# ABC Audit — app-shell MFE Plugin drop

This folder makes the **ABC Audit** service appear in the app-shell **Plugin
Library** (`/library`) and open **in-shell**, authed by the user's app-shell
session — the Class-2 MFE-plugin path (the app-shell has no Class-3 "Services"
registry; it embeds MFE bundles).

## What the app-shell expects (contract)

The app-shell `/library` page reads a multi-MFE **`index.json`** manifest
(schema `doxa-1040-maps-mfe-index@1`) via `GET /api/_library`, which scans the
source configured by the server env var:

```
NUXT_MFE_INDEX_SOURCE=<path-or-url>      # a local path to this folder / its index.json, OR an http(s) URL
NUXT_PUBLIC_MFE_LIBRARY_ENABLED=true     # already set on the DT app-shell (turns /library on)
```

Each **bundle** in the manifest is an **IIFE** that registers a **custom
element**; the shell embeds it as `<abc-audit-tree profile-config='{…}'>`. The
`/library` "View" action opens the profile's `embed` staging page.

## Layout

```
mfe-index/
  index.json                     manifest (static, checked in)
  build.sh                       assembles the drop (builds the IIFE, copies it in)
  abc-audit/
    abc-audit.iife.js            BUILT — self-mounting <abc-audit-tree> (see build.sh)
    audit-tree/index.html        staging "View" page — loader-injects-token
```

`abc-audit.iife.js` is **built, not committed** (the builder sandbox has no npm).
Run `./build.sh` on any host with npm (the deploy host / BUILD-GATE) to produce it.

## The auth wire (C1 — no second login)

The token is **never baked** into the bundle. The staging page injects it at
runtime (priority: `?tk=` → `window.__MFE_TOKEN__` → baked `profile-config.tk`)
and the API base the same way (`?api=` → `window.__ABC_API_URL__` → `apiUrl`).
The custom element writes the token to `localStorage['abc_dev_token']` and sets
the API host before the Vue app's first `getTree()` — so the tree loads live
under the user's tenant with no re-login. The token is the **app-shell-signed
HS256 JWT**; the running ABC API verifies it with the same
`APP_SHELL_JWT_SECRET` (C1 wire, already live).

The app-shell's library "View" href must therefore be given `?tk=<session JWT>`
and `?api=<abc api base>` for a specific deployment — or a host wrapper sets
`window.__MFE_TOKEN__` / `window.__ABC_API_URL__` before loading the bundle.

## Deploy steps (coordinator / deploy-side)

1. `cd abc-audit-service/mfe-index && ./build.sh`  → produces `abc-audit/abc-audit.iife.js`
2. Serve this `mfe-index/` folder (static) OR push it to Forgejo raw.
3. Set on the app-shell container:
   `NUXT_MFE_INDEX_SOURCE=<served-url-or-path>/index.json` and recreate the app-shell.
4. Log into `:3000` → `/library` shows **ABC Audit** → View → the audit tree opens
   in-shell (44 audits render), no second login.

No app-shell **code** change is needed — `NUXT_MFE_INDEX_SOURCE` is deploy
config. (If in-shell mounting ever needs shell code, STOP and coordinate the
authoritative app-shell tree with qa-coord/pm-1040-maps.)