@voxgig/build 4.2.0 → 4.4.0

package/build.ts

@@ -18,6 +18,7 @@ import { srv_handler } from './env/lambda/srv_handler'
 import { resources_yml } from './env/lambda/res_yml'
 
 import { env_gen, ENV_FILES, ENV_SRC, KINDS as ENV_KINDS } from './env/env_gen'
+import { web_gen, WEB_FILES } from './env/web/web_gen'
 
 import {
   generate, empty, TM,
@@ -42,7 +43,15 @@ const EnvGen = {
   env_gen,
   files: ENV_FILES,
   srcfiles: ENV_SRC,
-  kinds: ENV_KINDS,
+  kinds: [...ENV_KINDS, 'web'],
+}
+
+
+// EnvWeb: the experimental web frontend (SPA + backend web runner +
+// auth), generated create-once. See env/web/web_gen.ts.
+const EnvWeb = {
+  web_gen,
+  files: WEB_FILES,
 }
 
 
@@ -59,6 +68,7 @@ const Fragments = {
 export {
   EnvLambda,
   EnvGen,
+  EnvWeb,
   Fragments,
 
   // Building blocks for ejected project templates (src/gen/<name>.ts

package/dist/build.d.ts

@@ -28,6 +28,7 @@ declare const EnvGen: {
         folder: string;
         tm?: string;
         src?: string;
+        root?: string;
     }) => Promise<void>;
     files: Record<string, {
         frag: string;
@@ -40,10 +41,25 @@ declare const EnvGen: {
     }[]>;
     kinds: string[];
 };
+declare const EnvWeb: {
+    web_gen: (model: any, spec: {
+        root: string;
+        tm?: string;
+        env?: any;
+        force?: boolean;
+    }) => Promise<{
+        created: string[];
+        skipped: string[];
+    }>;
+    files: {
+        frag: string;
+        out: string;
+    }[];
+};
 declare const Fragments: {
     load: typeof loadFragment;
     render: typeof renderFragment;
     list: typeof listFragments;
     folder: string;
 };
-export { EnvLambda, EnvGen, Fragments, generate, empty, TM, loadFragment, renderFragment, MsgMetaShape, CoreConfShape, CloudConfShape, res_dynamo_yml, };
+export { EnvLambda, EnvGen, EnvWeb, Fragments, generate, empty, TM, loadFragment, renderFragment, MsgMetaShape, CoreConfShape, CloudConfShape, res_dynamo_yml, };

package/dist/build.js

@@ -1,7 +1,7 @@
 "use strict";
 /* Copyright © 2022-2026 Voxgig Ltd, MIT License. */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.res_dynamo_yml = exports.CloudConfShape = exports.CoreConfShape = exports.MsgMetaShape = exports.renderFragment = exports.loadFragment = exports.TM = exports.empty = exports.generate = exports.Fragments = exports.EnvGen = exports.EnvLambda = void 0;
+exports.res_dynamo_yml = exports.CloudConfShape = exports.CoreConfShape = exports.MsgMetaShape = exports.renderFragment = exports.loadFragment = exports.TM = exports.empty = exports.generate = exports.Fragments = exports.EnvWeb = exports.EnvGen = exports.EnvLambda = void 0;
 // EnvLambda: generation of the Lambda deployment templates, built on the
 // jostraca templating library. The templates live in env/lambda/, one file
 // per output for convenience:
@@ -18,6 +18,7 @@ const srv_yml_1 = require("./env/lambda/srv_yml");
 const srv_handler_1 = require("./env/lambda/srv_handler");
 const res_yml_1 = require("./env/lambda/res_yml");
 const env_gen_1 = require("./env/env_gen");
+const web_gen_1 = require("./env/web/web_gen");
 const generate_1 = require("./env/lambda/generate");
 Object.defineProperty(exports, "generate", { enumerable: true, get: function () { return generate_1.generate; } });
 Object.defineProperty(exports, "empty", { enumerable: true, get: function () { return generate_1.empty; } });
@@ -43,9 +44,16 @@ const EnvGen = {
     env_gen: env_gen_1.env_gen,
     files: env_gen_1.ENV_FILES,
     srcfiles: env_gen_1.ENV_SRC,
-    kinds: env_gen_1.KINDS,
+    kinds: [...env_gen_1.KINDS, 'web'],
 };
 exports.EnvGen = EnvGen;
+// EnvWeb: the experimental web frontend (SPA + backend web runner +
+// auth), generated create-once. See env/web/web_gen.ts.
+const EnvWeb = {
+    web_gen: web_gen_1.web_gen,
+    files: web_gen_1.WEB_FILES,
+};
+exports.EnvWeb = EnvWeb;
 // Fragment tooling (used by voxgig-system template list/eject/diff, and
 // available to project code).
 const Fragments = {

package/dist/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../build.ts"],"names":[],"mappings":";AAAA,oDAAoD;;;AAEpD,yEAAyE;AACzE,2EAA2E;AAC3E,8BAA8B;AAC9B,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,qCAAqC;AAErC,kDAA8C;AAC9C,0DAAsD;AACtD,kDAAoD;AAEpD,2CAA+E;AAE/E,oDAG8B;AA0C5B,yFA5CA,mBAAQ,OA4CA;AACR,sFA7CU,gBAAK,OA6CV;AACL,mFA9CiB,aAAE,OA8CjB;AACF,6FA9CA,uBAAY,OA8CA;AACZ,+FA/Cc,yBAAc,OA+Cd;AA5ChB,qCAA0C;AA6CxC,6FA7CO,kBAAY,OA6CP;AA5Cd,uCAA4D;AA6C1D,8FA7CO,oBAAa,OA6CP;AACb,+FA9CsB,qBAAc,OA8CtB;AA7ChB,yDAAqD;AA8CnD,+FA9CO,+BAAc,OA8CP;AA3ChB,MAAM,SAAS,GAAG;IAChB,OAAO,EAAP,iBAAO;IACP,WAAW,EAAX,yBAAW;IACX,aAAa,EAAb,uBAAa;CACd,CAAA;AAwBC,8BAAS;AArBX,wEAAwE;AACxE,yDAAyD;AACzD,MAAM,MAAM,GAAG;IACb,OAAO,EAAP,iBAAO;IACP,KAAK,EAAE,mBAAS;IAChB,QAAQ,EAAE,iBAAO;IACjB,KAAK,EAAE,eAAS;CACjB,CAAA;AAeC,wBAAM;AAZR,wEAAwE;AACxE,8BAA8B;AAC9B,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,uBAAY;IAClB,MAAM,EAAE,yBAAc;IACtB,IAAI,EAAE,wBAAa;IACnB,MAAM,EAAE,iBAAM;CACf,CAAA;AAMC,8BAAS"}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../build.ts"],"names":[],"mappings":";AAAA,oDAAoD;;;AAEpD,yEAAyE;AACzE,2EAA2E;AAC3E,8BAA8B;AAC9B,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,qCAAqC;AAErC,kDAA8C;AAC9C,0DAAsD;AACtD,kDAAoD;AAEpD,2CAA+E;AAC/E,+CAAsD;AAEtD,oDAG8B;AAmD5B,yFArDA,mBAAQ,OAqDA;AACR,sFAtDU,gBAAK,OAsDV;AACL,mFAvDiB,aAAE,OAuDjB;AACF,6FAvDA,uBAAY,OAuDA;AACZ,+FAxDc,yBAAc,OAwDd;AArDhB,qCAA0C;AAsDxC,6FAtDO,kBAAY,OAsDP;AArDd,uCAA4D;AAsD1D,8FAtDO,oBAAa,OAsDP;AACb,+FAvDsB,qBAAc,OAuDtB;AAtDhB,yDAAqD;AAuDnD,+FAvDO,+BAAc,OAuDP;AApDhB,MAAM,SAAS,GAAG;IAChB,OAAO,EAAP,iBAAO;IACP,WAAW,EAAX,yBAAW;IACX,aAAa,EAAb,uBAAa;CACd,CAAA;AAgCC,8BAAS;AA7BX,wEAAwE;AACxE,yDAAyD;AACzD,MAAM,MAAM,GAAG;IACb,OAAO,EAAP,iBAAO;IACP,KAAK,EAAE,mBAAS;IAChB,QAAQ,EAAE,iBAAO;IACjB,KAAK,EAAE,CAAC,GAAG,eAAS,EAAE,KAAK,CAAC;CAC7B,CAAA;AAuBC,wBAAM;AApBR,oEAAoE;AACpE,wDAAwD;AACxD,MAAM,MAAM,GAAG;IACb,OAAO,EAAP,iBAAO;IACP,KAAK,EAAE,mBAAS;CACjB,CAAA;AAgBC,wBAAM;AAbR,wEAAwE;AACxE,8BAA8B;AAC9B,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,uBAAY;IAClB,MAAM,EAAE,yBAAc;IACtB,IAAI,EAAE,wBAAa;IACnB,MAAM,EAAE,iBAAM;CACf,CAAA;AAOC,8BAAS"}

package/dist/env/env_gen.d.ts

@@ -12,5 +12,6 @@ declare const env_gen: (model: any, spec: {
     folder: string;
     tm?: string;
     src?: string;
+    root?: string;
 }) => Promise<void>;
 export { env_gen, ENV_FILES, ENV_SRC, KINDS, };

package/dist/env/env_gen.js

@@ -21,6 +21,7 @@ const path_1 = __importDefault(require("path"));
 const util_1 = require("@voxgig/util");
 const conf_1 = require("../shape/conf");
 const generate_1 = require("./lambda/generate");
+const web_gen_1 = require("./web/web_gen");
 // The supported environment kinds and the files each generates.
 // `out` may contain $$slots$$ (rendered with the same slot values).
 const ENV_FILES = {
@@ -97,6 +98,16 @@ const env_gen = async (model, spec) => {
             continue;
         }
         const kind = def.kind || name;
+        // The 'web' kind is the frontend SPA (+ backend web runner + auth),
+        // not a flat deployment-artifact set - delegate to EnvWeb.
+        if ('web' === kind) {
+            if (null == spec.root) {
+                throw new Error('@voxgig/build: env kind "web" needs spec.root ' +
+                    '(the project root); pass it from the build action');
+            }
+            await (0, web_gen_1.web_gen)(model, { root: spec.root, tm: spec.tm, env: def });
+            continue;
+        }
         const filedefs = ENV_FILES[kind];
         if (null == filedefs) {
             throw new Error('@voxgig/build: unknown environment kind: ' + kind +

package/dist/env/env_gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"env_gen.js","sourceRoot":"","sources":["../../env/env_gen.ts"],"names":[],"mappings":";AAAA,+CAA+C;;;;;;AAE/C,sEAAsE;AACtE,6DAA6D;AAC7D,EAAE;AACF,uCAAuC;AACvC,wEAAwE;AACxE,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,sCAAsC;AAEtC,4CAAmB;AACnB,gDAAuB;AAEvB,uCAAuC;AAEvC,wCAA6C;AAE7C,gDAA0E;AAG1E,gEAAgE;AAChE,oEAAoE;AACpE,MAAM,SAAS,GAAoD;IACjE,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,EAAE;QAC5C,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;KACnD;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE;QACvE,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;QAClD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;KACnD;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,YAAY,EAAE;QACrD,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,aAAa,EAAE;QACvD,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,WAAW,EAAE;KACpD;IACD,EAAE,EAAE;QACF,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,iBAAiB,EAAE;QAC3D,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,WAAW,EAAE;KAChD;IACD,GAAG,EAAE;QACH,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,gBAAgB,EAAE;QAC1D,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,WAAW,EAAE;KACjD;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;QAClD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;KACnD;IACD,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,eAAe,EAAE;QAC/D,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,WAAW,EAAE;KACxD;CACF,CAAA;AAwGC,8BAAS;AAtGX,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,mDAAmD;AACnD,MAAM,OAAO,GAAiE;IAC5E,KAAK,EAAE,EAAE,EAAE,2CAA2C;IACtD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE;KAChE;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE;KAClE;IACD,EAAE,EAAE;QACF,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;KAC1D;IACD,GAAG,EAAE;QACH,sDAAsD;QACtD,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE;KACtE;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE;KAC/D;IACD,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE;KAC3E;CACF,CAAA;AA6EC,0BAAO;AA3ET,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AA4ElC,sBAAK;AAzEP,MAAM,OAAO,GAAG,KAAK,EAAE,KAAU,EAAE,IAKlC,EAAE,EAAE;;IAEH,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAA;IAEjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,GAAG,GAAQ,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAE/B,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACzB,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,IAAI;gBAChE,QAAQ,GAAG,IAAI,GAAG,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAA;QACjE,CAAC;QAED,gEAAgE;QAChE,8DAA8D;QAC9D,+BAA+B;QAC/B,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,IAAI,CAAC;YACzB,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0CAAE,OAAO,KAAI,IAAI;YAC3C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,WAAW;YACjC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,KAAK;SAC1B,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,QAAQ,KAAK,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,KAAK,CAAC,GAAG,GAAG,IAAI,CAAA;QAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,EAAE,IAAA,yBAAc,EAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC;YACnC,OAAO,EAAE,IAAA,yBAAc,EAAC,IAAA,uBAAY,EAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC;SACnE,CAAC,CAAC,CAAA;QAEH,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,EAAE,KAAK,CAAC,CAAA;QAE/C,qEAAqE;QACrE,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,KAAK,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAA,yBAAc,EAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;gBACvE,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,OAAO,GACX,IAAA,yBAAc,EAAC,IAAA,uBAAY,EAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;oBAC3D,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;oBACrD,YAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAIC,0BAAO"}
+{"version":3,"file":"env_gen.js","sourceRoot":"","sources":["../../env/env_gen.ts"],"names":[],"mappings":";AAAA,+CAA+C;;;;;;AAE/C,sEAAsE;AACtE,6DAA6D;AAC7D,EAAE;AACF,uCAAuC;AACvC,wEAAwE;AACxE,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,sCAAsC;AAEtC,4CAAmB;AACnB,gDAAuB;AAEvB,uCAAuC;AAEvC,wCAA6C;AAE7C,gDAA0E;AAC1E,2CAAuC;AAGvC,gEAAgE;AAChE,oEAAoE;AACpE,MAAM,SAAS,GAAoD;IACjE,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,EAAE;QAC5C,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;KACnD;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE;QACvE,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;QAClD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;KACnD;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,YAAY,EAAE;QACrD,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,aAAa,EAAE;QACvD,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,WAAW,EAAE;KACpD;IACD,EAAE,EAAE;QACF,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,iBAAiB,EAAE;QAC3D,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,WAAW,EAAE;KAChD;IACD,GAAG,EAAE;QACH,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,gBAAgB,EAAE;QAC1D,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,WAAW,EAAE;KACjD;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;QAClD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,WAAW,EAAE;KACnD;IACD,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,eAAe,EAAE;QAC/D,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,WAAW,EAAE;KACxD;CACF,CAAA;AAqHC,8BAAS;AAnHX,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,mDAAmD;AACnD,MAAM,OAAO,GAAiE;IAC5E,KAAK,EAAE,EAAE,EAAE,2CAA2C;IACtD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE;KAChE;IACD,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE;KAClE;IACD,EAAE,EAAE;QACF,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;KAC1D;IACD,GAAG,EAAE;QACH,sDAAsD;QACtD,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE;KACtE;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE;KAC/D;IACD,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE;KAC3E;CACF,CAAA;AA0FC,0BAAO;AAxFT,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAyFlC,sBAAK;AAtFP,MAAM,OAAO,GAAG,KAAK,EAAE,KAAU,EAAE,IAOlC,EAAE,EAAE;;IAEH,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAA;IAEjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,GAAG,GAAQ,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAE/B,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACzB,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;QAE7B,oEAAoE;QACpE,2DAA2D;QAC3D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD;oBAC9D,mDAAmD,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,IAAA,iBAAO,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YAChE,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,IAAI;gBAChE,QAAQ,GAAG,IAAI,GAAG,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAA;QACjE,CAAC;QAED,gEAAgE;QAChE,8DAA8D;QAC9D,+BAA+B;QAC/B,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,IAAI,CAAC;YACzB,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0CAAE,OAAO,KAAI,IAAI;YAC3C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,WAAW;YACjC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,KAAK;SAC1B,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,QAAQ,KAAK,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,KAAK,CAAC,GAAG,GAAG,IAAI,CAAA;QAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,EAAE,IAAA,yBAAc,EAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC;YACnC,OAAO,EAAE,IAAA,yBAAc,EAAC,IAAA,uBAAY,EAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC;SACnE,CAAC,CAAC,CAAA;QAEH,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,EAAE,KAAK,CAAC,CAAA;QAE/C,qEAAqE;QACrE,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,KAAK,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAA,yBAAc,EAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;gBACvE,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,OAAO,GACX,IAAA,yBAAc,EAAC,IAAA,uBAAY,EAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;oBAC3D,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;oBACrD,YAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAIC,0BAAO"}

package/dist/env/web/web_gen.d.ts

@@ -0,0 +1,19 @@
+declare const WEB_FILES: {
+    frag: string;
+    out: string;
+}[];
+declare const DEFAULT_USERS: {
+    name: string;
+    email: string;
+    password: string;
+}[];
+declare const web_gen: (model: any, spec: {
+    root: string;
+    tm?: string;
+    env?: any;
+    force?: boolean;
+}) => Promise<{
+    created: string[];
+    skipped: string[];
+}>;
+export { web_gen, WEB_FILES, DEFAULT_USERS, };

package/dist/env/web/web_gen.js

@@ -0,0 +1,93 @@
+"use strict";
+/* Copyright © 2026 Voxgig Ltd, MIT License. */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_USERS = exports.WEB_FILES = exports.web_gen = void 0;
+// EnvWeb: generate the experimental web frontend - a Single Page App built
+// from web components on a client-side Seneca service bus (no React/Vue) -
+// plus the backend web runner and auth service it needs.
+//
+// Everything EnvWeb generates is CREATE-ONCE: a project owns its frontend
+// after generation (the SPA is a starting point users heavily customize).
+// Fragments live in @voxgig/build tm/web/ and are project-shadowable via
+// spec.tm (the project's tm/web folder), like every other template.
+//
+// The entity admin is model-driven at RUNTIME (it fetches the compiled
+// model.json), so the generated SPA adapts to any model with no
+// per-entity code generation.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const util_1 = require("@voxgig/util");
+const conf_1 = require("../../shape/conf");
+const generate_1 = require("../lambda/generate");
+// File manifest: fragment (relative to tm/web) -> output path (relative to
+// the project root, which holds backend/ and web/). $$slots$$ in the
+// output path are rendered too.
+const WEB_FILES = [
+    // Frontend SPA (web/)
+    { frag: 'web/package.json.frag', out: 'web/package.json' },
+    { frag: 'web/index.html.frag', out: 'web/index.html' },
+    { frag: 'web/playwright.config.js.frag', out: 'web/playwright.config.js' },
+    { frag: 'web/src/main.js.frag', out: 'web/src/main.js' },
+    { frag: 'web/src/bus.js.frag', out: 'web/src/bus.js' },
+    { frag: 'web/src/style.css.frag', out: 'web/src/style.css' },
+    { frag: 'web/src/cmp/app.js.frag', out: 'web/src/cmp/app.js' },
+    { frag: 'web/src/cmp/auth.js.frag', out: 'web/src/cmp/auth.js' },
+    { frag: 'web/src/cmp/admin.js.frag', out: 'web/src/cmp/admin.js' },
+    { frag: 'web/e2e/smoke.spec.js.frag', out: 'web/e2e/smoke.spec.js' },
+    // Backend web runner + auth service (backend/src/...)
+    { frag: 'backend/env/web/web.ts.frag', out: 'backend/src/env/web/web.ts' },
+    { frag: 'backend/srv/auth/auth-srv.ts.frag', out: 'backend/src/srv/auth/auth-srv.ts' },
+    { frag: 'backend/srv/auth/get_info.ts.frag', out: 'backend/src/srv/auth/get_info.ts' },
+    { frag: 'backend/srv/auth/signin_user.ts.frag', out: 'backend/src/srv/auth/signin_user.ts' },
+    { frag: 'backend/srv/auth/signout_user.ts.frag', out: 'backend/src/srv/auth/signout_user.ts' },
+    { frag: 'backend/srv/auth/load_auth.ts.frag', out: 'backend/src/srv/auth/load_auth.ts' },
+    { frag: 'backend/srv/auth/web_signin_user.ts.frag', out: 'backend/src/srv/auth/web_signin_user.ts' },
+    { frag: 'backend/srv/auth/web_signout_user.ts.frag', out: 'backend/src/srv/auth/web_signout_user.ts' },
+    { frag: 'backend/srv/auth/web_load_auth.ts.frag', out: 'backend/src/srv/auth/web_load_auth.ts' },
+];
+exports.WEB_FILES = WEB_FILES;
+// Default seeded users (local testing only), rendered into the runner.
+const DEFAULT_USERS = [
+    { name: 'Alice Example', email: 'alice@example.com', password: 'alice-pass-01' },
+    { name: 'Bob Example', email: 'bob@example.com', password: 'bob-pass-01' },
+];
+exports.DEFAULT_USERS = DEFAULT_USERS;
+// web_gen(model, spec): generate the frontend + backend web pieces into
+// the project. spec.root is the project root (parent of backend/); files
+// that already exist are left untouched (create-once).
+const web_gen = async (model, spec) => {
+    const core = (0, conf_1.CoreConfShape)(model.main.conf.core);
+    const envdef = spec.env || {};
+    const users = envdef.users || DEFAULT_USERS;
+    const seed = users[0] || DEFAULT_USERS[0];
+    const port = envdef.port ||
+        (model.main.conf.port && model.main.conf.port.backend) || 8080;
+    const slots = {
+        name: core.name,
+        Name: (0, util_1.camelify)(core.name),
+        users: JSON.stringify(users, null, 2),
+        e2eport: envdef.e2eport || (port + 10),
+        seedEmail: seed.email,
+        seedPassword: seed.password,
+    };
+    const created = [];
+    const skipped = [];
+    for (const fd of WEB_FILES) {
+        const outrel = (0, generate_1.renderFragment)(fd.out, slots);
+        const dest = path_1.default.join(spec.root, outrel);
+        if (fs_1.default.existsSync(dest) && !spec.force) {
+            skipped.push(outrel);
+            continue;
+        }
+        const content = (0, generate_1.renderFragment)((0, generate_1.loadFragment)(fd.frag, spec, 'web'), slots);
+        fs_1.default.mkdirSync(path_1.default.dirname(dest), { recursive: true });
+        fs_1.default.writeFileSync(dest, content);
+        created.push(outrel);
+    }
+    return { created: created.sort(), skipped: skipped.sort() };
+};
+exports.web_gen = web_gen;
+//# sourceMappingURL=web_gen.js.map

package/dist/env/web/web_gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web_gen.js","sourceRoot":"","sources":["../../../env/web/web_gen.ts"],"names":[],"mappings":";AAAA,+CAA+C;;;;;;AAE/C,2EAA2E;AAC3E,2EAA2E;AAC3E,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,8BAA8B;AAE9B,4CAAmB;AACnB,gDAAuB;AAEvB,uCAAuC;AAEvC,2CAAgD;AAEhD,iDAAiE;AAGjE,2EAA2E;AAC3E,qEAAqE;AACrE,gCAAgC;AAChC,MAAM,SAAS,GAAoC;IACjD,sBAAsB;IACtB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IAC1D,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IACtD,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,0BAA0B,EAAE;IAC1E,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,iBAAiB,EAAE;IACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IACtD,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IAC5D,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,oBAAoB,EAAE;IAC9D,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,qBAAqB,EAAE;IAChE,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,sBAAsB,EAAE;IAClE,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,uBAAuB,EAAE;IAEpE,sDAAsD;IACtD,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,4BAA4B,EAAE;IAC1E,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,EAAE,kCAAkC,EAAE;IACtF,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,EAAE,kCAAkC,EAAE;IACtF,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,EAAE,qCAAqC,EAAE;IAC5F,EAAE,IAAI,EAAE,uCAAuC,EAAE,GAAG,EAAE,sCAAsC,EAAE;IAC9F,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,mCAAmC,EAAE;IACxF,EAAE,IAAI,EAAE,0CAA0C,EAAE,GAAG,EAAE,yCAAyC,EAAE;IACpG,EAAE,IAAI,EAAE,2CAA2C,EAAE,GAAG,EAAE,0CAA0C,EAAE;IACtG,EAAE,IAAI,EAAE,wCAAwC,EAAE,GAAG,EAAE,uCAAuC,EAAE;CACjG,CAAA;AA6DC,8BAAS;AA1DX,uEAAuE;AACvE,MAAM,aAAa,GAAG;IACpB,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,eAAe,EAAE;IAChF,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE;CAC3E,CAAA;AAuDC,sCAAa;AApDf,wEAAwE;AACxE,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,OAAO,GAAG,KAAK,EAAE,KAAU,EAAE,IAKlC,EAAE,EAAE;IAEH,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAA;IAE7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAA;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;QACtB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;IAEhE,MAAM,KAAK,GAAwB;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,IAAI,CAAC;QACzB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACtC,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,YAAY,EAAE,IAAI,CAAC,QAAQ;KAC5B,CAAA;IAED,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,yBAAc,EAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAEzC,IAAI,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpB,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,IAAA,uBAAY,EAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QACzE,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,YAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAA;AAC7D,CAAC,CAAA;AAIC,0BAAO"}

package/env/env_gen.ts

@@ -20,6 +20,7 @@ import { camelify } from '@voxgig/util'
 import { CoreConfShape } from '../shape/conf'
 
 import { generate, loadFragment, renderFragment } from './lambda/generate'
+import { web_gen } from './web/web_gen'
 
 
 // The supported environment kinds and the files each generates.
@@ -93,6 +94,8 @@ const env_gen = async (model: any, spec: {
   tm?: string        // project tm/env folder (fragment shadowing)
   src?: string       // project src/env folder: runtime entries generated
                      // here ONCE (existing files are never overwritten)
+  root?: string      // project root (holds backend/ and web/) - required
+                     // for the 'web' kind (full frontend generation)
 }) => {
 
   const core = CoreConfShape(model.main.conf.core)
@@ -107,6 +110,17 @@ const env_gen = async (model: any, spec: {
     }
 
     const kind = def.kind || name
+
+    // The 'web' kind is the frontend SPA (+ backend web runner + auth),
+    // not a flat deployment-artifact set - delegate to EnvWeb.
+    if ('web' === kind) {
+      if (null == spec.root) {
+        throw new Error('@voxgig/build: env kind "web" needs spec.root ' +
+          '(the project root); pass it from the build action')
+      }
+      await web_gen(model, { root: spec.root, tm: spec.tm, env: def })
+      continue
+    }
     const filedefs = ENV_FILES[kind]
     if (null == filedefs) {
       throw new Error('@voxgig/build: unknown environment kind: ' + kind +

package/env/web/web_gen.ts

@@ -0,0 +1,115 @@
+/* Copyright © 2026 Voxgig Ltd, MIT License. */
+
+// EnvWeb: generate the experimental web frontend - a Single Page App built
+// from web components on a client-side Seneca service bus (no React/Vue) -
+// plus the backend web runner and auth service it needs.
+//
+// Everything EnvWeb generates is CREATE-ONCE: a project owns its frontend
+// after generation (the SPA is a starting point users heavily customize).
+// Fragments live in @voxgig/build tm/web/ and are project-shadowable via
+// spec.tm (the project's tm/web folder), like every other template.
+//
+// The entity admin is model-driven at RUNTIME (it fetches the compiled
+// model.json), so the generated SPA adapts to any model with no
+// per-entity code generation.
+
+import Fs from 'fs'
+import Path from 'path'
+
+import { camelify } from '@voxgig/util'
+
+import { CoreConfShape } from '../../shape/conf'
+
+import { loadFragment, renderFragment } from '../lambda/generate'
+
+
+// File manifest: fragment (relative to tm/web) -> output path (relative to
+// the project root, which holds backend/ and web/). $$slots$$ in the
+// output path are rendered too.
+const WEB_FILES: { frag: string, out: string }[] = [
+  // Frontend SPA (web/)
+  { frag: 'web/package.json.frag', out: 'web/package.json' },
+  { frag: 'web/index.html.frag', out: 'web/index.html' },
+  { frag: 'web/playwright.config.js.frag', out: 'web/playwright.config.js' },
+  { frag: 'web/src/main.js.frag', out: 'web/src/main.js' },
+  { frag: 'web/src/bus.js.frag', out: 'web/src/bus.js' },
+  { frag: 'web/src/style.css.frag', out: 'web/src/style.css' },
+  { frag: 'web/src/cmp/app.js.frag', out: 'web/src/cmp/app.js' },
+  { frag: 'web/src/cmp/auth.js.frag', out: 'web/src/cmp/auth.js' },
+  { frag: 'web/src/cmp/admin.js.frag', out: 'web/src/cmp/admin.js' },
+  { frag: 'web/e2e/smoke.spec.js.frag', out: 'web/e2e/smoke.spec.js' },
+
+  // Backend web runner + auth service (backend/src/...)
+  { frag: 'backend/env/web/web.ts.frag', out: 'backend/src/env/web/web.ts' },
+  { frag: 'backend/srv/auth/auth-srv.ts.frag', out: 'backend/src/srv/auth/auth-srv.ts' },
+  { frag: 'backend/srv/auth/get_info.ts.frag', out: 'backend/src/srv/auth/get_info.ts' },
+  { frag: 'backend/srv/auth/signin_user.ts.frag', out: 'backend/src/srv/auth/signin_user.ts' },
+  { frag: 'backend/srv/auth/signout_user.ts.frag', out: 'backend/src/srv/auth/signout_user.ts' },
+  { frag: 'backend/srv/auth/load_auth.ts.frag', out: 'backend/src/srv/auth/load_auth.ts' },
+  { frag: 'backend/srv/auth/web_signin_user.ts.frag', out: 'backend/src/srv/auth/web_signin_user.ts' },
+  { frag: 'backend/srv/auth/web_signout_user.ts.frag', out: 'backend/src/srv/auth/web_signout_user.ts' },
+  { frag: 'backend/srv/auth/web_load_auth.ts.frag', out: 'backend/src/srv/auth/web_load_auth.ts' },
+]
+
+
+// Default seeded users (local testing only), rendered into the runner.
+const DEFAULT_USERS = [
+  { name: 'Alice Example', email: 'alice@example.com', password: 'alice-pass-01' },
+  { name: 'Bob Example', email: 'bob@example.com', password: 'bob-pass-01' },
+]
+
+
+// web_gen(model, spec): generate the frontend + backend web pieces into
+// the project. spec.root is the project root (parent of backend/); files
+// that already exist are left untouched (create-once).
+const web_gen = async (model: any, spec: {
+  root: string       // project root (holds backend/ and web/)
+  tm?: string        // project tm/web folder (fragment shadowing)
+  env?: any          // the model env entry (config: port, users)
+  force?: boolean    // overwrite existing files (default: create-once)
+}) => {
+
+  const core = CoreConfShape(model.main.conf.core)
+  const envdef = spec.env || {}
+
+  const users = envdef.users || DEFAULT_USERS
+  const seed = users[0] || DEFAULT_USERS[0]
+  const port = envdef.port ||
+    (model.main.conf.port && model.main.conf.port.backend) || 8080
+
+  const slots: Record<string, any> = {
+    name: core.name,
+    Name: camelify(core.name),
+    users: JSON.stringify(users, null, 2),
+    e2eport: envdef.e2eport || (port + 10),
+    seedEmail: seed.email,
+    seedPassword: seed.password,
+  }
+
+  const created: string[] = []
+  const skipped: string[] = []
+
+  for (const fd of WEB_FILES) {
+    const outrel = renderFragment(fd.out, slots)
+    const dest = Path.join(spec.root, outrel)
+
+    if (Fs.existsSync(dest) && !spec.force) {
+      skipped.push(outrel)
+      continue
+    }
+
+    const content = renderFragment(loadFragment(fd.frag, spec, 'web'), slots)
+    Fs.mkdirSync(Path.dirname(dest), { recursive: true })
+    Fs.writeFileSync(dest, content)
+    created.push(outrel)
+  }
+
+  return { created: created.sort(), skipped: skipped.sort() }
+}
+
+
+export {
+  web_gen,
+  WEB_FILES,
+  DEFAULT_USERS,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/build",
-  "version": "4.2.0",
+  "version": "4.4.0",
   "main": "dist/build.js",
   "type": "commonjs",
   "types": "dist/build.d.ts",

package/tm/web/backend/env/web/web.ts.frag

@@ -0,0 +1,120 @@
+
+// Local web runner: the local in-memory backend plus an HTTP layer for
+// the SPA - express serving web/dist, the model, and a single seneca
+// gateway endpoint (/seneca) that the browser-side Seneca bus posts
+// messages to (seneca-browser fetch transport). Cookie auth via
+// @seneca/gateway-auth (express_cookie): signin sets the todo-auth
+// cookie, after which the gateway attaches the principal so @seneca/owner
+// scopes todos per user.
+//
+// Predefined users are seeded at startup (local testing only).
+
+import Path from 'node:path'
+
+import Express from 'express'
+import CookieParser from 'cookie-parser'
+
+import Seneca from 'seneca'
+import { Local } from '@voxgig/system'
+
+import { basic, base } from '../shared/basic'
+
+import Pkg from '../../../package.json'
+import Model from '../../../model/model.json'
+
+
+const PORT = parseInt(process.env.PORT || '', 10) ||
+  (Model as any).main.conf.port.backend
+
+// Predefined users seeded at startup (local testing only). Edit freely.
+const USERS = $$users$$
+
+
+run()
+
+
+async function run() {
+  const { deep } = Seneca.util
+
+  const seneca = Seneca(deep(base.seneca, { tag: '$$name$$-web' }))
+
+  seneca.context.model = Model
+  seneca.context.env = 'local'
+  seneca.context.stage = 'local'
+  seneca.context.srvname = 'all'
+  seneca.context.pkg = Pkg
+
+  seneca.test()
+
+  basic(seneca)
+
+  seneca
+    .use('gateway', {
+      // Allow auth + every service the model declares (aim:<srv>).
+      allow: Object.keys((Model as any).main.srv).reduce(
+        (a: any, n: string) => (a['aim:' + n] = true, a),
+        { 'aim:req,on:auth': true }),
+    })
+    .use('gateway-express', {
+      // gateway-express sets/clears the auth cookie when a result carries
+      // gateway$.auth (see web_signin_user / web_signout_user). Cookie
+      // attributes use the plugin defaults (httpOnly, sameSite).
+      auth: {
+        token: {
+          name: '$$name$$-auth',
+        },
+      },
+    })
+    .use('gateway-auth', {
+      spec: {
+        express_cookie: {
+          active: true,
+          token: {
+            name: '$$name$$-auth',
+          },
+          user: {
+            auth: true,
+            require: false,
+          },
+        },
+      },
+    })
+
+  seneca.use(Local, {
+    srv: {
+      folder: __dirname + '/../../../dist/srv',
+    },
+  })
+
+  await seneca.ready()
+
+  // Seed the predefined users (idempotent per boot: in-memory store).
+  for (const u of USERS) {
+    const res = await seneca.post('sys:user,register:user', u)
+    if (!res.ok) {
+      console.log('SEED-USER-FAILED', u.email, res.why)
+    }
+  }
+
+  const app = Express()
+  // web/ is a sibling of backend/; from dist/env/local go up to the
+  // project root, then web/dist.
+  const webdist = Path.join(
+    __dirname, '..', '..', '..', '..', 'web', 'dist')
+
+  app
+    .use(Express.json())
+    .use(new (CookieParser as any)())
+    .post('/seneca', seneca.export('gateway-express/handler'))
+    .get('/model.json',
+      (_req: any, res: any) => res.sendFile(
+        Path.join(__dirname, '..', '..', '..', 'model', 'model.json')))
+    .use(Express.static(webdist))
+    .listen(PORT)
+
+  console.log('$$name$$-web started', {
+    port: PORT,
+    users: USERS.map((u) => u.email),
+    version: Pkg.version,
+  })
+}

package/tm/web/backend/srv/auth/auth-srv.ts.frag

@@ -0,0 +1,4 @@
+
+import { MakeSrv } from '@voxgig/system'
+
+module.exports = MakeSrv('auth', require)

package/tm/web/backend/srv/auth/get_info.ts.frag

@@ -0,0 +1,5 @@
+module.exports = function make_get_info() {
+  return async function get_info(this: any, _msg: any) {
+    return { ok: true, srv: 'auth' }
+  }
+}

package/tm/web/backend/srv/auth/load_auth.ts.frag

@@ -0,0 +1,6 @@
+module.exports = function make_load_auth() {
+  return async function load_auth(this: any, msg: any) {
+    const user = await this.entity('sys/user').load$(msg.user_id)
+    return { ok: !!user, state: user ? 'signedin' : 'signedout', user }
+  }
+}

package/tm/web/backend/srv/auth/signin_user.ts.frag

@@ -0,0 +1,14 @@
+// Sign a user in via @seneca/user login (email + password).
+module.exports = function make_signin_user() {
+  return async function signin_user(this: any, msg: any) {
+    const seneca = this
+
+    const out = await seneca.post('sys:user,login:user', {
+      email: msg.email,
+      password: msg.password,
+      fields: ['id', 'email', 'name', 'handle'],
+    })
+
+    return out
+  }
+}

package/tm/web/backend/srv/auth/signout_user.ts.frag

@@ -0,0 +1,5 @@
+module.exports = function make_signout_user() {
+  return async function signout_user(this: any, msg: any) {
+    return this.post('sys:user,logout:user', { token: msg.token })
+  }
+}

package/tm/web/backend/srv/auth/web_load_auth.ts.frag

@@ -0,0 +1,12 @@
+// Current auth state, from the principal the gateway resolved (cookie).
+module.exports = function make_web_load_auth() {
+  return async function web_load_auth(this: any, _msg: any, meta: any) {
+    const user = meta.custom?.principal?.user
+    const out: any = { ok: true, state: 'signedout' }
+    if (user) {
+      out.state = 'signedin'
+      out.user = { id: user.id, email: user.email, handle: user.handle }
+    }
+    return out
+  }
+}

package/tm/web/backend/srv/auth/web_signin_user.ts.frag

@@ -0,0 +1,25 @@
+// Gateway signin: on success the gateway$ auth token result field makes
+// gateway-auth (express_cookie) set the auth cookie.
+module.exports = function make_web_signin_user() {
+  return async function web_signin_user(this: any, msg: any) {
+    const res = await this.post('aim:auth,signin:user', {
+      email: msg.email,
+      password: msg.password,
+    })
+
+    const out: any = { ok: res.ok }
+    if (res.ok) {
+      out.gateway$ = { auth: { token: res.login.token } }
+      out.user = {
+        id: res.user.id,
+        email: res.user.email,
+        name: res.user.name,
+        handle: res.user.handle,
+      }
+    }
+    else {
+      out.why = res.why
+    }
+    return out
+  }
+}

package/tm/web/backend/srv/auth/web_signout_user.ts.frag

@@ -0,0 +1,9 @@
+module.exports = function make_web_signout_user() {
+  return async function web_signout_user(this: any, _msg: any, meta: any) {
+    const token = meta.custom?.principal?.token
+    if (token) {
+      await this.post('aim:auth,signout:user', { token })
+    }
+    return { ok: true, gateway$: { auth: { remove: true } } }
+  }
+}

package/tm/web/web/e2e/smoke.spec.js.frag

@@ -0,0 +1,21 @@
+import { test, expect } from '@playwright/test'
+
+// Generic smoke test: the SPA boots, a seeded user can sign in, and the
+// model-driven entity admin renders with at least one entity. Add
+// project-specific CRUD flows alongside this file.
+
+test('sign in and load the entity admin', async ({ page }) => {
+  await page.goto('/')
+
+  await expect(page.locator('vg-auth h2')).toHaveText('Sign in')
+
+  await page.fill('input[name=email]', '$$seedEmail$$')
+  await page.fill('input[name=password]', '$$seedPassword$$')
+  await page.click('vg-auth button[type=submit]')
+
+  await expect(page.locator('.vg-auth-bar b')).toHaveText('$$seedEmail$$')
+  await expect(page.locator('vg-entity-admin nav a')).not.toHaveCount(0)
+
+  // The first entity's list loads (count line rendered).
+  await expect(page.locator('#vg-count')).toBeVisible()
+})

package/tm/web/web/index.html.frag

@@ -0,0 +1,15 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>$$Name$$</title>
+    <script src="/seneca-browser.js"></script>
+    <script src="/seneca-browser-store.js"></script>
+    <script src="/seneca-browser-debug.js"></script>
+  </head>
+  <body>
+    <vg-app></vg-app>
+    <script type="module" src="/src/main.js"></script>
+  </body>
+</html>

package/tm/web/web/package.json.frag

@@ -0,0 +1,19 @@
+{
+  "name": "$$name$$-web",
+  "version": "0.1.0",
+  "private": true,
+  "description": "$$Name$$ SPA: web components on a Seneca service bus",
+  "scripts": {
+    "postinstall": "node -e \"const fs=require('fs');fs.mkdirSync('public',{recursive:true});for(const p of ['seneca-browser','@voxgig/seneca-browser-store','@voxgig/seneca-browser-debug'])fs.copyFileSync(require.resolve(p),'public/'+p.replace('@voxgig/','')+'.js')\"",
+    "dev": "vite",
+    "build": "vite build",
+    "e2e": "playwright test"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.58.2",
+    "@voxgig/seneca-browser-debug": "^0.1.0",
+    "@voxgig/seneca-browser-store": "^0.1.0",
+    "seneca-browser": "^8.0.0-rc4",
+    "vite": "^7.3.4"
+  }
+}

package/tm/web/web/playwright.config.js.frag

@@ -0,0 +1,40 @@
+// Headless-chrome E2E for the $$Name$$ SPA. The backend web runner (which
+// serves the built SPA and the /seneca gateway) is started as the test
+// webServer; Playwright waits for it, then drives the SPA.
+import { defineConfig, devices } from '@playwright/test'
+
+const PORT = $$e2eport$$
+
+export default defineConfig({
+  testDir: './e2e',
+  timeout: 30000,
+  fullyParallel: false,
+  // One worker: all specs share a single backend web runner with one
+  // in-memory store and the same seeded users, so they must run serially to
+  // avoid cross-spec contention on shared state.
+  workers: 1,
+  reporter: [['list']],
+  use: {
+    baseURL: `http://localhost:${PORT}`,
+    trace: 'off',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: {
+        ...devices['Desktop Chrome'],
+        // Self-contained chromium (no system chrome / no desktop): install
+        // with `npx playwright install chromium` (no --with-deps).
+        launchOptions: { args: ['--no-sandbox'] },
+      },
+    },
+  ],
+  webServer: {
+    command: `npm run build && cd ../backend && PORT=${PORT} node dist/env/web/web.js`,
+    url: `http://localhost:${PORT}/`,
+    timeout: 60000,
+    reuseExistingServer: false,
+    stdout: 'ignore',
+    stderr: 'pipe',
+  },
+})

package/tm/web/web/src/bus.js.frag

@@ -0,0 +1,78 @@
+// The browser-side Seneca service bus. All component state and all
+// backend communication flow through messages on this bus:
+//
+//   aim:*             -> the backend gateway (/seneca) via the
+//                        seneca-browser fetch transport (cookie auth)
+//   cmp:*             -> local component plugins (state)
+//
+// Cross-component notification uses the tiny `evt` plugin below:
+// components post cmp:bus,emit:<name> and subscribe with onEvent().
+
+/* global Seneca, SenecaBrowserStore, SenecaBrowserDebug */
+
+const bus = Seneca({
+  legacy: false,
+  timeout: 8888,
+  plugin: {
+    browser: {
+      endpoint: '/seneca',
+      fetch: {
+        credentials: 'same-origin',
+      },
+    },
+  },
+})
+  .test()
+  .client({ type: 'browser', pin: 'aim:*' })
+
+
+// Transparent state cache (Redux-like): caches aim:* query results and
+// invalidates on writes, so repeated reads are served without a round-trip.
+// Registered AFTER .client() so the aim:* pin actions exist to be wrapped.
+if ('undefined' !== typeof SenecaBrowserStore) {
+  bus.use(SenecaBrowserStore, { pin: 'aim:*' })
+}
+
+// In-window devtools: a resizable/hideable pop-up showing live Seneca
+// message flows, config, and (via the store plugin above) the cache tree.
+// aim:* messages are the remote (backend) calls. Loaded as a global script
+// in index.html; guarded so a missing bundle never breaks the app.
+if ('undefined' !== typeof SenecaBrowserDebug) {
+  bus.use(SenecaBrowserDebug, { remotePins: 'aim:*' })
+}
+
+
+// Event fanout, unified on Seneca messages: cross-component events use the
+// bus's own sub/act. Unlike a plain `add` (single handler), `sub` allows
+// many observers per pattern - so it IS the pub/sub primitive. A no-op sink
+// action lets `act` resolve; observers subscribe via `sub`. This is the same
+// mechanism reactivity uses (see @seneca/browser-store's changed:* events).
+bus.add('cmp:evt', function (msg, reply) {
+  reply()
+})
+
+function onEvent(name, fn) {
+  bus.sub('cmp:evt,name:' + name, function (msg) {
+    fn(msg.data || {})
+  })
+}
+
+function emit(name, data) {
+  bus.act('cmp:evt,name:' + name, { data })
+}
+
+
+// Avoid cross-user staleness: drop all cached queries whenever auth changes
+// (sign in / sign out), since cached results are principal-scoped.
+if ('undefined' !== typeof SenecaBrowserStore) {
+  onEvent('auth', function () {
+    bus.act('sys:browser-store,clear:store', function () {})
+  })
+}
+
+
+export {
+  bus,
+  onEvent,
+  emit,
+}

package/tm/web/web/src/cmp/admin.js.frag

@@ -0,0 +1,272 @@
+// Entity admin: a django-admin-style generic CRUD UI, driven entirely by
+// the compiled model (fetched from /model.json). The entity_admin plugin
+// owns the model + per-entity message mapping (state); the
+// <vg-entity-admin> component renders nav / list / form and talks to the
+// plugin (and through it, the backend) only via bus messages.
+
+import { bus } from '../bus.js'
+
+
+// Fields managed by the system, not the form.
+const SYS_FIELDS = ['id', 'owner_id', 't_c', 't_m', 't_mh', 't_ch']
+
+
+bus.use(function entity_admin() {
+  const seneca = this
+
+  let model = null
+
+  // Entities from the model: [{ zone, name, canon, fields }]
+  function entities() {
+    const out = []
+    const ent = (model && model.main.ent) || {}
+    for (const zone of Object.keys(ent)) {
+      if ('sys' === zone) {
+        continue
+      }
+      for (const name of Object.keys(ent[zone])) {
+        out.push({
+          zone,
+          name,
+          canon: zone + '/' + name,
+          fields: ent[zone][name].field || {},
+        })
+      }
+    }
+    return out
+  }
+
+  // Message mapping convention: entity zone/name -> aim:<zone>,<verb>:<name>.
+  function msgFor(canon, verb) {
+    const [zone, name] = canon.split('/')
+    return { aim: zone, [verb]: name }
+  }
+
+  seneca.add('cmp:entity_admin,load:model', function (msg, reply) {
+    if (model) {
+      return reply({ ok: true, entities: entities() })
+    }
+    fetch('/model.json').then((r) => r.json()).then((m) => {
+      model = m
+      reply({ ok: true, entities: entities() })
+    }).catch((e) => reply({ ok: false, why: String(e) }))
+  })
+
+  seneca.add('cmp:entity_admin,list:item', function (msg, reply) {
+    this.act(msgFor(msg.canon, 'list'), function (err, out) {
+      reply(err ? { ok: false, why: err.message } : out)
+    })
+  })
+
+  // Save/remove just pass through to the backend. The UI refresh is NOT
+  // triggered here: the store plugin emits a sys:browser-store,changed:group
+  // message on the write, and <vg-entity-admin> re-lists reactively in
+  // response (see connectedCallback). This decouples "who mutated" from
+  // "who must refresh".
+  seneca.add('cmp:entity_admin,save:item', function (msg, reply) {
+    this.act({ ...msgFor(msg.canon, 'save'), item: msg.item },
+      function (err, out) {
+        reply(err ? { ok: false, why: err.message } : out)
+      })
+  })
+
+  seneca.add('cmp:entity_admin,remove:item', function (msg, reply) {
+    this.act({ ...msgFor(msg.canon, 'remove'), id: msg.id },
+      function (err, out) {
+        reply(err ? { ok: false, why: err.message } : out)
+      })
+  })
+})
+
+
+function inputFor(fname, fdef, value) {
+  const kind = (fdef && fdef.kind) || 'String'
+  const val = null == value ? '' : value
+  if ('Boolean' === kind) {
+    return `<input name="${fname}" type="checkbox" ${true === value ? 'checked' : ''} />`
+  }
+  if ('Number' === kind) {
+    return `<input name="${fname}" type="number" value="${val}" />`
+  }
+  return `<input name="${fname}" type="text" value="${String(val).replace(/"/g, '&quot;')}" />`
+}
+
+
+class VgEntityAdmin extends HTMLElement {
+  constructor() {
+    super()
+    this.canon = null
+    this.editing = null   // item being edited, or {} for new
+  }
+
+  connectedCallback() {
+    // Reactivity via Seneca messages: re-list whenever the store signals that
+    // this entity's data changed - regardless of which component wrote it.
+    // `sub` is Seneca's native fan-out (many observers per pattern), so this
+    // is the same messaging primitive used everywhere else.
+    bus.sub('sys:browser-store,changed:group', (msg) => {
+      if (this.isConnected && msg.group === this.canon) {
+        this.renderList()
+      }
+    })
+    bus.sub('sys:browser-store,changed:all', () => {
+      if (this.isConnected && this.canon) {
+        this.renderList()
+      }
+    })
+    this.render()
+  }
+
+  async render() {
+    const res = await bus.post('cmp:entity_admin,load:model')
+    if (!res.ok) {
+      this.innerHTML = `<p>model load failed: ${res.why}</p>`
+      return
+    }
+    this.entities = res.entities
+    if (null == this.canon && 0 < res.entities.length) {
+      this.canon = res.entities[0].canon
+    }
+
+    const nav = res.entities.map((e) =>
+      `<a href="#" class="vg-nav ${e.canon === this.canon ? 'sel' : ''}"
+        data-canon="${e.canon}">${e.canon}</a>`).join(' ')
+
+    this.innerHTML = `
+      <div class="vg-admin">
+        <nav>${nav}</nav>
+        <div id="vg-list"></div>
+        <div id="vg-form"></div>
+      </div>`
+
+    for (const a of this.querySelectorAll('.vg-nav')) {
+      a.onclick = (ev) => {
+        ev.preventDefault()
+        this.canon = a.dataset.canon
+        this.editing = null
+        this.render()
+      }
+    }
+
+    await this.renderList()
+    this.renderForm()
+  }
+
+  entdef() {
+    return this.entities.find((e) => e.canon === this.canon)
+  }
+
+  async renderList() {
+    // May be invoked reactively (store change event) before the first full
+    // render has built the DOM - skip until the list container exists.
+    if (!this.entities || !this.querySelector('#vg-list')) {
+      return
+    }
+    const out = await bus.post('cmp:entity_admin,list:item',
+      { canon: this.canon })
+    const items = (out.ok && out.list) || []
+    const fields = Object.keys(this.entdef().fields)
+      .filter((f) => !SYS_FIELDS.includes(f))
+
+    const head = fields.map((f) => `<th>${f}</th>`).join('')
+    const rows = items.map((item) => `
+      <tr data-id="${item.id}">
+        ${fields.map((f) => `<td>${null == item[f] ? '' : item[f]}</td>`).join('')}
+        <td>
+          <button class="vg-edit" data-id="${item.id}">edit</button>
+          <button class="vg-del" data-id="${item.id}">delete</button>
+        </td>
+      </tr>`).join('')
+
+    this.querySelector('#vg-list').innerHTML = `
+      <h2>${this.canon} <button id="vg-new">new</button></h2>
+      <table class="vg-table">
+        <thead><tr>${head}<th></th></tr></thead>
+        <tbody>${rows}</tbody>
+      </table>
+      <p id="vg-count">${items.length} item${1 === items.length ? '' : 's'}</p>`
+
+    this.items = items
+    this.querySelector('#vg-new').onclick = () => {
+      this.editing = {}
+      this.renderForm()
+    }
+    for (const b of this.querySelectorAll('.vg-edit')) {
+      b.onclick = () => {
+        this.editing = this.items.find((i) => i.id === b.dataset.id)
+        this.renderForm()
+      }
+    }
+    for (const b of this.querySelectorAll('.vg-del')) {
+      b.onclick = async () => {
+        await bus.post('cmp:entity_admin,remove:item',
+          { canon: this.canon, id: b.dataset.id })
+        // The list refresh comes reactively from the store's changed event.
+        this.editing = null
+        this.renderForm()
+      }
+    }
+  }
+
+  renderForm() {
+    const box = this.querySelector('#vg-form')
+    if (null == this.editing) {
+      box.innerHTML = ''
+      return
+    }
+
+    const def = this.entdef()
+    const fields = Object.keys(def.fields)
+      .filter((f) => !SYS_FIELDS.includes(f))
+
+    box.innerHTML = `
+      <form class="vg-entity-form">
+        <h3>${this.editing.id ? 'Edit' : 'New'} ${this.canon}</h3>
+        ${fields.map((f) => `
+          <label>${(def.fields[f] && def.fields[f].label) || f}
+            ${inputFor(f, def.fields[f], this.editing[f])}
+          </label>`).join('')}
+        <button type="submit">Save</button>
+        <button type="button" id="vg-cancel">Cancel</button>
+        <div id="vg-form-err"></div>
+      </form>`
+
+    box.querySelector('#vg-cancel').onclick = () => {
+      this.editing = null
+      this.renderForm()
+    }
+
+    box.querySelector('form').onsubmit = async (ev) => {
+      ev.preventDefault()
+      const item = { ...(this.editing.id ? { id: this.editing.id } : {}) }
+      for (const f of fields) {
+        const input = box.querySelector(`[name="${f}"]`)
+        const kind = (def.fields[f] && def.fields[f].kind) || 'String'
+        if ('Boolean' === kind) {
+          item[f] = input.checked
+        }
+        else if ('' === input.value) {
+          // Blank optional field: leave unset (don't send an empty string;
+          // an optional/Skip field rejects '').
+          continue
+        }
+        else {
+          item[f] = 'Number' === kind ? Number(input.value) : input.value
+        }
+      }
+      const res = await bus.post('cmp:entity_admin,save:item',
+        { canon: this.canon, item })
+      if (!res.ok) {
+        box.querySelector('#vg-form-err').textContent =
+          'save failed: ' + (res.why || '')
+      }
+      else {
+        // The list refresh comes reactively from the store's changed event.
+        this.editing = null
+        this.renderForm()
+      }
+    }
+  }
+}
+
+customElements.define('vg-entity-admin', VgEntityAdmin)

package/tm/web/web/src/cmp/app.js.frag

@@ -0,0 +1,30 @@
+// App shell: shows the auth component always; the entity admin only when
+// signed in. Reacts to bus auth events.
+
+import { bus, onEvent } from '../bus.js'
+
+
+class VgApp extends HTMLElement {
+  connectedCallback() {
+    this.innerHTML = `
+      <header><h1>$$Name$$</h1><vg-auth></vg-auth></header>
+      <main id="vg-main"></main>`
+
+    onEvent('auth', ({ user }) => this.setMain(user))
+
+    // Resolve the cookie session on load.
+    bus.post('cmp:auth,load:state')
+  }
+
+  setMain(user) {
+    const main = this.querySelector('#vg-main')
+    if (user) {
+      main.innerHTML = '<vg-entity-admin></vg-entity-admin>'
+    }
+    else {
+      main.innerHTML = '<p class="vg-hint">Sign in to manage your data.</p>'
+    }
+  }
+}
+
+customElements.define('vg-app', VgApp)

package/tm/web/web/src/cmp/auth.js.frag

@@ -0,0 +1,97 @@
+// Auth: a seneca plugin holding the signed-in principal, and the
+// <vg-auth> web component (sign-in form / signed-in bar) driving it
+// purely through bus messages.
+
+import { bus, emit } from '../bus.js'
+
+
+bus.use(function auth_cmp() {
+  const seneca = this
+
+  let user = null
+
+  seneca.add('cmp:auth,get:state', function (msg, reply) {
+    reply({ ok: true, user })
+  })
+
+  // Resolve current auth from the backend (cookie session).
+  seneca.add('cmp:auth,load:state', function (msg, reply) {
+    this.act('aim:req,on:auth,load:auth', function (err, out) {
+      user = (!err && out.ok && 'signedin' === out.state) ? out.user : null
+      emit('auth', { user })
+      reply({ ok: true, user })
+    })
+  })
+
+  seneca.add('cmp:auth,signin:user', function (msg, reply) {
+    this.act('aim:req,on:auth,signin:user', {
+      email: msg.email,
+      password: msg.password,
+    }, function (err, out) {
+      if (err || !out.ok) {
+        return reply({ ok: false, why: (out && out.why) || 'signin-failed' })
+      }
+      user = out.user
+      emit('auth', { user })
+      reply({ ok: true, user })
+    })
+  })
+
+  seneca.add('cmp:auth,signout:user', function (msg, reply) {
+    this.act('aim:req,on:auth,signout:user', function () {
+      user = null
+      emit('auth', { user })
+      reply({ ok: true })
+    })
+  })
+})
+
+
+class VgAuth extends HTMLElement {
+  connectedCallback() {
+    this.render()
+  }
+
+  async render() {
+    const state = await bus.post('cmp:auth,get:state')
+
+    if (state.user) {
+      this.innerHTML = `
+        <div class="vg-auth-bar">
+          <span>Signed in: <b>${state.user.email}</b></span>
+          <button id="vg-signout">Sign out</button>
+        </div>`
+      this.querySelector('#vg-signout').onclick = async () => {
+        await bus.post('cmp:auth,signout:user')
+        this.render()
+      }
+    }
+    else {
+      this.innerHTML = `
+        <form class="vg-auth-form">
+          <h2>Sign in</h2>
+          <label>Email <input name="email" type="email" required /></label>
+          <label>Password <input name="password" type="password" required /></label>
+          <button type="submit">Sign in</button>
+          <div class="vg-auth-err" id="vg-auth-err"></div>
+        </form>`
+      this.querySelector('form').onsubmit = async (ev) => {
+        ev.preventDefault()
+        const fd = new FormData(ev.target)
+        const res = await bus.post('cmp:auth,signin:user', {
+          email: fd.get('email'),
+          password: fd.get('password'),
+        })
+        if (!res.ok) {
+          this.querySelector('#vg-auth-err').textContent =
+            'Sign in failed: ' + res.why
+        }
+        else {
+          this.render()
+        }
+      }
+    }
+  }
+}
+
+customElements.define('vg-auth', VgAuth)

package/tm/web/web/src/main.js.frag

@@ -0,0 +1,10 @@
+// Todo SPA entry: web components on a Seneca service bus (experimental).
+// No framework: each component is a custom element backed by a seneca
+// plugin (state), and all data flows are bus messages - aim:* messages
+// travel to the backend gateway via the seneca-browser fetch transport.
+
+import './style.css'
+import './bus.js'
+import './cmp/auth.js'
+import './cmp/admin.js'
+import './cmp/app.js'

package/tm/web/web/src/style.css.frag

@@ -0,0 +1,26 @@
+* { box-sizing: border-box; }
+body { font: 15px/1.5 system-ui, sans-serif; margin: 0; color: #1c2733; }
+header { display: flex; align-items: center; justify-content: space-between;
+  padding: 0.6rem 1.2rem; border-bottom: 2px solid #e3e8ee; }
+header h1 { font-size: 1.2rem; margin: 0; }
+main { padding: 1.2rem; max-width: 60rem; }
+
+.vg-auth-bar { display: flex; gap: 0.8rem; align-items: center; }
+.vg-auth-form { max-width: 22rem; display: grid; gap: 0.6rem; }
+.vg-auth-form label { display: grid; gap: 0.2rem; }
+.vg-auth-err { color: #b3261e; min-height: 1.2em; }
+
+.vg-admin nav { margin-bottom: 1rem; }
+.vg-admin nav a { margin-right: 0.8rem; text-decoration: none; }
+.vg-admin nav a.sel { font-weight: 700; border-bottom: 2px solid #1c2733; }
+
+.vg-table { border-collapse: collapse; width: 100%; }
+.vg-table th, .vg-table td { text-align: left; padding: 0.35rem 0.6rem;
+  border-bottom: 1px solid #e3e8ee; }
+
+.vg-entity-form { margin-top: 1.2rem; max-width: 26rem; display: grid;
+  gap: 0.6rem; padding: 1rem; border: 1px solid #e3e8ee; border-radius: 6px; }
+.vg-entity-form label { display: grid; gap: 0.2rem; }
+
+button { cursor: pointer; padding: 0.25rem 0.7rem; }
+.vg-hint { color: #5b6b7b; }