ores.web

ores.web is the browser interface for ORE Studio. It replaces the removed Qt desktop client. A browser cannot present a NATS client certificate on a WebSocket, so the component pairs a React client with a Fastify backend-for-frontend (BFF) that owns the mTLS connection to the broker.

The component is a TypeScript project. It has no C++ parts and no compiled CMake target. The four npm packages under packages/ are its structure: bff, contracts, web, and wire-protocol. It builds with npm ci and npm run build from the component root.

• The checkout .env, through ORES_WEB_* for the process settings and ORES_NATS_* for the broker.
• The site configuration in config/environments.json, or the file named by ORES_WEB_SITE_CONFIG. It declares the environments, the active environment, the developer surface, and the ACME test accounts.
• NATS responses over mTLS from ores.iam.service, ores.refdata.service, and the other domain services.
• Change notifications that the services publish on their event subjects.
• The org models under projects/ores.*/modeling/, which ores.codegen renders into the TypeScript protocol and domain types. The generated tree is committed.
• Browser requests on the /api HTTP surface.

• The built browser bundle in packages/web/dist. The BFF serves it on ORES_WEB_PORT.
• The /api HTTP surface on the same port.
• NATS requests and subscriptions that the BFF sends on behalf of the browser.
• A first-party session cookie that holds an opaque session identifier. The token stays in the BFF, and the browser never receives it.
• Generated TypeScript in packages/wire-protocol/src/generated/.

• projects/ores.web/README.md — component overview and operator instructions.
• projects/ores.web/packages/bff/src/main.ts — the BFF process entry point.
• projects/ores.web/packages/bff/src/server.ts — the Fastify HTTP surface and the static browser bundle.
• projects/ores.web/packages/web/src/main.tsx — the React browser entry point.
• projects/ores.web/package.json — the workspace scripts: build, test, typecheck, verify:login, and seed:account.

• ores.iam.service — authentication, sessions, accounts, and change reasons.
• ores.refdata.service — reference data such as countries.
• The other domain services that the browser reaches through the BFF.
• ores.codegen — the generator that renders the TypeScript protocol and domain types from the org models.
• Node.js 22 or later.
• Third-party libraries: Fastify, React, React Router, TanStack Query, NATS.js, @msgpack/msgpack, Zod, Vite, Tailwind CSS, and Vitest.
• The component links no C++ library, because it has no C++ parts.

• The entity specification — a superseded specification. It required one shared list, detail and history screen per entity, driven by a generated declaration; those screens are deleted and the interface is to be built from hand-written journey screens instead.
• The component specification — the browser shell, the session, the transport to the BFF, the i18n catalogue, the styling, and the wire-protocol package.
• Change notification — the channel to the browser, the payload, and the visual language.
• Icon reference — the icon vocabulary and the process for adding to it.
• Gaps: country against the specification — a superseded audit. It measured screens and shared controls that are now deleted, and its findings cannot be reproduced.
• Qt account screen: raw reference analysis — the historical analysis of the removed Qt client.
• Protocol types are generated from the C++ codegen model — the decision behind the generated wire types.
• The connections store was removed, and why — why the per-user connection store is gone.
• ores.codegen — the generator that produces the TypeScript.
• ores.iam.service — the authentication service the browser signs in through.
• ores.refdata.service — the reference-data service the browser reaches through the BFF.
• TypeScript Clean Standard — the checklist this component's packages follow.
• Journey runtime — the journey runtime, the step-call contract, and the direction between the packages.