SurgeAuthentication engine

A shared session substrate exposed through a browser-facing router and a service-facing API.

Two surfaces, one substrate

A browser-facing router for SPA frontends and a service-facing API for backend callers, both reading and writing the same session/token substrate.

Surface (paths, shapes) may change across versions. Behavior — what a session or token means once minted — never does.

Consuming services can mount the same router at their own path and run one engine instance against one database of record.