@levr-one/auth 1.0.0

package/dist/config.js

@@ -0,0 +1,234 @@
+/**
+ * Unified environment configuration for TQ.AI
+ *
+ * Single source of truth for backend URLs, auth URLs, and OAuth client IDs.
+ * Precedence: TQ_BACKEND_URL env var > ~/.tq/config.json > token apiBaseUrl > staging default
+ *
+ * In test environments (VITEST or NODE_ENV=test), ~/.tq/config.json is
+ * skipped so that tests stay deterministic and never depend on the
+ * developer's local config file.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getTqDir, loadTokens } from './token-store.js';
+/**
+ * Returns true when running inside a test runner (Vitest, Jest, etc.).
+ */
+function isTestEnv() {
+    return (process.env.VITEST !== undefined ||
+        process.env.NODE_ENV === 'test' ||
+        process.env.JEST_WORKER_ID !== undefined);
+}
+/**
+ * Detect whether the developer is running in TLS dev mode (mkcert + DEV_TLS).
+ *
+ * Resolution order:
+ *   1. Tests (Vitest/Jest/NODE_ENV=test)   → always false (deterministic).
+ *   2. Explicit `DEV_TLS` env var          → 'true'/'false' wins.
+ *   3. Cert files at apps/backender/certs/ → presence ⇒ TLS mode.
+ *
+ * The cert-file probe walks up from cwd until it finds the repo root or
+ * hits the filesystem root, so this works whether the CLI is run from
+ * the repo root, an app subdirectory, or a worktree.
+ */
+function isLocalTlsMode() {
+    if (isTestEnv())
+        return false;
+    if (process.env.DEV_TLS === 'true')
+        return true;
+    if (process.env.DEV_TLS === 'false')
+        return false;
+    let dir = process.cwd();
+    for (let i = 0; i < 10; i++) {
+        if (fs.existsSync(path.join(dir, 'apps/backender/certs/dev.crt'))) {
+            return true;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return false;
+}
+const LOCAL_HTTP = {
+    environment: 'local',
+    apiUrl: 'http://localhost:8080',
+    authUrl: 'http://localhost:3021',
+    clientUrl: 'http://localhost:3020',
+    oauthClientId: '2',
+};
+const LOCAL_HTTPS = {
+    environment: 'local',
+    // internal D14: TLS dev mode mirrors the prod parent-domain topology
+    // (`*.levr.test` is the dev counterpart of `*.levr.now` / `*.levr.one`).
+    // The mkcert cert generated by scripts/dev-setup-tls.sh covers these
+    // hostnames, /etc/hosts entries are written by the same script, and the
+    // SPA's `runtime-config.ts` falls back to the same triple. Keeping the
+    // names consistent end-to-end means cookies set with `Domain=.levr.test`
+    // travel to all three subdomains the same way they do in prod.
+    apiUrl: 'https://api.levr.test:8080',
+    authUrl: 'https://auth.levr.test:3021',
+    clientUrl: 'https://ai.levr.test:3020',
+    oauthClientId: '2',
+};
+/**
+ * Environment presets. Staging is the default.
+ *
+ * `local` is a getter that returns the HTTPS variant when DEV_TLS dev mode
+ * is detected (see `isLocalTlsMode()`), so `yarn tq:env local` writes the
+ * right URLs whether the user has TLS dev mode set up or not.
+ */
+export const PRESETS = {
+    staging: {
+        environment: 'staging',
+        // internal D15: levr.now is the unified staging origin set.
+        apiUrl: 'https://api.levr.now',
+        authUrl: 'https://auth.levr.now',
+        clientUrl: 'https://ai.levr.now',
+        oauthClientId: '2',
+    },
+    get local() {
+        return isLocalTlsMode() ? { ...LOCAL_HTTPS } : { ...LOCAL_HTTP };
+    },
+    production: {
+        environment: 'production',
+        // internal: rebranded levr.tools → levr.one. Redirect CloudFront keeps
+        // legacy levr.tools URLs reachable indefinitely via 301.
+        apiUrl: 'https://api.levr.one',
+        authUrl: 'https://auth.levr.one',
+        clientUrl: 'https://ai.levr.one',
+        oauthClientId: '2',
+    },
+};
+/**
+ * Env var override — single canonical name
+ */
+const ENV_VAR = 'TQ_BACKEND_URL';
+/**
+ * Legacy localhost form for the HTTPS dev preset. Older configs and
+ * stored tokens may have `https://localhost:8080` as the apiUrl; we
+ * accept it as an alias of `LOCAL_HTTPS` so flipping DEV_TLS doesn't
+ * orphan existing config files.
+ */
+const LOCAL_HTTPS_LOCALHOST_ALIAS = 'https://localhost:8080';
+/**
+ * Resolve a full TqConfig from a bare API URL by matching presets.
+ * Returns 'custom' environment if no preset matches.
+ *
+ * Local resolution covers three forms:
+ *   - `http://localhost:8080`        → LOCAL_HTTP
+ *   - `https://api.levr.test:8080`   → LOCAL_HTTPS (canonical TLS form)
+ *   - `https://localhost:8080`       → LOCAL_HTTPS (legacy alias)
+ *
+ * Resolving the legacy localhost alias to the new levr.test preset means
+ * a token issued in TLS mode under the old localhost URL still maps to
+ * the right config when read after this change.
+ */
+export function resolveFromApiUrl(url) {
+    const normalized = url.replace(/\/+$/, '');
+    if (normalized === LOCAL_HTTP.apiUrl)
+        return { ...LOCAL_HTTP };
+    if (normalized === LOCAL_HTTPS.apiUrl)
+        return { ...LOCAL_HTTPS };
+    if (normalized === LOCAL_HTTPS_LOCALHOST_ALIAS)
+        return { ...LOCAL_HTTPS };
+    for (const preset of [PRESETS.staging, PRESETS.production]) {
+        if (preset.apiUrl === normalized) {
+            return { ...preset };
+        }
+    }
+    // Custom URL -- use staging-style auth/client URLs as placeholders
+    return {
+        environment: 'custom',
+        apiUrl: normalized,
+        authUrl: normalized,
+        clientUrl: normalized,
+        oauthClientId: process.env.TQ_OAUTH_CLIENT_ID || '2',
+    };
+}
+/**
+ * Load unified config with precedence:
+ * 1. TQ_BACKEND_URL env var
+ * 2. ~/.tq/config.json  (skipped in test environments)
+ * 3. Token's apiBaseUrl from ~/.tq/oauth-tokens.json (skipped in test environments)
+ * 4. Staging default
+ *
+ * TQ_OAUTH_CLIENT_ID env var overrides oauthClientId from any source.
+ */
+export function loadConfig() {
+    let config;
+    // 1. Check env var override
+    const envValue = process.env[ENV_VAR];
+    if (envValue) {
+        config = resolveFromApiUrl(envValue);
+        if (process.env.TQ_OAUTH_CLIENT_ID) {
+            config.oauthClientId = process.env.TQ_OAUTH_CLIENT_ID;
+        }
+        return config;
+    }
+    // 2. Read ~/.tq/config.json (skip in test environments for determinism)
+    if (!isTestEnv()) {
+        const configPath = getConfigFilePath();
+        if (fs.existsSync(configPath)) {
+            try {
+                const raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+                config = {
+                    environment: raw.environment || 'custom',
+                    apiUrl: raw.apiUrl ?? PRESETS.staging.apiUrl,
+                    authUrl: raw.authUrl ?? PRESETS.staging.authUrl,
+                    clientUrl: raw.clientUrl ?? PRESETS.staging.clientUrl,
+                    oauthClientId: raw.oauthClientId ?? '2',
+                };
+                // Apply TQ_OAUTH_CLIENT_ID override
+                if (process.env.TQ_OAUTH_CLIENT_ID) {
+                    config.oauthClientId = process.env.TQ_OAUTH_CLIENT_ID;
+                }
+                return config;
+            }
+            catch {
+                process.stderr.write(`[tq-oauth] WARNING: Malformed config at ${configPath}, falling back to default.\n`);
+            }
+        }
+    }
+    // 3. Infer from stored token's apiBaseUrl (tokens know which backend issued them)
+    if (!isTestEnv()) {
+        const stored = loadTokens();
+        if (stored?.apiBaseUrl) {
+            config = resolveFromApiUrl(stored.apiBaseUrl);
+            if (process.env.TQ_OAUTH_CLIENT_ID) {
+                config.oauthClientId = process.env.TQ_OAUTH_CLIENT_ID;
+            }
+            process.stderr.write(`[tq-oauth] No config.json found. Using environment from token: ${config.environment} (${config.apiUrl})\n`);
+            return config;
+        }
+    }
+    // 4. Default to staging
+    config = { ...PRESETS.staging };
+    // Apply TQ_OAUTH_CLIENT_ID override
+    if (process.env.TQ_OAUTH_CLIENT_ID) {
+        config.oauthClientId = process.env.TQ_OAUTH_CLIENT_ID;
+    }
+    return config;
+}
+/**
+ * Write config to ~/.tq/config.json using atomic write (tmp + rename)
+ */
+export function writeConfig(config) {
+    const tqDir = getTqDir();
+    if (!fs.existsSync(tqDir)) {
+        fs.mkdirSync(tqDir, { recursive: true, mode: 0o700 });
+    }
+    const configPath = getConfigFilePath();
+    const tempPath = configPath + '.tmp';
+    fs.writeFileSync(tempPath, JSON.stringify(config, null, 2) + '\n', {
+        mode: 0o600,
+    });
+    fs.renameSync(tempPath, configPath);
+}
+/**
+ * Get the config file path (~/.tq/config.json)
+ */
+export function getConfigFilePath() {
+    return path.join(getTqDir(), 'config.json');
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAUxD;;GAEG;AACH,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc;IACrB,IAAI,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAa;IAC3B,WAAW,EAAE,OAAO;IACpB,MAAM,EAAE,uBAAuB;IAC/B,OAAO,EAAE,uBAAuB;IAChC,SAAS,EAAE,uBAAuB;IAClC,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,WAAW,GAAa;IAC5B,WAAW,EAAE,OAAO;IACpB,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,EAAE,4BAA4B;IACpC,OAAO,EAAE,6BAA6B;IACtC,SAAS,EAAE,2BAA2B;IACtC,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAyD;IAC3E,OAAO,EAAE;QACP,WAAW,EAAE,SAAS;QACtB,4DAA4D;QAC5D,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,uBAAuB;QAChC,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,GAAG;KACnB;IACD,IAAI,KAAK;QACP,OAAO,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;IACnE,CAAC;IACD,UAAU,EAAE;QACV,WAAW,EAAE,YAAY;QACzB,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,uBAAuB;QAChC,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,GAAG;KACnB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE3C,IAAI,UAAU,KAAK,UAAU,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IAC/D,IAAI,UAAU,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC;IACjE,IAAI,UAAU,KAAK,2BAA2B;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC;IAE1E,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,OAAO;QACL,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,UAAU;QACrB,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,MAAgB,CAAC;IAErB,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAChB,CAAC;gBACvB,MAAM,GAAG;oBACP,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,QAAQ;oBACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM;oBAC5C,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO;oBAC/C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS;oBACrD,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG;iBACxC,CAAC;gBACF,oCAAoC;gBACpC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBACnC,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBACxD,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,UAAU,8BAA8B,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,MAAM,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBACnC,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACxD,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,MAAM,KAAK,CAC5G,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,oCAAoC;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgB;IAC1C,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAErC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACjE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC"}

package/dist/config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../src/config.test.ts"],"names":[],"mappings":""}

package/dist/config.test.js

@@ -0,0 +1,221 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+// Mutable ref so the mock factory can read the current tmpDir
+const state = vi.hoisted(() => ({ tmpDir: '' }));
+// Mock token-store — config.ts imports getTqDir and loadTokens from it
+vi.mock('./token-store.js', () => ({
+    getTqDir: () => path.join(state.tmpDir, '.tq'),
+    loadTokens: () => null,
+}));
+import { loadConfig, writeConfig, resolveFromApiUrl, getConfigFilePath, PRESETS, } from './config.js';
+/**
+ * Temporarily simulate a non-test environment so loadConfig()
+ * exercises the config-file reading path.
+ */
+function withNonTestEnv(fn) {
+    const saved = {
+        VITEST: process.env.VITEST,
+        NODE_ENV: process.env.NODE_ENV,
+        JEST_WORKER_ID: process.env.JEST_WORKER_ID,
+    };
+    delete process.env.VITEST;
+    process.env.NODE_ENV = 'development';
+    delete process.env.JEST_WORKER_ID;
+    try {
+        return fn();
+    }
+    finally {
+        if (saved.VITEST !== undefined)
+            process.env.VITEST = saved.VITEST;
+        else
+            delete process.env.VITEST;
+        if (saved.NODE_ENV !== undefined)
+            process.env.NODE_ENV = saved.NODE_ENV;
+        else
+            delete process.env.NODE_ENV;
+        if (saved.JEST_WORKER_ID !== undefined)
+            process.env.JEST_WORKER_ID = saved.JEST_WORKER_ID;
+        else
+            delete process.env.JEST_WORKER_ID;
+    }
+}
+beforeEach(() => {
+    state.tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tq-oauth-test-'));
+    // Clear relevant env vars
+    delete process.env.TQ_BACKEND_URL;
+    delete process.env.TQ_OAUTH_CLIENT_ID;
+});
+afterEach(() => {
+    fs.rmSync(state.tmpDir, { recursive: true, force: true });
+    delete process.env.TQ_BACKEND_URL;
+    delete process.env.TQ_OAUTH_CLIENT_ID;
+});
+// ---------- resolveFromApiUrl ----------
+describe('resolveFromApiUrl', () => {
+    it('returns staging preset for staging URL', () => {
+        const config = resolveFromApiUrl('https://api.levr.now');
+        expect(config.environment).toBe('staging');
+        expect(config.apiUrl).toBe('https://api.levr.now');
+        expect(config.authUrl).toBe('https://auth.levr.now');
+        expect(config.clientUrl).toBe('https://ai.levr.now');
+    });
+    it('returns local preset for localhost URL', () => {
+        const config = resolveFromApiUrl('http://localhost:8080');
+        expect(config.environment).toBe('local');
+        expect(config.authUrl).toBe('http://localhost:3021');
+    });
+    it('returns local preset for canonical TLS URL (api.levr.test)', () => {
+        const config = resolveFromApiUrl('https://api.levr.test:8080');
+        expect(config.environment).toBe('local');
+        expect(config.apiUrl).toBe('https://api.levr.test:8080');
+        expect(config.authUrl).toBe('https://auth.levr.test:3021');
+        expect(config.clientUrl).toBe('https://ai.levr.test:3020');
+    });
+    it('treats legacy https://localhost:8080 as an alias of LOCAL_HTTPS', () => {
+        // Tokens issued before LOCAL_HTTPS adopted *.levr.test still need to
+        // resolve to 'local' so users don't fall through to 'custom' on
+        // upgrade. The alias maps to the NEW canonical URLs.
+        const config = resolveFromApiUrl('https://localhost:8080');
+        expect(config.environment).toBe('local');
+        expect(config.apiUrl).toBe('https://api.levr.test:8080');
+        expect(config.authUrl).toBe('https://auth.levr.test:3021');
+        expect(config.clientUrl).toBe('https://ai.levr.test:3020');
+    });
+    it('returns production preset for production URL', () => {
+        const config = resolveFromApiUrl('https://api.levr.one');
+        expect(config.environment).toBe('production');
+        expect(config.authUrl).toBe('https://auth.levr.one');
+    });
+    it('strips trailing slashes before matching', () => {
+        const config = resolveFromApiUrl('http://localhost:8080///');
+        expect(config.environment).toBe('local');
+    });
+    it('returns custom environment for unknown URLs', () => {
+        const config = resolveFromApiUrl('https://my-backend.example.com');
+        expect(config.environment).toBe('custom');
+        expect(config.apiUrl).toBe('https://my-backend.example.com');
+        expect(config.oauthClientId).toBe('2');
+    });
+    it('returns a fresh copy for each call', () => {
+        const a = resolveFromApiUrl('http://localhost:8080');
+        const b = resolveFromApiUrl('http://localhost:8080');
+        expect(a).not.toBe(b);
+        expect(a).toEqual(b);
+    });
+});
+// ---------- loadConfig ----------
+describe('loadConfig', () => {
+    it('defaults to staging when no env var and no config file', () => {
+        const config = loadConfig();
+        expect(config).toEqual(PRESETS.staging);
+    });
+    it('uses TQ_BACKEND_URL env var when set', () => {
+        process.env.TQ_BACKEND_URL = 'http://localhost:8080';
+        const config = loadConfig();
+        expect(config.environment).toBe('local');
+        expect(config.apiUrl).toBe('http://localhost:8080');
+    });
+    it('env var takes precedence over config file', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        fs.writeFileSync(path.join(tqDir, 'config.json'), JSON.stringify(PRESETS.staging));
+        process.env.TQ_BACKEND_URL = 'http://localhost:8080';
+        const config = loadConfig();
+        expect(config.environment).toBe('local');
+    });
+    it('reads config from ~/.tq/config.json when no env var (non-test env)', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        fs.writeFileSync(path.join(tqDir, 'config.json'), JSON.stringify(PRESETS.production));
+        const config = withNonTestEnv(() => loadConfig());
+        expect(config.environment).toBe('production');
+        expect(config.apiUrl).toBe('https://api.levr.one');
+    });
+    it('skips config file in test environments and defaults to staging', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        fs.writeFileSync(path.join(tqDir, 'config.json'), JSON.stringify(PRESETS.production));
+        // VITEST env var is set by vitest — loadConfig should skip the file
+        const config = loadConfig();
+        expect(config).toEqual(PRESETS.staging);
+    });
+    it('falls back to staging on malformed config.json (non-test env)', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        fs.writeFileSync(path.join(tqDir, 'config.json'), 'not json{{{');
+        const config = withNonTestEnv(() => loadConfig());
+        expect(config).toEqual(PRESETS.staging);
+    });
+    it('applies TQ_OAUTH_CLIENT_ID override with env var source', () => {
+        process.env.TQ_BACKEND_URL = 'http://localhost:8080';
+        process.env.TQ_OAUTH_CLIENT_ID = '99';
+        const config = loadConfig();
+        expect(config.oauthClientId).toBe('99');
+    });
+    it('applies TQ_OAUTH_CLIENT_ID override with config file source (non-test env)', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        fs.writeFileSync(path.join(tqDir, 'config.json'), JSON.stringify(PRESETS.local));
+        process.env.TQ_OAUTH_CLIENT_ID = '42';
+        const config = withNonTestEnv(() => loadConfig());
+        expect(config.oauthClientId).toBe('42');
+    });
+    it('applies TQ_OAUTH_CLIENT_ID override with default source', () => {
+        process.env.TQ_OAUTH_CLIENT_ID = '7';
+        const config = loadConfig();
+        expect(config.oauthClientId).toBe('7');
+        expect(config.environment).toBe('staging');
+    });
+    it('defaults oauthClientId to 2 when missing from config file (non-test env)', () => {
+        const tqDir = path.join(state.tmpDir, '.tq');
+        fs.mkdirSync(tqDir, { recursive: true });
+        fs.writeFileSync(path.join(tqDir, 'config.json'), JSON.stringify({
+            environment: 'local',
+            apiUrl: 'http://localhost:8080',
+            authUrl: 'http://localhost:3021',
+            clientUrl: 'http://localhost:3020',
+        }));
+        const config = withNonTestEnv(() => loadConfig());
+        expect(config.oauthClientId).toBe('2');
+    });
+});
+// ---------- writeConfig ----------
+describe('writeConfig', () => {
+    it('creates ~/.tq directory and writes config.json', () => {
+        writeConfig(PRESETS.local);
+        const configPath = getConfigFilePath();
+        expect(fs.existsSync(configPath)).toBe(true);
+        const written = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+        expect(written.environment).toBe('local');
+        expect(written.apiUrl).toBe('http://localhost:8080');
+    });
+    it('overwrites existing config', () => {
+        writeConfig(PRESETS.local);
+        writeConfig(PRESETS.staging);
+        const configPath = getConfigFilePath();
+        const written = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+        expect(written.environment).toBe('staging');
+    });
+    it('does not leave temp files after write', () => {
+        writeConfig(PRESETS.local);
+        const tqDir = path.join(state.tmpDir, '.tq');
+        const files = fs.readdirSync(tqDir);
+        expect(files).not.toContain('config.json.tmp');
+        expect(files).toContain('config.json');
+    });
+    it('round-trips through writeConfig and loadConfig (non-test env)', () => {
+        writeConfig(PRESETS.production);
+        const loaded = withNonTestEnv(() => loadConfig());
+        expect(loaded).toEqual(PRESETS.production);
+    });
+});
+// ---------- getConfigFilePath ----------
+describe('getConfigFilePath', () => {
+    it('returns path under ~/.tq/', () => {
+        const p = getConfigFilePath();
+        expect(p).toBe(path.join(state.tmpDir, '.tq', 'config.json'));
+    });
+});
+//# sourceMappingURL=config.test.js.map

package/dist/config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.js","sourceRoot":"","sources":["../src/config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,8DAA8D;AAC9D,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEjD,uEAAuE;AACvE,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC;IAC9C,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC,CAAC,CAAC;AAEJ,OAAO,EACL,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,GAER,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,SAAS,cAAc,CAAI,EAAW;IACpC,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;QAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC9B,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;KAC3C,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC;IACrC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;;YAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;;YACnE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YACpC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;;YAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzC,CAAC;AACH,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxE,0BAA0B;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,0CAA0C;AAE1C,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,qEAAqE;QACrE,gEAAgE;QAChE,qDAAqD;QACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,mCAAmC;AAEnC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,uBAAuB,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAChC,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,uBAAuB,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CACnC,CAAC;QAEF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CACnC,CAAC;QAEF,oEAAoE;QACpE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,uBAAuB,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAC9B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC;YACb,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,uBAAuB;YAChC,SAAS,EAAE,uBAAuB;SACnC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,oCAAoC;AAEpC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CACzB,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CACzB,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0CAA0C;AAE1C,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/file-lock.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Cross-process advisory file lock for coordinating token refresh.
+ *
+ * Problem: each MCP process has its own OAuthClient with a per-process
+ * refreshPromise dedup. When multiple MCP processes (tq-backender-proxy,
+ * tq-agent-bridge, etc.) hit an expired access token at roughly the same
+ * time, they ALL POST /v1/oauth/token with the same refresh token. The
+ * backend rotates the refresh token on first request; subsequent requests
+ * see invalid_grant (400). After CLEAR_TOKENS_AFTER_FAILURES (3)
+ * consecutive 400s, clearTokens() wipes the environment entry entirely.
+ *
+ * Fix: before calling the refresh endpoint, acquire an exclusive lock
+ * file keyed on apiBaseUrl. On acquire, re-read the token file — if
+ * another process refreshed while we waited, adopt their tokens and
+ * skip the network call. Otherwise, call the refresh endpoint and
+ * release the lock.
+ *
+ * Stale lock handling: if the lock file's mtime is older than
+ * STALE_LOCK_THRESHOLD_MS, consider the holder dead (crashed, killed)
+ * and break the lock. This keeps a single bad actor from wedging all
+ * MCP processes forever.
+ */
+export interface FileLockHandle {
+    release: () => void;
+    /** Was the lock broken because the previous holder left a stale file? */
+    brokeStaleLock: boolean;
+}
+/**
+ * Build a lock file path from an apiBaseUrl. Each environment
+ * (localhost, staging, production) gets its own lock since their
+ * tokens are independent.
+ */
+export declare function getLockPath(apiBaseUrl: string): string;
+/**
+ * Acquire an exclusive lock file. Blocks up to `maxWaitMs` while another
+ * holder has it. If the lock file is stale (mtime > threshold), break it
+ * and take it. Returns a handle with `release()` that MUST be called
+ * in finally.
+ */
+export declare function acquireFileLock(lockPath: string, maxWaitMs?: number): Promise<FileLockHandle>;
+//# sourceMappingURL=file-lock.d.ts.map

package/dist/file-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-lock.d.ts","sourceRoot":"","sources":["../src/file-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAItD;AAsBD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAS,GACjB,OAAO,CAAC,cAAc,CAAC,CAiDzB"}

package/dist/file-lock.js

@@ -0,0 +1,110 @@
+/**
+ * Cross-process advisory file lock for coordinating token refresh.
+ *
+ * Problem: each MCP process has its own OAuthClient with a per-process
+ * refreshPromise dedup. When multiple MCP processes (tq-backender-proxy,
+ * tq-agent-bridge, etc.) hit an expired access token at roughly the same
+ * time, they ALL POST /v1/oauth/token with the same refresh token. The
+ * backend rotates the refresh token on first request; subsequent requests
+ * see invalid_grant (400). After CLEAR_TOKENS_AFTER_FAILURES (3)
+ * consecutive 400s, clearTokens() wipes the environment entry entirely.
+ *
+ * Fix: before calling the refresh endpoint, acquire an exclusive lock
+ * file keyed on apiBaseUrl. On acquire, re-read the token file — if
+ * another process refreshed while we waited, adopt their tokens and
+ * skip the network call. Otherwise, call the refresh endpoint and
+ * release the lock.
+ *
+ * Stale lock handling: if the lock file's mtime is older than
+ * STALE_LOCK_THRESHOLD_MS, consider the holder dead (crashed, killed)
+ * and break the lock. This keeps a single bad actor from wedging all
+ * MCP processes forever.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { getTqDir } from './token-store.js';
+const LOCK_DIR = 'locks';
+const STALE_LOCK_THRESHOLD_MS = 30_000; // 30s — well over a normal refresh
+const ACQUIRE_POLL_INTERVAL_MS = 50;
+const ACQUIRE_JITTER_MS = 100;
+/**
+ * Build a lock file path from an apiBaseUrl. Each environment
+ * (localhost, staging, production) gets its own lock since their
+ * tokens are independent.
+ */
+export function getLockPath(apiBaseUrl) {
+    const safe = apiBaseUrl.replace(/[^a-zA-Z0-9]/g, '_');
+    const dir = path.join(getTqDir(), LOCK_DIR);
+    return path.join(dir, `refresh-${safe}.lock`);
+}
+function ensureLockDir(lockPath) {
+    const dir = path.dirname(lockPath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+function breakStaleLockIfAny(lockPath) {
+    try {
+        const stat = fs.statSync(lockPath);
+        if (Date.now() - stat.mtimeMs > STALE_LOCK_THRESHOLD_MS) {
+            fs.unlinkSync(lockPath);
+            return true;
+        }
+    }
+    catch {
+        // lock file gone — race with holder releasing; caller will retry
+    }
+    return false;
+}
+/**
+ * Acquire an exclusive lock file. Blocks up to `maxWaitMs` while another
+ * holder has it. If the lock file is stale (mtime > threshold), break it
+ * and take it. Returns a handle with `release()` that MUST be called
+ * in finally.
+ */
+export async function acquireFileLock(lockPath, maxWaitMs = 10_000) {
+    ensureLockDir(lockPath);
+    const start = Date.now();
+    let brokeStaleLock = false;
+    while (true) {
+        try {
+            // 'wx' — exclusive create, fail if exists (atomic on POSIX)
+            const fd = fs.openSync(lockPath, 'wx');
+            fs.writeSync(fd, `${process.pid}\n${Date.now()}`);
+            fs.closeSync(fd);
+            let released = false;
+            return {
+                brokeStaleLock,
+                release: () => {
+                    if (released)
+                        return;
+                    released = true;
+                    try {
+                        fs.unlinkSync(lockPath);
+                    }
+                    catch {
+                        // Already gone — either we crashed and another process broke
+                        // it, or a test cleaned up. Either way, benign.
+                    }
+                },
+            };
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+            if (breakStaleLockIfAny(lockPath)) {
+                brokeStaleLock = true;
+                // Retry immediately after breaking a stale lock
+                continue;
+            }
+            if (Date.now() - start >= maxWaitMs) {
+                throw new Error(`Could not acquire lock ${lockPath} within ${maxWaitMs}ms`);
+            }
+            // Wait with jitter to avoid thundering herd
+            const delay = ACQUIRE_POLL_INTERVAL_MS +
+                Math.floor(Math.random() * ACQUIRE_JITTER_MS);
+            await new Promise((r) => setTimeout(r, delay));
+        }
+    }
+}
+//# sourceMappingURL=file-lock.js.map

package/dist/file-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-lock.js","sourceRoot":"","sources":["../src/file-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC;AACzB,MAAM,uBAAuB,GAAG,MAAM,CAAC,CAAC,mCAAmC;AAC3E,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAQ9B;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,IAAI,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,uBAAuB,EAAE,CAAC;YACxD,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,SAAS,GAAG,MAAM;IAElB,aAAa,CAAC,QAAQ,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,4DAA4D;YAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAClD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEjB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,OAAO;gBACL,cAAc;gBACd,OAAO,EAAE,GAAG,EAAE;oBACZ,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC1B,CAAC;oBAAC,MAAM,CAAC;wBACP,6DAA6D;wBAC7D,gDAAgD;oBAClD,CAAC;gBACH,CAAC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAEhE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,cAAc,GAAG,IAAI,CAAC;gBACtB,gDAAgD;gBAChD,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,WAAW,SAAS,IAAI,CAC3D,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,MAAM,KAAK,GACT,wBAAwB;gBACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,iBAAiB,CAAC,CAAC;YAChD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC"}