minutework 0.1.40 → 0.1.42

package/assets/templates/vuilder-public-site/tools/env/check-dev-env.test.ts

@@ -0,0 +1,49 @@
+import { execFileSync } from "node:child_process";
+import { describe, expect, it } from "vitest";
+
+const scriptPath = new URL("./check-dev-env.mjs", import.meta.url).pathname;
+const baseEnv: NodeJS.ProcessEnv = { NODE_ENV: "test", PATH: process.env.PATH ?? "" };
+
+describe("check-dev-env", () => {
+  it("fails fast with the sandbox-link hint when managed env is missing", () => {
+    try {
+      execFileSync(process.execPath, [scriptPath], {
+        encoding: "utf8",
+        env: baseEnv,
+      });
+      throw new Error("expected check-dev-env to fail");
+    } catch (error) {
+      const stderr =
+        typeof error === "object" && error !== null && "stderr" in error
+          ? String((error as { stderr: string }).stderr)
+          : String(error);
+      expect(stderr).toContain("vuilder-app local dev is missing managed sandbox env.");
+      expect(stderr).toContain("MW_PUBLIC_CONTENT_REF");
+      expect(stderr).toContain("MW_VUILDER_ONBOARDING_INTENT_TOKEN");
+      expect(stderr).toContain("minutework sandbox create");
+      expect(stderr).toContain("minutework sandbox connect");
+    }
+  });
+
+  it("passes when managed env is present in the shell", () => {
+    expect(() =>
+      execFileSync(process.execPath, [scriptPath], {
+        encoding: "utf8",
+        env: {
+          ...baseEnv,
+          MW_AUTH_BASE_URL: "https://auth.minutework.ai",
+          MW_PLATFORM_BASE_URL: "https://platform.minutework.ai",
+          MW_PUBLIC_BASE_URL: "http://127.0.0.1:3300",
+          MW_PUBLIC_CONTENT_DIGEST: "public-content-digest",
+          MW_PUBLIC_CONTENT_REF: "runtime:test-public:content",
+          MW_PUBLIC_DJ_BASE_URL: "https://public-dj.minutework.ai",
+          MW_PUBLIC_DJ_READ_TOKEN: "public-dj-read-token",
+          MW_PUBLIC_RELEASE_CLASS: "ssr_container",
+          MW_PUBLIC_SITE_ENV: "preview",
+          MW_PUBLIC_SITE_PROPERTY_KEY: "vuilder-app",
+          MW_VUILDER_ONBOARDING_INTENT_TOKEN: "onboarding-intent-token",
+        },
+      }),
+    ).not.toThrow();
+  });
+});

package/assets/templates/vuilder-public-site/tools/template/validate-template.mjs

@@ -0,0 +1,44 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const templateRoot = path.resolve(__dirname, "..", "..");
+const manifestPath = path.join(templateRoot, "template.json");
+const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+
+const requiredFields = [
+  "template_id",
+  "template_kind",
+  "template_profile",
+  "template_version",
+  "materialize",
+  "builder_edit_mode",
+  "seed_source",
+  "required_bootstrap_steps",
+  "example_features",
+];
+
+for (const field of requiredFields) {
+  if (!(field in manifest)) {
+    throw new Error(`template.json is missing required field "${field}"`);
+  }
+}
+
+if (manifest.template_id !== "vuilder-public-site") {
+  throw new Error("template_id must be vuilder-public-site");
+}
+
+if (manifest.template_kind !== "public_site") {
+  throw new Error("template_kind must be public_site");
+}
+
+if (manifest.template_profile !== "public_dj_cms") {
+  throw new Error("template_profile must be public_dj_cms");
+}
+
+if (manifest.materialize?.destination !== "app") {
+  throw new Error("vuilder-public-site must materialize to app");
+}
+
+console.log("template.json is valid");

package/assets/templates/vuilder-public-site/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2017",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": false,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/assets/templates/vuilder-public-site/vitest.config.ts

@@ -0,0 +1,15 @@
+import path from "node:path";
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    globals: true,
+  },
+  resolve: {
+    alias: {
+      "@": new URL("./src", import.meta.url).pathname,
+      "server-only": path.resolve(__dirname, "test/server-only-stub.ts"),
+    },
+  },
+});

package/assets/templates/vuilder-shell/.env.example

@@ -0,0 +1,8 @@
+NEXT_PUBLIC_MW_APP_ID=vuilder.vertical
+MW_TEMPLATE_APP_NAME=Vuilder Shell
+MW_PUBLIC_BASE_URL=http://127.0.0.1:3301
+MW_AUTH_BASE_URL=http://127.0.0.1:3400
+MW_PUBLIC_SITE_PROPERTY_KEY=vuilder-shell
+MW_PUBLIC_SITE_ENV=preview
+MW_PLATFORM_BASE_URL=http://127.0.0.1:8000
+MW_PLATFORM_FETCH_TIMEOUT_MS=15000

package/assets/templates/vuilder-shell/.storybook/main.ts

@@ -0,0 +1,19 @@
+import { defineMain } from "@storybook/nextjs-vite/node";
+
+export default defineMain({
+  stories: [
+    "../src/design-system/**/*.stories.@(ts|tsx|mdx)",
+    "../src/design-system/docs/**/*.mdx",
+  ],
+  addons: ["@storybook/addon-docs", "@storybook/addon-a11y"],
+  framework: {
+    name: "@storybook/nextjs-vite",
+    options: {
+      nextConfigPath: "../next.config.mjs",
+    },
+  },
+  staticDirs: ["../public"],
+  docs: {
+    defaultName: "Overview",
+  },
+});

package/assets/templates/vuilder-shell/.storybook/preview.tsx

@@ -0,0 +1,38 @@
+import { definePreview } from "@storybook/nextjs-vite";
+
+import "../src/app/globals.css";
+import { ThemeProvider } from "../src/lib/theme";
+
+export default definePreview({
+  decorators: [
+    (Story) => (
+      <ThemeProvider
+        attribute="class"
+        defaultTheme="light"
+        enableSystem
+        disableTransitionOnChange
+      >
+        <div className="min-h-screen bg-background p-6 text-foreground">
+          <Story />
+        </div>
+      </ThemeProvider>
+    ),
+  ],
+  parameters: {
+    layout: "centered",
+    nextjs: {
+      appDirectory: true,
+    },
+    controls: {
+      matchers: {
+        color: /(background|color)$/i,
+        date: /Date$/i,
+      },
+    },
+    options: {
+      storySort: {
+        order: ["Design System"],
+      },
+    },
+  },
+});

package/assets/templates/vuilder-shell/README.md

@@ -0,0 +1,49 @@
+# Vuilder Shell Template
+
+`vuilder-shell` is the branded customer tenant shell for Vuilder-owned verticals.
+It is generated next to `vuilder-app` in a Vuilder workspace.
+
+The shell opens after the customer has signed in through central SSO and the
+platform has completed the `customer_vertical_signup` intent. The platform owns
+identity, tenant runtime provisioning, and app-pack install authority. This
+template owns customer-visible navigation, workspace status, and vertical
+product UI.
+
+## Route Shape
+
+- public route at `/`
+- platform member auth handoff at `/login`, which redirects to central SSO with
+  a shell return URL
+- branded tenant setup/status route at `/w/[workspace_slug]/connect`
+- branded tenant workspace route at `/w/[workspace_slug]`
+- compatibility authenticated app route at `/app`
+
+## Auth Profile
+
+This template uses central platform SSO plus a tenant-bound shell session minted
+by the platform after membership is established. `/login` sets a short-lived
+host-only shell handoff state cookie before redirecting to SSO. SSO returns to
+`/api/auth/accept-shell-session` with a short-lived one-use code and the echoed
+state; the shell validates the state, exchanges the code server-side, sets a
+host-only `mw_vuilder_shell_session` cookie, and redirects to the clean
+workspace URL. Raw platform session and CSRF cookies stay on the SSO origin; the
+shell never builds Django session or CSRF headers. The shell does not render a
+password form and does not expose a local credential-login BFF; `/login` is only
+an SSO redirect handoff. Local `/api/auth/session` and `/api/auth/logout` are
+thin shell-token helpers; logout best-effort revokes the tenant-bound shell
+token before clearing cookies. Browser React never stores platform credentials,
+runtime keys, provisioning secrets, package refs, or install coordinates.
+
+For production handoff from `auth.*` to a branded shell on a sibling subdomain,
+configure `MW_AUTH_BASE_URL` and `MW_PUBLIC_BASE_URL`. Do not configure a shared
+parent-domain shell cookie; the shell session cookie is host-only on the branded
+shell origin.
+
+`vuilder-shell` is not a `tenant-app` and must not use `@minutework/web-auth`
+or same-origin `/_mw` customer routes.
+
+## Vuilder Boundary
+
+Vuilders may customize UI, route layout, visual design, tenant settings,
+runtime-backed data views, agents, workflows, and branding. They must not move
+provisioning decisions into React state or browser-submitted payloads.

package/assets/templates/vuilder-shell/components.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "new-york",
+  "rsc": true,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/app/globals.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "aliases": {
+    "components": "@/design-system",
+    "utils": "@/lib/utils",
+    "ui": "@/design-system/primitives",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "iconLibrary": "lucide"
+}

package/assets/templates/vuilder-shell/eslint.config.mjs

@@ -0,0 +1,41 @@
+import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
+import nextTypeScript from "eslint-config-next/typescript";
+
+import designSystemPlugin from "./tools/design-system/eslint-plugin-design-system.mjs";
+
+const eslintConfig = [
+  ...nextCoreWebVitals,
+  ...nextTypeScript,
+  {
+    ignores: [
+      ".next/**",
+      "node_modules/**",
+      "next-env.d.ts",
+      "storybook-static/**",
+      "src/design-system/tokens/manifest.ts",
+    ],
+  },
+  {
+    files: ["src/app/**/*.{ts,tsx}", "src/features/**/*.{ts,tsx}"],
+    plugins: {
+      "design-system": designSystemPlugin,
+    },
+    rules: {
+      "design-system/no-design-system-bypass-imports": "error",
+      "design-system/no-cva-outside-design-system": "error",
+      "design-system/no-raw-design-values": "error",
+      "design-system/no-bespoke-visual-stacks-in-features": "error",
+    },
+  },
+  {
+    files: ["src/design-system/**/*.{ts,tsx}"],
+    plugins: {
+      "design-system": designSystemPlugin,
+    },
+    rules: {
+      "design-system/no-raw-design-values": "error",
+    },
+  },
+];
+
+export default eslintConfig;

package/assets/templates/vuilder-shell/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/assets/templates/vuilder-shell/next.config.mjs

@@ -0,0 +1,33 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { existsSync } from "node:fs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+function resolveTurbopackRoot(startDirectory) {
+  let directory = startDirectory;
+
+  while (true) {
+    if (existsSync(path.join(directory, "pnpm-workspace.yaml"))) {
+      return directory;
+    }
+
+    const parent = path.dirname(directory);
+    if (parent === directory) {
+      return startDirectory;
+    }
+    directory = parent;
+  }
+}
+
+const nextConfig = {
+  reactStrictMode: true,
+  typedRoutes: true,
+  // Prefer the nearest workspace root so scaffolded tenant-app packages inside a
+  // monorepo and the in-repo template both resolve dependencies correctly.
+  turbopack: {
+    root: resolveTurbopackRoot(__dirname),
+  },
+};
+
+export default nextConfig;

package/assets/templates/vuilder-shell/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "vuilder-shell",
+  "version": "0.1.0",
+  "private": true,
+  "packageManager": "pnpm@9.0.0",
+  "engines": {
+    "node": ">=20.9.0"
+  },
+  "scripts": {
+    "dev": "next dev --hostname 127.0.0.1 --port 3301",
+    "build": "next build",
+    "build:validate": "node tools/template/with-public-site-fixture.mjs next build",
+    "start": "next start -p 3301",
+    "lint": "eslint .",
+    "test": "vitest run",
+    "typegen": "next typegen",
+    "template:validate": "node tools/template/validate-template.mjs",
+    "template:route-contract": "node tools/template/validate-route-contract.mjs",
+    "typecheck": "tsc --noEmit",
+    "validate": "pnpm template:validate && pnpm template:route-contract && pnpm typegen && pnpm design-system:tokens && pnpm design-system:check && pnpm typecheck && pnpm lint && pnpm test && pnpm build:validate && pnpm build-storybook:validate",
+    "design-system:tokens": "node tools/design-system/build-token-manifest.mjs",
+    "design-system:check": "node tools/design-system/run-checks.mjs",
+    "design-system:check:staged": "node tools/design-system/run-checks.mjs --staged",
+    "storybook": "storybook dev -p 6006",
+    "build-storybook": "storybook build",
+    "build-storybook:validate": "node tools/template/with-public-site-fixture.mjs storybook build",
+    "design-system:visual": "playwright test -c tools/design-system/playwright.config.mjs"
+  },
+  "dependencies": {
+    "@radix-ui/react-slot": "^1.2.4",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "lucide-react": "^0.564.0",
+    "next": "^16.2.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "server-only": "^0.0.1",
+    "tailwind-merge": "^3.3.1",
+    "tw-animate-css": "^1.3.3",
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.58.2",
+    "@storybook/addon-a11y": "^10.2.19",
+    "@storybook/addon-docs": "^10.2.19",
+    "@storybook/nextjs-vite": "^10.2.19",
+    "@tailwindcss/postcss": "^4.2.0",
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "ajv": "^8.17.1",
+    "eslint": "^9.39.1",
+    "eslint-config-next": "^16.2.0",
+    "http-server": "^14.1.1",
+    "postcss": "^8.5.6",
+    "storybook": "^10.2.19",
+    "tailwindcss": "^4.2.0",
+    "typescript": "^5.6.0",
+    "vitest": "^3.2.4"
+  }
+}

package/assets/templates/vuilder-shell/postcss.config.mjs

@@ -0,0 +1,8 @@
+/** @type {import('postcss-load-config').Config} */
+const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+
+export default config;

package/assets/templates/vuilder-shell/public/.gitkeep

@@ -0,0 +1 @@
+

package/assets/templates/vuilder-shell/src/app/api/auth/accept-shell-session/route.test.ts

@@ -0,0 +1,105 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  applyVuilderShellSessionToResponse: vi.fn(),
+  clearVuilderShellHandoffStateFromResponse: vi.fn(),
+  exchangeVuilderShellSessionHandoffCode: vi.fn(),
+  readVuilderShellHandoffState: vi.fn(),
+}));
+
+vi.mock("@/lib/platform/client.server", () => ({
+  exchangeVuilderShellSessionHandoffCode:
+    mocks.exchangeVuilderShellSessionHandoffCode,
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  applyVuilderShellSessionToResponse: mocks.applyVuilderShellSessionToResponse,
+  clearVuilderShellHandoffStateFromResponse:
+    mocks.clearVuilderShellHandoffStateFromResponse,
+  readVuilderShellHandoffState: mocks.readVuilderShellHandoffState,
+}));
+
+import { GET } from "./route";
+
+describe("GET /api/auth/accept-shell-session", () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("exchanges the handoff code, sets the shell token, and redirects locally", async () => {
+    mocks.readVuilderShellHandoffState.mockResolvedValue("state-1");
+    mocks.exchangeVuilderShellSessionHandoffCode.mockResolvedValue({
+      data: {
+        expires_at: "2026-06-09T12:00:00Z",
+        shell_session_token: "shell-token-1",
+      },
+    });
+
+    const response = await GET(
+      new Request(
+        "https://shell.example.com/api/auth/accept-shell-session?code=code-1&state=state-1&return_to=%2Fw%2Ffleet-alpha%2Fconnect",
+      ),
+    );
+
+    expect(response.status).toBe(307);
+    expect(response.headers.get("location")).toBe(
+      "https://shell.example.com/w/fleet-alpha/connect",
+    );
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    expect(response.headers.get("referrer-policy")).toBe("no-referrer");
+    expect(mocks.exchangeVuilderShellSessionHandoffCode).toHaveBeenCalledWith(
+      "code-1",
+      "state-1",
+    );
+    expect(mocks.applyVuilderShellSessionToResponse).toHaveBeenCalledWith(
+      expect.any(Response),
+      "shell-token-1",
+      "2026-06-09T12:00:00Z",
+    );
+  });
+
+  it("rejects external return paths", async () => {
+    mocks.readVuilderShellHandoffState.mockResolvedValue("state-1");
+    mocks.exchangeVuilderShellSessionHandoffCode.mockResolvedValue({
+      data: {
+        expires_at: "2026-06-09T12:00:00Z",
+        shell_session_token: "shell-token-1",
+      },
+    });
+
+    const response = await GET(
+      new Request(
+        "https://shell.example.com/api/auth/accept-shell-session?code=code-1&state=state-1&return_to=https%3A%2F%2Fevil.example.com%2F",
+      ),
+    );
+
+    expect(response.headers.get("location")).toBe("https://shell.example.com/app");
+  });
+
+  it("fails closed when the shell state does not match", async () => {
+    mocks.readVuilderShellHandoffState.mockResolvedValue("state-1");
+
+    const response = await GET(
+      new Request(
+        "https://shell.example.com/api/auth/accept-shell-session?code=code-1&state=attacker-state&return_to=%2Fw%2Ffleet-alpha%2Fconnect",
+        {
+          headers: {
+            cookie: "mw_vuilder_shell_session=existing-shell-token",
+          },
+        },
+      ),
+    );
+
+    expect(response.headers.get("location")).toBe(
+      "https://shell.example.com/w/fleet-alpha/connect",
+    );
+    expect(mocks.exchangeVuilderShellSessionHandoffCode).not.toHaveBeenCalled();
+    expect(mocks.applyVuilderShellSessionToResponse).not.toHaveBeenCalled();
+    expect(mocks.clearVuilderShellHandoffStateFromResponse).toHaveBeenCalledWith(
+      expect.any(Response),
+    );
+    expect(response.headers.get("set-cookie") ?? "").not.toContain(
+      "mw_vuilder_shell_session",
+    );
+  });
+});

package/assets/templates/vuilder-shell/src/app/api/auth/accept-shell-session/route.ts

@@ -0,0 +1,63 @@
+import { NextResponse } from "next/server";
+
+import { appRoutes } from "@/lib/app-routes";
+import { exchangeVuilderShellSessionHandoffCode } from "@/lib/platform/client.server";
+import {
+  applyVuilderShellSessionToResponse,
+  clearVuilderShellHandoffStateFromResponse,
+  readVuilderShellHandoffState,
+} from "@/lib/platform/session.server";
+
+function normalizeLocalReturnTo(value?: string | null) {
+  const candidate = String(value ?? "").trim();
+  if (!candidate || !candidate.startsWith("/") || candidate.startsWith("//")) {
+    return appRoutes.appHome;
+  }
+
+  try {
+    const parsed = new URL(candidate, "http://localhost");
+    if (parsed.origin !== "http://localhost" || !parsed.pathname.startsWith("/")) {
+      return appRoutes.appHome;
+    }
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  } catch {
+    return appRoutes.appHome;
+  }
+}
+
+export async function GET(request: Request) {
+  const url = new URL(request.url);
+  const shellSessionHandoffCode = url.searchParams.get("code")?.trim() ?? "";
+  const shellHandoffState = url.searchParams.get("state")?.trim() ?? "";
+  const expectedShellHandoffState = await readVuilderShellHandoffState();
+  const returnTo = normalizeLocalReturnTo(url.searchParams.get("return_to"));
+  const response = NextResponse.redirect(new URL(returnTo, url.origin));
+  response.headers.set("Cache-Control", "no-store");
+  response.headers.set("Referrer-Policy", "no-referrer");
+  clearVuilderShellHandoffStateFromResponse(response);
+
+  if (
+    !shellSessionHandoffCode ||
+    !shellHandoffState ||
+    !expectedShellHandoffState ||
+    shellHandoffState !== expectedShellHandoffState
+  ) {
+    return response;
+  }
+
+  try {
+    const result = await exchangeVuilderShellSessionHandoffCode(
+      shellSessionHandoffCode,
+      expectedShellHandoffState,
+    );
+    applyVuilderShellSessionToResponse(
+      response,
+      result.data.shell_session_token,
+      result.data.expires_at,
+    );
+  } catch {
+    return response;
+  }
+
+  return response;
+}

package/assets/templates/vuilder-shell/src/app/api/auth/logout/route.test.ts

@@ -0,0 +1,63 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  clearPlatformSessionFromResponse: vi.fn(),
+  readPlatformAuthState: vi.fn(),
+  revokeVuilderShellSession: vi.fn(),
+}));
+
+vi.mock("@/lib/platform/client.server", () => ({
+  revokeVuilderShellSession: mocks.revokeVuilderShellSession,
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  clearPlatformSessionFromResponse: mocks.clearPlatformSessionFromResponse,
+  readPlatformAuthState: mocks.readPlatformAuthState,
+}));
+
+import { POST } from "./route";
+
+describe("POST /api/auth/logout", () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("rejects cross-origin submissions before clearing shared cookies", async () => {
+    const response = await POST(
+      new Request("https://shell.example.com/api/auth/logout", {
+        method: "POST",
+        headers: { origin: "https://evil.example.com" },
+      }),
+    );
+
+    expect(response.status).toBe(403);
+    expect(mocks.readPlatformAuthState).not.toHaveBeenCalled();
+    expect(mocks.revokeVuilderShellSession).not.toHaveBeenCalled();
+    expect(mocks.clearPlatformSessionFromResponse).not.toHaveBeenCalled();
+  });
+
+  it("revokes and clears shell session cookies for same-origin submissions", async () => {
+    const authState = { shellSessionToken: "shell-token-1" };
+    mocks.readPlatformAuthState.mockResolvedValue(authState);
+    mocks.revokeVuilderShellSession.mockResolvedValue(undefined);
+
+    const response = await POST(
+      new Request("https://shell.example.com/api/auth/logout", {
+        method: "POST",
+        headers: { origin: "https://shell.example.com" },
+      }),
+    );
+
+    expect(response.status).toBe(204);
+    expect(response.headers.get("Cache-Control")).toBe("no-store");
+    expect(mocks.revokeVuilderShellSession).toHaveBeenCalledWith(authState);
+    expect(mocks.clearPlatformSessionFromResponse).toHaveBeenCalledWith(
+      expect.any(Response),
+    );
+    expect(
+      mocks.revokeVuilderShellSession.mock.invocationCallOrder[0],
+    ).toBeLessThan(
+      mocks.clearPlatformSessionFromResponse.mock.invocationCallOrder[0],
+    );
+  });
+});