@levr-one/auth 1.1.1 → 1.1.3

package/dist/logout-args.test.js

@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest';
+import { parseLogoutArgs } from './logout-args.js';
+describe('parseLogoutArgs', () => {
+    it('defaults to the configured backend when nothing is named', () => {
+        expect(parseLogoutArgs([])).toEqual({ kind: 'configured' });
+    });
+    // review F-002. `args.indexOf('--backend')` saw only the space-separated
+    // form, so `--backend=<url>` fell through to the CONFIGURED backend —
+    // clearing one the operator had not named, and exiting 0.
+    it.each([
+        ['space-separated', ['--backend', 'http://localhost:9480']],
+        ['inline', ['--backend=http://localhost:9480']],
+    ])('accepts the %s --backend form', (_label, args) => {
+        expect(parseLogoutArgs(args)).toEqual({
+            kind: 'backend',
+            url: 'http://localhost:9480',
+        });
+    });
+    it.each([
+        ['space-separated', ['--env', 'staging']],
+        ['inline', ['--env=staging']],
+    ])('accepts the %s --env form', (_label, args) => {
+        expect(parseLogoutArgs(args)).toEqual({ kind: 'env', env: 'staging' });
+    });
+    it('normalizes a trailing slash on --backend', () => {
+        expect(parseLogoutArgs(['--backend=https://api.levr.now/'])).toEqual({
+            kind: 'backend',
+            url: 'https://api.levr.now',
+        });
+    });
+    it('recognises --all', () => {
+        expect(parseLogoutArgs(['--all'])).toEqual({ kind: 'all' });
+    });
+    // Fails CLOSED: an unrecognised argument must never fall back to a default
+    // target, which is the whole-file-wipe failure mode via argument parsing.
+    it.each([
+        [['--target', 'http://localhost:9480']],
+        [['--backened=http://localhost:9480']],
+        [['http://localhost:9480']],
+        [['--backend', 'http://x', '--extra']],
+    ])('rejects unknown arguments %j', (args) => {
+        const r = parseLogoutArgs(args);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Unknown argument/);
+    });
+    it('rejects two targets rather than silently picking one', () => {
+        const r = parseLogoutArgs(['--backend=http://localhost:9480', '--all']);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/only one of/);
+    });
+    it.each([
+        ['a bare flag', ['--backend']],
+        ['an empty inline value', ['--backend=']],
+        ['a following flag', ['--backend', '--all']],
+    ])('rejects --backend with no url (%s)', (_label, args) => {
+        expect(parseLogoutArgs(args).kind).toBe('error');
+    });
+    it.each(['localhost:8580', 'ftp://x', '/tmp/nope', 'api.levr.now'])('rejects %s as a backend url', (value) => {
+        const r = parseLogoutArgs([`--backend=${value}`]);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Not a backend url/);
+    });
+    it('rejects an unknown environment name', () => {
+        const r = parseLogoutArgs(['--env=staging-typo']);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Unknown environment/);
+    });
+    it.each(['local', 'staging', 'production'])('accepts --env %s', (env) => {
+        expect(parseLogoutArgs([`--env=${env}`])).toEqual({ kind: 'env', env });
+    });
+});
+//# sourceMappingURL=logout-args.test.js.map

package/dist/logout-args.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.test.js","sourceRoot":"","sources":["../src/logout-args.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,sEAAsE;IACtE,0DAA0D;IAC1D,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAC3D,CAAC,QAAQ,EAAE,CAAC,iCAAiC,CAAC,CAAC;KAChD,CAAC,CAAC,+BAA+B,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACnD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACpC,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,uBAAuB;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,CAAC;KAC9B,CAAC,CAAC,2BAA2B,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,eAAe,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,sBAAsB;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;QACvC,CAAC,CAAC,kCAAkC,CAAC,CAAC;QACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC3B,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;KACvC,CAAC,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC,uBAAuB,EAAE,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC,CAAC,oCAAoC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACxD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CACjE,6BAA6B,EAC7B,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/status-report.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Pure decision logic behind `tq:status` (internal).
+ *
+ * Lives outside `cli.ts` for the same reason `scripts/setup-mcp-workspace.lib.ts`
+ * lives outside `setup-mcp.ts`: that module ends in a self-executing `switch`,
+ * so importing it from a test would run a CLI command against the developer's
+ * real `~/.tq`. Everything here is pure — the caller does the fs reading and
+ * passes the parsed values in.
+ *
+ * ## The defect this exists to prevent
+ *
+ * `tq:status` used to render its per-environment block from the three
+ * hardcoded `ENV_URLS` presets, while `tq:login` stores a token under the
+ * backend's real URL. On any local that is not literally `http://localhost:8080`
+ * — every worktree, every DEV_TLS checkout — the block therefore reported a
+ * backend the user had not logged into and could not refresh: a stale
+ * `local: expired 157366m ago (active)` that survived every login, sitting
+ * directly beneath a `Status: valid` line describing a different token.
+ *
+ * The load-bearing assertion in the tests is that a backend absent from
+ * `ENV_URLS` is still listed, and that "active" is decided by URL rather than
+ * by environment name.
+ */
+/** One rendered row of the stored-token table. */
+export interface TokenRow {
+    /** True for the backend `~/.tq/config.json` currently points at. */
+    active: boolean;
+    url: string;
+    /** `local` / `staging` / `production` / `custom`. */
+    label: string;
+    /** e.g. `valid 738m`, `expired 12m ago`. */
+    expiry: string;
+}
+export declare function formatExpiry(expiresAt: number, now: number): string;
+/**
+ * Human label for a stored backend URL.
+ *
+ * `resolveEnvFromUrl` only recognises the three `ENV_URLS` presets, so every
+ * worktree-offset local and every DEV_TLS local comes back unnamed — which is
+ * most of a working machine's token map. Loopback and the `.levr.test` dev
+ * domain are local by construction, so name them rather than render a dozen
+ * indistinguishable `custom` rows.
+ */
+export declare function labelForBackend(url: string): string;
+/**
+ * Build the stored-token table from the backends the token map ACTUALLY holds.
+ *
+ * `activeUrl` is matched by URL, never by environment name: the name `local`
+ * maps to the hardcoded `:8080` preset, which on a worktree is a different
+ * backend from the configured one.
+ *
+ * Active row first, then alphabetical — deterministic, so the table does not
+ * reshuffle between runs.
+ */
+export declare function buildTokenRows(entries: ReadonlyArray<{
+    url: string;
+    tokens: {
+        expiresAt: number;
+    };
+}>, activeUrl: string | undefined, now: number): TokenRow[];
+/**
+ * Map a `levr` MCP URL to the backend URL that `~/.tq/oauth-tokens.json` and
+ * `~/.tq/workspace.json` are keyed by, so the MCP entry can be compared
+ * against the configured backend.
+ *
+ * The MCP host is not the API host for the hosted environments — both are
+ * reached through the client origin's `/api` proxy — so the levr URL cannot be
+ * compared directly. The aliases are DERIVED from `PRESETS` rather than
+ * written out, so they cannot drift from the environment definitions.
+ *
+ * Twin of `identityKeyFromLevrUrl` in `scripts/setup-mcp-workspace.lib.ts`,
+ * which resolves the same key on the WRITE side. `scripts/` imports no
+ * workspace package, so the two cannot share code today; deriving from
+ * `PRESETS` is what keeps this copy honest.
+ */
+export declare function backendUrlForLevrMcp(levrUrl: string): string;
+/** The `levr` server entry, extracted from a parsed `.mcp.json`. */
+export interface LevrMcpEntry {
+    url: string;
+    workspaceId?: string;
+}
+/**
+ * Pull the `levr` entry out of a parsed `.mcp.json`.
+ *
+ * Returns undefined for every shape that does not carry a usable URL —
+ * missing file, wrong type, no `levr` server, no `url`. Reporting nothing is
+ * correct here: the section is diagnostic, and a guess about which control
+ * plane an agent is talking to is worse than silence.
+ */
+export declare function levrEntryFrom(parsed: unknown): LevrMcpEntry | undefined;
+//# sourceMappingURL=status-report.d.ts.map

package/dist/status-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.d.ts","sourceRoot":"","sources":["../src/status-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,kDAAkD;AAClD,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,EACtE,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,GACV,QAAQ,EAAE,CAYZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB5D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAsBvE"}

package/dist/status-report.js

@@ -0,0 +1,145 @@
+/**
+ * Pure decision logic behind `tq:status` (internal).
+ *
+ * Lives outside `cli.ts` for the same reason `scripts/setup-mcp-workspace.lib.ts`
+ * lives outside `setup-mcp.ts`: that module ends in a self-executing `switch`,
+ * so importing it from a test would run a CLI command against the developer's
+ * real `~/.tq`. Everything here is pure — the caller does the fs reading and
+ * passes the parsed values in.
+ *
+ * ## The defect this exists to prevent
+ *
+ * `tq:status` used to render its per-environment block from the three
+ * hardcoded `ENV_URLS` presets, while `tq:login` stores a token under the
+ * backend's real URL. On any local that is not literally `http://localhost:8080`
+ * — every worktree, every DEV_TLS checkout — the block therefore reported a
+ * backend the user had not logged into and could not refresh: a stale
+ * `local: expired 157366m ago (active)` that survived every login, sitting
+ * directly beneath a `Status: valid` line describing a different token.
+ *
+ * The load-bearing assertion in the tests is that a backend absent from
+ * `ENV_URLS` is still listed, and that "active" is decided by URL rather than
+ * by environment name.
+ */
+import { resolveEnvFromUrl } from './token-store.js';
+import { PRESETS } from './config.js';
+export function formatExpiry(expiresAt, now) {
+    const mins = Math.round((expiresAt - now) / 1000 / 60);
+    return now >= expiresAt ? `expired ${-mins}m ago` : `valid ${mins}m`;
+}
+/**
+ * Human label for a stored backend URL.
+ *
+ * `resolveEnvFromUrl` only recognises the three `ENV_URLS` presets, so every
+ * worktree-offset local and every DEV_TLS local comes back unnamed — which is
+ * most of a working machine's token map. Loopback and the `.levr.test` dev
+ * domain are local by construction, so name them rather than render a dozen
+ * indistinguishable `custom` rows.
+ */
+export function labelForBackend(url) {
+    const preset = resolveEnvFromUrl(url);
+    if (preset)
+        return preset;
+    try {
+        const { hostname } = new URL(url);
+        if (hostname === 'localhost' ||
+            hostname === '127.0.0.1' ||
+            hostname === '[::1]' ||
+            hostname === 'levr.test' ||
+            hostname.endsWith('.levr.test')) {
+            return 'local';
+        }
+    }
+    catch {
+        // Not a parseable URL — fall through to `custom`.
+    }
+    return 'custom';
+}
+/**
+ * Build the stored-token table from the backends the token map ACTUALLY holds.
+ *
+ * `activeUrl` is matched by URL, never by environment name: the name `local`
+ * maps to the hardcoded `:8080` preset, which on a worktree is a different
+ * backend from the configured one.
+ *
+ * Active row first, then alphabetical — deterministic, so the table does not
+ * reshuffle between runs.
+ */
+export function buildTokenRows(entries, activeUrl, now) {
+    return entries
+        .map((e) => ({
+        active: !!activeUrl && e.url === activeUrl,
+        url: e.url,
+        label: labelForBackend(e.url),
+        expiry: formatExpiry(e.tokens.expiresAt, now),
+    }))
+        .sort((a, b) => {
+        if (a.active !== b.active)
+            return a.active ? -1 : 1;
+        return a.url.localeCompare(b.url);
+    });
+}
+/**
+ * Map a `levr` MCP URL to the backend URL that `~/.tq/oauth-tokens.json` and
+ * `~/.tq/workspace.json` are keyed by, so the MCP entry can be compared
+ * against the configured backend.
+ *
+ * The MCP host is not the API host for the hosted environments — both are
+ * reached through the client origin's `/api` proxy — so the levr URL cannot be
+ * compared directly. The aliases are DERIVED from `PRESETS` rather than
+ * written out, so they cannot drift from the environment definitions.
+ *
+ * Twin of `identityKeyFromLevrUrl` in `scripts/setup-mcp-workspace.lib.ts`,
+ * which resolves the same key on the WRITE side. `scripts/` imports no
+ * workspace package, so the two cannot share code today; deriving from
+ * `PRESETS` is what keeps this copy honest.
+ */
+export function backendUrlForLevrMcp(levrUrl) {
+    const base = levrUrl.replace(/\/+$/, '').replace(/\/v1\/mcp$/, '');
+    // ONLY the two hosted presets. `PRESETS.local` must never join this list:
+    // under DEV_TLS it is `LOCAL_HTTPS`, whose clientUrl+`/api` is
+    // `https://ai.levr.test:3020/api` — a real key in the token map that has to
+    // resolve VERBATIM. Adding it would rewrite that key to
+    // `https://api.levr.test:8080` and make the entry unreachable, and the
+    // "keys a DEV_TLS local verbatim" test would still pass, because
+    // `isTestEnv()` makes PRESETS.local the plain-HTTP variant. The test below
+    // that asserts this exclusion holds under TLS is the one that would catch
+    // it. (review F-006)
+    for (const preset of [PRESETS.staging, PRESETS.production]) {
+        if (base === `${preset.clientUrl}/api`)
+            return preset.apiUrl;
+    }
+    // Everything else keys verbatim: that base IS the URL the backend was
+    // reached at when its token was stored (worktree locals, DEV_TLS).
+    return base;
+}
+/**
+ * Pull the `levr` entry out of a parsed `.mcp.json`.
+ *
+ * Returns undefined for every shape that does not carry a usable URL —
+ * missing file, wrong type, no `levr` server, no `url`. Reporting nothing is
+ * correct here: the section is diagnostic, and a guess about which control
+ * plane an agent is talking to is worse than silence.
+ */
+export function levrEntryFrom(parsed) {
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const servers = parsed.mcpServers;
+    if (servers === null || typeof servers !== 'object')
+        return undefined;
+    const levr = servers.levr;
+    if (levr === null || typeof levr !== 'object')
+        return undefined;
+    const { url, headers } = levr;
+    if (typeof url !== 'string' || !url)
+        return undefined;
+    const wsId = headers !== null && typeof headers === 'object'
+        ? headers['Workspace-Id']
+        : undefined;
+    return {
+        url,
+        workspaceId: typeof wsId === 'string' && wsId ? wsId : undefined,
+    };
+}
+//# sourceMappingURL=status-report.js.map

package/dist/status-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.js","sourceRoot":"","sources":["../src/status-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAatC,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,GAAW;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IACE,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,WAAW;YACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC/B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsE,EACtE,SAA6B,EAC7B,GAAW;IAEX,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;QAC1C,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;KAC9C,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACnE,0EAA0E;IAC1E,+DAA+D;IAC/D,4EAA4E;IAC5E,wDAAwD;IACxD,uEAAuE;IACvE,iEAAiE;IACjE,2EAA2E;IAC3E,0EAA0E;IAC1E,qBAAqB;IACrB,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,IAAI,KAAK,GAAG,MAAM,CAAC,SAAS,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAC/D,CAAC;IACD,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAI,MAAmC,CAAC,UAAU,CAAC;IAChE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEtE,MAAM,IAAI,GAAI,OAAmC,CAAC,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAA4C,CAAC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,IAAI,GACR,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAC7C,CAAC,CAAE,OAAmC,CAAC,cAAc,CAAC;QACtD,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,GAAG;QACH,WAAW,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC"}

package/dist/status-report.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=status-report.test.d.ts.map

package/dist/status-report.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.test.d.ts","sourceRoot":"","sources":["../src/status-report.test.ts"],"names":[],"mappings":""}

package/dist/status-report.test.js

@@ -0,0 +1,159 @@
+import { describe, it, expect } from 'vitest';
+import { PRESETS } from './config.js';
+import { backendUrlForLevrMcp, buildTokenRows, formatExpiry, labelForBackend, levrEntryFrom, } from './status-report.js';
+const NOW = 1_700_000_000_000;
+const at = (minutes) => ({ expiresAt: NOW + minutes * 60_000 });
+describe('buildTokenRows', () => {
+    // The regression this whole module exists for: the old block rendered the
+    // three hardcoded ENV_URLS presets, so a worktree-offset local was invisible
+    // and the `:8080` row it printed instead could never be refreshed.
+    it('lists a backend that is not one of the three presets', () => {
+        const rows = buildTokenRows([{ url: 'http://localhost:9480', tokens: at(60) }], 'http://localhost:9480', NOW);
+        expect(rows.map((r) => r.url)).toEqual(['http://localhost:9480']);
+    });
+    it('decides "active" by url, not by environment name', () => {
+        const rows = buildTokenRows([
+            { url: 'http://localhost:8080', tokens: at(-99999) },
+            { url: 'http://localhost:9480', tokens: at(60) },
+        ], 'http://localhost:9480', NOW);
+        // Both are "local" by name. Only the configured URL is active — marking
+        // the :8080 preset active is exactly the old bug.
+        expect(rows.filter((r) => r.active).map((r) => r.url)).toEqual([
+            'http://localhost:9480',
+        ]);
+        expect(rows.every((r) => r.label === 'local')).toBe(true);
+    });
+    it('puts the active row first, then sorts the rest alphabetically', () => {
+        const rows = buildTokenRows([
+            { url: 'https://api.levr.now', tokens: at(60) },
+            { url: 'http://localhost:8080', tokens: at(60) },
+            { url: 'http://localhost:9480', tokens: at(60) },
+        ], 'http://localhost:9480', NOW);
+        expect(rows.map((r) => r.url)).toEqual([
+            'http://localhost:9480',
+            'http://localhost:8080',
+            'https://api.levr.now',
+        ]);
+    });
+    it('marks nothing active when the configured backend has no token', () => {
+        const rows = buildTokenRows([{ url: 'https://api.levr.now', tokens: at(60) }], 'http://localhost:9480', NOW);
+        expect(rows.some((r) => r.active)).toBe(false);
+    });
+    it('marks nothing active when there is no configured backend', () => {
+        const rows = buildTokenRows([{ url: 'https://api.levr.now', tokens: at(60) }], undefined, NOW);
+        expect(rows.some((r) => r.active)).toBe(false);
+    });
+});
+describe('formatExpiry', () => {
+    it('reports remaining minutes while valid', () => {
+        expect(formatExpiry(NOW + 90 * 60_000, NOW)).toBe('valid 90m');
+    });
+    it('reports elapsed minutes once expired', () => {
+        expect(formatExpiry(NOW - 12 * 60_000, NOW)).toBe('expired 12m ago');
+    });
+    it('treats the exact expiry instant as expired', () => {
+        expect(formatExpiry(NOW, NOW)).toBe('expired 0m ago');
+    });
+});
+describe('labelForBackend', () => {
+    it('names the presets', () => {
+        expect(labelForBackend('https://api.levr.now')).toBe('staging');
+        expect(labelForBackend('https://api.levr.one')).toBe('production');
+        expect(labelForBackend('http://localhost:8080')).toBe('local');
+    });
+    it('names a worktree-offset loopback backend local', () => {
+        expect(labelForBackend('http://localhost:9480')).toBe('local');
+        expect(labelForBackend('http://127.0.0.1:9480')).toBe('local');
+    });
+    it('names the DEV_TLS dev domain local', () => {
+        expect(labelForBackend('https://ai.levr.test:3020/api')).toBe('local');
+        expect(labelForBackend('https://api.levr.test:8080')).toBe('local');
+    });
+    it('names the levr.test apex local, not just its subdomains', () => {
+        expect(labelForBackend('https://levr.test:3020')).toBe('local');
+    });
+    it('falls back to custom for a remote backend', () => {
+        expect(labelForBackend('https://backend.testquality.net')).toBe('custom');
+    });
+    it('falls back to custom for an unparseable url', () => {
+        expect(labelForBackend('not a url')).toBe('custom');
+    });
+    it('does not treat a lookalike host as local', () => {
+        // `.endsWith('.levr.test')` must not match an attacker-ish suffix host.
+        expect(labelForBackend('https://evil-levr.test.example.com')).toBe('custom');
+    });
+});
+describe('backendUrlForLevrMcp', () => {
+    it('maps the hosted staging MCP url to the api host it is keyed by', () => {
+        expect(backendUrlForLevrMcp('https://ai.levr.now/api/v1/mcp')).toBe('https://api.levr.now');
+    });
+    it('maps the hosted production MCP url to the api host it is keyed by', () => {
+        expect(backendUrlForLevrMcp('https://ai.levr.one/api/v1/mcp')).toBe('https://api.levr.one');
+    });
+    it('keys a worktree local verbatim', () => {
+        expect(backendUrlForLevrMcp('http://localhost:9780/v1/mcp')).toBe('http://localhost:9780');
+    });
+    it('keys a DEV_TLS local verbatim, keeping the /api prefix', () => {
+        // This exact string is a real key in the token map — rewriting it would
+        // make the entry unreachable.
+        expect(backendUrlForLevrMcp('https://ai.levr.test:3020/api/v1/mcp')).toBe('https://ai.levr.test:3020/api');
+    });
+    it('keeps two different worktree ports distinct', () => {
+        expect(backendUrlForLevrMcp('http://localhost:8180/v1/mcp')).not.toBe(backendUrlForLevrMcp('http://localhost:8580/v1/mcp'));
+    });
+    // review F-006. `PRESETS.local` must never join the alias loop: under
+    // DEV_TLS its clientUrl+/api is `https://ai.levr.test:3020/api`, a real key
+    // in the token map that has to resolve verbatim. Asserting against
+    // PRESETS.local itself pins the exclusion in BOTH modes — a hardcoded
+    // DEV_TLS string cannot, because isTestEnv() forces the plain-HTTP preset
+    // and the assertion would pass over a broken function.
+    it('never aliases the local preset, whichever variant is active', () => {
+        const localMcp = `${PRESETS.local.clientUrl}/api/v1/mcp`;
+        expect(backendUrlForLevrMcp(localMcp)).toBe(`${PRESETS.local.clientUrl}/api`);
+        expect(backendUrlForLevrMcp(localMcp)).not.toBe(PRESETS.local.apiUrl);
+    });
+    it('tolerates a trailing slash', () => {
+        expect(backendUrlForLevrMcp('https://ai.levr.now/api/v1/mcp/')).toBe('https://api.levr.now');
+    });
+});
+describe('levrEntryFrom', () => {
+    const config = {
+        mcpServers: {
+            levr: {
+                type: 'http',
+                url: 'https://ai.levr.now/api/v1/mcp',
+                headers: { 'Workspace-Id': 'ws-1' },
+            },
+            'qinetic-mcp': { type: 'stdio' },
+        },
+    };
+    it('extracts the url and the Workspace-Id header', () => {
+        expect(levrEntryFrom(config)).toEqual({
+            url: 'https://ai.levr.now/api/v1/mcp',
+            workspaceId: 'ws-1',
+        });
+    });
+    it('returns the url alone when no Workspace-Id is pinned', () => {
+        expect(levrEntryFrom({ mcpServers: { levr: { url: 'http://x/v1/mcp' } } })).toEqual({ url: 'http://x/v1/mcp', workspaceId: undefined });
+    });
+    it.each([
+        ['null', null],
+        ['an array', []],
+        ['a string', 'nope'],
+        ['no mcpServers', {}],
+        ['no levr server', { mcpServers: { 'qinetic-mcp': { type: 'stdio' } } }],
+        ['a levr server with no url', { mcpServers: { levr: { type: 'http' } } }],
+        ['a non-string url', { mcpServers: { levr: { url: 42 } } }],
+        ['an empty url', { mcpServers: { levr: { url: '' } } }],
+    ])('returns undefined for %s', (_label, input) => {
+        expect(levrEntryFrom(input)).toBeUndefined();
+    });
+    it('ignores a non-string Workspace-Id rather than rendering it', () => {
+        expect(levrEntryFrom({
+            mcpServers: {
+                levr: { url: 'http://x/v1/mcp', headers: { 'Workspace-Id': 7 } },
+            },
+        })).toEqual({ url: 'http://x/v1/mcp', workspaceId: undefined });
+    });
+});
+//# sourceMappingURL=status-report.test.js.map

package/dist/status-report.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.test.js","sourceRoot":"","sources":["../src/status-report.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAC9B,MAAM,EAAE,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;AAExE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,cAAc,CACzB,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAClD,uBAAuB,EACvB,GAAG,CACJ,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,cAAc,CACzB;YACE,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE;YACpD,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;SACjD,EACD,uBAAuB,EACvB,GAAG,CACJ,CAAC;QACF,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7D,uBAAuB;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,cAAc,CACzB;YACE,EAAE,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;YAC/C,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;YAChD,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;SACjD,EACD,uBAAuB,EACvB,GAAG,CACJ,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YACrC,uBAAuB;YACvB,uBAAuB;YACvB,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,cAAc,CACzB,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EACjD,uBAAuB,EACvB,GAAG,CACJ,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,IAAI,GAAG,cAAc,CACzB,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EACjD,SAAS,EACT,GAAG,CACJ,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,eAAe,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,wEAAwE;QACxE,MAAM,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAChE,QAAQ,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACjE,sBAAsB,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACjE,sBAAsB,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,oBAAoB,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAC/D,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,CAAC,oBAAoB,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CACvE,+BAA+B,CAChC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,oBAAoB,CAAC,8BAA8B,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CACnE,oBAAoB,CAAC,8BAA8B,CAAC,CACrD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,4EAA4E;IAC5E,mEAAmE;IACnE,sEAAsE;IACtE,0EAA0E;IAC1E,uDAAuD;IACvD,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,aAAa,CAAC;QAEzD,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACzC,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,MAAM,CACjC,CAAC;QACF,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,oBAAoB,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI,CAClE,sBAAsB,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,MAAM,GAAG;QACb,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,gCAAgC;gBACrC,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;aACpC;YACD,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACjC;KACF,CAAC;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,gCAAgC;YACrC,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CACJ,aAAa,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,MAAM,EAAE,IAAI,CAAC;QACd,CAAC,UAAU,EAAE,EAAE,CAAC;QAChB,CAAC,UAAU,EAAE,MAAM,CAAC;QACpB,CAAC,eAAe,EAAE,EAAE,CAAC;QACrB,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxE,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACzE,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC3D,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;KACxD,CAAC,CAAC,0BAA0B,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CACJ,aAAa,CAAC;YACZ,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE;aACjE;SACF,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/token-store.d.ts

@@ -60,6 +60,23 @@ export declare function loadTokensForEnv(env: EnvName): StoredTokens | null;
  * `--target <url>` and the CLI fetches the matching token entry by URL.
  */
 export declare function loadTokensForUrl(url: string): StoredTokens | null;
+/**
+ * Every backend the token map actually holds, with its canonical key.
+ *
+ * `loadTokensForEnv` can only ever see the three hardcoded `ENV_URLS`
+ * presets, so a worktree-offset local (`http://localhost:9480`), a DEV_TLS
+ * local, or any custom backend is invisible to it — while `saveTokens` keys
+ * on the token's real `apiBaseUrl`. Anything that wants to SHOW what is
+ * stored, rather than resolve one named environment, must enumerate the real
+ * keys or it will report on a backend the user never logged into. (internal)
+ *
+ * Malformed entries are dropped, so every returned `tokens` is a usable
+ * `StoredTokens` — expired included, since expiry is the caller's to display.
+ */
+export declare function listTokenEntries(): Array<{
+    url: string;
+    tokens: StoredTokens;
+}>;
 /**
  * Save tokens for the current environment.
  * Upserts the entry keyed by the token's apiBaseUrl.
@@ -69,11 +86,35 @@ export declare function saveTokens(tokens: StoredTokens): void;
  * Save tokens for a specific environment by name.
  */
 export declare function saveTokensForEnv(env: EnvName, tokens: StoredTokens): void;
+/**
+ * Remove the stored token for exactly ONE backend.
+ *
+ * @returns true when an entry was removed, false when that backend had none.
+ *
+ * Never touches another backend's entry, and never removes the file except
+ * when the entry cleared was the last one — at which point an empty map and a
+ * missing file mean the same thing.
+ */
+export declare function clearTokensForUrl(url: string): boolean;
+/**
+ * Remove EVERY stored token, for every backend.
+ *
+ * Only ever reached through an explicit opt-in (`tq:logout --all`). This used
+ * to be the silent fallback of `clearTokens()` whenever the current backend
+ * could not be resolved — so an absent `~/.tq/config.json` with no
+ * `TQ_BACKEND_URL` set destroyed a dozen backends' credentials while the
+ * operator believed they were logging out of one. The single `.bak` survives
+ * that once, not twice. (internal D2)
+ */
+export declare function clearAllTokens(): void;
 /**
  * Clear stored tokens for the current environment.
- * Moves the entire file to .bak before removing the entry.
+ *
+ * Refuses when the current backend cannot be resolved rather than falling
+ * back to wiping the file — see `clearAllTokens` for what that fallback used
+ * to do. Returns false when nothing was removed, for any reason.
  */
-export declare function clearTokens(): void;
+export declare function clearTokens(): boolean;
 /**
  * Attempt to restore tokens from backup (.bak file)
  * Returns true if backup was restored successfully.

package/dist/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;AAyBzD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAMlE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAEtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAGpB;AAiED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,YAAY,GAAG,IAAI,CAmBhD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAMlE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOjE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAarD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAIzE;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,IAAI,CA6BlC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAiCjD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAIzC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;GAEG;AACH,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAiBrD"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;AAyBzD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAMlE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAEtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAGpB;AAiED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,YAAY,GAAG,IAAI,CAmBhD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAMlE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,IAAI,KAAK,CAAC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC,CAID;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAarD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAIzE;AAaD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAqBtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAQrC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,OAAO,CAWrC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAiCjD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAIzC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;GAEG;AACH,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAiBrD"}