@levr-one/auth 1.1.2 → 1.1.3

package/dist/connection-error.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Turning a failed `fetch` into something an operator can act on (internal D5).
+ *
+ * Node's fetch reports every transport failure as the same opaque
+ * `TypeError: fetch failed`, with the real reason buried in `.cause`. Printed
+ * raw by the CLI's error handlers it named no URL and gave no reason:
+ *
+ *   $ TQ_BACKEND_URL=http://localhost:9999 yarn tq:login
+ *   Error: TypeError: fetch failed
+ *
+ * In a worktree that is nearly always "the backend is not running" — but it
+ * reads as a broken CLI, so the operator debugs the CLI. The exit code was
+ * already correct; only the message was useless.
+ */
+/**
+ * A one-line explanation when `err` is a transport failure, otherwise
+ * undefined so the caller falls back to printing the error itself.
+ *
+ * Deliberately narrow: only codes that genuinely mean "nothing answered at
+ * this address" are claimed. Reporting an unrelated failure as "backend not
+ * running" would send the operator to start a server that is already up.
+ */
+export declare function describeConnectionError(err: unknown, apiUrl: string): string | undefined;
+//# sourceMappingURL=connection-error.d.ts.map

package/dist/connection-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-error.d.ts","sourceRoot":"","sources":["../src/connection-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuBH;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAqBpB"}

package/dist/connection-error.js

@@ -0,0 +1,56 @@
+/**
+ * Turning a failed `fetch` into something an operator can act on (internal D5).
+ *
+ * Node's fetch reports every transport failure as the same opaque
+ * `TypeError: fetch failed`, with the real reason buried in `.cause`. Printed
+ * raw by the CLI's error handlers it named no URL and gave no reason:
+ *
+ *   $ TQ_BACKEND_URL=http://localhost:9999 yarn tq:login
+ *   Error: TypeError: fetch failed
+ *
+ * In a worktree that is nearly always "the backend is not running" — but it
+ * reads as a broken CLI, so the operator debugs the CLI. The exit code was
+ * already correct; only the message was useless.
+ */
+/**
+ * Walk the `cause` chain for a syscall-level error code.
+ *
+ * Depth-bounded: a cause chain is nominally short, but it is attacker- and
+ * bug-reachable data, and a cyclic `cause` would hang the process inside an
+ * error handler — the one place with nothing left to catch it.
+ */
+function errorCodeOf(err, depth = 0) {
+    if (depth > 5 || err === null || typeof err !== 'object')
+        return undefined;
+    const { code, cause } = err;
+    if (typeof code === 'string' && code)
+        return code;
+    return errorCodeOf(cause, depth + 1);
+}
+/**
+ * A one-line explanation when `err` is a transport failure, otherwise
+ * undefined so the caller falls back to printing the error itself.
+ *
+ * Deliberately narrow: only codes that genuinely mean "nothing answered at
+ * this address" are claimed. Reporting an unrelated failure as "backend not
+ * running" would send the operator to start a server that is already up.
+ */
+export function describeConnectionError(err, apiUrl) {
+    const code = errorCodeOf(err);
+    switch (code) {
+        case 'ECONNREFUSED':
+        case 'ERR_SOCKET_CONNECTION_TIMEOUT':
+        case 'ETIMEDOUT':
+        case 'EHOSTUNREACH':
+        case 'ENETUNREACH':
+            return (`No backend is listening at ${apiUrl} — it does not exist or is not running.\n` +
+                'Start it, or point at another environment with `yarn tq:env <local|staging|production>`.');
+        case 'ENOTFOUND':
+        case 'EAI_AGAIN':
+            return (`Cannot resolve the host for ${apiUrl} — the address does not exist.\n` +
+                'Check `yarn tq:env` for the configured backend.');
+        default:
+            return undefined;
+    }
+}
+//# sourceMappingURL=connection-error.js.map

package/dist/connection-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-error.js","sourceRoot":"","sources":["../src/connection-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAgB,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAY,EACZ,MAAc;IAEd,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,CAAC;QACpB,KAAK,+BAA+B,CAAC;QACrC,KAAK,WAAW,CAAC;QACjB,KAAK,cAAc,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,CACL,8BAA8B,MAAM,2CAA2C;gBAC/E,0FAA0F,CAC3F,CAAC;QACJ,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,CACL,+BAA+B,MAAM,kCAAkC;gBACvE,iDAAiD,CAClD,CAAC;QACJ;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/connection-error.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connection-error.test.d.ts.map

package/dist/connection-error.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-error.test.d.ts","sourceRoot":"","sources":["../src/connection-error.test.ts"],"names":[],"mappings":""}

package/dist/connection-error.test.js

@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'vitest';
+import { describeConnectionError } from './connection-error.js';
+const URL_ = 'http://localhost:9999';
+/** The shape Node's fetch actually produces: opaque outer, real code in cause. */
+function fetchFailure(code) {
+    const outer = new TypeError('fetch failed');
+    outer.cause = Object.assign(new Error('connect ' + code), { code });
+    return outer;
+}
+describe('describeConnectionError', () => {
+    it('explains a refused connection, naming the backend', () => {
+        const msg = describeConnectionError(fetchFailure('ECONNREFUSED'), URL_);
+        expect(msg).toContain(URL_);
+        expect(msg).toContain('not running');
+    });
+    it.each([
+        'ETIMEDOUT',
+        'EHOSTUNREACH',
+        'ENETUNREACH',
+        'ERR_SOCKET_CONNECTION_TIMEOUT',
+    ])('explains %s as nothing listening', (code) => {
+        expect(describeConnectionError(fetchFailure(code), URL_)).toContain('No backend is listening');
+    });
+    it.each(['ENOTFOUND', 'EAI_AGAIN'])('explains %s as an unresolvable host', (code) => {
+        expect(describeConnectionError(fetchFailure(code), URL_)).toContain('Cannot resolve the host');
+    });
+    it('finds a code nested several causes deep', () => {
+        const inner = Object.assign(new Error('refused'), {
+            code: 'ECONNREFUSED',
+        });
+        const mid = Object.assign(new Error('mid'), { cause: inner });
+        const outer = Object.assign(new TypeError('fetch failed'), { cause: mid });
+        expect(describeConnectionError(outer, URL_)).toContain('not running');
+    });
+    it('reads a code on the error itself, with no cause chain', () => {
+        expect(describeConnectionError(Object.assign(new Error('x'), {
+            code: 'ECONNREFUSED',
+        }), URL_)).toContain('not running');
+    });
+    // The caller falls back to printing the error, so claiming an unrelated
+    // failure is "backend not running" would send the operator to start a
+    // server that is already up.
+    it('declines an HTTP-level failure it cannot attribute', () => {
+        expect(describeConnectionError(new Error('401 Unauthorized'), URL_)).toBeUndefined();
+    });
+    it.each([
+        ['a plain string', 'boom'],
+        ['null', null],
+        ['undefined', undefined],
+        ['a code that is not a string', Object.assign(new Error('x'), { code: 7 })],
+    ])('declines %s', (_label, input) => {
+        expect(describeConnectionError(input, URL_)).toBeUndefined();
+    });
+    it('terminates on a cyclic cause chain', () => {
+        // An error handler is the one place with nothing left to catch a hang.
+        const a = new Error('a');
+        const b = new Error('b');
+        a.cause = b;
+        b.cause = a;
+        expect(describeConnectionError(a, URL_)).toBeUndefined();
+    });
+});
+//# sourceMappingURL=connection-error.test.js.map

package/dist/connection-error.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-error.test.js","sourceRoot":"","sources":["../src/connection-error.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,IAAI,GAAG,uBAAuB,CAAC;AAErC,kFAAkF;AAClF,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;IAC3C,KAA6B,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAClD,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,EAC5B,EAAE,IAAI,EAAE,CACT,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,GAAG,GAAG,uBAAuB,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,WAAW;QACX,cAAc;QACd,aAAa;QACb,+BAA+B;KAChC,CAAC,CAAC,kCAAkC,EAAE,CAAC,IAAI,EAAE,EAAE;QAC9C,MAAM,CAAC,uBAAuB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CACjE,yBAAyB,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CACjC,qCAAqC,EACrC,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,uBAAuB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CACjE,yBAAyB,CAC1B,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE;YAChD,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CACJ,uBAAuB,CACrB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;YAC5B,IAAI,EAAE,cAAc;SACrB,CAAC,EACF,IAAI,CACL,CACF,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,sEAAsE;IACtE,6BAA6B;IAC7B,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CACJ,uBAAuB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAC7D,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAC1B,CAAC,MAAM,EAAE,IAAI,CAAC;QACd,CAAC,WAAW,EAAE,SAAS,CAAC;QACxB,CAAC,6BAA6B,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;KAC5E,CAAC,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAClC,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,uEAAuE;QACvE,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAyB,CAAC,KAAK,GAAG,CAAC,CAAC;QACpC,CAAyB,CAAC,KAAK,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,uBAAuB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/logout-args.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Argument parsing for `tq:logout` (internal D1), kept pure so it can be
+ * tested — `cli.ts` ends in a self-executing `switch`, so importing it from a
+ * test would run a CLI command against the developer's real `~/.tq`.
+ *
+ * ## The defect this exists to prevent
+ *
+ * The first cut matched flags with `args.indexOf('--backend')`, which sees
+ * only the space-separated form. `--backend=<url>` therefore matched nothing,
+ * fell past every branch, and returned the CONFIGURED backend — clearing a
+ * backend the operator had not named, printing success, and exiting 0. An
+ * unrecognised flag did the same, because nothing rejected leftovers.
+ *
+ * That is the whole-file-wipe failure mode reached through argument parsing
+ * rather than through a fallback, so this fails CLOSED: anything not
+ * understood is an error, never a default.
+ */
+/** What the operator asked `logout` to clear. */
+export type LogoutRequest = {
+    kind: 'all';
+} | {
+    kind: 'backend';
+    url: string;
+} | {
+    kind: 'env';
+    env: 'local' | 'staging' | 'production';
+}
+/** No target named — the configured backend, as before. */
+ | {
+    kind: 'configured';
+} | {
+    kind: 'error';
+    message: string;
+};
+export declare function parseLogoutArgs(args: string[]): LogoutRequest;
+//# sourceMappingURL=logout-args.d.ts.map

package/dist/logout-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.d.ts","sourceRoot":"","sources":["../src/logout-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,iDAAiD;AACjD,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,YAAY,CAAA;CAAE;AAC1D,2DAA2D;GACzD;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAyCvC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAsD7D"}

package/dist/logout-args.js

@@ -0,0 +1,100 @@
+/**
+ * Argument parsing for `tq:logout` (internal D1), kept pure so it can be
+ * tested — `cli.ts` ends in a self-executing `switch`, so importing it from a
+ * test would run a CLI command against the developer's real `~/.tq`.
+ *
+ * ## The defect this exists to prevent
+ *
+ * The first cut matched flags with `args.indexOf('--backend')`, which sees
+ * only the space-separated form. `--backend=<url>` therefore matched nothing,
+ * fell past every branch, and returned the CONFIGURED backend — clearing a
+ * backend the operator had not named, printing success, and exiting 0. An
+ * unrecognised flag did the same, because nothing rejected leftovers.
+ *
+ * That is the whole-file-wipe failure mode reached through argument parsing
+ * rather than through a fallback, so this fails CLOSED: anything not
+ * understood is an error, never a default.
+ */
+const ENV_NAMES = ['local', 'staging', 'production'];
+const USAGE = 'Usage: tq-oauth logout [--backend <url> | --env <local|staging|production> | --all]';
+/** Both `--flag value` and `--flag=value`. */
+function readFlag(args, flag) {
+    const inline = args.find((a) => a.startsWith(`${flag}=`));
+    if (inline !== undefined) {
+        return { present: true, value: inline.slice(flag.length + 1) };
+    }
+    const i = args.indexOf(flag);
+    if (i === -1)
+        return { present: false, value: '' };
+    const next = args[i + 1];
+    return {
+        present: true,
+        value: next && !next.startsWith('--') ? next : '',
+    };
+}
+/** Every token the known flags account for, so leftovers can be rejected. */
+function consumedTokens(args) {
+    const consumed = new Set();
+    for (const flag of ['--backend', '--env', '--all']) {
+        const inline = args.find((a) => a.startsWith(`${flag}=`));
+        if (inline)
+            consumed.add(inline);
+        const i = args.indexOf(flag);
+        if (i !== -1) {
+            consumed.add(args[i]);
+            const next = args[i + 1];
+            if (flag !== '--all' && next && !next.startsWith('--'))
+                consumed.add(next);
+        }
+    }
+    return consumed;
+}
+export function parseLogoutArgs(args) {
+    const consumed = consumedTokens(args);
+    const unknown = args.filter((a) => !consumed.has(a));
+    if (unknown.length > 0) {
+        return {
+            kind: 'error',
+            message: `Unknown argument${unknown.length > 1 ? 's' : ''}: ${unknown.join(', ')}\n` +
+                USAGE,
+        };
+    }
+    const backend = readFlag(args, '--backend');
+    const env = readFlag(args, '--env');
+    const all = args.includes('--all');
+    // Two targets is an operator mistake, and picking one silently is exactly
+    // the class of bug this module exists to prevent.
+    if ([backend.present, env.present, all].filter(Boolean).length > 1) {
+        return {
+            kind: 'error',
+            message: `Pass only one of --backend, --env, --all\n${USAGE}`,
+        };
+    }
+    if (all)
+        return { kind: 'all' };
+    if (backend.present) {
+        if (!backend.value) {
+            return { kind: 'error', message: `--backend requires a url\n${USAGE}` };
+        }
+        if (!/^https?:\/\//i.test(backend.value.trim())) {
+            return {
+                kind: 'error',
+                message: `Not a backend url: "${backend.value}" — expected an http(s) origin, ` +
+                    'e.g. http://localhost:8180',
+            };
+        }
+        return { kind: 'backend', url: backend.value.trim().replace(/\/+$/, '') };
+    }
+    if (env.present) {
+        const match = ENV_NAMES.find((n) => n === env.value);
+        if (!match) {
+            return {
+                kind: 'error',
+                message: `Unknown environment: "${env.value}" — expected ${ENV_NAMES.join(', ')}`,
+            };
+        }
+        return { kind: 'env', env: match };
+    }
+    return { kind: 'configured' };
+}
+//# sourceMappingURL=logout-args.js.map

package/dist/logout-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.js","sourceRoot":"","sources":["../src/logout-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAC9D,MAAM,KAAK,GACT,qFAAqF,CAAC;AAExF,8CAA8C;AAC9C,SAAS,QAAQ,CACf,IAAc,EACd,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EACL,mBAAmB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC3E,KAAK;SACR,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,6CAA6C,KAAK,EAAE;SAC9D,CAAC;IACJ,CAAC;IAED,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAEhC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,KAAK,EAAE,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EACL,uBAAuB,OAAO,CAAC,KAAK,kCAAkC;oBACtE,4BAA4B;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,yBAAyB,GAAG,CAAC,KAAK,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC"}

package/dist/logout-args.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=logout-args.test.d.ts.map

package/dist/logout-args.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.test.d.ts","sourceRoot":"","sources":["../src/logout-args.test.ts"],"names":[],"mappings":""}

package/dist/logout-args.test.js

@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest';
+import { parseLogoutArgs } from './logout-args.js';
+describe('parseLogoutArgs', () => {
+    it('defaults to the configured backend when nothing is named', () => {
+        expect(parseLogoutArgs([])).toEqual({ kind: 'configured' });
+    });
+    // review F-002. `args.indexOf('--backend')` saw only the space-separated
+    // form, so `--backend=<url>` fell through to the CONFIGURED backend —
+    // clearing one the operator had not named, and exiting 0.
+    it.each([
+        ['space-separated', ['--backend', 'http://localhost:9480']],
+        ['inline', ['--backend=http://localhost:9480']],
+    ])('accepts the %s --backend form', (_label, args) => {
+        expect(parseLogoutArgs(args)).toEqual({
+            kind: 'backend',
+            url: 'http://localhost:9480',
+        });
+    });
+    it.each([
+        ['space-separated', ['--env', 'staging']],
+        ['inline', ['--env=staging']],
+    ])('accepts the %s --env form', (_label, args) => {
+        expect(parseLogoutArgs(args)).toEqual({ kind: 'env', env: 'staging' });
+    });
+    it('normalizes a trailing slash on --backend', () => {
+        expect(parseLogoutArgs(['--backend=https://api.levr.now/'])).toEqual({
+            kind: 'backend',
+            url: 'https://api.levr.now',
+        });
+    });
+    it('recognises --all', () => {
+        expect(parseLogoutArgs(['--all'])).toEqual({ kind: 'all' });
+    });
+    // Fails CLOSED: an unrecognised argument must never fall back to a default
+    // target, which is the whole-file-wipe failure mode via argument parsing.
+    it.each([
+        [['--target', 'http://localhost:9480']],
+        [['--backened=http://localhost:9480']],
+        [['http://localhost:9480']],
+        [['--backend', 'http://x', '--extra']],
+    ])('rejects unknown arguments %j', (args) => {
+        const r = parseLogoutArgs(args);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Unknown argument/);
+    });
+    it('rejects two targets rather than silently picking one', () => {
+        const r = parseLogoutArgs(['--backend=http://localhost:9480', '--all']);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/only one of/);
+    });
+    it.each([
+        ['a bare flag', ['--backend']],
+        ['an empty inline value', ['--backend=']],
+        ['a following flag', ['--backend', '--all']],
+    ])('rejects --backend with no url (%s)', (_label, args) => {
+        expect(parseLogoutArgs(args).kind).toBe('error');
+    });
+    it.each(['localhost:8580', 'ftp://x', '/tmp/nope', 'api.levr.now'])('rejects %s as a backend url', (value) => {
+        const r = parseLogoutArgs([`--backend=${value}`]);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Not a backend url/);
+    });
+    it('rejects an unknown environment name', () => {
+        const r = parseLogoutArgs(['--env=staging-typo']);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Unknown environment/);
+    });
+    it.each(['local', 'staging', 'production'])('accepts --env %s', (env) => {
+        expect(parseLogoutArgs([`--env=${env}`])).toEqual({ kind: 'env', env });
+    });
+});
+//# sourceMappingURL=logout-args.test.js.map

package/dist/logout-args.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.test.js","sourceRoot":"","sources":["../src/logout-args.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,sEAAsE;IACtE,0DAA0D;IAC1D,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAC3D,CAAC,QAAQ,EAAE,CAAC,iCAAiC,CAAC,CAAC;KAChD,CAAC,CAAC,+BAA+B,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACnD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACpC,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,uBAAuB;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,CAAC;KAC9B,CAAC,CAAC,2BAA2B,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,eAAe,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,sBAAsB;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;QACvC,CAAC,CAAC,kCAAkC,CAAC,CAAC;QACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC3B,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;KACvC,CAAC,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC,uBAAuB,EAAE,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC,CAAC,oCAAoC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACxD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CACjE,6BAA6B,EAC7B,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/status-report.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Pure decision logic behind `tq:status` (internal).
+ *
+ * Lives outside `cli.ts` for the same reason `scripts/setup-mcp-workspace.lib.ts`
+ * lives outside `setup-mcp.ts`: that module ends in a self-executing `switch`,
+ * so importing it from a test would run a CLI command against the developer's
+ * real `~/.tq`. Everything here is pure — the caller does the fs reading and
+ * passes the parsed values in.
+ *
+ * ## The defect this exists to prevent
+ *
+ * `tq:status` used to render its per-environment block from the three
+ * hardcoded `ENV_URLS` presets, while `tq:login` stores a token under the
+ * backend's real URL. On any local that is not literally `http://localhost:8080`
+ * — every worktree, every DEV_TLS checkout — the block therefore reported a
+ * backend the user had not logged into and could not refresh: a stale
+ * `local: expired 157366m ago (active)` that survived every login, sitting
+ * directly beneath a `Status: valid` line describing a different token.
+ *
+ * The load-bearing assertion in the tests is that a backend absent from
+ * `ENV_URLS` is still listed, and that "active" is decided by URL rather than
+ * by environment name.
+ */
+/** One rendered row of the stored-token table. */
+export interface TokenRow {
+    /** True for the backend `~/.tq/config.json` currently points at. */
+    active: boolean;
+    url: string;
+    /** `local` / `staging` / `production` / `custom`. */
+    label: string;
+    /** e.g. `valid 738m`, `expired 12m ago`. */
+    expiry: string;
+}
+export declare function formatExpiry(expiresAt: number, now: number): string;
+/**
+ * Human label for a stored backend URL.
+ *
+ * `resolveEnvFromUrl` only recognises the three `ENV_URLS` presets, so every
+ * worktree-offset local and every DEV_TLS local comes back unnamed — which is
+ * most of a working machine's token map. Loopback and the `.levr.test` dev
+ * domain are local by construction, so name them rather than render a dozen
+ * indistinguishable `custom` rows.
+ */
+export declare function labelForBackend(url: string): string;
+/**
+ * Build the stored-token table from the backends the token map ACTUALLY holds.
+ *
+ * `activeUrl` is matched by URL, never by environment name: the name `local`
+ * maps to the hardcoded `:8080` preset, which on a worktree is a different
+ * backend from the configured one.
+ *
+ * Active row first, then alphabetical — deterministic, so the table does not
+ * reshuffle between runs.
+ */
+export declare function buildTokenRows(entries: ReadonlyArray<{
+    url: string;
+    tokens: {
+        expiresAt: number;
+    };
+}>, activeUrl: string | undefined, now: number): TokenRow[];
+/**
+ * Map a `levr` MCP URL to the backend URL that `~/.tq/oauth-tokens.json` and
+ * `~/.tq/workspace.json` are keyed by, so the MCP entry can be compared
+ * against the configured backend.
+ *
+ * The MCP host is not the API host for the hosted environments — both are
+ * reached through the client origin's `/api` proxy — so the levr URL cannot be
+ * compared directly. The aliases are DERIVED from `PRESETS` rather than
+ * written out, so they cannot drift from the environment definitions.
+ *
+ * Twin of `identityKeyFromLevrUrl` in `scripts/setup-mcp-workspace.lib.ts`,
+ * which resolves the same key on the WRITE side. `scripts/` imports no
+ * workspace package, so the two cannot share code today; deriving from
+ * `PRESETS` is what keeps this copy honest.
+ */
+export declare function backendUrlForLevrMcp(levrUrl: string): string;
+/** The `levr` server entry, extracted from a parsed `.mcp.json`. */
+export interface LevrMcpEntry {
+    url: string;
+    workspaceId?: string;
+}
+/**
+ * Pull the `levr` entry out of a parsed `.mcp.json`.
+ *
+ * Returns undefined for every shape that does not carry a usable URL —
+ * missing file, wrong type, no `levr` server, no `url`. Reporting nothing is
+ * correct here: the section is diagnostic, and a guess about which control
+ * plane an agent is talking to is worse than silence.
+ */
+export declare function levrEntryFrom(parsed: unknown): LevrMcpEntry | undefined;
+//# sourceMappingURL=status-report.d.ts.map

package/dist/status-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.d.ts","sourceRoot":"","sources":["../src/status-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,kDAAkD;AAClD,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,EACtE,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,GACV,QAAQ,EAAE,CAYZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB5D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAsBvE"}

package/dist/status-report.js

@@ -0,0 +1,145 @@
+/**
+ * Pure decision logic behind `tq:status` (internal).
+ *
+ * Lives outside `cli.ts` for the same reason `scripts/setup-mcp-workspace.lib.ts`
+ * lives outside `setup-mcp.ts`: that module ends in a self-executing `switch`,
+ * so importing it from a test would run a CLI command against the developer's
+ * real `~/.tq`. Everything here is pure — the caller does the fs reading and
+ * passes the parsed values in.
+ *
+ * ## The defect this exists to prevent
+ *
+ * `tq:status` used to render its per-environment block from the three
+ * hardcoded `ENV_URLS` presets, while `tq:login` stores a token under the
+ * backend's real URL. On any local that is not literally `http://localhost:8080`
+ * — every worktree, every DEV_TLS checkout — the block therefore reported a
+ * backend the user had not logged into and could not refresh: a stale
+ * `local: expired 157366m ago (active)` that survived every login, sitting
+ * directly beneath a `Status: valid` line describing a different token.
+ *
+ * The load-bearing assertion in the tests is that a backend absent from
+ * `ENV_URLS` is still listed, and that "active" is decided by URL rather than
+ * by environment name.
+ */
+import { resolveEnvFromUrl } from './token-store.js';
+import { PRESETS } from './config.js';
+export function formatExpiry(expiresAt, now) {
+    const mins = Math.round((expiresAt - now) / 1000 / 60);
+    return now >= expiresAt ? `expired ${-mins}m ago` : `valid ${mins}m`;
+}
+/**
+ * Human label for a stored backend URL.
+ *
+ * `resolveEnvFromUrl` only recognises the three `ENV_URLS` presets, so every
+ * worktree-offset local and every DEV_TLS local comes back unnamed — which is
+ * most of a working machine's token map. Loopback and the `.levr.test` dev
+ * domain are local by construction, so name them rather than render a dozen
+ * indistinguishable `custom` rows.
+ */
+export function labelForBackend(url) {
+    const preset = resolveEnvFromUrl(url);
+    if (preset)
+        return preset;
+    try {
+        const { hostname } = new URL(url);
+        if (hostname === 'localhost' ||
+            hostname === '127.0.0.1' ||
+            hostname === '[::1]' ||
+            hostname === 'levr.test' ||
+            hostname.endsWith('.levr.test')) {
+            return 'local';
+        }
+    }
+    catch {
+        // Not a parseable URL — fall through to `custom`.
+    }
+    return 'custom';
+}
+/**
+ * Build the stored-token table from the backends the token map ACTUALLY holds.
+ *
+ * `activeUrl` is matched by URL, never by environment name: the name `local`
+ * maps to the hardcoded `:8080` preset, which on a worktree is a different
+ * backend from the configured one.
+ *
+ * Active row first, then alphabetical — deterministic, so the table does not
+ * reshuffle between runs.
+ */
+export function buildTokenRows(entries, activeUrl, now) {
+    return entries
+        .map((e) => ({
+        active: !!activeUrl && e.url === activeUrl,
+        url: e.url,
+        label: labelForBackend(e.url),
+        expiry: formatExpiry(e.tokens.expiresAt, now),
+    }))
+        .sort((a, b) => {
+        if (a.active !== b.active)
+            return a.active ? -1 : 1;
+        return a.url.localeCompare(b.url);
+    });
+}
+/**
+ * Map a `levr` MCP URL to the backend URL that `~/.tq/oauth-tokens.json` and
+ * `~/.tq/workspace.json` are keyed by, so the MCP entry can be compared
+ * against the configured backend.
+ *
+ * The MCP host is not the API host for the hosted environments — both are
+ * reached through the client origin's `/api` proxy — so the levr URL cannot be
+ * compared directly. The aliases are DERIVED from `PRESETS` rather than
+ * written out, so they cannot drift from the environment definitions.
+ *
+ * Twin of `identityKeyFromLevrUrl` in `scripts/setup-mcp-workspace.lib.ts`,
+ * which resolves the same key on the WRITE side. `scripts/` imports no
+ * workspace package, so the two cannot share code today; deriving from
+ * `PRESETS` is what keeps this copy honest.
+ */
+export function backendUrlForLevrMcp(levrUrl) {
+    const base = levrUrl.replace(/\/+$/, '').replace(/\/v1\/mcp$/, '');
+    // ONLY the two hosted presets. `PRESETS.local` must never join this list:
+    // under DEV_TLS it is `LOCAL_HTTPS`, whose clientUrl+`/api` is
+    // `https://ai.levr.test:3020/api` — a real key in the token map that has to
+    // resolve VERBATIM. Adding it would rewrite that key to
+    // `https://api.levr.test:8080` and make the entry unreachable, and the
+    // "keys a DEV_TLS local verbatim" test would still pass, because
+    // `isTestEnv()` makes PRESETS.local the plain-HTTP variant. The test below
+    // that asserts this exclusion holds under TLS is the one that would catch
+    // it. (review F-006)
+    for (const preset of [PRESETS.staging, PRESETS.production]) {
+        if (base === `${preset.clientUrl}/api`)
+            return preset.apiUrl;
+    }
+    // Everything else keys verbatim: that base IS the URL the backend was
+    // reached at when its token was stored (worktree locals, DEV_TLS).
+    return base;
+}
+/**
+ * Pull the `levr` entry out of a parsed `.mcp.json`.
+ *
+ * Returns undefined for every shape that does not carry a usable URL —
+ * missing file, wrong type, no `levr` server, no `url`. Reporting nothing is
+ * correct here: the section is diagnostic, and a guess about which control
+ * plane an agent is talking to is worse than silence.
+ */
+export function levrEntryFrom(parsed) {
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const servers = parsed.mcpServers;
+    if (servers === null || typeof servers !== 'object')
+        return undefined;
+    const levr = servers.levr;
+    if (levr === null || typeof levr !== 'object')
+        return undefined;
+    const { url, headers } = levr;
+    if (typeof url !== 'string' || !url)
+        return undefined;
+    const wsId = headers !== null && typeof headers === 'object'
+        ? headers['Workspace-Id']
+        : undefined;
+    return {
+        url,
+        workspaceId: typeof wsId === 'string' && wsId ? wsId : undefined,
+    };
+}
+//# sourceMappingURL=status-report.js.map