Built-in Modules

Understand Lenso's first-party and platform-owned modules.

Generated hosts start with LENSO_COMPOSITION_PROFILE=core and no real auth module. Use local development tokens while building the first app surface, then install auth modules when the app needs real sessions, password login, or device policy.

If you are authoring a module that consumes the authenticated actor instead of installing auth itself, read Auth and Capabilities.

Module map

Module	Kind	Install	What it owns
`auth`	first-party linked module	`lenso module install auth`	auth users, sessions, session revoke, dev session route, auth Console pages
`auth-anonymous`	first-party provider module	`lenso module install auth-anonymous`	anonymous session route, anonymous identity marker, account-upgrade link seam
`auth-password`	first-party provider module	`lenso module install auth-password`	password registration and login routes, password credential storage, token strategy config
`auth-oidc`	first-party provider module	`lenso module install auth-oidc`	OIDC discovery, authorize/token endpoints, Runtime Console login handoff
`auth-device`	first-party policy module	`lenso module install auth-device`	device records and session device policy
`platform-story`	platform-owned system module	included by the platform composition	Runtime Console story routes, story display metadata, Stories Console surface

auth, auth-anonymous, and auth-password are also exposed through lenso::host::builtins. auth-oidc and auth-device are installed through CLI descriptors. platform-story is not a business module. It is Lenso-owned runtime observability infrastructure.