[mrgoonie]

Closes #22

What

• examples/astro-node: a TOSE-style Astro SSR shop on @astrojs/node over transport: "ccp", with these parts:
  • A demo login mapped through identity.authenticate, using rebindEachRequest and a logout that calls revoke with the widget's hint.
  • An orders.status read action.
  • A payments.create mutate action. The customer approves a server-signed quote, and the backend validates it again: login, same-origin JSON, owner, order state, amount, expiry and replay.
• examples/ccp-smoke: vitest suites that start the built Astro Node and Next.js (next start) hosts as real servers against the existing fake CCP ingress.
  • A shared contract checks config, session and refresh, SSE chat and history, expired, forged, altered and missing tokens (401), and unknown routes (404).
  • It also checks origins and CORS, agent allowlists, 413 and 429 limits, mapped CCP refusals (503, 429, run_failed, revoked secret), and edge-session refresh.
  • Secret hygiene covers responses, pages, scripts, built client files and host logs, with no Gateway marker anywhere.
  • Astro-only checks cover identity, rebind and logout, two instances, the user directory being down (503), and the order and payment routes. They also check that the page-action manifest reaches CCP.
• build:hosts builds both hosts with canary secrets and fails if one is inlined into a client bundle. test:staging validates the environment before starting anything; it reports variable names only, never values, and refuses Gateway variables.
• docs/ccp-host-smoke.md covers:
  • What runs in CI, and the staging run (env check, private secret, manual 404/503/401 cases, teardown).
  • Who does what across the SDK, the host BFF and the TOSE backend.
  • Multi-instance trade-offs (Server handler: pluggable store for CCP identity sessions #15), safe QR and links (feat(widget): safely render Markdown images for product photos and payment QR #9) and page awareness (feat(context): optional current-page awareness for embedded webchat #2).
  • The reverse-proxy origin note.
• CI: a new ccp-smoke job.

No SDK source or public API change; createDeweeHandler is used as is.

Findings

• Behind a proxy, and under next start, request.url does not carry the public origin. Same-origin calls are therefore refused with 403 forbidden_origin unless the public origin is in DEWEE_ALLOWED_ORIGINS. This is documented, and the smoke runs set it the same way production would.
• Logout on instance A revokes the hinted session and the sessions A holds. A session that only instance B exchanged stays valid at CCP until it expires (the test asserts this). This is the Server handler: pluggable store for CCP identity sessions #15 trade-off, not fixed here.
• next build of Next.js 16.4.0 (already on main) stops once with a security advisory notice; build:hosts retries once. An upgrade of next is recommended separately.

Verification

Local runs (Windows, Node 24), all passing:

• pnpm typecheck, pnpm test, pnpm build, pnpm test:bundlers
• pnpm -r test and pnpm -r build. The first -r build hit the Next notice; the retry passed.
• pnpm -C examples/ccp-smoke build:hosts, typecheck and test: 40 passed, 1 skipped (the staging-only check).

Not run: the staging smoke (no credentials).

🤖 Generated with Claude Code