@quonfig/cli 0.0.16 → 0.0.18

package/dist/util/get-valid-token.js

@@ -6,38 +6,62 @@
  * directly as a bearer token and no disk reads/writes or refresh calls
  * are made. This is the non-interactive (CI) path.
  */
+import { getDomain } from './domain-urls.js';
 import { decodeJWT, refreshAccessToken } from './oauth-client.js';
 import { loadTokens, saveTokens } from './token-storage.js';
-export async function getValidAccessToken() {
+const noopLog = () => { };
+export async function getValidAccessToken(log = noopLog) {
     const envKey = process.env.QUONFIG_API_KEY;
     if (envKey && envKey.length > 0) {
         if (!envKey.startsWith('qf_uk_')) {
             throw new Error(`QUONFIG_API_KEY must start with "qf_uk_" (got "${envKey.slice(0, 8)}..."). Generate one from the web UI under Settings → API Keys.`);
         }
+        log('getValidAccessToken: using QUONFIG_API_KEY (CI path)');
         return envKey;
     }
     const tokens = await loadTokens();
+    log('getValidAccessToken: loaded tokens', {
+        domain: getDomain(),
+        hasAccessToken: Boolean(tokens?.accessToken),
+        hasRefreshToken: Boolean(tokens?.refreshToken),
+        expiresAt: tokens?.expiresAt,
+    });
     if (!tokens?.accessToken) {
         throw new Error('Not authenticated. Please run `qfg login` first.');
     }
     // Check expiry using the JWT's exp claim, falling back to stored expiresAt
     let expired = tokens.expiresAt ? tokens.expiresAt < Date.now() : false;
+    let expirySource = 'stored';
     try {
         const payload = decodeJWT(tokens.accessToken);
         if (typeof payload.exp === 'number') {
             expired = payload.exp * 1000 < Date.now();
+            expirySource = 'jwt';
         }
     }
     catch {
         /* use stored expiresAt */
     }
+    log('getValidAccessToken: expiry check', { expired, expirySource, now: Date.now() });
     if (!expired) {
         return tokens.accessToken;
     }
     if (!tokens.refreshToken) {
-        throw new Error('Session expired. Please run `qfg login` to re-authenticate.');
+        throw new Error('Session expired (no refresh_token on disk). Please run `qfg login` to re-authenticate.');
     }
-    const refreshed = await refreshAccessToken(tokens.refreshToken);
+    log('getValidAccessToken: access token expired, calling WorkOS refresh');
+    let refreshed;
+    try {
+        refreshed = await refreshAccessToken(tokens.refreshToken);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        log('getValidAccessToken: refresh FAILED', { detail });
+        throw new Error(`Token refresh failed: ${detail}`);
+    }
+    log('getValidAccessToken: refresh succeeded', {
+        gotNewRefreshToken: Boolean(refreshed.refresh_token),
+    });
     let expiresAt = Date.now() + 300 * 1000;
     try {
         const payload = decodeJWT(refreshed.access_token);
@@ -55,5 +79,6 @@ export async function getValidAccessToken() {
         refreshToken: refreshed.refresh_token,
     };
     await saveTokens(updated);
+    log('getValidAccessToken: refreshed tokens saved', { newExpiresAt: expiresAt });
     return refreshed.access_token;
 }

package/dist/util/token-storage.js

@@ -8,7 +8,11 @@ const getTokenFile = (options) => {
     const filename = domain === 'quonfig.com' ? 'tokens.json' : `tokens-${domain.replaceAll('.', '-')}.json`;
     return path.join(getQuonfigDir(options), filename);
 };
-const getConfigFile = (options) => path.join(getQuonfigDir(options), 'config');
+const getConfigFile = (options) => {
+    const domain = getDomain();
+    const filename = domain === 'quonfig.com' ? 'config' : `config-${domain.replaceAll('.', '-')}`;
+    return path.join(getQuonfigDir(options), filename);
+};
 /**
  * Find a workspace ID by slug across all saved profiles.
  * Used to resolve QUONFIG_WORKSPACE and --workspace flag values.

package/oclif.manifest.json

@@ -2689,5 +2689,5 @@
       ]
     }
   },
-  "version": "0.0.16"
+  "version": "0.0.18"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },
@@ -32,6 +32,7 @@
     "lodash.camelcase": "^4.3.0",
     "mustache": "^4.2.0",
     "node-forge": "^1.4.0",
+    "typescript": "^5",
     "zod": "^4.1.12"
   },
   "description": "Quonfig CLI. For arbitrary targeting rules (email, plan, segment, custom property), run `qfg config-schema` then `qfg pull`.",
@@ -58,8 +59,7 @@
     "prettier": "^3.6.2",
     "shx": "^0.3.4",
     "ts-node": "^10.9.1",
-    "tsx": "^4.21.0",
-    "typescript": "^5"
+    "tsx": "^4.21.0"
   },
   "engines": {
     "node": ">=18.0.0"