@timekast/factory 1.19.0 → 1.21.0

package/dist/lib/backlog-api.js

@@ -0,0 +1,302 @@
+/**
+ * Backlog-central REST v1 client for the Factory ↔ backlog.timekast.mx integration.
+ *
+ * A THIN HTTP client that MIRRORS the proven fetch shape of `neon-api.ts`
+ * (`Authorization: Bearer ${key}` + a constant base URL + a typed error carrying
+ * the HTTP status + an injectable `fetchImpl` seam) — we reuse that shape rather
+ * than reinvent an HTTP client per command (issue §6). The provision/push/sync
+ * commands (BSYNC-003/005/006) consume this single surface instead of each
+ * hand-rolling headers/errors/backoff.
+ *
+ * TWO auth scopes ride the SAME `Authorization: Bearer` header; the CALLER picks
+ * which key to pass (this client does not distinguish them):
+ *   - the org-level `admin` token (rail `BACKLOG_ADMIN_TOKEN`) — ONLY the three
+ *     org endpoints: `POST /projects`, `POST /projects/{pid}/keys`,
+ *     `DELETE /projects/{pid}`. It 403s (`PROJECT_NOT_IN_KEY`) on anything scoped
+ *     to a project's elements.
+ *   - the per-project `read_write` key (derivative `.env.local` `BACKLOG_API_KEY`)
+ *     — every element/release/sync-state/summary call.
+ * (Live-verified separation — `project/abraham/smoke-findings.md` Hallazgo 1.)
+ *
+ * Every call surfaces a typed {@link BacklogApiError} on a non-2xx response that
+ * carries the HTTP status + best-effort body, so the caller can map edge cases to
+ * actionable es-MX messages. The `429` (rate ~120 req/min) backoff lives HERE, in
+ * the shared request helper — NOT in the parser/mapping of BSYNC-004 (issue §6).
+ *
+ * The `fetch` impl is an INJECTABLE seam (`BacklogApiDeps.fetchImpl`) so the unit
+ * tests drive method + URL + payload with a mock and NEVER hit the live network;
+ * the real end-to-end exercise is BSYNC-001 (spike) + BSYNC-014 (E2E).
+ */
+/** Backlog-central REST v1 base (`servers[0].url` of the live `/openapi.json`). */
+export const BACKLOG_API_BASE = 'https://backlog.timekast.mx/api/v1';
+/** Timeout (ms) per call — a dead network must not hang the command using it. */
+const BACKLOG_API_TIMEOUT_MS = 30_000;
+/**
+ * A `429 Too Many Requests` (rate ~120 req/min) is retried with linear backoff —
+ * same shape `neon-api.ts` uses for its `423` lock retry. Tests inject a no-op
+ * `sleepImpl` so no real time passes.
+ */
+const BACKLOG_RATE_MAX_RETRIES = 4;
+const BACKLOG_RATE_BACKOFF_MS = 1_000;
+// ─────────────────────────────────────────────────────────────────────────────
+// Error + injectable seams (calqued 1:1 from neon-api.ts)
+// ─────────────────────────────────────────────────────────────────────────────
+/** A non-2xx response from the backlog API. Carries the HTTP status for mapping. */
+export class BacklogApiError extends Error {
+    status;
+    /** The raw response body (best-effort, truncated) — context, never a secret. */
+    body;
+    constructor(status, body, context) {
+        super(`Backlog API ${status} en ${context}: ${body || '(sin cuerpo)'}`);
+        this.name = 'BacklogApiError';
+        this.status = status;
+        this.body = body;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Path segment (plural) per element type — the API routes elements by plural. */
+const ELEMENT_PATH_SEGMENT = {
+    epic: 'epics',
+    feature: 'features',
+    story: 'stories',
+    task: 'tasks',
+    bug: 'bugs',
+};
+// ─────────────────────────────────────────────────────────────────────────────
+// Shared request helper — headers, timeout, 429 backoff, error, `{data}` unwrap
+// ─────────────────────────────────────────────────────────────────────────────
+/** Shared headers for every backlog call (Bearer auth + JSON). */
+function backlogHeaders(apiKey) {
+    return {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+    };
+}
+/** Read a response body as text (best-effort) for error context — never throws. */
+async function safeBody(response) {
+    try {
+        return (await response.text()).slice(0, 500);
+    }
+    catch {
+        return '';
+    }
+}
+/** Parse a JSON body defensively — a missing/invalid body yields `{}`, never throws. */
+async function safeJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Perform one backlog call: Bearer headers + JSON body + per-call abort timeout,
+ * retrying `429` with linear backoff (the ONE place backoff lives — issue §6).
+ * On any other non-2xx it throws a typed {@link BacklogApiError}. On success it
+ * unwraps the universal `{ data }` envelope and returns `data` typed as `T`.
+ *
+ * @throws {BacklogApiError} on any non-2xx (after exhausting the 429 retries).
+ */
+async function backlogRequest(apiKey, path, init, context, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const sleep = deps.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const doFetch = () => fetchImpl(`${BACKLOG_API_BASE}${path}`, {
+        method: init.method,
+        headers: backlogHeaders(apiKey),
+        ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+        signal: AbortSignal.timeout(BACKLOG_API_TIMEOUT_MS),
+    });
+    // Retry on 429 (rate limit) with linear backoff — every endpoint can hit it.
+    let response = await doFetch();
+    for (let attempt = 0; response.status === 429 && attempt < BACKLOG_RATE_MAX_RETRIES; attempt++) {
+        await sleep(BACKLOG_RATE_BACKOFF_MS * (attempt + 1));
+        response = await doFetch();
+    }
+    if (!response.ok) {
+        throw new BacklogApiError(response.status, await safeBody(response), context);
+    }
+    const json = (await safeJson(response));
+    return json.data;
+}
+/**
+ * Create the backlog project — `POST /projects` with the org-level `admin` token.
+ * `internalKey` is our slug (server validates `^[a-z0-9-]{3,40}$`; a collision
+ * 409s `INTERNAL_KEY_TAKEN` — the caller adopts the existing project). Returns the
+ * project id (`{pid}`) + its public board UUID (smoke Hallazgo 1).
+ *
+ * @throws {BacklogApiError} on any non-2xx (409 = internalKey taken → adopt).
+ */
+export async function createBacklogProject(adminToken, input, deps = {}) {
+    const data = await backlogRequest(adminToken, '/projects', {
+        method: 'POST',
+        body: {
+            name: input.name,
+            internalKey: input.internalKey,
+            defaultLanguage: input.defaultLanguage ?? 'es',
+            enabledLanguages: input.enabledLanguages ?? ['es', 'en'],
+        },
+    }, 'POST /projects', deps);
+    if (!data?.id || !data?.publicUuid) {
+        throw new BacklogApiError(201, JSON.stringify(data).slice(0, 500), 'POST /projects (respuesta sin id/publicUuid)');
+    }
+    return { id: data.id, publicUuid: data.publicUuid };
+}
+/**
+ * Mint a per-project `read_write` key — `POST /projects/{pid}/keys` with the
+ * `admin` token. The returned `plaintextKey` (`tk_live_*`, scope fixed to this
+ * project) is SHOW-ONCE: it is the only time this value is readable, so the caller
+ * writes it straight to `.env.local` (`BACKLOG_API_KEY`) and never logs it.
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function mintBacklogKey(adminToken, projectId, keyName, deps = {}) {
+    const data = await backlogRequest(adminToken, `/projects/${encodeURIComponent(projectId)}/keys`, { method: 'POST', body: { name: keyName } }, 'POST /projects/{pid}/keys', deps);
+    if (!data?.plaintextKey) {
+        throw new BacklogApiError(201, JSON.stringify(data).slice(0, 500), 'POST /projects/{pid}/keys (respuesta sin plaintextKey)');
+    }
+    return data.plaintextKey;
+}
+/**
+ * Soft-delete the backlog project — `DELETE /projects/{pid}` with the `admin`
+ * token. It DEACTIVATES (does not hard-delete, does not cascade) and is
+ * IDEMPOTENT: a repeat returns 200 with the same `{ deactivated: true }` (smoke
+ * Hallazgo 7). Unblocks `--destroy` (BSYNC-003).
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function deleteBacklogProject(adminToken, projectId, deps = {}) {
+    await backlogRequest(adminToken, `/projects/${encodeURIComponent(projectId)}`, { method: 'DELETE' }, 'DELETE /projects/{pid}', deps);
+}
+/**
+ * Shared POST for the four element creates — `POST /projects/{pid}/{plural}`.
+ * The body is the caller's already-mapped payload (BSYNC-004 builds it); this
+ * client only performs the HTTP call. Returns the created id + minted humanId.
+ *
+ * NOTE on idempotency: a re-POST of an existing `id` currently returns `500`
+ * (NOT the documented `409 ELEMENT_ID_EXISTS`) — smoke Hallazgo 3. So the push
+ * (BSYNC-005) MUST pre-check existence via {@link getSyncState}, not treat a
+ * status here as an "already exists" signal.
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+async function createElement(apiKey, projectId, segment, body, context, deps) {
+    const data = await backlogRequest(apiKey, `/projects/${encodeURIComponent(projectId)}/${segment}`, { method: 'POST', body }, context, deps);
+    const humanId = data?.humanId;
+    // The response may echo the id; fall back to the client-supplied one we sent.
+    const id = data?.id ?? body.id;
+    if (!id || !humanId) {
+        throw new BacklogApiError(201, JSON.stringify(data).slice(0, 500), `${context} (respuesta sin id/humanId)`);
+    }
+    return { id, humanId };
+}
+/** Create an epic — `POST /projects/{pid}/epics`. @throws {BacklogApiError} on non-2xx. */
+export async function createEpic(apiKey, projectId, body, deps = {}) {
+    return createElement(apiKey, projectId, 'epics', body, 'POST /projects/{pid}/epics', deps);
+}
+/** Create a feature — `POST /projects/{pid}/features`. @throws {BacklogApiError} on non-2xx. */
+export async function createFeature(apiKey, projectId, body, deps = {}) {
+    return createElement(apiKey, projectId, 'features', body, 'POST /projects/{pid}/features', deps);
+}
+/** Create a story — `POST /projects/{pid}/stories`. @throws {BacklogApiError} on non-2xx. */
+export async function createStory(apiKey, projectId, body, deps = {}) {
+    return createElement(apiKey, projectId, 'stories', body, 'POST /projects/{pid}/stories', deps);
+}
+/** Create a task — `POST /projects/{pid}/tasks`. @throws {BacklogApiError} on non-2xx. */
+export async function createTask(apiKey, projectId, body, deps = {}) {
+    return createElement(apiKey, projectId, 'tasks', body, 'POST /projects/{pid}/tasks', deps);
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Element status PATCH — per-project `read_write` key (BSYNC-005/006)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Update one element's status — `PATCH /projects/{pid}/{plural}/{id}` with
+ * `{ status }` (smoke Hallazgo 3). `elementType` selects the plural path segment.
+ * The response `{ updated: true }` is not echoed back to the caller.
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function patchElementStatus(apiKey, projectId, elementType, elementId, status, deps = {}) {
+    const segment = ELEMENT_PATH_SEGMENT[elementType];
+    await backlogRequest(apiKey, `/projects/${encodeURIComponent(projectId)}/${segment}/${encodeURIComponent(elementId)}`, { method: 'PATCH', body: { status } }, `PATCH /projects/{pid}/${segment}/{id}`, deps);
+}
+/**
+ * Read the project's flat element list — `GET /projects/{pid}/sync-state` (smoke
+ * Hallazgo 4). It lists ALL elements (does NOT filter by visibility), so it is the
+ * remote `{ id → (status, points, updatedAt) }` truth the self-healing diffs
+ * against the local SSOT — and the existence pre-check the push uses in place of
+ * the (broken) 409-on-collision signal. Paginated via `page`/`pageSize`; the
+ * caller reads `total` to decide whether more pages are needed.
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function getSyncState(apiKey, projectId, opts = {}, deps = {}) {
+    const query = new URLSearchParams();
+    if (opts.page !== undefined)
+        query.set('page', String(opts.page));
+    if (opts.pageSize !== undefined)
+        query.set('pageSize', String(opts.pageSize));
+    const suffix = query.toString() ? `?${query.toString()}` : '';
+    const data = await backlogRequest(apiKey, `/projects/${encodeURIComponent(projectId)}/sync-state${suffix}`, { method: 'GET' }, 'GET /projects/{pid}/sync-state', deps);
+    return {
+        items: data?.items ?? [],
+        total: data?.total ?? 0,
+        page: data?.page ?? 1,
+        pageSize: data?.pageSize ?? data?.items?.length ?? 0,
+    };
+}
+/**
+ * List the project's releases — `GET /projects/{pid}/releases`. Feeds the
+ * adopt-by-name flow (releases take NO client-supplied id, so the push matches an
+ * existing release by name before creating one — D12). Tolerates either a bare
+ * `data: [...]` or a `data: { items: [...] }` envelope (same defensive parse
+ * `neon-api.ts` uses for its key list).
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function listBacklogReleases(apiKey, projectId, deps = {}) {
+    const data = await backlogRequest(apiKey, `/projects/${encodeURIComponent(projectId)}/releases`, { method: 'GET' }, 'GET /projects/{pid}/releases', deps);
+    const list = Array.isArray(data) ? data : (data?.items ?? []);
+    return list
+        .filter((r) => typeof r?.id === 'string')
+        .map((r) => ({ id: r.id, name: (r.name ?? {}) }));
+}
+/**
+ * Create a release — `POST /projects/{pid}/releases` (smoke Hallazgo 5). It takes
+ * no client-supplied `id`; the server mints one and returns it. Returns the new
+ * release id.
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function createRelease(apiKey, projectId, body, deps = {}) {
+    const data = await backlogRequest(apiKey, `/projects/${encodeURIComponent(projectId)}/releases`, { method: 'POST', body }, 'POST /projects/{pid}/releases', deps);
+    if (!data?.id) {
+        throw new BacklogApiError(201, JSON.stringify(data).slice(0, 500), 'POST /projects/{pid}/releases (respuesta sin id)');
+    }
+    return { id: data.id };
+}
+/**
+ * Assign an element to a release — `POST /releases/{rid}/assignments` (smoke
+ * Hallazgo 5). NOTE this route is RELEASE-scoped, NOT under `/projects/{pid}`.
+ * The mapping rule: assign ONLY epics — features/stories inherit the release, and
+ * assigning a child whose ancestor epic is already assigned 422s `PARENT_MISMATCH`
+ * (tasks/bugs are not releasable at all). Enforcing that rule is the caller's job;
+ * the API accepts `epic`/`feature`/`story` here.
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function assignToRelease(apiKey, releaseId, elementType, elementId, deps = {}) {
+    await backlogRequest(apiKey, `/releases/${encodeURIComponent(releaseId)}/assignments`, { method: 'POST', body: { elementType, elementId } }, 'POST /releases/{rid}/assignments', deps);
+}
+/**
+ * Read the project's rollup — `GET /projects/{pid}/summary` (smoke Hallazgo 5).
+ * The rollup propagates epic → release and drops `wont_do` from point
+ * denominators. Prefer {@link getSyncState} for heartbeat/reconcile; use this for
+ * a point/progress rollup view.
+ *
+ * @throws {BacklogApiError} on any non-2xx.
+ */
+export async function getSummary(apiKey, projectId, deps = {}) {
+    return backlogRequest(apiKey, `/projects/${encodeURIComponent(projectId)}/summary`, { method: 'GET' }, 'GET /projects/{pid}/summary', deps);
+}

package/dist/lib/backlog-mapping.js

@@ -0,0 +1,175 @@
+/**
+ * Mapping tables + credential resolution for the Factory ↔ backlog.timekast.mx
+ * integration — the shared translation layer between the LOCAL backlog vocabulary
+ * (the emoji+word `Status:`, `P0..P3` priority, integer Story Points, `must/should/
+ * could` MoSCoW that live in issue/epic markdown) and the REMOTE enums the API
+ * accepts (`backlog-api.ts`). Both `push` (BSYNC-005) and `sync` (BSYNC-006)
+ * consume this ONE module so neither hand-rolls the translation.
+ *
+ * Two design rules the issue (§4) pins down:
+ *   - Every axis (status/priority/points/moscow) is a DATA TABLE, never scattered
+ *     if/else — a reviewer reads the bijection at a glance.
+ *   - Status is a strict 6↔6 BIJECTION: each of the 6 local buckets has exactly one
+ *     remote destination and vice-versa (asserted by the unit tests).
+ *
+ * Local status buckets mirror `scripts/tools/update-board.ts` `parseStatus()` (SSOT
+ * vocabulary: `.claude/skills/tk-backlog/methodology/issue-shape.md`). `Deferred`
+ * and `Postponed` are synonyms that both bucket to `postponed` locally → `deferred`
+ * remotely, keeping the 6↔6 bijection intact.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+/**
+ * LOCAL bucket → REMOTE `WorkStatus`. Half of the bijection; {@link STATUS_REMOTE_TO_LOCAL}
+ * is its exact inverse. The 6 remote states were live-verified (smoke Hallazgo 3).
+ */
+export const STATUS_LOCAL_TO_REMOTE = {
+    todo: 'todo',
+    'in-progress': 'in_progress',
+    done: 'done',
+    'wont-do': 'wont_do',
+    postponed: 'deferred',
+    blocked: 'blocked',
+};
+/** REMOTE `WorkStatus` → LOCAL bucket. Exact inverse of {@link STATUS_LOCAL_TO_REMOTE}. */
+export const STATUS_REMOTE_TO_LOCAL = {
+    todo: 'todo',
+    in_progress: 'in-progress',
+    done: 'done',
+    wont_do: 'wont-do',
+    deferred: 'postponed',
+    blocked: 'blocked',
+};
+/** Translate a local status bucket to the remote `WorkStatus` the API PATCH accepts. */
+export function mapStatusToRemote(local) {
+    return STATUS_LOCAL_TO_REMOTE[local];
+}
+/** Translate a remote `WorkStatus` (from `sync-state`) back to the local bucket for the diff. */
+export function mapStatusToLocal(remote) {
+    return STATUS_REMOTE_TO_LOCAL[remote];
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Priority — P0..P3 → p0..p3 (data table)
+// ─────────────────────────────────────────────────────────────────────────────
+/** LOCAL `P0..P3` → REMOTE `p0..p3` (FCT-005 — an axis independent of MoSCoW). */
+export const PRIORITY_LOCAL_TO_REMOTE = {
+    P0: 'p0',
+    P1: 'p1',
+    P2: 'p2',
+    P3: 'p3',
+};
+/**
+ * Map a raw `Priority:` value (`P1`, `P0 (Crítico)`, …) to the remote enum. Extracts
+ * the `P0..P3` token defensively; anything without one → `undefined` (the push then
+ * omits `priority` rather than sending a bogus value).
+ */
+export function mapPriority(raw) {
+    if (!raw)
+        return undefined;
+    const match = raw.toUpperCase().match(/P[0-3]/);
+    return match ? PRIORITY_LOCAL_TO_REMOTE[match[0]] : undefined;
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// MoSCoW — must/should/could (data table)
+// ─────────────────────────────────────────────────────────────────────────────
+/** The three MoSCoW commitments that ever reach the backlog (`won't` never pushes). */
+export const MOSCOW_VALUES = ['must', 'should', 'could'];
+/**
+ * Normalize a raw `MoSCoW:` value to the remote enum. A `—` / empty / unknown value
+ * (a legacy issue without the BSYNC-007 field, or a placeholder) → `undefined`, so
+ * the push omits `moscow` instead of guessing.
+ */
+export function mapMoscow(raw) {
+    if (!raw)
+        return undefined;
+    const value = raw.trim().toLowerCase();
+    return MOSCOW_VALUES.includes(value)
+        ? value
+        : undefined;
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Story points — canonical scale (data table)
+// ─────────────────────────────────────────────────────────────────────────────
+/** The canonical Fibonacci-ish Story Points scale (DoR: 1/2/3/5/8/13). */
+export const STORY_POINTS_SCALE = [1, 2, 3, 5, 8, 13];
+/** Whether a value sits on the canonical {@link STORY_POINTS_SCALE}. */
+export function isCanonicalStoryPoints(sp) {
+    return STORY_POINTS_SCALE.includes(sp);
+}
+/**
+ * Map local Story Points to the remote `points` field. A positive integer passes
+ * through unchanged (fidelity — we never re-bucket the team's estimate); `0`/missing
+ * → `null`, which the API treats as "no points" (epics/features carry `null` too,
+ * smoke Hallazgo 4). Non-canonical positive values (e.g. `4`) pass through as-is;
+ * {@link isCanonicalStoryPoints} lets the caller warn without dropping the value.
+ */
+export function mapStoryPoints(sp) {
+    return Number.isInteger(sp) && sp > 0 ? sp : null;
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Credential resolution — fail-closed, NEVER throws (issue §4)
+// ─────────────────────────────────────────────────────────────────────────────
+/** The env keys the derivative's `.env.local` carries for the backlog integration. */
+export const BACKLOG_API_KEY_VAR = 'BACKLOG_API_KEY';
+export const BACKLOG_PROJECT_ID_VAR = 'BACKLOG_PROJECT_ID';
+/** Default FS reader — reads `.env.local` if present, swallowing any error to `null`. */
+function defaultReadFile(filePath) {
+    try {
+        return existsSync(filePath) ? readFileSync(filePath, 'utf8') : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read one `KEY=value` from an env-file body, stripping a matching quote pair. */
+function readEnvValue(body, key) {
+    const match = body.match(new RegExp(`^${key}=(.*)$`, 'm'));
+    if (!match)
+        return undefined;
+    let value = match[1].trim();
+    if (value.length >= 2 &&
+        ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'")))) {
+        value = value.slice(1, -1);
+    }
+    return value.length > 0 ? value : undefined;
+}
+/**
+ * Resolve the per-project backlog credentials from `{rootDir}/.env.local`. FAIL-CLOSED
+ * (issue §4): a missing file, an unreadable file, or a missing/empty `BACKLOG_API_KEY`
+ * / `BACKLOG_PROJECT_ID` all return the distinctive `not-configured` result — this
+ * function NEVER throws, so a derivative that never provisioned the backlog service
+ * does not crash `push`/`sync`; they just skip. The `readFile` seam is injectable so
+ * tests drive every branch without disk.
+ */
+export function resolveBacklogCredentials(rootDir, deps = {}) {
+    const read = deps.readFile ?? defaultReadFile;
+    let body;
+    try {
+        body = read(`${rootDir.replace(/\/+$/, '')}/.env.local`);
+    }
+    catch {
+        // A throwing injected reader must still fail closed, never propagate.
+        body = null;
+    }
+    if (body === null) {
+        return {
+            status: 'not-configured',
+            reason: 'No se encontró `.env.local`; el backlog central no está configurado.',
+        };
+    }
+    const apiKey = readEnvValue(body, BACKLOG_API_KEY_VAR);
+    const projectId = readEnvValue(body, BACKLOG_PROJECT_ID_VAR);
+    if (!apiKey || !projectId) {
+        const missing = [
+            !apiKey ? BACKLOG_API_KEY_VAR : null,
+            !projectId ? BACKLOG_PROJECT_ID_VAR : null,
+        ]
+            .filter(Boolean)
+            .join(' + ');
+        return {
+            status: 'not-configured',
+            reason: `Falta ${missing} en \`.env.local\`; el backlog central no está configurado.`,
+        };
+    }
+    return { status: 'configured', apiKey, projectId };
+}