From 9332522614465f5dc60feed38e2f6dfff8b2941a Mon Sep 17 00:00:00 2001
From: Ajay Ghanwat <ghanwat.ajay@workroot.in>
Date: Sat, 22 Aug 2026 23:36:31 +0530
Subject: [PATCH] fix: initialize configured auth in production builds

---
 bun.lock                    | 4 ++--
 packages/auth/package.json  | 2 +-
 packages/auth/src/engine.ts | 5 +++++
 packages/cli/package.json   | 2 +-
 packages/cli/src/build.ts   | 9 +++++++++
 5 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/bun.lock b/bun.lock
index 007e5ba8..0919c85d 100644
--- a/bun.lock
+++ b/bun.lock
@@ -235,7 +235,7 @@
     },
     "packages/auth": {
       "name": "@wrnexus/auth",
-      "version": "0.8.16",
+      "version": "0.8.17",
       "dependencies": {
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/captcha": "workspace:*",
@@ -292,7 +292,7 @@
     },
     "packages/cli": {
       "name": "@wrnexus/cli",
-      "version": "0.8.50",
+      "version": "0.8.51",
       "bin": {
         "wrnexus": "src/index.ts",
       },
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 4945c420..a9d60ce1 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/auth",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "description": "Complete authentication, account security, MFA, passkeys, recovery, devices, risk, and audit system for WRNexusJS.",
   "type": "module",
   "sideEffects": false,
diff --git a/packages/auth/src/engine.ts b/packages/auth/src/engine.ts
index ab448a42..ed44709d 100644
--- a/packages/auth/src/engine.ts
+++ b/packages/auth/src/engine.ts
@@ -11,6 +11,7 @@ import {
 import { inferIdentityType, normalizeIdentity, publicUser } from "./normalize.ts";
 import { assertPasskeyProvider, MemoryPasskeyChallengeStore } from "./passkeys/index.ts";
 import { evaluateAuthRisk } from "./risk.ts";
+import { setDefaultAuthEngine } from "./runtime.ts";
 import type { AuthStore } from "./store.ts";
 import { generateTotpSecret, totpUri, verifyTotp } from "./totp/index.ts";
 import type {
@@ -2298,5 +2299,9 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
     },
   };
 
+  // The application config is evaluated in both dev and generated production
+  // runtimes. Registering here makes that configured engine available to the
+  // package-owned routes without an application startup shim.
+  setDefaultAuthEngine(engine);
   return engine;
 }
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 156bc2e8..6cb1bccb 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.8.50",
+  "version": "0.8.51",
   "type": "module",
   "main": "src/index.ts",
   "exports": {
diff --git a/packages/cli/src/build.ts b/packages/cli/src/build.ts
index 289e95ec..ee81b9ca 100644
--- a/packages/cli/src/build.ts
+++ b/packages/cli/src/build.ts
@@ -702,6 +702,15 @@ applyAuthzManifestEarly([${authzSetupEntries}]);
     imports.push(`import "./.authz-setup.ts";`);
   }
 
+  // Runtime plugin state (notably the configured auth engine and OAuth
+  // providers) is established by evaluating the application config. The build
+  // process runs in a different process, so its globals cannot serve the
+  // generated production server.
+  const runtimeConfigPath = ["wrnexus.config.ts", "wrnexus.config.js", "wrnexus.config.mjs"]
+    .map((name) => join(appRoot, name))
+    .find(existsSync);
+  if (runtimeConfigPath) imports.push(`import ${JSON.stringify(fwd(runtimeConfigPath))};`);
+
   const manifestRoutes = (routes: Route[]): string => {
     const parts = routes.map((r) => {
       const v = `m${counter++}`;