@levr-one/auth 1.1.2 → 1.1.4

package/dist/logout-args.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Argument parsing for `tq:logout` (internal D1), kept pure so it can be
+ * tested — `cli.ts` ends in a self-executing `switch`, so importing it from a
+ * test would run a CLI command against the developer's real `~/.tq`.
+ *
+ * ## The defect this exists to prevent
+ *
+ * The first cut matched flags with `args.indexOf('--backend')`, which sees
+ * only the space-separated form. `--backend=<url>` therefore matched nothing,
+ * fell past every branch, and returned the CONFIGURED backend — clearing a
+ * backend the operator had not named, printing success, and exiting 0. An
+ * unrecognised flag did the same, because nothing rejected leftovers.
+ *
+ * That is the whole-file-wipe failure mode reached through argument parsing
+ * rather than through a fallback, so this fails CLOSED: anything not
+ * understood is an error, never a default.
+ */
+/** What the operator asked `logout` to clear. */
+export type LogoutRequest = {
+    kind: 'all';
+} | {
+    kind: 'backend';
+    url: string;
+} | {
+    kind: 'env';
+    env: 'local' | 'staging' | 'production';
+}
+/** No target named — the configured backend, as before. */
+ | {
+    kind: 'configured';
+} | {
+    kind: 'error';
+    message: string;
+};
+export declare function parseLogoutArgs(args: string[]): LogoutRequest;
+//# sourceMappingURL=logout-args.d.ts.map

package/dist/logout-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.d.ts","sourceRoot":"","sources":["../src/logout-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,iDAAiD;AACjD,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,YAAY,CAAA;CAAE;AAC1D,2DAA2D;GACzD;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAyCvC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAsD7D"}

package/dist/logout-args.js

@@ -0,0 +1,100 @@
+/**
+ * Argument parsing for `tq:logout` (internal D1), kept pure so it can be
+ * tested — `cli.ts` ends in a self-executing `switch`, so importing it from a
+ * test would run a CLI command against the developer's real `~/.tq`.
+ *
+ * ## The defect this exists to prevent
+ *
+ * The first cut matched flags with `args.indexOf('--backend')`, which sees
+ * only the space-separated form. `--backend=<url>` therefore matched nothing,
+ * fell past every branch, and returned the CONFIGURED backend — clearing a
+ * backend the operator had not named, printing success, and exiting 0. An
+ * unrecognised flag did the same, because nothing rejected leftovers.
+ *
+ * That is the whole-file-wipe failure mode reached through argument parsing
+ * rather than through a fallback, so this fails CLOSED: anything not
+ * understood is an error, never a default.
+ */
+const ENV_NAMES = ['local', 'staging', 'production'];
+const USAGE = 'Usage: tq-oauth logout [--backend <url> | --env <local|staging|production> | --all]';
+/** Both `--flag value` and `--flag=value`. */
+function readFlag(args, flag) {
+    const inline = args.find((a) => a.startsWith(`${flag}=`));
+    if (inline !== undefined) {
+        return { present: true, value: inline.slice(flag.length + 1) };
+    }
+    const i = args.indexOf(flag);
+    if (i === -1)
+        return { present: false, value: '' };
+    const next = args[i + 1];
+    return {
+        present: true,
+        value: next && !next.startsWith('--') ? next : '',
+    };
+}
+/** Every token the known flags account for, so leftovers can be rejected. */
+function consumedTokens(args) {
+    const consumed = new Set();
+    for (const flag of ['--backend', '--env', '--all']) {
+        const inline = args.find((a) => a.startsWith(`${flag}=`));
+        if (inline)
+            consumed.add(inline);
+        const i = args.indexOf(flag);
+        if (i !== -1) {
+            consumed.add(args[i]);
+            const next = args[i + 1];
+            if (flag !== '--all' && next && !next.startsWith('--'))
+                consumed.add(next);
+        }
+    }
+    return consumed;
+}
+export function parseLogoutArgs(args) {
+    const consumed = consumedTokens(args);
+    const unknown = args.filter((a) => !consumed.has(a));
+    if (unknown.length > 0) {
+        return {
+            kind: 'error',
+            message: `Unknown argument${unknown.length > 1 ? 's' : ''}: ${unknown.join(', ')}\n` +
+                USAGE,
+        };
+    }
+    const backend = readFlag(args, '--backend');
+    const env = readFlag(args, '--env');
+    const all = args.includes('--all');
+    // Two targets is an operator mistake, and picking one silently is exactly
+    // the class of bug this module exists to prevent.
+    if ([backend.present, env.present, all].filter(Boolean).length > 1) {
+        return {
+            kind: 'error',
+            message: `Pass only one of --backend, --env, --all\n${USAGE}`,
+        };
+    }
+    if (all)
+        return { kind: 'all' };
+    if (backend.present) {
+        if (!backend.value) {
+            return { kind: 'error', message: `--backend requires a url\n${USAGE}` };
+        }
+        if (!/^https?:\/\//i.test(backend.value.trim())) {
+            return {
+                kind: 'error',
+                message: `Not a backend url: "${backend.value}" — expected an http(s) origin, ` +
+                    'e.g. http://localhost:8180',
+            };
+        }
+        return { kind: 'backend', url: backend.value.trim().replace(/\/+$/, '') };
+    }
+    if (env.present) {
+        const match = ENV_NAMES.find((n) => n === env.value);
+        if (!match) {
+            return {
+                kind: 'error',
+                message: `Unknown environment: "${env.value}" — expected ${ENV_NAMES.join(', ')}`,
+            };
+        }
+        return { kind: 'env', env: match };
+    }
+    return { kind: 'configured' };
+}
+//# sourceMappingURL=logout-args.js.map

package/dist/logout-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.js","sourceRoot":"","sources":["../src/logout-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAC9D,MAAM,KAAK,GACT,qFAAqF,CAAC;AAExF,8CAA8C;AAC9C,SAAS,QAAQ,CACf,IAAc,EACd,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EACL,mBAAmB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC3E,KAAK;SACR,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,6CAA6C,KAAK,EAAE;SAC9D,CAAC;IACJ,CAAC;IAED,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAEhC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,KAAK,EAAE,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EACL,uBAAuB,OAAO,CAAC,KAAK,kCAAkC;oBACtE,4BAA4B;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,yBAAyB,GAAG,CAAC,KAAK,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC"}

package/dist/logout-args.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=logout-args.test.d.ts.map

package/dist/logout-args.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.test.d.ts","sourceRoot":"","sources":["../src/logout-args.test.ts"],"names":[],"mappings":""}

package/dist/logout-args.test.js

@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest';
+import { parseLogoutArgs } from './logout-args.js';
+describe('parseLogoutArgs', () => {
+    it('defaults to the configured backend when nothing is named', () => {
+        expect(parseLogoutArgs([])).toEqual({ kind: 'configured' });
+    });
+    // review F-002. `args.indexOf('--backend')` saw only the space-separated
+    // form, so `--backend=<url>` fell through to the CONFIGURED backend —
+    // clearing one the operator had not named, and exiting 0.
+    it.each([
+        ['space-separated', ['--backend', 'http://localhost:9480']],
+        ['inline', ['--backend=http://localhost:9480']],
+    ])('accepts the %s --backend form', (_label, args) => {
+        expect(parseLogoutArgs(args)).toEqual({
+            kind: 'backend',
+            url: 'http://localhost:9480',
+        });
+    });
+    it.each([
+        ['space-separated', ['--env', 'staging']],
+        ['inline', ['--env=staging']],
+    ])('accepts the %s --env form', (_label, args) => {
+        expect(parseLogoutArgs(args)).toEqual({ kind: 'env', env: 'staging' });
+    });
+    it('normalizes a trailing slash on --backend', () => {
+        expect(parseLogoutArgs(['--backend=https://api.levr.now/'])).toEqual({
+            kind: 'backend',
+            url: 'https://api.levr.now',
+        });
+    });
+    it('recognises --all', () => {
+        expect(parseLogoutArgs(['--all'])).toEqual({ kind: 'all' });
+    });
+    // Fails CLOSED: an unrecognised argument must never fall back to a default
+    // target, which is the whole-file-wipe failure mode via argument parsing.
+    it.each([
+        [['--target', 'http://localhost:9480']],
+        [['--backened=http://localhost:9480']],
+        [['http://localhost:9480']],
+        [['--backend', 'http://x', '--extra']],
+    ])('rejects unknown arguments %j', (args) => {
+        const r = parseLogoutArgs(args);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Unknown argument/);
+    });
+    it('rejects two targets rather than silently picking one', () => {
+        const r = parseLogoutArgs(['--backend=http://localhost:9480', '--all']);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/only one of/);
+    });
+    it.each([
+        ['a bare flag', ['--backend']],
+        ['an empty inline value', ['--backend=']],
+        ['a following flag', ['--backend', '--all']],
+    ])('rejects --backend with no url (%s)', (_label, args) => {
+        expect(parseLogoutArgs(args).kind).toBe('error');
+    });
+    it.each(['localhost:8580', 'ftp://x', '/tmp/nope', 'api.levr.now'])('rejects %s as a backend url', (value) => {
+        const r = parseLogoutArgs([`--backend=${value}`]);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Not a backend url/);
+    });
+    it('rejects an unknown environment name', () => {
+        const r = parseLogoutArgs(['--env=staging-typo']);
+        expect(r.kind).toBe('error');
+        expect(r.kind === 'error' && r.message).toMatch(/Unknown environment/);
+    });
+    it.each(['local', 'staging', 'production'])('accepts --env %s', (env) => {
+        expect(parseLogoutArgs([`--env=${env}`])).toEqual({ kind: 'env', env });
+    });
+});
+//# sourceMappingURL=logout-args.test.js.map

package/dist/logout-args.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-args.test.js","sourceRoot":"","sources":["../src/logout-args.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,sEAAsE;IACtE,0DAA0D;IAC1D,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAC3D,CAAC,QAAQ,EAAE,CAAC,iCAAiC,CAAC,CAAC;KAChD,CAAC,CAAC,+BAA+B,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACnD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACpC,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,uBAAuB;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,CAAC;KAC9B,CAAC,CAAC,2BAA2B,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,eAAe,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,sBAAsB;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;QACvC,CAAC,CAAC,kCAAkC,CAAC,CAAC;QACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC3B,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;KACvC,CAAC,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC,uBAAuB,EAAE,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;KAC7C,CAAC,CAAC,oCAAoC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACxD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CACjE,6BAA6B,EAC7B,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/status-report.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Pure decision logic behind `tq:status` (internal).
+ *
+ * Lives outside `cli.ts` for the same reason `scripts/setup-mcp-workspace.lib.ts`
+ * lives outside `setup-mcp.ts`: that module ends in a self-executing `switch`,
+ * so importing it from a test would run a CLI command against the developer's
+ * real `~/.tq`. Everything here is pure — the caller does the fs reading and
+ * passes the parsed values in.
+ *
+ * ## The defect this exists to prevent
+ *
+ * `tq:status` used to render its per-environment block from the three
+ * hardcoded `ENV_URLS` presets, while `tq:login` stores a token under the
+ * backend's real URL. On any local that is not literally `http://localhost:8080`
+ * — every worktree, every DEV_TLS checkout — the block therefore reported a
+ * backend the user had not logged into and could not refresh: a stale
+ * `local: expired 157366m ago (active)` that survived every login, sitting
+ * directly beneath a `Status: valid` line describing a different token.
+ *
+ * The load-bearing assertion in the tests is that a backend absent from
+ * `ENV_URLS` is still listed, and that "active" is decided by URL rather than
+ * by environment name.
+ */
+/** One rendered row of the stored-token table. */
+export interface TokenRow {
+    /** True for the backend `~/.tq/config.json` currently points at. */
+    active: boolean;
+    url: string;
+    /** `local` / `staging` / `production` / `custom`. */
+    label: string;
+    /** e.g. `valid 738m`, `expired 12m ago`. */
+    expiry: string;
+}
+export declare function formatExpiry(expiresAt: number, now: number): string;
+/**
+ * Human label for a stored backend URL.
+ *
+ * `resolveEnvFromUrl` only recognises the three `ENV_URLS` presets, so every
+ * worktree-offset local and every DEV_TLS local comes back unnamed — which is
+ * most of a working machine's token map. Loopback and the `.levr.test` dev
+ * domain are local by construction, so name them rather than render a dozen
+ * indistinguishable `custom` rows.
+ */
+export declare function labelForBackend(url: string): string;
+/**
+ * Build the stored-token table from the backends the token map ACTUALLY holds.
+ *
+ * `activeUrl` is matched by URL, never by environment name: the name `local`
+ * maps to the hardcoded `:8080` preset, which on a worktree is a different
+ * backend from the configured one.
+ *
+ * Active row first, then alphabetical — deterministic, so the table does not
+ * reshuffle between runs.
+ */
+export declare function buildTokenRows(entries: ReadonlyArray<{
+    url: string;
+    tokens: {
+        expiresAt: number;
+    };
+}>, activeUrl: string | undefined, now: number): TokenRow[];
+/**
+ * Map a `levr` MCP URL to the backend URL that `~/.tq/oauth-tokens.json` and
+ * `~/.tq/workspace.json` are keyed by, so the MCP entry can be compared
+ * against the configured backend.
+ *
+ * The MCP host is not the API host for the hosted environments — both are
+ * reached through the client origin's `/api` proxy — so the levr URL cannot be
+ * compared directly. The aliases are DERIVED from `PRESETS` rather than
+ * written out, so they cannot drift from the environment definitions.
+ *
+ * Twin of `identityKeyFromLevrUrl` in `scripts/setup-mcp-workspace.lib.ts`,
+ * which resolves the same key on the WRITE side. `scripts/` imports no
+ * workspace package, so the two cannot share code today; deriving from
+ * `PRESETS` is what keeps this copy honest.
+ */
+export declare function backendUrlForLevrMcp(levrUrl: string): string;
+/** The `levr` server entry, extracted from a parsed `.mcp.json`. */
+export interface LevrMcpEntry {
+    url: string;
+    workspaceId?: string;
+}
+/**
+ * Pull the `levr` entry out of a parsed `.mcp.json`.
+ *
+ * Returns undefined for every shape that does not carry a usable URL —
+ * missing file, wrong type, no `levr` server, no `url`. Reporting nothing is
+ * correct here: the section is diagnostic, and a guess about which control
+ * plane an agent is talking to is worse than silence.
+ */
+export declare function levrEntryFrom(parsed: unknown): LevrMcpEntry | undefined;
+//# sourceMappingURL=status-report.d.ts.map

package/dist/status-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.d.ts","sourceRoot":"","sources":["../src/status-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,kDAAkD;AAClD,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,EACtE,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,GACV,QAAQ,EAAE,CAYZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB5D;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAsBvE"}

package/dist/status-report.js

@@ -0,0 +1,145 @@
+/**
+ * Pure decision logic behind `tq:status` (internal).
+ *
+ * Lives outside `cli.ts` for the same reason `scripts/setup-mcp-workspace.lib.ts`
+ * lives outside `setup-mcp.ts`: that module ends in a self-executing `switch`,
+ * so importing it from a test would run a CLI command against the developer's
+ * real `~/.tq`. Everything here is pure — the caller does the fs reading and
+ * passes the parsed values in.
+ *
+ * ## The defect this exists to prevent
+ *
+ * `tq:status` used to render its per-environment block from the three
+ * hardcoded `ENV_URLS` presets, while `tq:login` stores a token under the
+ * backend's real URL. On any local that is not literally `http://localhost:8080`
+ * — every worktree, every DEV_TLS checkout — the block therefore reported a
+ * backend the user had not logged into and could not refresh: a stale
+ * `local: expired 157366m ago (active)` that survived every login, sitting
+ * directly beneath a `Status: valid` line describing a different token.
+ *
+ * The load-bearing assertion in the tests is that a backend absent from
+ * `ENV_URLS` is still listed, and that "active" is decided by URL rather than
+ * by environment name.
+ */
+import { resolveEnvFromUrl } from './token-store.js';
+import { PRESETS } from './config.js';
+export function formatExpiry(expiresAt, now) {
+    const mins = Math.round((expiresAt - now) / 1000 / 60);
+    return now >= expiresAt ? `expired ${-mins}m ago` : `valid ${mins}m`;
+}
+/**
+ * Human label for a stored backend URL.
+ *
+ * `resolveEnvFromUrl` only recognises the three `ENV_URLS` presets, so every
+ * worktree-offset local and every DEV_TLS local comes back unnamed — which is
+ * most of a working machine's token map. Loopback and the `.levr.test` dev
+ * domain are local by construction, so name them rather than render a dozen
+ * indistinguishable `custom` rows.
+ */
+export function labelForBackend(url) {
+    const preset = resolveEnvFromUrl(url);
+    if (preset)
+        return preset;
+    try {
+        const { hostname } = new URL(url);
+        if (hostname === 'localhost' ||
+            hostname === '127.0.0.1' ||
+            hostname === '[::1]' ||
+            hostname === 'levr.test' ||
+            hostname.endsWith('.levr.test')) {
+            return 'local';
+        }
+    }
+    catch {
+        // Not a parseable URL — fall through to `custom`.
+    }
+    return 'custom';
+}
+/**
+ * Build the stored-token table from the backends the token map ACTUALLY holds.
+ *
+ * `activeUrl` is matched by URL, never by environment name: the name `local`
+ * maps to the hardcoded `:8080` preset, which on a worktree is a different
+ * backend from the configured one.
+ *
+ * Active row first, then alphabetical — deterministic, so the table does not
+ * reshuffle between runs.
+ */
+export function buildTokenRows(entries, activeUrl, now) {
+    return entries
+        .map((e) => ({
+        active: !!activeUrl && e.url === activeUrl,
+        url: e.url,
+        label: labelForBackend(e.url),
+        expiry: formatExpiry(e.tokens.expiresAt, now),
+    }))
+        .sort((a, b) => {
+        if (a.active !== b.active)
+            return a.active ? -1 : 1;
+        return a.url.localeCompare(b.url);
+    });
+}
+/**
+ * Map a `levr` MCP URL to the backend URL that `~/.tq/oauth-tokens.json` and
+ * `~/.tq/workspace.json` are keyed by, so the MCP entry can be compared
+ * against the configured backend.
+ *
+ * The MCP host is not the API host for the hosted environments — both are
+ * reached through the client origin's `/api` proxy — so the levr URL cannot be
+ * compared directly. The aliases are DERIVED from `PRESETS` rather than
+ * written out, so they cannot drift from the environment definitions.
+ *
+ * Twin of `identityKeyFromLevrUrl` in `scripts/setup-mcp-workspace.lib.ts`,
+ * which resolves the same key on the WRITE side. `scripts/` imports no
+ * workspace package, so the two cannot share code today; deriving from
+ * `PRESETS` is what keeps this copy honest.
+ */
+export function backendUrlForLevrMcp(levrUrl) {
+    const base = levrUrl.replace(/\/+$/, '').replace(/\/v1\/mcp$/, '');
+    // ONLY the two hosted presets. `PRESETS.local` must never join this list:
+    // under DEV_TLS it is `LOCAL_HTTPS`, whose clientUrl+`/api` is
+    // `https://ai.levr.test:3020/api` — a real key in the token map that has to
+    // resolve VERBATIM. Adding it would rewrite that key to
+    // `https://api.levr.test:8080` and make the entry unreachable, and the
+    // "keys a DEV_TLS local verbatim" test would still pass, because
+    // `isTestEnv()` makes PRESETS.local the plain-HTTP variant. The test below
+    // that asserts this exclusion holds under TLS is the one that would catch
+    // it. (review F-006)
+    for (const preset of [PRESETS.staging, PRESETS.production]) {
+        if (base === `${preset.clientUrl}/api`)
+            return preset.apiUrl;
+    }
+    // Everything else keys verbatim: that base IS the URL the backend was
+    // reached at when its token was stored (worktree locals, DEV_TLS).
+    return base;
+}
+/**
+ * Pull the `levr` entry out of a parsed `.mcp.json`.
+ *
+ * Returns undefined for every shape that does not carry a usable URL —
+ * missing file, wrong type, no `levr` server, no `url`. Reporting nothing is
+ * correct here: the section is diagnostic, and a guess about which control
+ * plane an agent is talking to is worse than silence.
+ */
+export function levrEntryFrom(parsed) {
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const servers = parsed.mcpServers;
+    if (servers === null || typeof servers !== 'object')
+        return undefined;
+    const levr = servers.levr;
+    if (levr === null || typeof levr !== 'object')
+        return undefined;
+    const { url, headers } = levr;
+    if (typeof url !== 'string' || !url)
+        return undefined;
+    const wsId = headers !== null && typeof headers === 'object'
+        ? headers['Workspace-Id']
+        : undefined;
+    return {
+        url,
+        workspaceId: typeof wsId === 'string' && wsId ? wsId : undefined,
+    };
+}
+//# sourceMappingURL=status-report.js.map

package/dist/status-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.js","sourceRoot":"","sources":["../src/status-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAatC,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,GAAW;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IACE,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,WAAW;YACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC/B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsE,EACtE,SAA6B,EAC7B,GAAW;IAEX,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;QAC1C,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;KAC9C,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACnE,0EAA0E;IAC1E,+DAA+D;IAC/D,4EAA4E;IAC5E,wDAAwD;IACxD,uEAAuE;IACvE,iEAAiE;IACjE,2EAA2E;IAC3E,0EAA0E;IAC1E,qBAAqB;IACrB,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,IAAI,KAAK,GAAG,MAAM,CAAC,SAAS,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAC/D,CAAC;IACD,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAI,MAAmC,CAAC,UAAU,CAAC;IAChE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEtE,MAAM,IAAI,GAAI,OAAmC,CAAC,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAA4C,CAAC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,IAAI,GACR,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAC7C,CAAC,CAAE,OAAmC,CAAC,cAAc,CAAC;QACtD,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,GAAG;QACH,WAAW,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC"}

package/dist/status-report.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=status-report.test.d.ts.map

package/dist/status-report.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-report.test.d.ts","sourceRoot":"","sources":["../src/status-report.test.ts"],"names":[],"mappings":""}

package/dist/status-report.test.js

@@ -0,0 +1,159 @@
+import { describe, it, expect } from 'vitest';
+import { PRESETS } from './config.js';
+import { backendUrlForLevrMcp, buildTokenRows, formatExpiry, labelForBackend, levrEntryFrom, } from './status-report.js';
+const NOW = 1_700_000_000_000;
+const at = (minutes) => ({ expiresAt: NOW + minutes * 60_000 });
+describe('buildTokenRows', () => {
+    // The regression this whole module exists for: the old block rendered the
+    // three hardcoded ENV_URLS presets, so a worktree-offset local was invisible
+    // and the `:8080` row it printed instead could never be refreshed.
+    it('lists a backend that is not one of the three presets', () => {
+        const rows = buildTokenRows([{ url: 'http://localhost:9480', tokens: at(60) }], 'http://localhost:9480', NOW);
+        expect(rows.map((r) => r.url)).toEqual(['http://localhost:9480']);
+    });
+    it('decides "active" by url, not by environment name', () => {
+        const rows = buildTokenRows([
+            { url: 'http://localhost:8080', tokens: at(-99999) },
+            { url: 'http://localhost:9480', tokens: at(60) },
+        ], 'http://localhost:9480', NOW);
+        // Both are "local" by name. Only the configured URL is active — marking
+        // the :8080 preset active is exactly the old bug.
+        expect(rows.filter((r) => r.active).map((r) => r.url)).toEqual([
+            'http://localhost:9480',
+        ]);
+        expect(rows.every((r) => r.label === 'local')).toBe(true);
+    });
+    it('puts the active row first, then sorts the rest alphabetically', () => {
+        const rows = buildTokenRows([
+            { url: 'https://api.levr.now', tokens: at(60) },
+            { url: 'http://localhost:8080', tokens: at(60) },
+            { url: 'http://localhost:9480', tokens: at(60) },
+        ], 'http://localhost:9480', NOW);
+        expect(rows.map((r) => r.url)).toEqual([
+            'http://localhost:9480',
+            'http://localhost:8080',
+            'https://api.levr.now',
+        ]);
+    });
+    it('marks nothing active when the configured backend has no token', () => {
+        const rows = buildTokenRows([{ url: 'https://api.levr.now', tokens: at(60) }], 'http://localhost:9480', NOW);
+        expect(rows.some((r) => r.active)).toBe(false);
+    });
+    it('marks nothing active when there is no configured backend', () => {
+        const rows = buildTokenRows([{ url: 'https://api.levr.now', tokens: at(60) }], undefined, NOW);
+        expect(rows.some((r) => r.active)).toBe(false);
+    });
+});
+describe('formatExpiry', () => {
+    it('reports remaining minutes while valid', () => {
+        expect(formatExpiry(NOW + 90 * 60_000, NOW)).toBe('valid 90m');
+    });
+    it('reports elapsed minutes once expired', () => {
+        expect(formatExpiry(NOW - 12 * 60_000, NOW)).toBe('expired 12m ago');
+    });
+    it('treats the exact expiry instant as expired', () => {
+        expect(formatExpiry(NOW, NOW)).toBe('expired 0m ago');
+    });
+});
+describe('labelForBackend', () => {
+    it('names the presets', () => {
+        expect(labelForBackend('https://api.levr.now')).toBe('staging');
+        expect(labelForBackend('https://api.levr.one')).toBe('production');
+        expect(labelForBackend('http://localhost:8080')).toBe('local');
+    });
+    it('names a worktree-offset loopback backend local', () => {
+        expect(labelForBackend('http://localhost:9480')).toBe('local');
+        expect(labelForBackend('http://127.0.0.1:9480')).toBe('local');
+    });
+    it('names the DEV_TLS dev domain local', () => {
+        expect(labelForBackend('https://ai.levr.test:3020/api')).toBe('local');
+        expect(labelForBackend('https://api.levr.test:8080')).toBe('local');
+    });
+    it('names the levr.test apex local, not just its subdomains', () => {
+        expect(labelForBackend('https://levr.test:3020')).toBe('local');
+    });
+    it('falls back to custom for a remote backend', () => {
+        expect(labelForBackend('https://backend.testquality.net')).toBe('custom');
+    });
+    it('falls back to custom for an unparseable url', () => {
+        expect(labelForBackend('not a url')).toBe('custom');
+    });
+    it('does not treat a lookalike host as local', () => {
+        // `.endsWith('.levr.test')` must not match an attacker-ish suffix host.
+        expect(labelForBackend('https://evil-levr.test.example.com')).toBe('custom');
+    });
+});
+describe('backendUrlForLevrMcp', () => {
+    it('maps the hosted staging MCP url to the api host it is keyed by', () => {
+        expect(backendUrlForLevrMcp('https://ai.levr.now/api/v1/mcp')).toBe('https://api.levr.now');
+    });
+    it('maps the hosted production MCP url to the api host it is keyed by', () => {
+        expect(backendUrlForLevrMcp('https://ai.levr.one/api/v1/mcp')).toBe('https://api.levr.one');
+    });
+    it('keys a worktree local verbatim', () => {
+        expect(backendUrlForLevrMcp('http://localhost:9780/v1/mcp')).toBe('http://localhost:9780');
+    });
+    it('keys a DEV_TLS local verbatim, keeping the /api prefix', () => {
+        // This exact string is a real key in the token map — rewriting it would
+        // make the entry unreachable.
+        expect(backendUrlForLevrMcp('https://ai.levr.test:3020/api/v1/mcp')).toBe('https://ai.levr.test:3020/api');
+    });
+    it('keeps two different worktree ports distinct', () => {
+        expect(backendUrlForLevrMcp('http://localhost:8180/v1/mcp')).not.toBe(backendUrlForLevrMcp('http://localhost:8580/v1/mcp'));
+    });
+    // review F-006. `PRESETS.local` must never join the alias loop: under
+    // DEV_TLS its clientUrl+/api is `https://ai.levr.test:3020/api`, a real key
+    // in the token map that has to resolve verbatim. Asserting against
+    // PRESETS.local itself pins the exclusion in BOTH modes — a hardcoded
+    // DEV_TLS string cannot, because isTestEnv() forces the plain-HTTP preset
+    // and the assertion would pass over a broken function.
+    it('never aliases the local preset, whichever variant is active', () => {
+        const localMcp = `${PRESETS.local.clientUrl}/api/v1/mcp`;
+        expect(backendUrlForLevrMcp(localMcp)).toBe(`${PRESETS.local.clientUrl}/api`);
+        expect(backendUrlForLevrMcp(localMcp)).not.toBe(PRESETS.local.apiUrl);
+    });
+    it('tolerates a trailing slash', () => {
+        expect(backendUrlForLevrMcp('https://ai.levr.now/api/v1/mcp/')).toBe('https://api.levr.now');
+    });
+});
+describe('levrEntryFrom', () => {
+    const config = {
+        mcpServers: {
+            levr: {
+                type: 'http',
+                url: 'https://ai.levr.now/api/v1/mcp',
+                headers: { 'Workspace-Id': 'ws-1' },
+            },
+            'qinetic-mcp': { type: 'stdio' },
+        },
+    };
+    it('extracts the url and the Workspace-Id header', () => {
+        expect(levrEntryFrom(config)).toEqual({
+            url: 'https://ai.levr.now/api/v1/mcp',
+            workspaceId: 'ws-1',
+        });
+    });
+    it('returns the url alone when no Workspace-Id is pinned', () => {
+        expect(levrEntryFrom({ mcpServers: { levr: { url: 'http://x/v1/mcp' } } })).toEqual({ url: 'http://x/v1/mcp', workspaceId: undefined });
+    });
+    it.each([
+        ['null', null],
+        ['an array', []],
+        ['a string', 'nope'],
+        ['no mcpServers', {}],
+        ['no levr server', { mcpServers: { 'qinetic-mcp': { type: 'stdio' } } }],
+        ['a levr server with no url', { mcpServers: { levr: { type: 'http' } } }],
+        ['a non-string url', { mcpServers: { levr: { url: 42 } } }],
+        ['an empty url', { mcpServers: { levr: { url: '' } } }],
+    ])('returns undefined for %s', (_label, input) => {
+        expect(levrEntryFrom(input)).toBeUndefined();
+    });
+    it('ignores a non-string Workspace-Id rather than rendering it', () => {
+        expect(levrEntryFrom({
+            mcpServers: {
+                levr: { url: 'http://x/v1/mcp', headers: { 'Workspace-Id': 7 } },
+            },
+        })).toEqual({ url: 'http://x/v1/mcp', workspaceId: undefined });
+    });
+});
+//# sourceMappingURL=status-report.test.js.map