feat: resolve Phase 1 contract requests and compose every feature

Contracts and core:
- Feature gains auth and stop; FeatureFactory; core composeServer builds the
  context, runs the factories, then the job queue from the union of their jobs
  (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI.
- AppConfig/loadConfig own the layout and settings: courseDirs include
  <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir,
  importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python.
  resolveConfig derives the same for tests; cachePaths shares the importer's
  cache layout.
- canView: the global author role views every course (R14); the learner,
  studio and AI packages all call it.
- migrate(db, packages): core first, then packages in name order.
- Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on
  an empty file is 416.
- courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts.

Packages:
- import, studio and AI read AppConfig instead of process.env; the importer
  refuses ids used by studio/repos.
- learner migrations run through core migrate; library covers fall back to
  the importer's cached candidate behind a canView-checked route.
- studio preview renders through the learner LessonView (anchors honoured,
  draft URLs); AI drafts go to the studio draft branch for studio courses (as
  the requesting user) and to <dataDir>/drafts otherwise, and the generator
  page says which.

Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts
imports them by package name; nav.roles hides links by role.

Tests: compose, config, canView, media headers, migrations order, covers,
preview, nav, SPA bundle without server code, and an end-to-end flow on
SQLite and Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/src/bundle.test.ts

@@ -0,0 +1,25 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+// A subprocess, because HTML bundling inside a full `bun test` run is unreliable (see the learner's csp.test).
+test("the SPA bundles for the browser with no server code in it", async () => {
+  const out = mkdtempSync(join(tmpdir(), "stc-spa-"));
+  try {
+    const root = resolve(import.meta.dir, "../../..");
+    const p = Bun.spawn(["bun", "build", "apps/web/index.html", "--outdir", out, "--target", "browser"], { cwd: root, stdout: "pipe", stderr: "pipe" });
+    const code = await p.exited;
+    expect(code === 0 ? "" : await new Response(p.stderr).text()).toBe("");
+    const js = readdirSync(out).filter((f) => f.endsWith(".js")).map((f) => readFileSync(join(out, f), "utf8")).join("\n");
+    expect(js.length).toBeGreaterThan(1000);
+    // Server-only modules of the feature packages and their dependencies.
+    for (const marker of ["better-auth", "X509Certificate", "createStudioStore", "importFeature(", "aiFeature(", "createJobQueue", "bun:sqlite"]) {
+      expect([marker, js.includes(marker)]).toEqual([marker, false]);
+    }
+    // Every feature's browser half is present.
+    for (const page of ["/admin/import", "/studio/:courseId", "/admin/ai", "/c/:courseId/:lessonId"]) expect(js).toContain(page);
+  } finally {
+    rmSync(out, { recursive: true, force: true });
+  }
+}, 120_000);

apps/web/src/features.ts

@@ -1,8 +1,9 @@
 import type { WebFeature } from "@stc/contracts";
+// Browser-only entries ("@stc/<package>/web", mapped in tsconfig paths and package.json exports). Never import a
+// package's server index here: it pulls Better Auth, git and node:fs into the bundle.
 import { learnerWeb } from "@stc/feature-learner/web";
-import { importWeb } from "../../../packages/feature-import/src/web";
-import { studioWeb } from "../../../packages/feature-studio/src/web";
-import { aiWeb } from "../../../packages/feature-ai/src/web";
+import { importWeb } from "@stc/feature-import/web";
+import { studioWeb } from "@stc/feature-studio/web";
+import { aiWeb } from "@stc/feature-ai/web";
 
-// Phase 1 packages append one import line each and push into this list.
 export const webFeatures: WebFeature[] = [learnerWeb, importWeb, studioWeb, aiWeb];

apps/web/src/main.tsx

@@ -1,15 +1,33 @@
 import { createRoot } from "react-dom/client";
-import { lazy, Suspense } from "react";
-import { createBrowserRouter, Link, Outlet, RouterProvider, type RouteObject } from "react-router-dom";
+import { lazy, Suspense, useEffect, useState } from "react";
+import { createBrowserRouter, Link, Outlet, RouterProvider, useLocation, type RouteObject } from "react-router-dom";
+import type { AuthUser } from "@stc/contracts";
 import { AppShell } from "@stc/ui";
 import { webFeatures } from "./features";
+import { visibleNav } from "./nav";
 
 function Home() {
   return <p className="work">No features installed yet</p>;
 }
 
+/** The signed-in user (GET /api/me), refreshed on navigation so sign-in and sign-out update the nav. */
+function useSessionUser(): AuthUser | null {
+  const { pathname } = useLocation();
+  const [user, setUser] = useState<AuthUser | null>(null);
+  useEffect(() => {
+    let live = true;
+    fetch("/api/me", { credentials: "same-origin" })
+      .then((r) => (r.ok ? r.json() : { user: null }))
+      .then((b: { user: AuthUser | null }) => { if (live) setUser(b.user ?? null); })
+      .catch(() => { if (live) setUser(null); });
+    return () => { live = false; };
+  }, [pathname]);
+  return user;
+}
+
 function Layout() {
-  const nav = webFeatures.flatMap((f) => f.routes.filter((r) => r.nav?.area === "header"));
+  // Links the user cannot use are hidden; the pages and APIs still enforce access themselves.
+  const nav = visibleNav(webFeatures, useSessionUser());
   const header = (
     <>
       <Link to="/" style={{ fontWeight: 600, color: "var(--head)", textDecoration: "none" }}>STCourses</Link>

apps/web/src/nav.test.ts

@@ -0,0 +1,21 @@
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { webFeatures } from "./features";
+import { visibleNav } from "./nav";
+
+const labels = (roles: ("owner" | "author" | "learner")[] | null) => visibleNav(webFeatures, roles ? { roles } : null).map((r) => r.nav!.label);
+
+test("nav items are limited by role", () => {
+  expect(labels(null)).toEqual([]);
+  expect(labels(["learner"])).toEqual([]);
+  expect(labels(["author"])).toEqual(["Studio"]);
+  expect(labels(["owner"])).toEqual(["Studio", "Import", "AI"]);
+});
+
+test("features.ts imports only browser entries, by package name", () => {
+  const src = readFileSync(join(import.meta.dir, "features.ts"), "utf8");
+  const specs = [...src.matchAll(/from\s+"([^"]+)"/g)].map((m) => m[1]!);
+  for (const s of specs) expect(s === "@stc/contracts" || /^@stc\/feature-[a-z]+\/web$/.test(s)).toBe(true);
+  expect(specs.filter((s) => s.endsWith("/web")).length).toBe(4);
+});

apps/web/src/nav.ts

@@ -0,0 +1,15 @@
+import type { AuthUser, Role, WebFeature, WebRoute } from "@stc/contracts";
+
+/** Admin-area links default to the owner; header links default to everyone. `nav.roles` overrides both. */
+const DEFAULT_ROLES: Record<"header" | "admin", Role[] | undefined> = { header: undefined, admin: ["owner"] };
+
+/** The nav links this user may use, header links first, then admin links. */
+export function visibleNav(features: WebFeature[], user: Pick<AuthUser, "roles"> | null): WebRoute[] {
+  const all = features.flatMap((f) => f.routes.filter((r) => r.nav));
+  const allowed = (r: WebRoute) => {
+    const roles = r.nav!.roles ?? DEFAULT_ROLES[r.nav!.area];
+    if (!roles) return true;
+    return !!user && roles.some((x) => user.roles.includes(x));
+  };
+  return [...all.filter((r) => r.nav!.area === "header" && allowed(r)), ...all.filter((r) => r.nav!.area === "admin" && allowed(r))];
+}