@synap-core/sdk 1.3.0 → 1.4.0

package/dist/testing.d.cts

@@ -1,5 +1,5 @@
-import { P as PublicForm, a as PublicShare, b as PublicRecord } from './client-CVUT1Mcf.cjs';
-import { P as PodGrant, a as PodUser } from './types-DpqPNaaa.cjs';
+import { P as PublicForm, g as PublicShare, e as PublicRecord } from './client-C5sF20f1.cjs';
+import { P as PodGrant, a as PodUser, C as ClientMetadataDocument } from './types-C2KGNXEn.cjs';
 
 /**
  * Demo data for the mock pod. Shapes are the `@synap-core/sdk/public` wire
@@ -44,6 +44,18 @@ interface MockAuthServerOptions {
     refreshIdleSec?: number;
     /** Send `refresh_token_expires_in` with each refresh token. Default false (the pod does not say). */
     advertiseRefreshExpiry?: boolean;
+    /** The reuse grace, seconds (PB3b). Default 30 (the pod's); 0 = off (a pod before PB3b). */
+    refreshGraceSec?: number;
+    /**
+     * `synap_app` on token responses: the connection's id and its page on the
+     * pod console. Default `MOCK_APP`; null = a pod that does not send it.
+     */
+    app?: {
+        id: string;
+        manageUrl: string | null;
+    } | null;
+    /** Entities `GET /entities` answers (with `workspaceId` / `profileSlug` filters). */
+    entities?: Array<Record<string, unknown>>;
     grant?: PodGrant[];
     user?: PodUser;
     /** Override or remove (undefined) metadata fields: a pod too old, a lying issuer. */
@@ -70,6 +82,27 @@ interface AuthorizeDecision {
     /** Override `state` on the answer: a forged answer. */
     state?: string;
 }
+/** A proposal a governed write filed (`GET /proposals` lists the pending ones). */
+interface MockProposal {
+    id: string;
+    proposalType: string;
+    targetType: string;
+    targetId: string | null;
+    status: "pending" | "approved" | "rejected";
+    workspaceId: string | null;
+    createdAt: string;
+    correlationId: string | null;
+    sessionId: string | null;
+    agentUserId: string | null;
+    summary?: string;
+}
+/** The connection's `synap_app` the mock pod answers by default (backend `appTokenResponse`). */
+declare const MOCK_APP: {
+    id: string;
+    manageUrl: string;
+};
+/** The app's agent on the mock pod: who files its proposals. */
+declare const MOCK_APP_AGENT_ID = "agent_mock_app";
 interface MockAuthServer {
     issuer: string;
     fetch: typeof fetch;
@@ -80,6 +113,18 @@ interface MockAuthServer {
         path: string;
         body: unknown;
     }>;
+    /** Proposals filed by proposed writes, in order. */
+    proposals: MockProposal[];
+    /** The person approved or rejected one: it leaves the pending list. */
+    settleProposal(id: string, status: "approved" | "rejected"): void;
+    /** Another instance of the app rotated `token` (its own refresh): returns the pair the pod answered it. */
+    redeemElsewhere(token: string): Promise<{
+        access_token: string;
+        refresh_token: string;
+        expires_in: number;
+    }>;
+    /** Refresh redeems answered within the reuse grace (the same pair again). */
+    graceAnswers: number;
     /** Stand-in for the consent screen: validates the request like /authorize, returns where the pod redirects. */
     authorize(authorizeUrl: string, decision?: AuthorizeDecision): string;
     /** Mark a refresh token used elsewhere: presenting it now is a REUSE (family + live key revoked). */
@@ -96,6 +141,49 @@ interface MockAuthServer {
 }
 declare function createMockAuthServer(options?: MockAuthServerOptions): MockAuthServer;
 
+/**
+ * A mock Synap Cloud pod chooser (Control Plane `GET /connect/pod`, wave C1)
+ * for "Continue with Synap Cloud" tests and a kit's mock mode. No network:
+ * `choose()` stands in for the person signing in to the CP and picking a pod.
+ *
+ * Wire behaviour mirrors the CP route (doc 18 §1.1): it accepts only
+ * `client_id` (an https CIMD URL; http on loopback only with
+ * `allowInsecureLoopback`, for a kit's mock mode on http://localhost) and
+ * `state` (`^[A-Za-z0-9._~-]{16,256}$`),
+ * takes the return URL from the app's client metadata (`initiate_login_uri`),
+ * never from the query, and answers `<initiate_login_uri>?iss=<pod issuer>&state=<state>`.
+ * It never sees a code or a token.
+ *
+ *   const cloud = createMockCloud();
+ *   createPodAppAuth({ ...config, cloudUrl: cloud.url });
+ *   cloud.choose(location, { pod: mockPod.issuer, metadata: auth.metadata })  → the app's return URL
+ */
+
+/** A placeholder Control Plane origin; never contacted. */
+declare const MOCK_CLOUD_URL = "https://cp.mock-synap.test";
+interface MockCloud {
+    url: string;
+    /** The chooser URLs the app sent browsers to. */
+    requests: string[];
+    /**
+     * The person picks `pod` on the chooser: validates the request like the CP,
+     * returns where the CP redirects the browser. Throws on a request the CP
+     * refuses (shown as a page there, never redirected).
+     */
+    choose(location: string, opts: {
+        pod: string;
+        metadata: Pick<ClientMetadataDocument, "client_id" | "initiate_login_uri">;
+    }): string;
+    /** The person cancels on the chooser: `<initiate_login_uri>?state=…&error=access_denied`, no `iss`. */
+    cancel(location: string, opts: {
+        metadata: Pick<ClientMetadataDocument, "client_id" | "initiate_login_uri">;
+    }): string;
+}
+declare function createMockCloud(options?: {
+    url?: string;
+    allowInsecureLoopback?: boolean;
+}): MockCloud;
+
 /**
  * @synap-core/sdk/testing — a mock pod: a fake `fetch` that answers the pod's
  * public doors (forms, shares, sites) from fixtures, with no network. Inject
@@ -115,7 +203,7 @@ declare function createMockAuthServer(options?: MockAuthServerOptions): MockAuth
  *   anything else                               the uniform 404
  *
  * Pod-app sign-in (`@synap-core/sdk/connect`): `createMockAuthServer()`, see
- * ./auth-server.ts.
+ * ./auth-server.ts; Synap Cloud's pod chooser: `createMockCloud()`, ./cloud.ts.
  */
 
 /** A placeholder origin; never contacted. */
@@ -178,4 +266,4 @@ interface MockPod {
 }
 declare function createMockPod(options?: MockPodOptions): MockPod;
 
-export { type AuthorizeDecision, MOCK_AUTH_ISSUER, MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_GRANT, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, MOCK_USER, type MockAuthRequest, type MockAuthServer, type MockAuthServerOptions, type MockCollection, type MockHubFailure, type MockPod, type MockPodOptions, type MockRequest, type MockSite, type MockSubmission, createMockAuthServer, createMockPod };
+export { type AuthorizeDecision, MOCK_APP, MOCK_APP_AGENT_ID, MOCK_AUTH_ISSUER, MOCK_CLOUD_URL, MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_GRANT, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, MOCK_USER, type MockAuthRequest, type MockAuthServer, type MockAuthServerOptions, type MockCloud, type MockCollection, type MockHubFailure, type MockPod, type MockPodOptions, type MockProposal, type MockRequest, type MockSite, type MockSubmission, createMockAuthServer, createMockCloud, createMockPod };

package/dist/testing.d.ts

@@ -1,5 +1,5 @@
-import { P as PublicForm, a as PublicShare, b as PublicRecord } from './client-CVUT1Mcf.js';
-import { P as PodGrant, a as PodUser } from './types-DpqPNaaa.js';
+import { P as PublicForm, g as PublicShare, e as PublicRecord } from './client-C5sF20f1.js';
+import { P as PodGrant, a as PodUser, C as ClientMetadataDocument } from './types-C2KGNXEn.js';
 
 /**
  * Demo data for the mock pod. Shapes are the `@synap-core/sdk/public` wire
@@ -44,6 +44,18 @@ interface MockAuthServerOptions {
     refreshIdleSec?: number;
     /** Send `refresh_token_expires_in` with each refresh token. Default false (the pod does not say). */
     advertiseRefreshExpiry?: boolean;
+    /** The reuse grace, seconds (PB3b). Default 30 (the pod's); 0 = off (a pod before PB3b). */
+    refreshGraceSec?: number;
+    /**
+     * `synap_app` on token responses: the connection's id and its page on the
+     * pod console. Default `MOCK_APP`; null = a pod that does not send it.
+     */
+    app?: {
+        id: string;
+        manageUrl: string | null;
+    } | null;
+    /** Entities `GET /entities` answers (with `workspaceId` / `profileSlug` filters). */
+    entities?: Array<Record<string, unknown>>;
     grant?: PodGrant[];
     user?: PodUser;
     /** Override or remove (undefined) metadata fields: a pod too old, a lying issuer. */
@@ -70,6 +82,27 @@ interface AuthorizeDecision {
     /** Override `state` on the answer: a forged answer. */
     state?: string;
 }
+/** A proposal a governed write filed (`GET /proposals` lists the pending ones). */
+interface MockProposal {
+    id: string;
+    proposalType: string;
+    targetType: string;
+    targetId: string | null;
+    status: "pending" | "approved" | "rejected";
+    workspaceId: string | null;
+    createdAt: string;
+    correlationId: string | null;
+    sessionId: string | null;
+    agentUserId: string | null;
+    summary?: string;
+}
+/** The connection's `synap_app` the mock pod answers by default (backend `appTokenResponse`). */
+declare const MOCK_APP: {
+    id: string;
+    manageUrl: string;
+};
+/** The app's agent on the mock pod: who files its proposals. */
+declare const MOCK_APP_AGENT_ID = "agent_mock_app";
 interface MockAuthServer {
     issuer: string;
     fetch: typeof fetch;
@@ -80,6 +113,18 @@ interface MockAuthServer {
         path: string;
         body: unknown;
     }>;
+    /** Proposals filed by proposed writes, in order. */
+    proposals: MockProposal[];
+    /** The person approved or rejected one: it leaves the pending list. */
+    settleProposal(id: string, status: "approved" | "rejected"): void;
+    /** Another instance of the app rotated `token` (its own refresh): returns the pair the pod answered it. */
+    redeemElsewhere(token: string): Promise<{
+        access_token: string;
+        refresh_token: string;
+        expires_in: number;
+    }>;
+    /** Refresh redeems answered within the reuse grace (the same pair again). */
+    graceAnswers: number;
     /** Stand-in for the consent screen: validates the request like /authorize, returns where the pod redirects. */
     authorize(authorizeUrl: string, decision?: AuthorizeDecision): string;
     /** Mark a refresh token used elsewhere: presenting it now is a REUSE (family + live key revoked). */
@@ -96,6 +141,49 @@ interface MockAuthServer {
 }
 declare function createMockAuthServer(options?: MockAuthServerOptions): MockAuthServer;
 
+/**
+ * A mock Synap Cloud pod chooser (Control Plane `GET /connect/pod`, wave C1)
+ * for "Continue with Synap Cloud" tests and a kit's mock mode. No network:
+ * `choose()` stands in for the person signing in to the CP and picking a pod.
+ *
+ * Wire behaviour mirrors the CP route (doc 18 §1.1): it accepts only
+ * `client_id` (an https CIMD URL; http on loopback only with
+ * `allowInsecureLoopback`, for a kit's mock mode on http://localhost) and
+ * `state` (`^[A-Za-z0-9._~-]{16,256}$`),
+ * takes the return URL from the app's client metadata (`initiate_login_uri`),
+ * never from the query, and answers `<initiate_login_uri>?iss=<pod issuer>&state=<state>`.
+ * It never sees a code or a token.
+ *
+ *   const cloud = createMockCloud();
+ *   createPodAppAuth({ ...config, cloudUrl: cloud.url });
+ *   cloud.choose(location, { pod: mockPod.issuer, metadata: auth.metadata })  → the app's return URL
+ */
+
+/** A placeholder Control Plane origin; never contacted. */
+declare const MOCK_CLOUD_URL = "https://cp.mock-synap.test";
+interface MockCloud {
+    url: string;
+    /** The chooser URLs the app sent browsers to. */
+    requests: string[];
+    /**
+     * The person picks `pod` on the chooser: validates the request like the CP,
+     * returns where the CP redirects the browser. Throws on a request the CP
+     * refuses (shown as a page there, never redirected).
+     */
+    choose(location: string, opts: {
+        pod: string;
+        metadata: Pick<ClientMetadataDocument, "client_id" | "initiate_login_uri">;
+    }): string;
+    /** The person cancels on the chooser: `<initiate_login_uri>?state=…&error=access_denied`, no `iss`. */
+    cancel(location: string, opts: {
+        metadata: Pick<ClientMetadataDocument, "client_id" | "initiate_login_uri">;
+    }): string;
+}
+declare function createMockCloud(options?: {
+    url?: string;
+    allowInsecureLoopback?: boolean;
+}): MockCloud;
+
 /**
  * @synap-core/sdk/testing — a mock pod: a fake `fetch` that answers the pod's
  * public doors (forms, shares, sites) from fixtures, with no network. Inject
@@ -115,7 +203,7 @@ declare function createMockAuthServer(options?: MockAuthServerOptions): MockAuth
  *   anything else                               the uniform 404
  *
  * Pod-app sign-in (`@synap-core/sdk/connect`): `createMockAuthServer()`, see
- * ./auth-server.ts.
+ * ./auth-server.ts; Synap Cloud's pod chooser: `createMockCloud()`, ./cloud.ts.
  */
 
 /** A placeholder origin; never contacted. */
@@ -178,4 +266,4 @@ interface MockPod {
 }
 declare function createMockPod(options?: MockPodOptions): MockPod;
 
-export { type AuthorizeDecision, MOCK_AUTH_ISSUER, MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_GRANT, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, MOCK_USER, type MockAuthRequest, type MockAuthServer, type MockAuthServerOptions, type MockCollection, type MockHubFailure, type MockPod, type MockPodOptions, type MockRequest, type MockSite, type MockSubmission, createMockAuthServer, createMockPod };
+export { type AuthorizeDecision, MOCK_APP, MOCK_APP_AGENT_ID, MOCK_AUTH_ISSUER, MOCK_CLOUD_URL, MOCK_FAILURE_TOKENS, MOCK_FORM, MOCK_GRANT, MOCK_POD_URL, MOCK_RETRY_AFTER_SEC, MOCK_SHARE, MOCK_SITE, MOCK_TOKENS, MOCK_USER, type MockAuthRequest, type MockAuthServer, type MockAuthServerOptions, type MockCloud, type MockCollection, type MockHubFailure, type MockPod, type MockPodOptions, type MockProposal, type MockRequest, type MockSite, type MockSubmission, createMockAuthServer, createMockCloud, createMockPod };

package/dist/testing.js

@@ -105,6 +105,8 @@ var MOCK_GRANT = [
   { permission: "entity.post.create", workspaceId: "ws_mock_studio", workspaceName: "Studio" }
 ];
 var MOCK_USER = { id: "user_mock_ada", name: "Ada Lovelace" };
+var MOCK_APP = { id: "app_mock_studio", manageUrl: "https://pod-admin.mock-synap.test/apps/app_mock_studio" };
+var MOCK_APP_AGENT_ID = "agent_mock_app";
 function json(status, body, headers = {}) {
   return new Response(JSON.stringify(body), {
     status,
@@ -127,7 +129,12 @@ function createMockAuthServer(options = {}) {
   const refreshTokens = /* @__PURE__ */ new Map();
   const requests = [];
   const writes = [];
+  const proposals = [];
+  const entities = [...options.entities ?? []];
+  const graceMs = (options.refreshGraceSec ?? 30) * 1e3;
+  const app = options.app === void 0 ? MOCK_APP : options.app;
   let proposalSeq = 0;
+  let graceAnswers = 0;
   const metadata = () => {
     const base = {
       issuer,
@@ -155,18 +162,24 @@ function createMockAuthServer(options = {}) {
     for (const r of refreshTokens.values()) if (r.family === family) r.revoked = true;
     for (const a of access.values()) if (a.family === family) a.revoked = true;
   };
-  const tokenBody = (scope, clientId, family) => {
-    const accessToken = `synap_hub_mock_${randomToken()}`;
-    access.set(accessToken, { expiresAt: now() + accessTtl * 1e3, revoked: false, family: refresh ? family : null });
+  const tokenBody = (scope, clientId, family, pair) => {
+    const accessToken = pair?.accessToken ?? `synap_hub_mock_${randomToken()}`;
+    if (!pair) access.set(accessToken, { expiresAt: now() + accessTtl * 1e3, revoked: false, family: refresh ? family : null, scope });
+    const row = access.get(accessToken);
     const body = {
       access_token: accessToken,
       token_type: "Bearer",
-      expires_in: accessTtl,
+      // As the pod: what the key has left, never an assumed hour.
+      expires_in: Math.max(0, Math.floor((row.expiresAt - now()) / 1e3)),
       scope: scope.join(" "),
       synap_grant: grant.filter((g) => scope.includes(g.permission)),
-      synap_user: user
+      synap_user: user,
+      ...app ? { synap_app: app } : {}
     };
-    if (refresh) {
+    if (pair) {
+      body.refresh_token = pair.refreshToken;
+      if (options.advertiseRefreshExpiry) body.refresh_token_expires_in = Math.floor((refreshTokens.get(pair.refreshToken).idleUntil - now()) / 1e3);
+    } else if (refresh) {
       const refreshToken = randomToken();
       refreshTokens.set(refreshToken, { clientId, family, idleUntil: now() + refreshIdle * 1e3, used: false, revoked: false, scope });
       body.refresh_token = refreshToken;
@@ -198,6 +211,13 @@ function createMockAuthServer(options = {}) {
         return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
       }
       if (row.used) {
+        const successor = row.successor ? refreshTokens.get(row.successor) : void 0;
+        const key = row.pairAccess ? access.get(row.pairAccess) : void 0;
+        const inGrace = graceMs > 0 && row.usedAt !== void 0 && now() - row.usedAt < graceMs;
+        if (inGrace && successor && !successor.used && !successor.revoked && key && !key.revoked && key.expiresAt > now()) {
+          graceAnswers++;
+          return json(200, tokenBody(row.scope, row.clientId, row.family, { accessToken: row.pairAccess, refreshToken: row.successor }));
+        }
         reuses++;
         revokeFamily(row.family);
         return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
@@ -208,11 +228,16 @@ function createMockAuthServer(options = {}) {
         return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
       }
       row.used = true;
-      return json(200, tokenBody(row.scope, row.clientId, row.family));
+      row.usedAt = now();
+      for (const a of access.values()) if (a.family === row.family) a.revoked = true;
+      const body = tokenBody(row.scope, row.clientId, row.family);
+      row.successor = body.refresh_token;
+      row.pairAccess = body.access_token;
+      return json(200, body);
     }
     return oauthError("unsupported_grant_type", "Unsupported grant_type");
   }
-  function hub(method, path, headers, body) {
+  function hub(method, path, query, headers, body) {
     const failure2 = options.failures?.[path];
     if (failure2 === "unreachable") return "reject";
     const bearer = /^Bearer (.+)$/.exec(headers.authorization ?? "")?.[1];
@@ -234,11 +259,43 @@ function createMockAuthServer(options = {}) {
       return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
     }
     if (method === "GET" && path === "/users/me") return json(200, user);
-    if (method === "GET" && path === "/entities") return json(200, { entities: [], total: 0 });
+    if (method === "GET" && path === "/entities") {
+      const ws = query.get("workspaceId");
+      const kind = query.get("profileSlug");
+      const offset = Number(query.get("offset") ?? 0) || 0;
+      const limit = Number(query.get("limit") ?? 50) || 50;
+      const rows = entities.filter((e) => (!ws || e.workspaceId === ws) && (!kind || e.profileSlug === kind));
+      return json(200, rows.slice(offset, offset + limit));
+    }
+    if (method === "GET" && path === "/proposals") {
+      const readable = new Set(grant.filter((g) => g.permission === "proposal.read" && row.scope.includes(g.permission)).map((g) => g.workspaceId));
+      const status = query.get("status") ?? "pending";
+      const ws = query.get("workspaceId");
+      const limit = Math.min(Math.max(Number(query.get("limit") ?? 50) || 50, 1), 200);
+      const offset = Number(query.get("offset") ?? 0) || 0;
+      const rows = proposals.filter((p) => p.workspaceId !== null && readable.has(p.workspaceId)).filter((p) => (status === "all" || p.status === status) && (!ws || p.workspaceId === ws)).reverse();
+      const page = rows.slice(offset, offset + limit);
+      return json(200, { proposals: page, limit, offset, total: rows.length, hasMore: offset + page.length < rows.length });
+    }
     if (method !== "GET") {
       writes.push({ method, path, body });
+      const fields = body && typeof body === "object" ? body : {};
+      const workspaceId = typeof fields.workspaceId === "string" ? fields.workspaceId : null;
       if ((options.writeMode ?? "proposed") === "proposed") {
         const proposalId = `prop_mock_${++proposalSeq}`;
+        proposals.push({
+          id: proposalId,
+          proposalType: method === "POST" ? "create" : method === "DELETE" ? "delete" : "update",
+          targetType: path.split("/")[1]?.replace(/s$/, "") ?? "entity",
+          targetId: null,
+          status: "pending",
+          workspaceId,
+          createdAt: new Date(now()).toISOString(),
+          correlationId: null,
+          sessionId: null,
+          agentUserId: MOCK_APP_AGENT_ID,
+          ...typeof fields.title === "string" ? { summary: `Create "${fields.title}"` } : {}
+        });
         return json(200, {
           status: "proposed",
           message: "Sent for review",
@@ -246,7 +303,9 @@ function createMockAuthServer(options = {}) {
           reviewUrl: `${issuer}/open/${proposalId}`
         });
       }
-      return json(200, { status: "created", id: `ent_mock_${writes.length}` });
+      const id = `ent_mock_${writes.length}`;
+      if (method === "POST" && path === "/entities") entities.push({ id, ...fields });
+      return json(200, { status: "created", id });
     }
     return json(404, { error: "Not found" });
   }
@@ -285,7 +344,7 @@ function createMockAuthServer(options = {}) {
       } catch {
         body = rawBody;
       }
-      const res = hub(method, hubPath, headers, body);
+      const res = hub(method, hubPath, url.searchParams, headers, body);
       if (res === "reject") throw new TypeError("Failed to fetch: mock pod unreachable");
       return res;
     }
@@ -296,6 +355,20 @@ function createMockAuthServer(options = {}) {
     fetch: mockFetch,
     requests,
     writes,
+    proposals,
+    settleProposal(id, status) {
+      const p = proposals.find((x) => x.id === id);
+      if (p) p.status = status;
+    },
+    async redeemElsewhere(t) {
+      const row = refreshTokens.get(t);
+      const res = await token({ grant_type: "refresh_token", refresh_token: t, client_id: row?.clientId ?? "" });
+      if (res.status !== 200) throw new Error(`redeemElsewhere: the pod answered ${res.status}`);
+      return await res.json();
+    },
+    get graceAnswers() {
+      return graceAnswers;
+    },
     authorize(authorizeUrl, decision = {}) {
       const url = new URL(authorizeUrl);
       if (`${url.origin}${url.pathname}` !== `${issuer}/authorize`) throw new Error(`Not this pod's /authorize: ${authorizeUrl}`);
@@ -351,6 +424,52 @@ function createMockAuthServer(options = {}) {
   };
 }
 
+// src/testing/cloud.ts
+var MOCK_CLOUD_URL = "https://cp.mock-synap.test";
+var STATE_RE = /^[A-Za-z0-9._~-]{16,256}$/;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function createMockCloud(options = {}) {
+  const base = (options.url ?? MOCK_CLOUD_URL).replace(/\/+$/, "");
+  const requests = [];
+  return {
+    url: base,
+    requests,
+    choose(location, { pod, metadata }) {
+      const back = check(location, metadata);
+      back.searchParams.set("iss", pod);
+      back.searchParams.set("state", new URL(location).searchParams.get("state"));
+      return back.href;
+    },
+    cancel(location, { metadata }) {
+      const back = check(location, metadata);
+      back.searchParams.set("state", new URL(location).searchParams.get("state"));
+      back.searchParams.set("error", "access_denied");
+      return back.href;
+    }
+  };
+  function check(location, metadata) {
+    requests.push(location);
+    const url = new URL(location);
+    if (`${url.origin}${url.pathname}` !== `${base}/connect/pod`) throw new Error(`Not this CP's /connect/pod: ${location}`);
+    const clientId = url.searchParams.get("client_id");
+    const state = url.searchParams.get("state");
+    if (!clientId || !cimdUrlAccepted(clientId)) throw new Error("Chooser refused: client_id must be an https CIMD URL");
+    if (!state || !STATE_RE.test(state)) throw new Error("Chooser refused: state is missing or malformed");
+    if (clientId !== metadata.client_id) throw new Error("Chooser refused: the client metadata is not this client_id's");
+    return new URL(metadata.initiate_login_uri);
+  }
+  function cimdUrlAccepted(clientId) {
+    let url;
+    try {
+      url = new URL(clientId);
+    } catch {
+      return false;
+    }
+    if (url.protocol === "https:") return true;
+    return url.protocol === "http:" && options.allowInsecureLoopback === true && LOOPBACK_HOSTS.has(url.hostname);
+  }
+}
+
 // src/testing/index.ts
 var MOCK_POD_URL = "https://mock.synap.invalid";
 var MOCK_TOKENS = { form: "demo-form", share: "demo", site: "demo-site" };
@@ -598,7 +717,10 @@ function createMockPod(options = {}) {
   };
 }
 export {
+  MOCK_APP,
+  MOCK_APP_AGENT_ID,
   MOCK_AUTH_ISSUER,
+  MOCK_CLOUD_URL,
   MOCK_FAILURE_TOKENS,
   MOCK_FORM,
   MOCK_GRANT,
@@ -609,6 +731,7 @@ export {
   MOCK_TOKENS,
   MOCK_USER,
   createMockAuthServer,
+  createMockCloud,
   createMockPod
 };
 //# sourceMappingURL=testing.js.map