in the affected surface.
+
+## Example files
+
+`example/` contains concrete route wrappers, editable view wrappers, and the
+client runtime helpers needed by an authentication surface. It also contains
+the optional app-owned managed-preview identity executable. Compose their
+surface and placement declarations into the application's ordinary config and
+placement files.
+
+## Variation points
+
+Change provider, routes, labels, page wrappers, permitted login methods, profile
+placements, and post-auth destinations while retaining the runtime contracts.
+
+## Verification
+
+Exercise failed and successful login, sign-out, reset, protected navigation,
+keyboard interaction, warm-cache return navigation, and browser refresh.
+
+## Avoid
+
+- storing credentials in source
+- copying auth repositories or session mechanics into the app
+- redirect loops between public and protected surfaces
+- generator commands, mutation metadata, or setup receipts

package/patterns/auth-surface/example/.vibe64/bin/preview-identity

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { runManagedPreviewIdentityCommand } from "@jskit-ai/auth-web/server/managedPreviewIdentity";
+
+process.exitCode = await runManagedPreviewIdentityCommand();

package/src/client/index.js

@@ -1,4 +1,3 @@
-import { AuthWebClientProvider } from "./providers/AuthWebClientProvider.js";
 import DefaultLoginView from "./views/DefaultLoginView.vue";
 import DefaultSignOutView from "./views/DefaultSignOutView.vue";
 import DefaultResetPasswordView from "./views/DefaultResetPasswordView.vue";
@@ -24,6 +23,4 @@ const routeComponents = Object.freeze({
   "auth-reset-password": DefaultResetPasswordView
 });
 
-const clientProviders = Object.freeze([AuthWebClientProvider]);
-
-export { routeComponents, clientProviders };
+export { routeComponents };

package/src/client/providers/AuthWebClientProvider.js

@@ -1,68 +1,40 @@
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
 import DefaultLoginView from "../views/DefaultLoginView.vue";
 import AuthProfileWidget from "../views/AuthProfileWidget.vue";
 import AuthProfileMenuLinkItem from "../views/AuthProfileMenuLinkItem.vue";
-import { createAuthGuardRuntime } from "../runtime/authGuardRuntime.js";
-import { completeOAuthCallbackFromUrl } from "../runtime/oauthCallbackRuntime.js";
 import { useLoginView } from "../runtime/useLoginView.js";
-import { bootAuthClientProvider } from "./bootAuthClientProvider.js";
-import { resolveSurfaceNavigationTargetFromPlacementContext } from "@jskit-ai/shell-web/client/placement";
-import { resolveAllowedReturnToOriginsFromPlacementContext } from "../lib/returnToPath.js";
+import { createAuthClient } from "../runtime/authClient.js";
 
-class AuthWebClientProvider {
-  static id = "auth.web.client";
-
-  register(app) {
-    if (!app || typeof app.singleton !== "function") {
-      throw new Error("AuthWebClientProvider requires application singleton().");
-    }
-
-    app.singleton("auth.login.component", () => DefaultLoginView);
-    app.singleton("auth.login.useLoginView", () => useLoginView);
-    app.singleton("auth.web.profile.widget", () => AuthProfileWidget);
-    app.singleton("auth.web.profile.menu.link-item", () => AuthProfileMenuLinkItem);
-    app.singleton("auth.mobile-callback.client", () =>
-      Object.freeze({
-        async completeFromUrl({
-          url = "",
-          fallbackReturnTo = "/",
-          placementContext = null,
-          defaultProvider = "",
-          request = undefined,
-          refreshSession = async () => null
-        } = {}) {
-          return completeOAuthCallbackFromUrl({
-            url,
-            fallbackReturnTo,
-            allowedReturnToOrigins: resolveAllowedReturnToOriginsFromPlacementContext(placementContext),
-            defaultProvider,
-            ...(typeof request === "function" ? { request } : {}),
-            refreshSession
-          });
-        }
-      })
-    );
-    app.singleton("runtime.auth-guard.client", () => {
-      if (!app.has("runtime.web-placement.client")) {
-        throw new Error("AuthWebClientProvider requires shell-web placement runtime.");
-      }
-
-      const placementRuntime = app.make("runtime.web-placement.client");
-      const realtimeSocket = app.has("runtime.realtime.client.socket") ? app.make("runtime.realtime.client.socket") : null;
-      const loginRouteTarget = resolveSurfaceNavigationTargetFromPlacementContext(placementRuntime.getContext(), {
-        path: "/auth/login",
-        surfaceId: "auth"
-      });
-      return createAuthGuardRuntime({
-        loginRoute: loginRouteTarget.href,
-        placementRuntime,
-        realtimeSocket
-      });
-    });
-  }
-
-  async boot(app) {
-    await bootAuthClientProvider(app);
+const AuthWebClientProvider = defineProvider({
+  id: "auth.web.client",
+  requires: {
+    components: "client.components",
+    pinia: "client.pinia",
+    shell: "client.shell",
+    vueApp: "client.vue"
+  },
+  optional: {
+    mobile: "client.mobile",
+    realtime: "client.realtime"
+  },
+  provides: {
+    auth: "client.auth"
+  },
+  setup({ components, mobile, pinia, realtime, shell, vueApp }) {
+    components.register("auth.login.component", DefaultLoginView);
+    components.register("auth.login.useLoginView", useLoginView);
+    components.register("auth.web.profile.widget", AuthProfileWidget);
+    components.register("auth.web.profile.menu.link-item", AuthProfileMenuLinkItem);
+    return {
+      auth: createAuthClient({ mobile, pinia, realtime, shell, vueApp })
+    };
+  },
+  async boot(_dependencies, { outputs }) {
+    await outputs.auth.initialize();
+  },
+  shutdown(_dependencies, { outputs }) {
+    outputs.auth.dispose();
   }
-}
+});
 
 export { AuthWebClientProvider };

package/src/client/runtime/authClient.js

@@ -0,0 +1,79 @@
+import { resolveSurfaceNavigationTargetFromPlacementContext } from "@jskit-ai/shell-web/client/placement";
+
+import { resolveAllowedReturnToOriginsFromPlacementContext } from "../lib/returnToPath.js";
+import { createAuthGuardRuntime } from "./authGuardRuntime.js";
+import { completeOAuthCallbackFromUrl } from "./oauthCallbackRuntime.js";
+import { createBrowserOAuthLaunchClient } from "./oauthLaunchClient.js";
+import {
+  AUTH_GUARD_RUNTIME_INJECTION_KEY,
+  AUTH_OAUTH_LAUNCH_CLIENT_INJECTION_KEY
+} from "./inject.js";
+import { useAuthStore } from "../stores/useAuthStore.js";
+
+function createMobileCallbackCompleter() {
+  return Object.freeze({
+    async completeFromUrl({
+      url = "",
+      fallbackReturnTo = "/",
+      placementContext = null,
+      defaultProvider = "",
+      request = undefined,
+      refreshSession = async () => null
+    } = {}) {
+      return completeOAuthCallbackFromUrl({
+        url,
+        fallbackReturnTo,
+        allowedReturnToOrigins: resolveAllowedReturnToOriginsFromPlacementContext(placementContext),
+        defaultProvider,
+        ...(typeof request === "function" ? { request } : {}),
+        refreshSession
+      });
+    }
+  });
+}
+
+function createAuthClient({ mobile = null, pinia, realtime = null, shell, vueApp } = {}) {
+  const placementRuntime = shell.placement;
+  const loginRouteTarget = resolveSurfaceNavigationTargetFromPlacementContext(placementRuntime.getContext(), {
+    path: "/auth/login",
+    surfaceId: "auth"
+  });
+  const guard = createAuthGuardRuntime({
+    loginRoute: loginRouteTarget.href,
+    placementRuntime,
+    realtimeSocket: realtime?.socket || null
+  });
+  const mobileCallback = createMobileCallbackCompleter();
+  const oauthLaunch = mobile?.oauthLaunch || createBrowserOAuthLaunchClient();
+  let stopAuthRefresh = null;
+
+  async function initialize() {
+    if (!pinia) {
+      throw new Error("AuthWebClientProvider requires Pinia installed in the client app.");
+    }
+    const authStore = useAuthStore(pinia);
+    authStore.attachRuntime(guard);
+    await authStore.initialize();
+    stopAuthRefresh = authStore.subscribe(() => {
+      void shell.bootstrap.refresh("auth.state");
+    });
+    vueApp?.provide?.(AUTH_GUARD_RUNTIME_INJECTION_KEY, guard);
+    vueApp?.provide?.(AUTH_OAUTH_LAUNCH_CLIENT_INJECTION_KEY, oauthLaunch);
+  }
+
+  function dispose() {
+    stopAuthRefresh?.();
+    stopAuthRefresh = null;
+    guard.dispose?.();
+  }
+
+  return Object.freeze({
+    dispose,
+    guard,
+    initialize,
+    mobileCallback,
+    oauthLaunch
+  });
+}
+
+export { createAuthClient, createMobileCallbackCompleter };

package/src/client/runtime/authGuardRuntime.js

@@ -262,10 +262,10 @@ function evaluateAuthGuard({ guard, context, loginRoute, authState = DEFAULT_AUT
 function installGuardEvaluator({ loginRoute = DEFAULT_LOGIN_ROUTE, getAuthState }) {
   const root = asGlobalObject();
   if (!root || typeof getAuthState !== "function") {
-    return;
+    return () => {};
   }
 
-  root[GLOBAL_GUARD_EVALUATOR_KEY] = ({ guard, context } = {}) => {
+  const evaluator = ({ guard, context } = {}) => {
     return evaluateAuthGuard({
       guard,
       context,
@@ -273,6 +273,12 @@ function installGuardEvaluator({ loginRoute = DEFAULT_LOGIN_ROUTE, getAuthState
       authState: getAuthState()
     });
   };
+  root[GLOBAL_GUARD_EVALUATOR_KEY] = evaluator;
+  return () => {
+    if (root[GLOBAL_GUARD_EVALUATOR_KEY] === evaluator) {
+      delete root[GLOBAL_GUARD_EVALUATOR_KEY];
+    }
+  };
 }
 
 function normalizeRuntimePath(value, fallback) {
@@ -422,6 +428,7 @@ function createAuthGuardRuntime({
   let authState = DEFAULT_AUTH_STATE;
   let activeRefreshPromise = null;
   let listenersInstalled = false;
+  const cleanup = [];
   const listeners = new Set();
   const subscribe = createListenerSubscription(listeners);
 
@@ -475,13 +482,12 @@ function createAuthGuardRuntime({
       return authState;
     }
 
-    installGuardEvaluator({
-      loginRoute: currentLoginRoute,
-      getAuthState: () => authState
-    });
-
     if (!listenersInstalled) {
       listenersInstalled = true;
+      cleanup.push(installGuardEvaluator({
+        loginRoute: currentLoginRoute,
+        getAuthState: () => authState
+      }));
       const onReconnect = () => {
         void refresh();
       };
@@ -503,20 +509,24 @@ function createAuthGuardRuntime({
       if (windowTarget) {
         if (reconnectRefreshEnabled) {
           windowTarget.addEventListener("online", onReconnect);
+          cleanup.push(() => windowTarget.removeEventListener("online", onReconnect));
         }
         if (foregroundRefreshEnabled) {
           windowTarget.addEventListener("focus", onWindowFocus);
+          cleanup.push(() => windowTarget.removeEventListener("focus", onWindowFocus));
         }
       }
 
       const documentTarget = getDocumentEventTarget();
       if (foregroundRefreshEnabled && documentTarget) {
         documentTarget.addEventListener("visibilitychange", onVisibilityChange);
+        cleanup.push(() => documentTarget.removeEventListener("visibilitychange", onVisibilityChange));
       }
 
       if (socket) {
         for (const eventName of realtimeEvents) {
           socket.on(eventName, onRealtimeRefresh);
+          cleanup.push(() => socket.off(eventName, onRealtimeRefresh));
         }
       }
     }
@@ -526,7 +536,18 @@ function createAuthGuardRuntime({
     });
   }
 
+  function dispose() {
+    for (const release of cleanup.splice(0, cleanup.length).reverse()) {
+      try {
+        release();
+      } catch {}
+    }
+    listeners.clear();
+    listenersInstalled = false;
+  }
+
   return Object.freeze({
+    dispose,
     initialize,
     refresh,
     getState,

package/src/server/AuthWebFeature.js

@@ -0,0 +1,41 @@
+import { resolveDevAuthPolicyFromEnv } from "@jskit-ai/auth-core/server/devAuth";
+import { defineFeature } from "@jskit-ai/kernel/server/features";
+import { AuthController } from "./controllers/AuthController.js";
+import { buildRoutes } from "./routes/authRoutes.js";
+import { AuthWebService } from "./services/AuthWebService.js";
+
+function devAuthBootstrapEnabled(env) {
+  const policy = resolveDevAuthPolicyFromEnv(env);
+  return policy.enabled && !policy.isProduction;
+}
+
+const AuthWebFeature = defineFeature({
+  id: "auth.web",
+  domain: "auth",
+  requires: {
+    authService: "auth.service",
+    env: "runtime.env",
+    http: "runtime.http"
+  },
+  provides: {
+    authWeb: "auth.web"
+  },
+  setup({ authService, env, http }) {
+    const service = new AuthWebService({
+      authService,
+      devAuthBootstrapEnabled: devAuthBootstrapEnabled(env)
+    });
+    const controller = new AuthController({ service });
+    const routes = buildRoutes(controller, {
+      includeDevLoginAs: service.isDevLoginAsAvailable()
+    });
+    for (const route of routes) {
+      http.router.register(route.method, route.path, route, route.handler);
+    }
+    return {
+      authWeb: Object.freeze({ controller, routes: Object.freeze(routes), service })
+    };
+  }
+});
+
+export { AuthWebFeature };