@elizaos/shared 2.0.0-beta.1 → 2.0.11-beta.7

package/steward-session-client/index.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Shared Steward session client.
+ *
+ * Single source of truth for:
+ *  - the storage / cookie / endpoint key names used across os-homepage
+ *    (`elizaos.ai`), cloud-frontend (`elizacloud.ai`), and the cloud-api
+ *    `/api/auth/steward-session` route handler;
+ *  - the request / response / error shapes the route exchanges with the
+ *    browser;
+ *  - the small set of helpers each consumer needs (sync, clear, read).
+ *
+ * Browser-only helpers return cleanly under SSR (`typeof window === "undefined"`).
+ */
+/** localStorage key for the Steward access token (JWT). */
+export declare const STEWARD_TOKEN_KEY = "steward_session_token";
+/**
+ * localStorage key for the Steward refresh token.
+ *
+ * @deprecated Refresh tokens are now persisted only as the HttpOnly
+ * `steward-refresh-token` cookie (set by `/api/auth/steward-session` and
+ * `/api/auth/steward-nonce-exchange`). The localStorage copy was XSS-
+ * reachable and is being removed; only the key constant and the
+ * read/write/clear helpers below remain so legacy tabs left over from
+ * before the rollout can still drain their stale value via
+ * `clearStoredStewardToken()`. Do NOT add new readers/writers.
+ */
+export declare const STEWARD_REFRESH_TOKEN_KEY = "steward_refresh_token";
+/** Non-HttpOnly cookie set to "1" while the server-side session is live. */
+export declare const STEWARD_AUTHED_COOKIE = "steward-authed";
+/** Steward multi-tenant identifier for Eliza Cloud. */
+export declare const STEWARD_TENANT_ID = "elizacloud";
+/** Same-origin endpoint that exchanges the JWT for HttpOnly cookies. */
+export declare const STEWARD_SESSION_ENDPOINT = "/api/auth/steward-session";
+/**
+ * Same-origin endpoint that swaps a one-time OAuth `code` (the nonce-exchange
+ * flow's `?code=` query param) for HttpOnly cookies. The endpoint calls
+ * Steward's `POST /auth/oauth/exchange` server-side so the access and refresh
+ * tokens never touch the browser URL.
+ */
+export declare const STEWARD_NONCE_EXCHANGE_ENDPOINT = "/api/auth/steward-nonce-exchange";
+/**
+ * Same-origin endpoint that rotates the Steward access + refresh tokens
+ * using the HttpOnly `steward-refresh-token` cookie. The browser POSTs
+ * with `credentials: "include"`; the cookie travels automatically. Trusted
+ * Cloud browser origins receive the short-lived access token so the SPA can
+ * refresh its localStorage mirror while route auth remains synchronous.
+ */
+export declare const STEWARD_REFRESH_ENDPOINT = "/api/auth/steward-refresh";
+export interface StewardSessionRequest {
+    token: string;
+    refreshToken?: string | null;
+}
+export interface StewardSessionResponse {
+    ok: true;
+    userId: string;
+    stewardUserId: string;
+}
+/**
+ * Distinct outcomes the cloud-api route returns. The client uses these to
+ * decide whether to wipe localStorage (`invalid_token`) or hold steady
+ * (`server_secret_missing`).
+ */
+export type StewardSessionErrorCode = "missing_token" | "invalid_token" | "server_secret_missing" | "steward_user_sync_failed" | "internal_error" | "missing_code" | "code_invalid" | "code_expired" | "code_redirect_mismatch" | "code_tenant_mismatch" | "steward_upstream_unavailable" | "forbidden_origin";
+export declare class StewardSessionError extends Error {
+    readonly status: number;
+    readonly code: StewardSessionErrorCode | string | null;
+    constructor(message: string, status: number, code: StewardSessionErrorCode | string | null);
+}
+export interface SyncOpts {
+    /**
+     * Absolute or relative URL to POST to. Defaults to STEWARD_SESSION_ENDPOINT
+     * (same-origin). Pass an absolute URL when crossing origins
+     * (e.g. elizaos.ai -> api.elizacloud.ai).
+     */
+    endpoint?: string;
+    /**
+     * Override the global fetch (mainly for tests and SSR shims).
+     */
+    fetchImpl?: typeof fetch;
+}
+export interface ClearOpts {
+    /** Endpoints to DELETE. Defaults to [STEWARD_SESSION_ENDPOINT]. */
+    endpoints?: string[];
+    fetchImpl?: typeof fetch;
+}
+export declare function readStoredStewardToken(): string | null;
+export declare function writeStoredStewardToken(token: string): void;
+/**
+ * @deprecated The refresh token is now persisted only as the HttpOnly
+ * `steward-refresh-token` cookie. Reading it from localStorage is XSS-
+ * reachable and contradicts the cookie-only model. Callers should POST to
+ * `STEWARD_REFRESH_ENDPOINT` with `credentials: "include"` instead — the
+ * server reads the cookie and mints fresh tokens with no body payload.
+ * This helper is retained for one release window so legacy tabs can still
+ * be cleaned up via `clearStoredStewardToken()`; it will be removed once
+ * `os-homepage` and `cloud-frontend` have shipped the cookie-only flow.
+ */
+export declare function readStoredStewardRefreshToken(): string | null;
+/**
+ * @deprecated Writing the refresh token to localStorage defeats the
+ * HttpOnly-cookie protection the server already provides. The cookie is
+ * set by `/api/auth/steward-session` and `/api/auth/steward-nonce-exchange`
+ * — there is no longer any reason for the browser to hold a copy. This
+ * helper intentionally does not write and is kept only for one release
+ * window; after that it will be deleted.
+ */
+export declare function writeStoredStewardRefreshToken(_token: string): void;
+export declare function clearStoredStewardToken(): void;
+/**
+ * Returns true when the non-HttpOnly `steward-authed=1` marker cookie is
+ * present. The JWT cookie itself is HttpOnly, so JS uses this hint to know
+ * "there is a server session" without ever touching the token.
+ */
+export declare function hasStewardAuthedCookie(): boolean;
+/**
+ * POSTs the Steward JWT (+ optional refresh token) to the session endpoint
+ * so the server can set HttpOnly cookies. Throws `StewardSessionError` on
+ * non-2xx; caller decides whether to wipe localStorage based on `error.code`.
+ */
+export declare function syncStewardSession(token: string, refreshToken?: string | null, opts?: SyncOpts): Promise<StewardSessionResponse>;
+export interface StewardNonceExchangeRequest {
+    /** One-time code from the Steward redirect (`?code=`). */
+    code: string;
+    /**
+     * The `redirect_uri` that was sent to Steward `/authorize`. Steward verifies
+     * this matches what was issued. If omitted, the cloud-api route falls back
+     * to the value provided server-side via env / convention; in practice the
+     * caller should send the same redirect_uri it used originally.
+     */
+    redirectUri?: string;
+    /** Steward tenant ID (e.g. "elizacloud"). */
+    tenantId?: string;
+    /** PKCE verifier paired with the `code_challenge` sent to Steward. */
+    codeVerifier?: string;
+}
+export interface StewardNonceExchangeResponse extends StewardSessionResponse {
+    expiresIn?: number;
+    expiresAt?: number;
+    /**
+     * Steward JWT. Mirrored from the upstream Steward exchange so the SPA can
+     * write it to localStorage (required by `@stwd/react`'s `useAuth()` to
+     * report `isAuthenticated=true`). HttpOnly cookies are still the canonical
+     * session — this is the JS-readable copy that keeps the wallet and OAuth
+     * paths symmetric.
+     */
+    token?: string;
+    refreshToken?: string;
+}
+export interface ExchangeStewardCodeOpts extends SyncOpts {
+    /** redirect_uri that was sent to /authorize (must match exactly). */
+    redirectUri?: string;
+    /** Steward tenant id. */
+    tenantId?: string;
+    /** PKCE verifier paired with the `code_challenge` sent to Steward. */
+    codeVerifier?: string;
+}
+/**
+ * POSTs the one-time OAuth code to the cloud-api nonce-exchange endpoint.
+ * The route calls Steward `POST /auth/oauth/exchange` server-side, sets the
+ * HttpOnly steward-token + steward-refresh-token cookies, and returns the
+ * Eliza Cloud user id. Some cross-origin checkout callers may also receive a
+ * browser bearer token. Throws `StewardSessionError` on non-2xx.
+ */
+export declare function exchangeStewardCode(code: string, opts?: ExchangeStewardCodeOpts): Promise<StewardNonceExchangeResponse>;
+/**
+ * Best-effort DELETE of every configured session endpoint. Failures are
+ * swallowed — the caller has already wiped localStorage and there's nothing
+ * useful to do about a cookie that won't clear.
+ */
+export { buildStewardOAuthAuthorizeUrl, consumeStewardPkceVerifier, createStewardPkceChallenge, createStewardPkcePair, generateStewardPkceVerifier, type StewardOAuthProvider, type StewardPkcePair, storeStewardPkceVerifier, } from "./steward-oauth-pkce.js";
+export declare function clearStewardSession(opts?: ClearOpts): void;
+//# sourceMappingURL=index.d.ts.map

package/steward-session-client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/steward-session-client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,qCACR,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAMpE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B,eAAe,GACf,eAAe,GACf,uBAAuB,GACvB,0BAA0B,GAC1B,gBAAgB,GAGhB,cAAc,GACd,cAAc,GACd,cAAc,GACd,wBAAwB,GACxB,sBAAsB,GACtB,8BAA8B,GAC9B,kBAAkB,CAAC;AAEvB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,GAAG,IAAI,CAAC;gBAGrD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,uBAAuB,GAAG,MAAM,GAAG,IAAI;CAOhD;AAED,MAAM,WAAW,QAAQ;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAMD,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAOtD;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ3D;AAKD;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAiB7D;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAcnE;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAQ9C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAKhD;AAgBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,EAC5B,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,sBAAsB,CAAC,CA2BjC;AAMD,MAAM,WAAW,2BAA2B;IAC1C,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAwB,SAAQ,QAAQ;IACvD,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,4BAA4B,CAAC,CAwBvC;AAED;;;;GAIG;AACH,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAEjC,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,SAAc,GAAG,IAAI,CAS9D"}

package/steward-session-client/index.js

@@ -0,0 +1,248 @@
+/**
+ * Shared Steward session client.
+ *
+ * Single source of truth for:
+ *  - the storage / cookie / endpoint key names used across os-homepage
+ *    (`elizaos.ai`), cloud-frontend (`elizacloud.ai`), and the cloud-api
+ *    `/api/auth/steward-session` route handler;
+ *  - the request / response / error shapes the route exchanges with the
+ *    browser;
+ *  - the small set of helpers each consumer needs (sync, clear, read).
+ *
+ * Browser-only helpers return cleanly under SSR (`typeof window === "undefined"`).
+ */
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** localStorage key for the Steward access token (JWT). */
+export const STEWARD_TOKEN_KEY = "steward_session_token";
+/**
+ * localStorage key for the Steward refresh token.
+ *
+ * @deprecated Refresh tokens are now persisted only as the HttpOnly
+ * `steward-refresh-token` cookie (set by `/api/auth/steward-session` and
+ * `/api/auth/steward-nonce-exchange`). The localStorage copy was XSS-
+ * reachable and is being removed; only the key constant and the
+ * read/write/clear helpers below remain so legacy tabs left over from
+ * before the rollout can still drain their stale value via
+ * `clearStoredStewardToken()`. Do NOT add new readers/writers.
+ */
+export const STEWARD_REFRESH_TOKEN_KEY = "steward_refresh_token";
+/** Non-HttpOnly cookie set to "1" while the server-side session is live. */
+export const STEWARD_AUTHED_COOKIE = "steward-authed";
+/** Steward multi-tenant identifier for Eliza Cloud. */
+export const STEWARD_TENANT_ID = "elizacloud";
+/** Same-origin endpoint that exchanges the JWT for HttpOnly cookies. */
+export const STEWARD_SESSION_ENDPOINT = "/api/auth/steward-session";
+/**
+ * Same-origin endpoint that swaps a one-time OAuth `code` (the nonce-exchange
+ * flow's `?code=` query param) for HttpOnly cookies. The endpoint calls
+ * Steward's `POST /auth/oauth/exchange` server-side so the access and refresh
+ * tokens never touch the browser URL.
+ */
+export const STEWARD_NONCE_EXCHANGE_ENDPOINT = "/api/auth/steward-nonce-exchange";
+/**
+ * Same-origin endpoint that rotates the Steward access + refresh tokens
+ * using the HttpOnly `steward-refresh-token` cookie. The browser POSTs
+ * with `credentials: "include"`; the cookie travels automatically. Trusted
+ * Cloud browser origins receive the short-lived access token so the SPA can
+ * refresh its localStorage mirror while route auth remains synchronous.
+ */
+export const STEWARD_REFRESH_ENDPOINT = "/api/auth/steward-refresh";
+export class StewardSessionError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.name = "StewardSessionError";
+        this.status = status;
+        this.code = code;
+    }
+}
+// ---------------------------------------------------------------------------
+// localStorage helpers
+// ---------------------------------------------------------------------------
+export function readStoredStewardToken() {
+    if (typeof window === "undefined")
+        return null;
+    try {
+        return window.localStorage.getItem(STEWARD_TOKEN_KEY);
+    }
+    catch {
+        return null;
+    }
+}
+export function writeStoredStewardToken(token) {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.setItem(STEWARD_TOKEN_KEY, token);
+    }
+    catch {
+        // localStorage may be disabled (private mode, quota, sandboxed iframe);
+        // callers that need durability should detect this themselves.
+    }
+}
+let warnedReadRefresh = false;
+let warnedWriteRefresh = false;
+/**
+ * @deprecated The refresh token is now persisted only as the HttpOnly
+ * `steward-refresh-token` cookie. Reading it from localStorage is XSS-
+ * reachable and contradicts the cookie-only model. Callers should POST to
+ * `STEWARD_REFRESH_ENDPOINT` with `credentials: "include"` instead — the
+ * server reads the cookie and mints fresh tokens with no body payload.
+ * This helper is retained for one release window so legacy tabs can still
+ * be cleaned up via `clearStoredStewardToken()`; it will be removed once
+ * `os-homepage` and `cloud-frontend` have shipped the cookie-only flow.
+ */
+export function readStoredStewardRefreshToken() {
+    if (typeof window === "undefined")
+        return null;
+    if (!warnedReadRefresh) {
+        warnedReadRefresh = true;
+        try {
+            console.warn("[steward] readStoredStewardRefreshToken() is deprecated — refresh tokens live in the HttpOnly steward-refresh-token cookie. Use STEWARD_REFRESH_ENDPOINT with credentials: 'include' instead.");
+        }
+        catch {
+            // ignore
+        }
+    }
+    try {
+        return window.localStorage.getItem(STEWARD_REFRESH_TOKEN_KEY);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * @deprecated Writing the refresh token to localStorage defeats the
+ * HttpOnly-cookie protection the server already provides. The cookie is
+ * set by `/api/auth/steward-session` and `/api/auth/steward-nonce-exchange`
+ * — there is no longer any reason for the browser to hold a copy. This
+ * helper intentionally does not write and is kept only for one release
+ * window; after that it will be deleted.
+ */
+export function writeStoredStewardRefreshToken(_token) {
+    if (typeof window === "undefined")
+        return;
+    if (!warnedWriteRefresh) {
+        warnedWriteRefresh = true;
+        try {
+            console.warn("[steward] writeStoredStewardRefreshToken() is deprecated and no longer writes to localStorage. The HttpOnly steward-refresh-token cookie is now the only persistence. This call intentionally leaves storage unchanged.");
+        }
+        catch {
+            // ignore
+        }
+    }
+    // Intentionally do not write — the cookie is the source of truth. We keep
+    // the function so existing call sites compile through the rollout window.
+}
+export function clearStoredStewardToken() {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.removeItem(STEWARD_TOKEN_KEY);
+        window.localStorage.removeItem(STEWARD_REFRESH_TOKEN_KEY);
+    }
+    catch {
+        // ignore
+    }
+}
+/**
+ * Returns true when the non-HttpOnly `steward-authed=1` marker cookie is
+ * present. The JWT cookie itself is HttpOnly, so JS uses this hint to know
+ * "there is a server session" without ever touching the token.
+ */
+export function hasStewardAuthedCookie() {
+    if (typeof document === "undefined")
+        return false;
+    return document.cookie
+        .split(";")
+        .some((part) => part.trim().startsWith(`${STEWARD_AUTHED_COOKIE}=1`));
+}
+// ---------------------------------------------------------------------------
+// Network helpers
+// ---------------------------------------------------------------------------
+async function readErrorBody(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * POSTs the Steward JWT (+ optional refresh token) to the session endpoint
+ * so the server can set HttpOnly cookies. Throws `StewardSessionError` on
+ * non-2xx; caller decides whether to wipe localStorage based on `error.code`.
+ */
+export async function syncStewardSession(token, refreshToken, opts = {}) {
+    const endpoint = opts.endpoint ?? STEWARD_SESSION_ENDPOINT;
+    const f = opts.fetchImpl ?? fetch;
+    // Refresh tokens now live exclusively in the HttpOnly
+    // `steward-refresh-token` cookie. We forward whatever the caller passes
+    // (e.g. the value still arriving in a legacy URL fragment during the
+    // rollout window) so the server can set the cookie on first login, but we
+    // do NOT read it back from localStorage — that path is being removed.
+    const body = {
+        token,
+        ...(refreshToken ? { refreshToken } : {}),
+    };
+    const response = await f(endpoint, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        const errBody = await readErrorBody(response);
+        throw new StewardSessionError(errBody?.error || "Could not establish an Eliza Cloud session.", response.status, errBody?.code ?? null);
+    }
+    return (await response.json());
+}
+/**
+ * POSTs the one-time OAuth code to the cloud-api nonce-exchange endpoint.
+ * The route calls Steward `POST /auth/oauth/exchange` server-side, sets the
+ * HttpOnly steward-token + steward-refresh-token cookies, and returns the
+ * Eliza Cloud user id. Some cross-origin checkout callers may also receive a
+ * browser bearer token. Throws `StewardSessionError` on non-2xx.
+ */
+export async function exchangeStewardCode(code, opts = {}) {
+    const endpoint = opts.endpoint ?? STEWARD_NONCE_EXCHANGE_ENDPOINT;
+    const f = opts.fetchImpl ?? fetch;
+    const body = {
+        code,
+        ...(opts.redirectUri ? { redirectUri: opts.redirectUri } : {}),
+        ...(opts.tenantId ? { tenantId: opts.tenantId } : {}),
+        ...(opts.codeVerifier ? { codeVerifier: opts.codeVerifier } : {}),
+    };
+    const response = await f(endpoint, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        const errBody = await readErrorBody(response);
+        throw new StewardSessionError(errBody?.error || "Could not complete Eliza Cloud sign-in.", response.status, errBody?.code ?? null);
+    }
+    return (await response.json());
+}
+/**
+ * Best-effort DELETE of every configured session endpoint. Failures are
+ * swallowed — the caller has already wiped localStorage and there's nothing
+ * useful to do about a cookie that won't clear.
+ */
+export { buildStewardOAuthAuthorizeUrl, consumeStewardPkceVerifier, createStewardPkceChallenge, createStewardPkcePair, generateStewardPkceVerifier, storeStewardPkceVerifier, } from "./steward-oauth-pkce.js";
+export function clearStewardSession(opts = {}) {
+    const endpoints = opts.endpoints ?? [STEWARD_SESSION_ENDPOINT];
+    const f = opts.fetchImpl ?? (typeof fetch !== "undefined" ? fetch : null);
+    if (!f)
+        return;
+    for (const url of endpoints) {
+        f(url, { method: "DELETE", credentials: "include" }).catch(() => {
+            // ignore — see jsdoc
+        });
+    }
+}
+//# sourceMappingURL=index.js.map

package/steward-session-client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/steward-session-client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE9C,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,kCAAkC,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAsCpE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,IAAI,CAA0C;IAEvD,YACE,OAAe,EACf,MAAc,EACd,IAA6C;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAqBD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,sBAAsB;IACpC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B;IAC3C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CACV,+LAA+L,CAChM,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAC1C,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kBAAkB,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CACV,yNAAyN,CAC1N,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,QAAQ,CAAC,MAAM;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,YAA4B,EAC5B,OAAiB,EAAE;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAClC,sDAAsD;IACtD,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,IAAI,GAA0B;QAClC,KAAK;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,IAAI,mBAAmB,CAC3B,OAAO,EAAE,KAAK,IAAI,6CAA6C,EAC/D,QAAQ,CAAC,MAAM,EACf,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;AAC3D,CAAC;AA6CD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,OAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,+BAA+B,CAAC;IAClE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAClC,MAAM,IAAI,GAAgC;QACxC,IAAI;QACJ,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,IAAI,mBAAmB,CAC3B,OAAO,EAAE,KAAK,IAAI,yCAAyC,EAC3D,QAAQ,CAAC,MAAM,EACf,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,2BAA2B,EAG3B,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,UAAU,mBAAmB,CAAC,OAAkB,EAAE;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9D,qBAAqB;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/steward-session-client/steward-oauth-pkce.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Steward OAuth PKCE helpers (RFC 7636).
+ *
+ * Steward's `/auth/oauth/:provider/authorize` requires a S256 `code_challenge`
+ * when `response_type=code`. Mint a verifier/challenge pair, send the challenge
+ * at /authorize, stash the verifier in browser storage, and replay it at
+ * /exchange via {@link exchangeStewardCode}.
+ */
+export type StewardOAuthProvider = "google" | "discord" | "github" | "twitter";
+export declare function generateStewardPkceVerifier(): string;
+export declare function createStewardPkceChallenge(verifier: string): Promise<string>;
+export interface StewardPkcePair {
+    verifier: string;
+    challenge: string;
+}
+export declare function createStewardPkcePair(): Promise<StewardPkcePair>;
+export declare function storeStewardPkceVerifier(verifier: string): boolean;
+export declare function consumeStewardPkceVerifier(): string | null;
+export declare function buildStewardOAuthAuthorizeUrl(provider: StewardOAuthProvider, redirectUri: string, options: {
+    stewardApiUrl: string;
+    stewardTenantId?: string;
+    codeChallenge?: string;
+}): string;
+//# sourceMappingURL=steward-oauth-pkce.d.ts.map

package/steward-session-client/steward-oauth-pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steward-oauth-pkce.d.ts","sourceRoot":"","sources":["../../src/steward-session-client/steward-oauth-pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAoB/E,wBAAgB,2BAA2B,IAAI,MAAM,CAIpD;AAED,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,eAAe,CAAC,CAItE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAoBlE;AAED,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAK1D;AA6BD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IACP,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACA,MAAM,CAYR"}

package/steward-session-client/steward-oauth-pkce.js

@@ -0,0 +1,105 @@
+/**
+ * Steward OAuth PKCE helpers (RFC 7636).
+ *
+ * Steward's `/auth/oauth/:provider/authorize` requires a S256 `code_challenge`
+ * when `response_type=code`. Mint a verifier/challenge pair, send the challenge
+ * at /authorize, stash the verifier in browser storage, and replay it at
+ * /exchange via {@link exchangeStewardCode}.
+ */
+const STEWARD_PKCE_VERIFIER_STORAGE_KEY = "steward.oauth.pkce.verifier";
+const STEWARD_PKCE_VERIFIER_TTL_MS = 10 * 60 * 1000;
+const PKCE_VERIFIER_BYTES = 48;
+function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+export function generateStewardPkceVerifier() {
+    const bytes = new Uint8Array(PKCE_VERIFIER_BYTES);
+    crypto.getRandomValues(bytes);
+    return base64UrlEncode(bytes);
+}
+export async function createStewardPkceChallenge(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+export async function createStewardPkcePair() {
+    const verifier = generateStewardPkceVerifier();
+    const challenge = await createStewardPkceChallenge(verifier);
+    return { verifier, challenge };
+}
+export function storeStewardPkceVerifier(verifier) {
+    if (typeof window === "undefined")
+        return false;
+    const stored = JSON.stringify({
+        verifier,
+        expiresAt: Date.now() + STEWARD_PKCE_VERIFIER_TTL_MS,
+    });
+    let storedAnywhere = false;
+    try {
+        window.sessionStorage.setItem(STEWARD_PKCE_VERIFIER_STORAGE_KEY, stored);
+        storedAnywhere = true;
+    }
+    catch {
+        // private mode / disabled storage
+    }
+    try {
+        window.localStorage.setItem(STEWARD_PKCE_VERIFIER_STORAGE_KEY, stored);
+        storedAnywhere = true;
+    }
+    catch {
+        // same as above
+    }
+    return storedAnywhere;
+}
+export function consumeStewardPkceVerifier() {
+    if (typeof window === "undefined")
+        return null;
+    const sessionVerifier = consumeStoredPkceVerifier(window.sessionStorage);
+    const localVerifier = consumeStoredPkceVerifier(window.localStorage);
+    return sessionVerifier ?? localVerifier;
+}
+function consumeStoredPkceVerifier(storage) {
+    try {
+        const verifier = storage.getItem(STEWARD_PKCE_VERIFIER_STORAGE_KEY);
+        storage.removeItem(STEWARD_PKCE_VERIFIER_STORAGE_KEY);
+        return parseStoredPkceVerifier(verifier);
+    }
+    catch {
+        return null;
+    }
+}
+function parseStoredPkceVerifier(value) {
+    if (!value)
+        return null;
+    try {
+        const parsed = JSON.parse(value);
+        if (typeof parsed.verifier === "string" &&
+            typeof parsed.expiresAt === "number" &&
+            parsed.expiresAt >= Date.now()) {
+            return parsed.verifier;
+        }
+        return null;
+    }
+    catch {
+        return value;
+    }
+}
+export function buildStewardOAuthAuthorizeUrl(provider, redirectUri, options) {
+    const params = new URLSearchParams({
+        redirect_uri: redirectUri,
+        tenant_id: options.stewardTenantId ?? "elizacloud",
+        response_type: "code",
+    });
+    if (options.codeChallenge) {
+        params.set("code_challenge", options.codeChallenge);
+        params.set("code_challenge_method", "S256");
+    }
+    const stewardApiUrl = options.stewardApiUrl.replace(/\/+$/, "");
+    return `${stewardApiUrl}/auth/oauth/${provider}/authorize?${params.toString()}`;
+}
+//# sourceMappingURL=steward-oauth-pkce.js.map

package/steward-session-client/steward-oauth-pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steward-oauth-pkce.js","sourceRoot":"","sources":["../../src/steward-session-client/steward-oauth-pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AACxE,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAO/B,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAClD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACjD,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,4BAA4B;KACxB,CAAC,CAAC;IAChC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;QACzE,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;QACvE,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACzE,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrE,OAAO,eAAe,IAAI,aAAa,CAAC;AAC1C,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QACpE,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC;QACtD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAoB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAgC,CAAC;QAChE,IACE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAC9B,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAA8B,EAC9B,WAAmB,EACnB,OAIC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,OAAO,CAAC,eAAe,IAAI,YAAY;QAClD,aAAa,EAAE,MAAM;KACtB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,GAAG,aAAa,eAAe,QAAQ,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAClF,CAAC"}

package/test-support/test-helpers.d.ts

@@ -0,0 +1,79 @@
+import type http from "node:http";
+/** Standardized test result for mocked updater checks. */
+export type MockUpdateCheckResult = {
+    updateAvailable: boolean;
+    currentVersion: string;
+    latestVersion: string | null;
+    channel: string;
+    distTag: string;
+    cached: boolean;
+    error: string | null;
+};
+/** Snapshot and restore the configured environment variables around a test. */
+export declare function createEnvSandbox(keys: readonly string[]): {
+    clear: () => void;
+    restore: () => void;
+};
+export type PluginModuleShape = {
+    [key: string]: unknown;
+    default?: unknown;
+    plugin?: unknown;
+};
+/** Loose plugin-shape predicate used in dynamic test imports across suites. */
+export declare function looksLikePlugin(value: unknown): value is {
+    name: string;
+};
+/** Extract a plugin-like object from a dynamic module export shape. */
+export declare function extractPlugin(mod: PluginModuleShape): {
+    name: string;
+} | null;
+export declare function isPackageImportResolvable(packageName: string): boolean;
+export declare function isWorkspaceDependency(version: string | undefined): boolean;
+export declare function resolveDiscordPluginImportSpecifier(): string | null;
+export declare function resolveTelegramPluginImportSpecifier(): string | null;
+export declare function resolveLensPluginImportSpecifier(): string | null;
+export declare function resolveFarcasterPluginImportSpecifier(): string | null;
+export declare function resolveNostrPluginImportSpecifier(): string | null;
+export declare function resolveMatrixPluginImportSpecifier(): string | null;
+export declare function resolveFeishuPluginImportSpecifier(): string | null;
+export declare function resolveWechatPluginImportSpecifier(): string | null;
+/** Build a mock update check result with deterministic defaults. */
+export declare function buildMockUpdateCheckResult(overrides?: Partial<MockUpdateCheckResult>): MockUpdateCheckResult;
+/** Small utility to wait for asynchronous side-effects in tests. */
+export declare function waitMs(ms: number): Promise<void>;
+type MockResponsePayload<T> = {
+    res: MockHttpServerResponse;
+    getStatus: () => number;
+    getJson: () => T;
+};
+type MockHttpServerResponse = http.ServerResponse & {
+    _status: number;
+    _body: string;
+    writeHead: (statusCode: number) => void;
+};
+type MockBodyChunk = string | Buffer;
+export type MockRequestOptions = {
+    method?: string;
+    url?: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+    bodyChunks?: MockBodyChunk[];
+    json?: boolean;
+};
+/** Create a lightweight mocked HTTP response used by handler tests. */
+export declare function createMockHttpResponse<T = unknown>(): MockResponsePayload<T>;
+export declare function createMockHeadersRequest(headers?: Record<string, string>, options?: Omit<MockRequestOptions, "headers" | "body">): http.IncomingMessage & {
+    destroy: () => void;
+};
+export declare function createMockIncomingMessage({ method, url, headers, body, bodyChunks, json, }: MockRequestOptions): http.IncomingMessage & {
+    destroy: () => void;
+};
+export declare function createMockJsonRequest(body: unknown, options?: Omit<MockRequestOptions, "body" | "json">): http.IncomingMessage & {
+    destroy: () => void;
+};
+/** Return true when optional plugin imports are intentionally unavailable in this env. */
+export declare function isOptionalImportError(error: unknown, extraMarkers?: readonly string[]): boolean;
+/** Safely import optional plugin modules while allowing hard failures to bubble. */
+export declare function tryOptionalDynamicImport<T>(moduleName: string, markers?: readonly string[]): Promise<T | null>;
+export {};
+//# sourceMappingURL=test-helpers.d.ts.map