fix: initialize configured auth in production builds

bun.lock

@@ -235,7 +235,7 @@
     },
     "packages/auth": {
       "name": "@wrnexus/auth",
-      "version": "0.8.16",
+      "version": "0.8.17",
       "dependencies": {
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/captcha": "workspace:*",
@@ -292,7 +292,7 @@
     },
     "packages/cli": {
       "name": "@wrnexus/cli",
-      "version": "0.8.50",
+      "version": "0.8.51",
       "bin": {
         "wrnexus": "src/index.ts",
       },

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/auth",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "description": "Complete authentication, account security, MFA, passkeys, recovery, devices, risk, and audit system for WRNexusJS.",
   "type": "module",
   "sideEffects": false,

packages/auth/src/engine.ts

@@ -11,6 +11,7 @@ import {
 import { inferIdentityType, normalizeIdentity, publicUser } from "./normalize.ts";
 import { assertPasskeyProvider, MemoryPasskeyChallengeStore } from "./passkeys/index.ts";
 import { evaluateAuthRisk } from "./risk.ts";
+import { setDefaultAuthEngine } from "./runtime.ts";
 import type { AuthStore } from "./store.ts";
 import { generateTotpSecret, totpUri, verifyTotp } from "./totp/index.ts";
 import type {
@@ -2298,5 +2299,9 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
     },
   };
 
+  // The application config is evaluated in both dev and generated production
+  // runtimes. Registering here makes that configured engine available to the
+  // package-owned routes without an application startup shim.
+  setDefaultAuthEngine(engine);
   return engine;
 }

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.8.50",
+  "version": "0.8.51",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/cli/src/build.ts

@@ -702,6 +702,15 @@ applyAuthzManifestEarly([${authzSetupEntries}]);
     imports.push(`import "./.authz-setup.ts";`);
   }
 
+  // Runtime plugin state (notably the configured auth engine and OAuth
+  // providers) is established by evaluating the application config. The build
+  // process runs in a different process, so its globals cannot serve the
+  // generated production server.
+  const runtimeConfigPath = ["wrnexus.config.ts", "wrnexus.config.js", "wrnexus.config.mjs"]
+    .map((name) => join(appRoot, name))
+    .find(existsSync);
+  if (runtimeConfigPath) imports.push(`import ${JSON.stringify(fwd(runtimeConfigPath))};`);
+
   const manifestRoutes = (routes: Route[]): string => {
     const parts = routes.map((r) => {
       const v = `m${counter++}`;