// The DCR root-domain collision at the picker-classification level (issue #1120).//// Two DIFFERENT integrations share one registrable root domain (cloudflare.com)// but differ by host: a "Cloudflare" MCP integration whose OAuth is on// mcp.cloudflare.com, and the plain "Cloudflare" REST integration on// api.cloudflare.com. Connecting the MCP integration Dynamic-Client-Registers an// oauth_client (origin: dynamic_client_registration) against mcp.cloudflare.com.//// The regression PR #1139 missed: that auto-registered client leaking into the// REST integration's Add-connection app picker. The existing unit tests in// use-effective-oauth-client.test.ts check DCR exclusion and root-domain tiering// one picker at a time; this file asserts the CROSS-INTEGRATION property those// don't: the MCP integration's DCR client is offered in NONE of the REST// integration's picker tiers, yet stays visible in the MCP integration's own// auto-registered management list. It runs the exact pure classifier the app// (add-account-modal.tsx via useOAuthClientsForIntegration) uses to build the// picker, so it guards the shipped behaviour, not a reimplementation.//// The server-side half (that DCR actually mints this row over the wire and// reuses it on reconnect) is covered by e2e/cloud/dcr-root-domain-isolation.test.ts.import { describe, expect, it } from "@effect/vitest";import { IntegrationSlug, OAuthClientSlug, type Owner } from "@executor-js/sdk/shared";import type { OAuthClientOrigin } from "@executor-js/sdk/shared"; import {  selectClientsForEndpoints,  selectDcrClientsForIntegration,  type OAuthClientOption,} from "./use-effective-oauth-client"; const client = (  slug: string,  opts: {    readonly owner?: Owner;    readonly authorizationUrl: string;    readonly tokenUrl: string;    readonly origin: OAuthClientOrigin;  },): OAuthClientOption => ({  owner: opts.owner ?? "org",  slug: OAuthClientSlug.make(slug),  grant: "authorization_code",  authorizationUrl: opts.authorizationUrl,  tokenUrl: opts.tokenUrl,  clientId: "client-id",  origin: opts.origin,}); const MCP_INTEGRATION = IntegrationSlug.make("cloudflare_mcp");const REST_INTEGRATION = IntegrationSlug.make("cloudflare_api"); // The auto-registered client the MCP connect flow mints, exactly as the API// projects it (origin.kind = dynamic_client_registration, endpoints on the MCP// host, stamped with the MCP integration as its origin).const mcpDcrClient = client("dcr-mcp-cloudflare-com", {  authorizationUrl: "https://mcp.cloudflare.com/authorize",  tokenUrl: "https://mcp.cloudflare.com/token",  origin: { kind: "dynamic_client_registration", integration: MCP_INTEGRATION },}); // What the REST integration (api.cloudflare.com) declares to its picker.const restEndpoints = {  tokenUrl: "https://api.cloudflare.com/client/v4/oauth/token",  authorizationUrl: "https://api.cloudflare.com/client/v4/oauth/authorize",  integration: REST_INTEGRATION,  requireEndpointMatch: true,} as const; describe("DCR root-domain isolation across two same-provider integrations", () => {  it("the MCP integration's DCR client is offered in NO tier of the REST integration's picker", () => {    const rest = selectClientsForEndpoints([mcpDcrClient], restEndpoints);     const offeredInAnyTier = [...rest.matched, ...rest.nearMatches, ...rest.unmatched].map((c) =>      String(c.slug),    );    expect(      offeredInAnyTier,      "the auto-registered client never surfaces as a selectable app for a same-root integration",    ).not.toContain("dcr-mcp-cloudflare-com");    // The three tiers ARE the whole picker; nothing selectable remains.    expect(offeredInAnyTier, "the picker offers nothing to select").toEqual([]);    expect(      rest.matched.length,      "no exact/intent match, so the REST picker shows the register-an-app CTA",    ).toBe(0);    expect(rest.endpointMatched, "an endpoint was declared but nothing matched exactly").toBe(      false,    );  });   it("a same-root MANUAL app (not DCR) still lands in the near-matches tier, proving the exclusion is DCR-specific", () => {    // Same mcp.cloudflare.com endpoints, but a manual app: the classifier must    // still surface it (as a subdued near-match), so the empty picker above is    // due to the DCR origin, not the host mismatch.    const manualNearMiss = client("cloudflare-mcp-manual", {      authorizationUrl: "https://mcp.cloudflare.com/authorize",      tokenUrl: "https://mcp.cloudflare.com/token",      origin: { kind: "manual", integration: null },    });    const rest = selectClientsForEndpoints([manualNearMiss, mcpDcrClient], restEndpoints);     expect(      rest.nearMatches.map((c) => String(c.slug)),      "the manual same-root app is a tier-2 near-match",    ).toEqual(["cloudflare-mcp-manual"]);    expect(      [...rest.matched, ...rest.nearMatches, ...rest.unmatched].map((c) => String(c.slug)),      "the DCR client is still excluded even alongside a pickable manual app",    ).not.toContain("dcr-mcp-cloudflare-com");  });   it("the DCR client stays visible in the MCP integration's own auto-registered management list", () => {    // Hidden from the picker is not hidden from management: the MCP integration    // that minted it must still be able to review and remove it.    const managed = selectDcrClientsForIntegration([mcpDcrClient], {      integration: MCP_INTEGRATION,      tokenUrl: "https://mcp.cloudflare.com/token",      authorizationUrl: "https://mcp.cloudflare.com/authorize",    });    expect(      managed.map((c) => String(c.slug)),      "the auto-registered client is manageable from the integration that created it",    ).toEqual(["dcr-mcp-cloudflare-com"]);  });});