@robono/server 0.21.0 → 0.23.0

package/legacy/0.21.0/messenger-connected-templates.js

@@ -0,0 +1,138 @@
+import { customerMessengerTemplates } from './messenger-customer-templates.js';
+export function connectStarterTemplates(files, options) {
+    const provider = options.auth ?? 'custom', web = options.platform === 'web', q = JSON.stringify;
+    if (!['custom', 'supabase', 'firebase'].includes(provider))
+        throw Error('Choose custom, supabase or firebase sign-in.');
+    if (provider !== 'custom') {
+        const setup = provider === 'supabase' ? `import {createClient} from '@supabase/supabase-js';
+import {supabaseMessengerAuthentication} from '@robono/server';
+let verify:ReturnType<typeof supabaseMessengerAuthentication>|undefined;
+export async function authenticate(request:Request){
+if(verify)return verify(request);
+const url=process.env.SUPABASE_URL??process.env.NEXT_PUBLIC_SUPABASE_URL;
+const key=process.env.SUPABASE_PUBLISHABLE_KEY??process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY??process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+if(!url||!key)throw Error('Set your existing Supabase URL and publishable key on the server.');
+const provider=createClient(url,key,{auth:{persistSession:false,autoRefreshToken:false,detectSessionInUrl:false}});
+verify=supabaseMessengerAuthentication(provider.auth);
+return verify(request);
+}` : `import {getApps,initializeApp,applicationDefault} from 'firebase-admin/app';
+import {getAuth} from 'firebase-admin/auth';
+import {firebaseMessengerAuthentication} from '@robono/server';
+// Use the same Firebase project as your existing sign-in. Keep credentials on the server.
+let verify:ReturnType<typeof firebaseMessengerAuthentication>|undefined;
+export async function authenticate(request:Request){
+if(verify)return verify(request);
+const provider=getApps().find(app=>app.name==='robono-auth')??initializeApp({credential:applicationDefault()},'robono-auth');
+verify=firebaseMessengerAuthentication(getAuth(provider));
+return verify(request);
+}`;
+        files['server/robono-access.ts'] = `import type {MessengerAccess} from '@robono/server';\n${setup}\n\n// Keep YOUR current eligibility, suspension and membership checks here.
+// Signing in does not grant permission to every conversation.
+export async function authorize(access:MessengerAccess):Promise<boolean>{
+ throw Error('Connect your existing messaging permission check in robono-access.ts');
+}
+`;
+        files['.env.example'] += provider === 'supabase' ? '# Existing NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY\n# (or NEXT_PUBLIC_SUPABASE_ANON_KEY) are reused when present. Otherwise set:\n# SUPABASE_URL=\n# SUPABASE_PUBLISHABLE_KEY=\n' : '# Server only: path to your existing Firebase service-account file, or workload identity.\nGOOGLE_APPLICATION_CREDENTIALS=\n';
+    }
+    files['client/RobonoChat.tsx'] = web ? `'use client';
+import {useEffect,useRef} from 'react';
+import {mountRobonoMessenger} from '@robono/messaging-web';
+type Options=Parameters<typeof mountRobonoMessenger>[1];
+export function RobonoChat({userId,getAccessToken,contacts,onReady,onSignOut}:{userId:string;getAccessToken:Options['getAccessToken'];contacts?:Options['contacts'];onSignOut?:()=>Promise<void>;onReady?:(chat:ReturnType<typeof mountRobonoMessenger>|null)=>void}){
+ const element=useRef<HTMLDivElement>(null),latest=useRef({userId,getAccessToken,onReady,onSignOut}),active=useRef<ReturnType<typeof mountRobonoMessenger>|null>(null);
+ latest.current={userId,getAccessToken,onReady,onSignOut};
+ useEffect(()=>{
+  if(!element.current)return;
+  // Capture this account's token callback; never send another account's token for it.
+  const token=async()=>{if(latest.current.userId!==userId)throw Error('Account changed.');const value=await latest.current.getAccessToken();if(latest.current.userId!==userId)throw Error('Account changed.');return value;};
+  const chat=mountRobonoMessenger(element.current,{endpoint:'/api/robono',companyName:${q(options.companyName)},userId,getAccessToken:token,contacts,account:{name:'Account',onSignOut:async()=>{await latest.current.onSignOut?.();}}});
+  active.current=chat;latest.current.onReady?.(chat);
+  return()=>{active.current=null;latest.current.onReady?.(null);chat.unmount();};
+ },[userId]);
+ useEffect(()=>{active.current?.updateContacts(contacts);},[contacts]);
+ return <div ref={element} style={{height:'100%',minHeight:400}}/>;
+}
+` : `import React,{useEffect,useRef,useState} from 'react';
+import {createExpoMessenger,ExpoMessenger,type ExpoMessengerProps} from '@robono/messaging-react-native/expo';
+type Connection=ReturnType<typeof createExpoMessenger>;
+export function RobonoChat({userId,getAccessToken,contacts,isCallActive,onReady,onSignOut}:{userId:string;getAccessToken:()=>Promise<string>;contacts?:ExpoMessengerProps['contacts'];isCallActive?:()=>boolean;onSignOut?:()=>Promise<void>;onReady?:(connection:Connection|null)=>void}){
+ const latest=useRef({userId,getAccessToken,isCallActive,onReady});latest.current={userId,getAccessToken,isCallActive,onReady};
+ const [active,setActive]=useState<{userId:string;connection:Connection}|null>(null);
+ useEffect(()=>{
+  const token=async()=>{if(latest.current.userId!==userId)throw Error('Account changed.');const value=await latest.current.getAccessToken();if(latest.current.userId!==userId)throw Error('Account changed.');return value;};
+  const connection=createExpoMessenger({endpoint:${q(options.origin + '/api/robono')},userId,getAccessToken:token,isCallActive:()=>latest.current.isCallActive?.()??false});
+  setActive({userId,connection});latest.current.onReady?.(connection);
+  return()=>{latest.current.onReady?.(null);connection.dispose();};
+ },[userId]);
+ if(!active||active.userId!==userId)return null;
+ return <ExpoMessenger {...active.connection} userId={userId} companyName={${q(options.companyName)}} contacts={contacts} account={onSignOut?{name:'Account',onSignOut}:undefined}/>;
+}
+`;
+    files['client/ConnectedRobonoChat.tsx'] = `'use client';
+import React,{useEffect,useRef,useState} from 'react';
+import {RobonoChat} from './RobonoChat';
+import type {ComponentProps} from 'react';
+type ChatProps=ComponentProps<typeof RobonoChat>;
+export interface RobonoAccount {id:string;getAccessToken:()=>Promise<string>}
+export interface RobonoAccounts {
+ // Call the listener immediately with the current account, then on every account change.
+ subscribe(listener:(account:RobonoAccount|null)=>void):()=>void;
+ signOut():Promise<unknown>;
+}
+/** Keep mounted within your signed-in app. No second login or copied session is required. */
+export function ConnectedRobonoChat({accounts,...props}:Omit<ChatProps,'userId'|'getAccessToken'|'onReady'|'onSignOut'>&{accounts:RobonoAccounts}){
+ const [account,setAccount]=useState<RobonoAccount|null>(null),current=useRef<RobonoAccount|null>(null);
+ const sourceVersion=useRef(0),[version,setVersion]=useState(0);
+ const chat=useRef<Parameters<NonNullable<ChatProps['onReady']>>[0]>(null);
+ useEffect(()=>{
+  let live=true;setVersion(++sourceVersion.current);
+  if(current.current){void chat.current?.signOut().catch(()=>{});chat.current=null;current.current=null;setAccount(null);}
+  const off=accounts.subscribe(next=>{
+   if(!live)return;
+   if(current.current?.id!==next?.id){void chat.current?.signOut().catch(()=>{});chat.current=null;}
+   current.current=next;setAccount(next);
+  });
+  return()=>{live=false;sourceVersion.current++;current.current=null;off();};
+ },[accounts]);
+ const token=async()=>{const active=current.current;if(!active||active.id!==account?.id||sourceVersion.current!==version)throw Error('Account changed.');const value=await active.getAccessToken();if(current.current?.id!==active.id||sourceVersion.current!==version)throw Error('Account changed.');return value;};
+ return account?<RobonoChat key={version+':'+account.id} {...props} userId={account.id} getAccessToken={token} onReady={value=>{chat.current=value;}} onSignOut={async()=>{try{await chat.current?.signOut();}finally{await accounts.signOut();}}}/>:null;
+}
+// Before your app signs out, await its messenger handle's signOut when available.
+// A provider sign-out/account-change event also clears chat immediately. Notification removal
+// may require a valid old session; revoke that session and synchronize account suspension too.
+`;
+    if (provider === 'supabase')
+        files['client/robono-accounts.ts'] = `import type {SupabaseClient} from '@supabase/supabase-js';
+import type {RobonoAccounts,RobonoAccount} from './ConnectedRobonoChat';
+export function robonoAccounts(client:SupabaseClient):RobonoAccounts{
+ const account=(id:string):RobonoAccount=>({id,getAccessToken:async()=>{
+  const {data,error}=await client.auth.getSession();
+  if(error||data.session?.user.id!==id)throw Error('Sign in again.');
+  return data.session.access_token;
+ }});
+ return {subscribe(listener){
+  let live=true,events=0;
+  const {data}=client.auth.onAuthStateChange((_event,session)=>{events++;if(live)listener(session?account(session.user.id):null);});
+  const initial=events;
+  void client.auth.getSession().then(({data,error})=>{if(live&&events===initial)listener(!error&&data.session?account(data.session.user.id):null);}).catch(()=>{if(live&&events===initial)listener(null);});
+  return()=>{live=false;data.subscription.unsubscribe();};
+ },signOut:()=>client.auth.signOut()};
+}
+`;
+    if (provider === 'firebase')
+        files['client/robono-accounts.ts'] = `import {onIdTokenChanged,signOut,type Auth} from 'firebase/auth';
+import type {RobonoAccounts} from './ConnectedRobonoChat';
+export function robonoAccounts(auth:Auth):RobonoAccounts{
+ return {subscribe(listener){return onIdTokenChanged(auth,user=>listener(user?{id:user.uid,getAccessToken:async()=>{
+  if(auth.currentUser?.uid!==user.uid)throw Error('Sign in again.');
+  const token=await user.getIdToken();
+  if(auth.currentUser?.uid!==user.uid)throw Error('Sign in again.');
+  return token;
+ }}:null),()=>listener(null));},signOut:()=>signOut(auth)};
+}
+`;
+    files['ROBONO-SETUP.md'] += `\n## Connected accounts\n${provider === 'custom' ? 'Implement the small RobonoAccounts interface using your existing verified sign-in client.' : 'Import CustomerMessenger and pass your existing ' + (provider === 'supabase' ? 'Supabase client' : 'Firebase Auth instance') + ' as auth. The account wrapper is included.'} Pass your current contact dictionary as contacts; names and avatars update without restarting the chat. The connected screen listens for sign-in, sign-out and account switching. It uses a fresh token for each request and never substitutes one account’s token for another.\n\nKeep CustomerMessenger mounted in your signed-in application. Add setupChecks during development for a connection check using your existing login; no copied tokens are needed. The panel is hidden in production. Keep your own account suspension and permission checks in robono-access.ts; provider identity verification does not replace them. Missing permission code intentionally denies access. For explicit host sign-out, unregister messaging before revoking your session when possible. If the provider session has already expired, local content is still cleared; synchronize revoked account access on the server so notifications are also blocked.\n`;
+    Object.assign(files, customerMessengerTemplates(options));
+    return files;
+}
+//# sourceMappingURL=messenger-connected-templates.js.map

package/legacy/0.21.0/messenger-customer-templates.js

@@ -0,0 +1,111 @@
+/** A single customer-facing component; account wiring and diagnostics stay generated. */
+export function customerMessengerTemplates(options) {
+    const provider = options.auth ?? 'custom';
+    const web = options.platform === 'web';
+    const type = provider === 'supabase' ? 'SupabaseClient' : provider === 'firebase' ? 'Auth' : 'RobonoAccounts';
+    const typeImport = provider === 'supabase' ? "import type {SupabaseClient} from '@supabase/supabase-js';" : provider === 'firebase' ? "import type {Auth} from 'firebase/auth';" : "import type {RobonoAccounts} from './ConnectedRobonoChat';";
+    return {
+        'client/CustomerMessenger.tsx': `'use client';
+import React,{useMemo,type ComponentProps} from 'react';
+import {ConnectedRobonoChat} from './ConnectedRobonoChat';
+import {MessengerSetup} from './MessengerSetup';
+${typeImport}
+${provider === 'custom' ? '' : "import {robonoAccounts} from './robono-accounts';"}
+type Props=Omit<ComponentProps<typeof ConnectedRobonoChat>,'accounts'>&{
+  ${provider === 'custom' ? 'accounts' : 'auth'}:${type};
+  /** Optional development-only connection check. Never shown in a production build. */
+  setupChecks?:boolean;
+};
+export function CustomerMessenger({${provider === 'custom' ? 'accounts' : 'auth'},setupChecks=false,...props}:Props){
+  ${provider === 'custom' ? '' : 'const accounts=useMemo(()=>robonoAccounts(auth),[auth]);'}
+  return <>
+    {setupChecks&&${web ? "process.env.NODE_ENV==='development'" : '__DEV__'}&&<MessengerSetup accounts={accounts}/>}
+    <ConnectedRobonoChat accounts={accounts} {...props}/>
+  </>;
+}
+`,
+        'client/check-messenger-connection.ts': `export interface ConnectionCheck {name:string;status:'passed'|'failed'|'needs-action';detail:string}
+/** Read-only checks in the signed-in app. Tokens never enter the report or Robono's website. */
+export async function checkMessengerConnection(getAccessToken:()=>Promise<string>,signal:AbortSignal):Promise<ConnectionCheck[]>{
+  const endpoint=${JSON.stringify(web ? '/api/robono' : options.origin + '/api/robono')};
+  const checks:ConnectionCheck[]=[];
+  const run=async(name:string,operation:string,service:string,inspect:(data:any)=>Omit<ConnectionCheck,'name'>)=>{
+    try{
+      const token=await getAccessToken();
+      if(signal.aborted)throw Error('Cancelled');
+      const response=await fetch(endpoint+'?service='+service,{method:'POST',redirect:'error',signal,
+        headers:{'content-type':'application/json',authorization:'Bearer '+token},body:JSON.stringify({operation})});
+      if(!response.ok){
+        const detail=response.status===401?'Sign in again, then check that the server uses the same sign-in provider.':
+          response.status===403?'Check the server’s account permissions and allowed website address.':
+          response.status===404?'The /api/robono route is missing. Run the installer checklist.':
+          response.status===429?'The service is busy or a usage limit was reached. Try again shortly.':
+          'The server could not complete this check. Check its private configuration and permission code.';
+        checks.push({name,status:'failed',detail});return;
+      }
+      checks.push({name,...inspect(await response.json())});
+    }catch{
+      if(signal.aborted)return;
+      checks.push({name,status:'failed',detail:'Could not connect with the current login. Check your server address and internet connection.'});
+    }
+  };
+  await run('Signed-in messaging','settings','messages',data=>({status:data.settings?'passed':'failed',detail:data.settings?'Your current account can load messaging settings.':'The route did not return messaging settings.'}));
+  if(!signal.aborted)await run('Conversations','conversations','messages',data=>({status:!Array.isArray(data.conversations)?'failed':data.conversations.length?'passed':'needs-action',detail:!Array.isArray(data.conversations)?'The route did not return conversations.':data.conversations.length?'Your account has available conversations.':'Connect a second test account and synchronize their permitted relationship from your server.'}));
+  if(!signal.aborted)await run('Notifications','notification-status','notifications',data=>({status:!Array.isArray(data.providers)?'failed':data.providers.length?'passed':'needs-action',detail:!Array.isArray(data.providers)?'Check that the server uses the current messaging package.':data.providers.length?'A notification provider is configured. Test an actual background notification next.':'Connect website or Apple/Google notification settings in Robono. Chat can work before alerts are connected.'}));
+  return checks;
+}
+`,
+        'client/MessengerSetup.tsx': `'use client';
+import React,{useEffect,useRef,useState} from 'react';
+${web ? '' : "import {View,Text,Pressable} from 'react-native';"}
+import type {RobonoAccounts,RobonoAccount} from './ConnectedRobonoChat';
+import {checkMessengerConnection,type ConnectionCheck} from './check-messenger-connection';
+export function MessengerSetup({accounts}:{accounts:RobonoAccounts}){
+  const current=useRef<RobonoAccount|null>(null),generation=useRef(0),pending=useRef<AbortController|null>(null);
+  const [signedIn,setSignedIn]=useState(false),[busy,setBusy]=useState(false),[checks,setChecks]=useState<ConnectionCheck[]>([]);
+  useEffect(()=>{
+    generation.current++;current.current=null;pending.current?.abort();setBusy(false);setChecks([]);setSignedIn(false);
+    let live=true;
+    const off=accounts.subscribe(account=>{
+      if(!live)return;
+      if(current.current?.id!==account?.id){generation.current++;pending.current?.abort();setChecks([]);setBusy(false);}
+      current.current=account;setSignedIn(!!account);
+    });
+    return()=>{live=false;generation.current++;current.current=null;pending.current?.abort();off();};
+  },[accounts]);
+  const run=async()=>{
+    if(!current.current||pending.current&&!pending.current.signal.aborted)return;
+    const account=current.current,version=generation.current,controller=new AbortController();
+    pending.current=controller;setBusy(true);setChecks([]);
+    const timer=setTimeout(()=>controller.abort(),20000);
+    const token=async()=>{
+      if(current.current?.id!==account.id||generation.current!==version)throw Error('Account changed');
+      const value=await current.current.getAccessToken();
+      if(current.current?.id!==account.id||generation.current!==version)throw Error('Account changed');
+      return value;
+    };
+    try{
+      const result=await checkMessengerConnection(token,controller.signal);
+      if(generation.current===version)setChecks(controller.signal.aborted?[{name:'Connection',status:'failed',detail:'The check timed out. Check your connection and try again.'}]:result);
+    }finally{
+      clearTimeout(timer);
+      if(pending.current===controller)pending.current=null;
+      if(generation.current===version)setBusy(false);
+    }
+  };
+  ${web ? `return <aside aria-label="Messenger setup check" style={{padding:12,border:'1px solid #b8b8b8',borderRadius:8,background:'#fff',color:'#222',fontFamily:'system-ui',marginBottom:8}}>
+    <button type="button" disabled={!signedIn||busy} onClick={()=>void run()}>{busy?'Checking connection…':'Check connection'}</button>
+    <p style={{margin:'8px 0',fontSize:14}}>{signedIn?'Uses your current login. No copied tokens or messages.':'Sign in to your app to check the connection.'} Development only.</p>
+    {checks.length>0&&<ul aria-live="polite" style={{margin:0,paddingLeft:20}}>{checks.map(check=><li key={check.name}><strong>{check.status==='passed'?'Ready':check.status==='failed'?'Fix':'Next'} — {check.name}:</strong> {check.detail}</li>)}</ul>}
+    {checks.length>0&&<p style={{fontSize:12,marginBottom:0}}>These are connection checks. They do not prove account isolation, delivery or background notifications.</p>}
+  </aside>;` : `return <View accessibilityLabel="Messenger setup check" style={{padding:12,borderWidth:1,borderColor:'#b8b8b8',borderRadius:8,backgroundColor:'#fff',marginBottom:8}}>
+    <Pressable accessibilityRole="button" accessibilityState={{disabled:!signedIn||busy}} disabled={!signedIn||busy} onPress={()=>void run()} style={{padding:8}}><Text style={{color:'#174ea6',fontWeight:'600'}}>{busy?'Checking connection…':'Check connection'}</Text></Pressable>
+    <Text style={{color:'#222',marginVertical:8}}>{signedIn?'Uses your current login. No copied tokens or messages.':'Sign in to your app to check the connection.'} Development only.</Text>
+    {checks.map(check=><Text key={check.name} style={{color:'#222',marginBottom:6}}>{check.status==='passed'?'Ready':check.status==='failed'?'Fix':'Next'} — {check.name}: {check.detail}</Text>)}
+    {checks.length>0&&<Text style={{color:'#555',fontSize:12}}>These are connection checks. They do not prove account isolation, delivery or background notifications.</Text>}
+  </View>;`}
+}
+`,
+    };
+}
+//# sourceMappingURL=messenger-customer-templates.js.map

package/legacy/0.21.0/messenger-init.js

@@ -0,0 +1,121 @@
+import { connectStarterTemplates } from './messenger-connected-templates.js';
+import { mkdir, writeFile, access, realpath, lstat, rm } from 'node:fs/promises';
+import { resolve, dirname, relative, isAbsolute, join } from 'node:path';
+/** Pure templates contain no credentials. Host authentication deliberately fails closed. */
+export function messengerStarterFiles(options) {
+    const origin = new URL(options.origin);
+    if (origin.origin !== options.origin || origin.username || origin.password || !(origin.protocol === 'https:' || origin.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(origin.hostname)))
+        throw Error('Use your exact HTTPS website origin, or localhost for development.');
+    if (!['web', 'expo'].includes(options.platform) || !['next', 'fetch'].includes(options.framework) || !options.companyName.trim() || options.companyName.length > 100)
+        throw Error('Choose Website or React Native, your server framework, and a company name.');
+    if (options.platform === 'expo' && origin.protocol !== 'https:')
+        throw Error('Phone apps need an HTTPS server address reachable from the phone.');
+    const q = JSON.stringify, route = options.framework === 'next' ? 'app/api/robono/route.ts' : 'server/robono-route.ts';
+    const auth = `import type {MessengerAccess} from '@robono/server';
+// Replace ONLY these two functions with your existing account/permission service.
+// Do not read a user ID from the request body. Verify expiry and suspension.
+export async function authenticate(request:Request):Promise<string|null>{
+  throw Error('Connect your existing session verification in robono-access.ts');
+}
+// Account operations such as settings, conversations and notifications.register-device
+// have no conversation ID. Allow them only for active, eligible accounts.
+// Chat operations also need current membership and write/read permission checks.
+export async function authorize(access:MessengerAccess):Promise<boolean>{
+  throw Error('Connect your existing messaging permission check in robono-access.ts');
+}
+`;
+    const files = {
+        '.gitignore': '.env\n.env.local\nnode_modules/\n',
+        '.env.example': `# Server only. Never prefix this with NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_.\nROBONO_API_KEY=\n# Optional comma-separated exact website origins. Set this before deployment.\nROBONO_ALLOWED_ORIGINS=${options.origin}\n`,
+        'server/robono-access.ts': auth,
+        'server/robono.ts': `import {createRobonoMessengerServer} from '@robono/server';
+import {authenticate,authorize} from './robono-access';
+let messenger:ReturnType<typeof createRobonoMessengerServer>|undefined;
+export function getMessenger(){
+ if(messenger)return messenger;
+ const apiKey=process.env.ROBONO_API_KEY;
+ if(!apiKey)throw Error('Set ROBONO_API_KEY on your server.');
+ const allowedOrigins=process.env.ROBONO_ALLOWED_ORIGINS?.split(',').map((value:string)=>value.trim()).filter(Boolean)??[${q(options.origin)}];
+ return messenger=createRobonoMessengerServer({apiKey,authenticate,authorize,allowedOrigins});
+}
+`,
+        [route]: `import {getMessenger} from ${q(options.framework === 'next' ? '../../../server/robono' : './robono')};
+${options.framework === 'next' ? "export const runtime = 'nodejs';\n" : ''}export const GET=(request:Request)=>getMessenger().handle(request);
+export const POST=(request:Request)=>getMessenger().handle(request);
+`,
+        'server/synchronize-contacts.ts': `// Run on your server when your own relationship record changes.
+// Pass the server-only messenger instance from your application. Revisions come from YOUR database.
+export async function synchronizeFriendship(messenger:import('@robono/server').RobonoMessengerServer,friendship:{userA:string;userB:string;canMessage:boolean;revision:number}){
+  return messenger.robono.setRelationship({externalUserIds:[friendship.userA,friendship.userB],allowed:friendship.canMessage,revision:friendship.revision});
+}
+`,
+        'ROBONO-SETUP.md': `# Connect ${options.companyName.replace(/[\r\n]/g, ' ')} to Robono\n\nThese are prepared integration files, not a replacement for your app. No existing files were changed.\n\n1. Install the packages listed below in the corresponding server and client projects.\n2. Copy the generated files into your app. Put the Robono key only in the server's environment.\n3. Connect the two functions in robono-access.ts to your existing sign-in and permission checks. They reject access until connected.\n4. When your app permits or removes a friendship, call synchronizeFriendship with its current revision. Supply current contact names/avatars to the client. Group memberships use messenger.robono.setGroup.\n5. Mount GET and POST at /api/robono. Add the client screen, pass your signed-in account and token-refresh function, and call its signOut() before ending a session.\n6. Run robono-messenger-check against your own route with a disposable test-user token. Then exchange a message between two authorized users.\n\nServer: npm install @robono/server\nTypeScript server: npm install --save-dev typescript @types/node\nClient: npm install @robono/messaging @robono/${options.platform === 'web' ? 'messaging-web react react-dom' : 'messaging-react-native'}\n\n${options.platform === 'expo' ? 'For React Native, follow the native dependency and Expo configuration instructions in the package README before rebuilding iPhone and Android. Your app needs its own Apple/Google notification credentials; upload private keys only in Robono’s notification setup.' : 'For website alerts, enter your HTTPS origin and chat page in Robono’s notification setup. The supplied messenger handles the browser helper. No Apple/Google private key is needed.'}\n\nKeep feature choices in Robono’s Features & preview. Do not duplicate them in frontend permission switches. Your server remains responsible for who may use the service. Never return true for every permission request.\n\n## Local connection check\nSet ROBONO_MESSENGER_URL, ROBONO_TEST_USER_TOKEN and ROBONO_WEBSITE_ORIGIN in your local environment. Then run:\n\n\`\`\`sh\nnpx --package @robono/server robono-messenger-check\n# Shareable diagnostic output; contains no token or message content:\nnpx --package @robono/server robono-messenger-check --json\n\`\`\`\n\n## Assistance\nAn AI coding assistant may use these files and package documentation to connect your existing account service. It must preserve authentication, expiry, suspension, current memberships and server-only keys. It must not replace them with a demo password or an always-allow function. Do not send credentials or customer messages to support chat.\n`,
+    };
+    if (options.platform === 'web')
+        files['client/RobonoChat.tsx'] = `'use client';
+import {useEffect,useRef} from 'react';
+import {mountRobonoMessenger} from '@robono/messaging-web';
+type Options=Parameters<typeof mountRobonoMessenger>[1];
+// Keep getAccessToken and contacts stable. The token callback must return a current token.
+export function RobonoChat({userId,getAccessToken,contacts,onReady}:{userId:string;getAccessToken:Options['getAccessToken'];contacts:Options['contacts'];onReady:(chat:ReturnType<typeof mountRobonoMessenger>|null)=>void}){
+ const element=useRef<HTMLDivElement>(null);
+ useEffect(()=>{
+  if(!element.current)return;
+  const chat=mountRobonoMessenger(element.current,{endpoint:'/api/robono',companyName:${q(options.companyName)},userId,getAccessToken,contacts});
+  onReady(chat);return()=>{onReady(null);chat.unmount();};
+ },[userId,getAccessToken,contacts,onReady]);
+ return <div ref={element} style={{height:'100%',minHeight:400}}/>;
+}
+// Store onReady's chat handle. Await chat.signOut() BEFORE ending your own session.
+`;
+    else
+        files['client/RobonoChat.tsx'] = `import React,{useEffect,useState} from 'react';
+import {createExpoMessenger,ExpoMessenger,type ExpoMessengerProps} from '@robono/messaging-react-native/expo';
+type Connection=ReturnType<typeof createExpoMessenger>;
+export function RobonoChat({userId,getAccessToken,contacts,isCallActive,onReady}:{userId:string;getAccessToken:()=>Promise<string>;contacts:ExpoMessengerProps['contacts'];isCallActive:()=>boolean;onReady:(connection:Connection|null)=>void}){
+ const [active,setActive]=useState<{userId:string;connection:Connection}|null>(null);
+ useEffect(()=>{
+  const connection=createExpoMessenger({endpoint:${q(options.origin + '/api/robono')},userId,getAccessToken,isCallActive});
+  setActive({userId,connection});onReady(connection);
+  return()=>{onReady(null);connection.dispose();};
+ },[userId,getAccessToken,isCallActive,onReady]);
+ if(!active||active.userId!==userId)return null;
+ return <ExpoMessenger {...active.connection} userId={userId} companyName={${q(options.companyName)}} contacts={contacts}/>;
+}
+// Mount inside your app's safe area. Keep callbacks stable. Await connection.signOut()
+// BEFORE ending your session; dispose only detaches the screen.
+`;
+    return connectStarterTemplates(files, options);
+}
+/** All-or-nothing new directory; never edits a customer's existing app or env file. */
+export async function writeMessengerStarter(destination, options) {
+    const files = messengerStarterFiles(options), target = resolve(destination), parent = await realpath(dirname(target));
+    if (join(parent, target.slice(dirname(target).length + 1)) !== target)
+        throw Error('Use a destination without symbolic-link parents.');
+    try {
+        await access(target);
+        throw Error('That directory already exists. Choose a new directory.');
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+    }
+    await mkdir(target, { mode: 0o700 });
+    try {
+        for (const [name, content] of Object.entries(files)) {
+            const path = resolve(target, name), local = relative(target, path);
+            if (local.startsWith('..') || isAbsolute(local))
+                throw Error('Invalid template path');
+            await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+            if ((await lstat(dirname(path))).isSymbolicLink())
+                throw Error('Unexpected symbolic link');
+            await writeFile(path, content, { flag: 'wx', mode: 0o600 });
+        }
+    }
+    catch (e) {
+        await rm(target, { recursive: true, force: true });
+        throw e;
+    }
+    return Object.keys(files);
+}
+//# sourceMappingURL=messenger-init.js.map