feat: harden plugin api for separate repos, signed updates and generic external login

plugins/session-sharing/tests/backend/helpers.ts

@@ -141,7 +141,7 @@ export async function startServer(
     live,
     sharing: mock.services.get("sessions.sharing") as SessionSharingV1,
     guests: mock.ctx.registry.consume<SessionGuestsV1>(
-      "sessions.sharing.guests",
+      "session-sharing.guests",
     )!,
     async request(method, path, { user = "alice", body: given } = {}) {
       const body = method === "GET" ? undefined : given;

plugins/session-sharing/tests/backend/security.test.ts

@@ -416,7 +416,9 @@ describe("room guest links", () => {
         roomGuestToken: "guess",
         clientIp: "9.9.9.9",
       });
-      if (!result.ok && result.reason === "Too many requests") refused = true;
+      if (result.ok === false && result.reason === "Too many requests") {
+        refused = true;
+      }
     }
     expect(refused).toBe(true);
   });