# Published auth package consumer

This directory is an isolated PDF2HTML consumer of the published platform auth packages. It does not import from `/home/user/Projects/platform` or use workspace-relative package sources.

## Pinned package contract

Pins come from `/home/user/Projects/pdf2html/pnpm-workspace.yaml` and `/home/user/Projects/pdf2html/docs/integration/platform-auth.md` dated 2026-08-23:

- `@platform-modules/auth` `0.2.2`
- `@platform-modules/auth-react` `0.0.2`
- React `18.3.1`
- TypeScript `5.9.3`
- Vitest `3.2.6`

The compile fixture consumes the documented root exports for server and browser composition. The runtime test imports only these published public paths:

- `@platform-modules/auth`
- `@platform-modules/auth/engine-custom`
- `@platform-modules/auth/engine-better-auth`
- `@platform-modules/auth/otp-email`
- `@platform-modules/auth/api-keys`
- `@platform-modules/auth/oauth-provider`
- `@platform-modules/auth-react`

No credentials are used by the composition or tests. A fake `AuthEngine` exercises cookie lookup and the server role guard; the React fixture compiles an injected `AuthClient`, `AuthProvider`, and `RequireRole` composition.

## Verification evidence

All install, typecheck, test, and build work ran remotely through the established `run-remote` dispatcher. No dependency or build command ran locally.

Final run: `pdf2html-auth-consumer-verify2` on `debian3`, 2026-08-23.

Command shape (registry credentials supplied by the remote host configuration and never printed):

```text
run-remote launch --host debian3 --repo /home/user/Projects/pdf2html -- npm --prefix quality/platform-consumer/auth install
```

The package `postinstall` invokes `npm run verify`, which ran these stages in order:

```text
tsc --noEmit
vitest run
tsc -p tsconfig.build.json
```

Result:

```text
typecheck: PASS
test: PASS — 1 file, 2 tests
build: PASS
remote exit: 0
```

`skipLibCheck` is enabled so the consumer validates its own strict source against the packages' public declarations without requiring optional database-driver declaration packages pulled into Better Auth/Drizzle internals. This is not a compatibility shim and does not alter runtime resolution; the runtime test successfully loads every documented export path above.

## Earlier diagnostic runs

- `pdf2html-auth-consumer-verify1` on `debian2` reached TypeScript and failed because optional Better Auth/Drizzle declarations referenced uninstalled driver types, plus the first React `createElement` fixture omitted required `children` props. The fixture now supplies the public component props correctly; external declaration checking is intentionally skipped as described above.
- Registry configuration probes initially returned sanitized `404`/`401` responses when the scoped GitHub registry or its remote-host authentication was not selected. The final run used the established remote host's authenticated scoped registry configuration and succeeded. No token was printed or persisted here.