feat: centralize application framework primitives

packages/auth/src/engine.ts

@@ -266,7 +266,29 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
   if (options.secret.length < MIN_SECRET_LENGTH) {
     throw new TypeError(`auth secret must be at least ${MIN_SECRET_LENGTH} characters`);
   }
-  const store = options.store;
+  let resolvedStore: AuthStore | undefined;
+  const resolveStore = (): AuthStore => {
+    if (resolvedStore) return resolvedStore;
+    resolvedStore = typeof options.store === "function" ? options.store() : options.store;
+    if (!resolvedStore || typeof resolvedStore !== "object") {
+      throw new TypeError("WRN-AUTH-STORE: the auth store factory did not return an AuthStore");
+    }
+    return resolvedStore;
+  };
+  // AuthEngine.store remains source-compatible while deferring the factory
+  // until the first actual property read or method call.
+  const store = new Proxy({} as AuthStore, {
+    get(_target, property) {
+      const value = Reflect.get(resolveStore() as object, property);
+      return typeof value === "function" ? value.bind(resolveStore()) : value;
+    },
+    set(_target, property, value) {
+      return Reflect.set(resolveStore() as object, property, value);
+    },
+    has(_target, property) {
+      return Reflect.has(resolveStore() as object, property);
+    },
+  });
   const now = () => {
     const value = options.clock?.now() ?? Date.now();
     if (!Number.isFinite(value)) throw new Error("WRN-AUTH-CLOCK: clock returned an invalid time");