ABC Audit — app-shell MFE Plugin drop

This folder makes the ABC Audit service appear in the app-shell Plugin Library (/library) and open in-shell, authed by the user's app-shell session — the Class-2 MFE-plugin path (the app-shell has no Class-3 "Services" registry; it embeds MFE bundles).

What the app-shell expects (contract)

The app-shell /library page reads a multi-MFE index.json manifest (schema doxa-1040-maps-mfe-index@1) via GET /api/_library, which scans the source configured by the server env var:

NUXT_MFE_INDEX_SOURCE=<path-or-url>      # a local path to this folder / its index.json, OR an http(s) URL
NUXT_PUBLIC_MFE_LIBRARY_ENABLED=true     # already set on the DT app-shell (turns /library on)

Each bundle in the manifest is an IIFE that registers a custom element; the shell embeds it as <abc-audit-tree profile-config='{…}'>. The /library "View" action opens the profile's embed staging page.

Layout

mfe-index/
  index.json                     manifest (static, checked in)
  build.sh                       assembles the drop (builds the IIFE, copies it in)
  abc-audit/
    abc-audit.iife.js            BUILT — self-mounting <abc-audit-tree> (see build.sh)
    audit-tree/index.html        staging "View" page — loader-injects-token

abc-audit.iife.js is built, not committed (the builder sandbox has no npm). Run ./build.sh on any host with npm (the deploy host / BUILD-GATE) to produce it.

The auth wire (C1 — no second login)

The token is never baked into the bundle. The staging page injects it at runtime (priority: ?tk= → window.__MFE_TOKEN__ → baked profile-config.tk) and the API base the same way (?api= → window.__ABC_API_URL__ → apiUrl). The custom element writes the token to localStorage['abc_dev_token'] and sets the API host before the Vue app's first getTree() — so the tree loads live under the user's tenant with no re-login. The token is the app-shell-signed HS256 JWT; the running ABC API verifies it with the same APP_SHELL_JWT_SECRET (C1 wire, already live).

The app-shell's library "View" href must therefore be given ?tk=<session JWT> and ?api=<abc api base> for a specific deployment — or a host wrapper sets window.__MFE_TOKEN__ / window.__ABC_API_URL__ before loading the bundle.

Deploy steps (coordinator / deploy-side)

1. cd abc-audit-service/mfe-index && ./build.sh → produces abc-audit/abc-audit.iife.js
2. Serve this mfe-index/ folder (static) OR push it to Forgejo raw.
3. Set on the app-shell container: NUXT_MFE_INDEX_SOURCE=<served-url-or-path>/index.json and recreate the app-shell.
4. Log into :3000 → /library shows ABC Audit → View → the audit tree opens in-shell (44 audits render), no second login.

No app-shell code change is needed — NUXT_MFE_INDEX_SOURCE is deploy config. (If in-shell mounting ever needs shell code, STOP and coordinate the authoritative app-shell tree with qa-coord/pm-1040-maps.)