feat: centralize application framework primitives

packages/auth/test/plugin.test.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "bun:test";
 import type { Context } from "@wrnexus/core";
 import { createPluginRunner } from "@wrnexus/plugin";
-import { authPlugin } from "../src/plugin.ts";
+import { authPlugin, validateProductionAuthConfig } from "../src/plugin.ts";
 import { AUTH_ROUTE_DEFINITIONS } from "../src/routes/definitions.ts";
 import { readFileSync } from "node:fs";
 import { createAuthEngine } from "../src/engine.ts";
@@ -65,6 +65,21 @@ test("plugin contributes components, runtime, styles, migration, and toolbar", a
   expect(contributions.middleware).toHaveLength(1);
 });
 
+test("production auth validation rejects development secrets and origins", () => {
+  expect(() =>
+    validateProductionAuthConfig(
+      { baseUrl: "http://localhost:3000" },
+      { AUTH_SECRET: "change-me" },
+    ),
+  ).toThrow("AUTH_SECRET");
+  expect(() =>
+    validateProductionAuthConfig(
+      { baseUrl: "http://app.example" },
+      { AUTH_SECRET: "a-production-secret-that-is-longer-than-thirty-two-characters" },
+    ),
+  ).toThrow("HTTPS");
+});
+
 test("unconfigured automatic discovery fails closed for routes, middleware, and migrations", async () => {
   const metadata = new Map<string, unknown>();
   const runner = createPluginRunner(authPlugin(), {