packages/auth — @marketplaces/auth. Standalone Angular UI + gateway for QR, credentials and Yandex auth.
packages/payment — @marketplaces/payment. Standalone Angular UI + gateway for QR, card, SBP and Yandex Pay.

The packages call separate central services. They never derive or call the tenant API. Each request automatically includes the page hostname as X-Marketplace-Domain; central Auth/Payment APIs resolve that domain to the project.

bootstrapApplication(AppComponent, {
  providers: [
    provideHttpClient(),
    provideMarketplacesAuth({ apiUrl: 'https://auth.example.net' }),
    provideMarketplacesPayment({ apiUrl: 'https://payments.example.net' }),
  ],
});

<mp-auth qr credentials yandex mode="admin"
  (authenticated)="onLogin($event)" />

<mp-payment qr card sbp yandexPay [request]="checkout"
  (completed)="onPaid($event)" />

Import MarketplacesAuthComponent / MarketplacesPaymentComponent into the consuming standalone component. See docs/BACKEND-CONTRACT.md for central API and CORS requirements.

<mp-auth credentials mode="admin"> already posts {login, password, mode} to credentialsPath. AdminAuthService.loginWithCredentials() is a convenience wrapper for apps building their own login screen instead of the built-in component — it calls the gateway and activates the resulting session in one step:

export class MyAdminLoginComponent {
  private readonly adminAuth = inject(AdminAuthService);

  submit(login: string, password: string) {
    this.adminAuth.loginWithCredentials({ login, password }).subscribe({
      next: () => this.router.navigateByUrl('/admin'),
      error: (failure: AuthFailure) => {
        if (failure.code === 'invalid_credentials') this.error = 'Wrong login or password.';
        else if (failure.code === 'rate_limited') this.error = `Too many attempts, retry in ${failure.retryAfterSeconds ?? 60}s.`;
        else this.error = failure.message;
      },
    });
  }
}

The package has no notion of who the account is — it carries {login, password} to the backend exactly like any other admin login and stores whatever session/tokens come back. There is nothing to configure for a "superadmin" or any other privileged account: that decision (which login is special, what tenant to scope the resulting session to, audit logging) is entirely server-side. No password, username, or secret is ever hardcoded in this package.

Consumer documentation lives in the marketplaces repo: docs/PACKAGES-USAGE.md. Rationale: docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md.

Installing (no registry, no token)

Each package is published to a release branch where the repo root is the package, so npm can install it straight over git:

{
  "dependencies": {
    "@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth",
    "@marketplaces/payment": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/payment"
  }
}

No npm registry, no auth token, no SSH tunnel, no CI secret. Anonymous git read is all that's required — a fresh clone plus npm install works on any machine and any CI runner.

release/auth and release/payment are generated. Never commit to them by hand; they are force-pushed on every release.

Layout

npm workspaces monorepo. Each package builds standalone with tsc to dist/.

npm ci
npm run build     # all workspaces
npm test          # all workspaces

Angular and rxjs are peerDependencies, so the consuming app supplies exactly one copy at runtime.

Making a change

Edit under packages/<name>/src, export from index.ts.
npx changeset — pick the package and bump type, write one line. CI rejects PRs without one.
Open a PR against main. ci.yml builds, tests, and verifies the changeset exists.
On merge, release.yml rebuilds and force-pushes the release branches, and opens a "Version Packages" PR if there are unreleased changesets. Merging that PR bumps versions and triggers another release.
In the consuming project, run npm update @marketplaces/auth (git deps track the branch tip, so pin to a tag or commit SHA instead of the branch if you need reproducible installs).

Pinning

Branch refs move. For reproducible builds, pin to a commit:

git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#<commit-sha>

marketplaces currently tracks #release/auth (branch tip) — deliberate while the package churns, worth pinning once it stabilises.

Workflow syntax

ci.yml / release.yml are GitHub Actions. Gitea/Forgejo Actions are compatible. Other CI needs translating — the steps are just: install, build, test, force-push a branch.

A private npm registry also exists

A Verdaccio instance runs on the dev server (213.21.246.138:4873, Docker container verdaccio, storage /srv/marketplaces/verdaccio/) and holds @marketplaces/auth@0.1.0 and @marketplaces/payment@0.1.0. It is not the path anything uses today — it is only reachable from the server itself or through an SSH tunnel, which is exactly why the git-branch approach above exists. Keep it or delete it; nothing depends on it.

README.md

vitanovaPackages

Admin credentials login