@ascendenceai/cortena-extensions-e2e-kit 0.1.0

package/LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2026 Ascendence AI Technology Pvt Ltd. All rights reserved.
+
+This package is published for use with the Cortena platform by licensed Cortena
+customers and partners only. No permission is granted to copy, modify,
+redistribute or use it outside a Cortena deployment.
+
+Provided as is, without warranty.

package/README.md

@@ -0,0 +1,126 @@
+# @ascendenceai/cortena-extensions-e2e-kit
+
+The shared Playwright layer-3 kit — HOW-TO §23.4, audit rule P-36.
+
+§23.4 names the same six end-to-end flows for every extension, and none of them
+exist until something is deployed: the login page, the extension inside the
+CortenaWeb frame, the MCP consent page, the agent pop-up, UI state, and shell
+chrome — each in light **and** dark. Written per extension that is six copies of
+one sign-in helper, one theme switcher and one way of finding the sidebar, and
+drift on the single layer that is supposed to prove the fleet looks the same.
+Six of seven extensions therefore had no suite at all.
+
+Here it is written once. An extension supplies a config file and six values.
+
+## What an extension supplies
+
+Two files, both beside the extension root so `extension-ci.yml`'s end-to-end job
+finds them (`working-directory: extensions/<name>`).
+
+### `extensions/<name>/playwright.config.ts`
+
+```ts
+import { protocolConfig } from '@ascendenceai/cortena-extensions-e2e-kit/config';
+
+export default protocolConfig({
+  host: 'https://test.<name>.ascendenceai.com',
+  suitePackage: '@cortena-extensions/<name>-e2e',
+});
+```
+
+`retries: 0`, both themes as two projects, no web server and the Assure reporter
+are all the kit's; they are not options because each one is a rule (§23.4,
+§23.7). `CORTENA_E2E_BASE_URL` overrides `host` for a branch deployment.
+
+### `extensions/<name>/e2e/protocol.spec.ts`
+
+```ts
+defineProtocolSuite({
+  host, listRoute, filter, detail, agentSlug, helpTopic, expects, cases,
+});
+```
+
+| Value        | What it is |
+| ------------ | ---------- |
+| `host`       | The deployed test host. |
+| `listRoute`  | The extension's first list route, without a query. |
+| `filter`     | `{ param, value }` — one filter on that list, as the **query parameter** that holds it. If the filter is not in the URL, §9 is not satisfied and the spec says so. |
+| `detail`     | `{ open(page), urlPattern, close(page) }` — how a row is opened, the URL it must be at, and how it is closed. |
+| `agentSlug`  | The AgentTemplate slug, which is also the extension id and the mark id (§19.1). |
+| `helpTopic`  | Words the help panel must contain, from the extension's own functional document (§13). |
+| `expects`    | `brandName`, `navItems`, `menuItems?`, `listHeading`, `agentPrompt`, `a2uiPrompt?`, `consentScopes?`. |
+| `cases`      | The six `assureCase({ … })` literals. See below. |
+
+## Why the six cases are written in the extension's file
+
+`assure-sync-cases` reads `assureCase({ … })` out of the source **without
+running it** — it parses the object literal so a case for a broken screen is
+still written down — and it skips `node_modules`. A case built inside this
+package is therefore a case the catalogue never hears about, and a spec with no
+case records no result. So the literals live in the extension's own
+`e2e/protocol.spec.ts`, where the scanner walks; the *behaviour* lives here,
+where it is written once. `defineProtocolSuite` refuses to define anything if
+one of the six is missing. The generator emits them; an adopter copies them.
+
+## The fixtures, on their own
+
+| Fixture | What it does |
+| ------- | ------------ |
+| `signIn(page, { route, useForm })` | The organisation step, then the credentials step, against the test cortena-auth. With `CORTENA_E2E_TOKEN` and no `useForm`, the token handoff instead. |
+| `embedded(page, { route })` | The CortenaWeb launch: `?token=…&refreshToken=none`, and the assertion that no login screen appears. |
+| `theme(page, mode, { path })` | `attribute` writes the stored choice and asserts `data-theme`; `os` clears it and emulates `prefers-color-scheme`, which is the path a first visit takes. |
+| `shell(page)` | Every part of `AppShell` as locators, plus `openAvatarMenu`, `openHelp`, `openNavDrawer`. |
+| `popup(page)` | `open`, `ask`, `awaitStream`, and the A2UI block. `expectSessionResumes` is the reload half. |
+| `listState(page, { route, filter, detail })` | The five-way check of §9: detail, close, Back, reload, and the URL in a new page. |
+| `consent(page, { host, scopes })` | The MCP consent page. The resource, the authorisation server and the scopes are **discovered** from the extension's own `/.well-known/oauth-protected-resource` (RFC 9728), a client is registered dynamically, and the PKCE authorisation request is opened — the sequence an MCP client performs. cortena-auth's hosted page is located by its form, because it is not built from cortena-ui. Asserted and then **refused**: a suite that presses Allow every run leaves grants nobody revokes. |
+
+## Credentials
+
+Read from the environment and never committed:
+
+```
+CORTENA_E2E_ORG_ID          the dedicated test org          (required)
+CORTENA_E2E_TOKEN           a pre-minted token,  or
+CORTENA_E2E_USER_EMAIL      the test user  and
+CORTENA_E2E_USER_PASSWORD   its password
+```
+
+`CORTENA_E2E_USER_EMAIL` and `CORTENA_E2E_USER_PASSWORD` are not optional in
+practice: a pre-minted token is a session in the *extension*, and two of the six
+specs are about screens that are not the extension's — the login page, and the
+MCP consent page on cortena-auth's own host. Both need a person to sign in.
+Given only a token, the login spec skips and the consent spec fails saying so.
+
+Optional: `CORTENA_E2E_BASE_URL` to point at a branch deployment, and
+`CORTENA_E2E_MCP_CLIENT_ID` for an environment that forbids dynamic client
+registration.
+
+In CI these are repository secrets. `extension-ci.yml`'s `e2e-credentials` job
+checks for them and **skips** the end-to-end job when they are absent — a
+required check that is green because it did nothing is worse than no check. The
+Assure secrets (`ASSURE_URL`, `ASSURE_TOKEN`, `ASSURE_APPLICATION_ID`,
+`ASSURE_ENVIRONMENT_ID`) are separate and are what opens and closes the run.
+
+## Running it
+
+```sh
+pnpm exec playwright install --with-deps chromium     # once
+pnpm exec playwright test --list                      # no credentials needed
+pnpm exec playwright test                             # needs CORTENA_E2E_*
+pnpm exec playwright test --project chromium-dark-1280
+```
+
+From the extension directory, against the deployed test environment. Nothing
+here starts a server: there is no login page, no token handoff and no consent
+page on a laptop's dev server.
+
+## `locators.ts`
+
+Every selector the kit uses is in that one file, keyed on cortena-ui's own
+`data-slot` attributes — load-bearing markup, not test scaffolding somebody can
+delete. A renamed slot breaks every adopter's suite there, once.
+
+`SIGN_IN` is the block **DESIGN-119 moves**: it changes how sign-in and the
+signed-out state are mounted, so the shared `AuthScreen`/`LoginScreen` slots are
+tried first and an extension's own labelled form is the fallback. When DESIGN-119
+lands, the fallback goes and nothing else in the kit changes.

package/dist/config.d.ts

@@ -0,0 +1,59 @@
+import { type PlaywrightTestConfig } from '@playwright/test';
+export interface ProtocolConfigOptions {
+    /** The deployed test host. An extension's own value, and the only one it must set. */
+    host: string;
+    /**
+     * The package name the unannotated tests roll into as one suite case. It is
+     * what tells Assure which extension this run belongs to in the record a
+     * person reads; the ids come from `ASSURE_APPLICATION_ID` / `ASSURE_ENVIRONMENT_ID`.
+     */
+    suitePackage: string;
+    /** Defaults to `./e2e`, beside the config. */
+    testDir?: string;
+    /** Defaults to 1280×900, which is what the project names say. */
+    viewport?: {
+        width: number;
+        height: number;
+    };
+    /** Per-test timeout. Defaults to 90s: a streamed agent turn is not a fast assertion. */
+    timeout?: number;
+    /** Environment variable that overrides `host`, for a run against a branch deployment. */
+    hostEnvVar?: string;
+    /**
+     * Merged over the generated config, for the extension that genuinely differs
+     * — a longer timeout, an extra `use` option. `retries` and `reporter` are
+     * **not** overridable: both are rules (a retry launders a defect into a
+     * slower green, and an unreported run is a green pipeline over an empty
+     * record), and an option that can be turned off is a rule that will be.
+     */
+    overrides?: Omit<PlaywrightTestConfig, 'retries' | 'reporter'>;
+}
+/**
+ * The Playwright config every extension's layer-3 suite is.
+ *
+ * An extension copies `playwright.config.ts` and changes two values. What it
+ * gets, and why each is not negotiable:
+ *
+ *   **No web server.** The suite runs against the *deployed* test environment,
+ *   because the login page, the token handoff, the consent page and both themes
+ *   do not exist until something is deployed (§23.4). Nothing here starts one.
+ *
+ *   **`retries: 0`.** A flaky test is a defect to raise, not a retry to
+ *   configure around. A retry turns a real defect into a slower green, and the
+ *   Assure reporter records only the first attempt anyway — so a configured
+ *   retry buys a pipeline colour and loses the record.
+ *
+ *   **Two projects, light and dark.** §23.4 says both themes, and the project
+ *   name is how the variant reaches Assure: the reporter parses `{ theme,
+ *   viewport }` off the name, and a name that encodes neither records no
+ *   variant rather than a guessed one.
+ *
+ *   **The Assure reporter.** A run is opened per (application, environment) and
+ *   closed with a verdict, which is what the release gate reads (§23.7, P-35).
+ *   Without it the suite is a pipeline colour that evaporates.
+ *
+ *   **`fullyParallel: false`.** The specs sign in as one test user in one test
+ *   org and the agent spec holds a session. Running them against each other is
+ *   how a suite becomes flaky for a reason that is not a defect.
+ */
+export declare function protocolConfig(options: ProtocolConfigOptions): PlaywrightTestConfig;

package/dist/config.js

@@ -0,0 +1,63 @@
+import { defineConfig, devices } from '@playwright/test';
+/**
+ * The Playwright config every extension's layer-3 suite is.
+ *
+ * An extension copies `playwright.config.ts` and changes two values. What it
+ * gets, and why each is not negotiable:
+ *
+ *   **No web server.** The suite runs against the *deployed* test environment,
+ *   because the login page, the token handoff, the consent page and both themes
+ *   do not exist until something is deployed (§23.4). Nothing here starts one.
+ *
+ *   **`retries: 0`.** A flaky test is a defect to raise, not a retry to
+ *   configure around. A retry turns a real defect into a slower green, and the
+ *   Assure reporter records only the first attempt anyway — so a configured
+ *   retry buys a pipeline colour and loses the record.
+ *
+ *   **Two projects, light and dark.** §23.4 says both themes, and the project
+ *   name is how the variant reaches Assure: the reporter parses `{ theme,
+ *   viewport }` off the name, and a name that encodes neither records no
+ *   variant rather than a guessed one.
+ *
+ *   **The Assure reporter.** A run is opened per (application, environment) and
+ *   closed with a verdict, which is what the release gate reads (§23.7, P-35).
+ *   Without it the suite is a pipeline colour that evaporates.
+ *
+ *   **`fullyParallel: false`.** The specs sign in as one test user in one test
+ *   org and the agent spec holds a session. Running them against each other is
+ *   how a suite becomes flaky for a reason that is not a defect.
+ */
+export function protocolConfig(options) {
+    const viewport = options.viewport ?? { width: 1280, height: 900 };
+    const envVar = options.hostEnvVar ?? 'CORTENA_E2E_BASE_URL';
+    const baseURL = process.env[envVar]?.trim() || options.host;
+    const project = (name, colorScheme) => ({
+        name: `${name}-${viewport.width}`,
+        use: { ...devices['Desktop Chrome'], colorScheme, viewport },
+    });
+    return defineConfig({
+        testDir: options.testDir ?? './e2e',
+        fullyParallel: false,
+        workers: 1,
+        timeout: options.timeout ?? 90_000,
+        use: {
+            baseURL,
+            screenshot: 'only-on-failure',
+            trace: 'retain-on-failure',
+            video: 'off',
+        },
+        projects: [project('chromium-light', 'light'), project('chromium-dark', 'dark')],
+        ...options.overrides,
+        // After the spread, not before: these two are the rules, and a spread that
+        // could reach them is an option to switch them off.
+        retries: 0,
+        reporter: [
+            ['list'],
+            [
+                '@ascendenceai/cortena-extensions-assure-reporters/playwright',
+                { suitePackage: options.suitePackage },
+            ],
+        ],
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,EAA6B,MAAM,kBAAkB,CAAC;AA6BpF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAE5D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,WAA6B,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,EAAE,GAAG,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE;QACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE;KAC7D,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;QACnC,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM;QAClC,GAAG,EAAE;YACH,OAAO;YACP,UAAU,EAAE,iBAAiB;YAC7B,KAAK,EAAE,mBAAmB;YAC1B,KAAK,EAAE,KAAK;SACb;QACD,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAChF,GAAG,OAAO,CAAC,SAAS;QACpB,2EAA2E;QAC3E,oDAAoD;QACpD,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,CAAC,MAAM,CAAC;YACR;gBACE,8DAA8D;gBAC9D,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;aACvC;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/env.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The credentials, read from the environment and from nowhere else.
+ *
+ * Four variables, the same four `extension-ci.yml`'s `e2e-credentials` job
+ * checks for before it lets the end-to-end job run:
+ *
+ *   CORTENA_E2E_ORG_ID          the dedicated test org
+ *   CORTENA_E2E_USER_EMAIL      the dedicated test user
+ *   CORTENA_E2E_USER_PASSWORD   its password
+ *   CORTENA_E2E_TOKEN           a pre-minted token, instead of the two above
+ *
+ * Never a real user and never a shared account (§23.4). Nothing here has a
+ * default and nothing here is committed: a fixture that falls back to a
+ * checked-in credential is a credential in the repository, and the whole point
+ * of the CI job being *skipped* without them is that a suite which cannot sign
+ * in must not report a pass.
+ */
+export interface E2ECredentials {
+    orgId: string;
+    email?: string;
+    password?: string;
+    /** A launch token, which is also how CortenaWeb hands the app a session. */
+    token?: string;
+}
+export declare class MissingCredentialsError extends Error {
+    readonly name = "MissingCredentialsError";
+}
+/**
+ * Reads the four. Throws rather than returning a half-filled object: a suite
+ * that starts with no password fails on the first assertion of the first spec,
+ * and the failure it reports is "the heading was not visible" rather than "you
+ * did not set a password".
+ */
+export declare function readCredentials(env?: NodeJS.ProcessEnv): E2ECredentials;
+/** Whether a run could sign in at all, without throwing — for `test.skip` reasons. */
+export declare function hasCredentials(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The environment under test, for the record Assure keeps. A run is opened per
+ * (application, environment) and `CORTENA_E2E_ENVIRONMENT` is what names the
+ * second half in a human's words; the ids the reporter posts are Assure's own
+ * (`ASSURE_ENVIRONMENT_ID`).
+ */
+export declare function environmentName(env?: NodeJS.ProcessEnv): string;

package/dist/env.js

@@ -0,0 +1,67 @@
+/**
+ * The credentials, read from the environment and from nowhere else.
+ *
+ * Four variables, the same four `extension-ci.yml`'s `e2e-credentials` job
+ * checks for before it lets the end-to-end job run:
+ *
+ *   CORTENA_E2E_ORG_ID          the dedicated test org
+ *   CORTENA_E2E_USER_EMAIL      the dedicated test user
+ *   CORTENA_E2E_USER_PASSWORD   its password
+ *   CORTENA_E2E_TOKEN           a pre-minted token, instead of the two above
+ *
+ * Never a real user and never a shared account (§23.4). Nothing here has a
+ * default and nothing here is committed: a fixture that falls back to a
+ * checked-in credential is a credential in the repository, and the whole point
+ * of the CI job being *skipped* without them is that a suite which cannot sign
+ * in must not report a pass.
+ */
+export class MissingCredentialsError extends Error {
+    name = 'MissingCredentialsError';
+}
+const MESSAGE = [
+    'The end-to-end kit needs a user to sign in as.',
+    '',
+    '  CORTENA_E2E_ORG_ID         required — the dedicated test org',
+    '  CORTENA_E2E_TOKEN          a pre-minted token, or',
+    '  CORTENA_E2E_USER_EMAIL     the test user and',
+    '  CORTENA_E2E_USER_PASSWORD  its password',
+    '',
+    'In CI these are repository secrets and the end-to-end job is skipped when they',
+    'are absent — a skipped job is visibly not a pass. On a laptop, export them for',
+    'the test org and run `pnpm exec playwright test` from the extension directory.',
+].join('\n');
+/**
+ * Reads the four. Throws rather than returning a half-filled object: a suite
+ * that starts with no password fails on the first assertion of the first spec,
+ * and the failure it reports is "the heading was not visible" rather than "you
+ * did not set a password".
+ */
+export function readCredentials(env = process.env) {
+    const orgId = env.CORTENA_E2E_ORG_ID?.trim();
+    const token = env.CORTENA_E2E_TOKEN?.trim();
+    const email = env.CORTENA_E2E_USER_EMAIL?.trim();
+    const password = env.CORTENA_E2E_USER_PASSWORD?.trim();
+    if (!orgId || !(token || (email && password)))
+        throw new MissingCredentialsError(MESSAGE);
+    return { orgId, email, password, token };
+}
+/** Whether a run could sign in at all, without throwing — for `test.skip` reasons. */
+export function hasCredentials(env = process.env) {
+    try {
+        readCredentials(env);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The environment under test, for the record Assure keeps. A run is opened per
+ * (application, environment) and `CORTENA_E2E_ENVIRONMENT` is what names the
+ * second half in a human's words; the ids the reporter posts are Assure's own
+ * (`ASSURE_ENVIRONMENT_ID`).
+ */
+export function environmentName(env = process.env) {
+    return env.CORTENA_E2E_ENVIRONMENT?.trim() || 'cortena-test';
+}
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC9B,IAAI,GAAG,yBAAyB,CAAC;CACpD;AAED,MAAM,OAAO,GAAG;IACd,gDAAgD;IAChD,EAAE;IACF,gEAAgE;IAChE,qDAAqD;IACrD,gDAAgD;IAChD,2CAA2C;IAC3C,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;CACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC1F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,IAAI,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;AAC/D,CAAC"}

package/dist/fixtures/consent.d.ts

@@ -0,0 +1,107 @@
+import { type Page } from '@playwright/test';
+export interface ConsentOptions {
+    /**
+     * The extension's own origin. The resource, the authorisation server and the
+     * scopes are **discovered** from it, the way an MCP client discovers them —
+     * so a suite that hard-codes them passes against a deployment whose metadata
+     * says something else entirely.
+     */
+    host: string;
+    /**
+     * A pre-registered MCP client. Absent, one is registered dynamically at the
+     * authorisation server's `registration_endpoint`, which is what an MCP
+     * client with no prior relationship does.
+     */
+    clientId?: string;
+    /** Which scopes to ask for. Defaults to the first the resource advertises. */
+    scopes?: string[];
+    /** Where the authorisation code would be delivered. Never followed. */
+    redirectUri?: string;
+}
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported?: string[];
+}
+/** What a dynamic registration hands back, and everything needed to undo it. */
+export interface ClientRegistration {
+    clientId: string;
+    /** RFC 7592's credential for managing this client. Issued once, never re-issued. */
+    registrationAccessToken?: string;
+    registrationClientUri?: string;
+}
+export interface AuthorizationServerMetadata {
+    authorization_endpoint: string;
+    registration_endpoint?: string;
+    code_challenge_methods_supported?: string[];
+}
+/**
+ * The MCP consent page (§23.4, rules P-08 and P-16).
+ *
+ * This is the one screen of the six that **no extension renders**. The OAuth
+ * flow lands on cortena-auth's own hosted page — a different deployment, a
+ * different repository, and today not built from cortena-ui at all. So it is
+ * located by what a consent page *is* rather than by a `data-slot` this
+ * repository could promise: a page that names the client and the resource,
+ * lists the scopes being asked for, and offers a way to allow and a way to
+ * refuse. `ConsentScreen`'s slots are tried first, so the day cortena-auth
+ * adopts the shared composition this stops being heuristic and nothing here
+ * changes.
+ *
+ * The whole request is **discovered**, not written down: RFC 9728
+ * `/.well-known/oauth-protected-resource` on the extension's own host gives the
+ * resource identifier, the authorisation server and the scopes; the server's
+ * metadata gives the endpoints. That is exactly the sequence an MCP client
+ * performs, so a deployment whose metadata is wrong fails here rather than
+ * passing against values a test file remembered.
+ *
+ * It is asserted **without accepting**. Pressing Allow mints a real grant for
+ * the test user against a real resource, and a suite that does that on every
+ * run leaves a trail of grants nobody revokes. What the protocol requires is
+ * that the page exists, says what is being asked for, and can be refused.
+ */
+export declare function consent(page: Page, options: ConsentOptions): Promise<void>;
+/** RFC 9728, from the extension's own host. */
+export declare function discoverProtectedResource(page: Page, host: string): Promise<ProtectedResourceMetadata>;
+export declare function discoverAuthorizationServer(page: Page, issuer: string): Promise<AuthorizationServerMetadata>;
+/**
+ * Dynamic client registration — RFC 7591, and what every MCP client that has
+ * never met this server does on first use. A suite that needs a client id
+ * provisioned by hand is a suite that stops working the day the environment is
+ * rebuilt, which is the day it is most needed.
+ */
+export declare function registerClient(page: Page, server: AuthorizationServerMetadata, redirectUri: string): Promise<ClientRegistration>;
+/**
+ * Deletes the client this run registered — RFC 7592.
+ *
+ * Best effort, and deliberately so. Client management is optional: a server
+ * that does not implement it answers 404, 405 or 501, and failing the consent
+ * spec because the *cleanup* was not supported would report the product broken
+ * over a housekeeping detail. It says what happened and moves on; what it must
+ * never do is silently skip cleanup on a server that does support it, which is
+ * why the outcome is always logged.
+ */
+export declare function deleteClient(page: Page, registration: ClientRegistration): Promise<void>;
+/**
+ * The authorisation request, with PKCE.
+ *
+ * The verifier is fixed and public on purpose: no code is ever exchanged — the
+ * suite refuses the grant — so there is nothing for a secret to protect, and a
+ * generated one would only make the failure harder to reproduce.
+ */
+export declare const PKCE_VERIFIER = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
+export declare const PKCE_CHALLENGE = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
+export declare function authorizeUrl(input: {
+    server: AuthorizationServerMetadata;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    scopes: string[];
+}): string;
+/**
+ * cortena-auth's own sign-in, which the authorisation request lands on before
+ * it will show a consent page. Its markup is the server's, not cortena-ui's,
+ * so this is by accessible name and nothing else. Already signed in, there is
+ * no form and this returns.
+ */
+export declare function signInAtAuthorizationServer(page: Page): Promise<void>;