@quonfig/cli 0.0.19 → 0.0.21

package/dist/util/coerce.js

@@ -1,10 +1,21 @@
-import { ConfigValueType } from '@quonfig/node';
+import { ConfigValueType, durationToMilliseconds } from '@quonfig/node';
 const TRUE_VALUES = new Set(['true', '1', 't']);
 const BOOLEAN_VALUES = new Set([...TRUE_VALUES, 'false', '0', 'f']);
+// Strict ISO 8601 duration: at least one of D/H/M/S must be present (i.e. bare "P"
+// or "PT" alone are rejected). Mirrors the lenient pattern in @quonfig/node but
+// adds anchors and a non-empty check.
+const ISO_DURATION_PATTERN = /^P(?:\d+(?:\.\d+)?D)?(?:T(?:\d+(?:\.\d+)?H)?(?:\d+(?:\.\d+)?M)?(?:\d+(?:\.\d+)?S)?)?$/;
+const isValidIsoDuration = (value) => {
+    if (!ISO_DURATION_PATTERN.test(value))
+        return false;
+    // Reject "P", "PT" — pattern allows them but they have no components.
+    return value !== 'P' && value !== 'PT';
+};
 export const TYPE_MAPPING = {
     bool: ConfigValueType.Bool,
     boolean: ConfigValueType.Bool,
     double: ConfigValueType.Double,
+    duration: ConfigValueType.Duration,
     int: ConfigValueType.Int,
     string: ConfigValueType.String,
     'string-list': ConfigValueType.StringList,
@@ -50,6 +61,15 @@ export const coerceIntoType = (type, value) => {
                 throw new TypeError(`Invalid default value for JSON: ${value}`);
             }
         }
+        case 'duration': {
+            // durationToMilliseconds() returns 0 on no-match instead of throwing, so
+            // we anchor-check the format ourselves before delegating.
+            if (!isValidIsoDuration(value)) {
+                throw new TypeError(`Invalid default value for duration: ${value}. Expected ISO 8601 duration like PT30S, PT5M, PT1H30M.`);
+            }
+            const millis = durationToMilliseconds(value);
+            return [{ duration: { definition: value, millis } }, ConfigValueType.Duration];
+        }
         default: {
             return undefined;
         }

package/dist/util/config-value-dto.js

@@ -57,7 +57,9 @@ export function mapConfigValueToDto(configValue, valueType) {
         }
     }
     else if (configValue.duration !== undefined) {
-        value = configValue.duration;
+        // Storage / API expects {type: 'duration', value: '<ISO 8601 string>'} — not the
+        // internal {definition, millis} envelope used by the SDK's ConfigValue type.
+        value = configValue.duration.definition;
     }
     else if (configValue.intRange !== undefined) {
         value = configValue.intRange;

package/dist/util/encryption.d.ts

@@ -14,7 +14,10 @@ export declare function decrypt(encryptedString: string, keyStringHex: string):
  * @param command - The APICommand instance for API calls and logging
  * @param value - The plaintext value to encrypt
  * @param secret - Secret configuration containing key name
- * @param environmentId - Environment ID to fetch encryption key for (empty string for default)
+ * @param environmentName - Environment slug to fetch encryption key for (empty string for default).
+ *   Must be the slug stored in config files (e.g. "production"), not the DB UUID — the encryption
+ *   key config's `environments[].id` holds slugs, and matching against UUIDs silently falls back
+ *   to the default key and produces ciphertext that won't decrypt at runtime.
  * @returns Result<ConfigValue> with encrypted value or error
  */
-export declare function makeConfidentialValue(command: APICommand, value: string, secret: Secret, environmentId: string): Promise<Result<any>>;
+export declare function makeConfidentialValue(command: APICommand, value: string, secret: Secret, environmentName: string): Promise<Result<any>>;

package/dist/util/encryption.js

@@ -53,10 +53,13 @@ export function decrypt(encryptedString, keyStringHex) {
  * @param command - The APICommand instance for API calls and logging
  * @param value - The plaintext value to encrypt
  * @param secret - Secret configuration containing key name
- * @param environmentId - Environment ID to fetch encryption key for (empty string for default)
+ * @param environmentName - Environment slug to fetch encryption key for (empty string for default).
+ *   Must be the slug stored in config files (e.g. "production"), not the DB UUID — the encryption
+ *   key config's `environments[].id` holds slugs, and matching against UUIDs silently falls back
+ *   to the default key and produces ciphertext that won't decrypt at runtime.
  * @returns Result<ConfigValue> with encrypted value or error
  */
-export async function makeConfidentialValue(command, value, secret, environmentId) {
+export async function makeConfidentialValue(command, value, secret, environmentName) {
     // First check if the encryption key exists in metadata
     const metadataRequest = await command.apiClient.post('/api/v1/metadata/list', { workspaceId: command.workspaceId });
     if (!metadataRequest.ok) {
@@ -89,10 +92,12 @@ export async function makeConfidentialValue(command, value, secret, environmentI
     // Find the encryption key for this environment (or default)
     let secretKey;
     let envVar;
-    // Check environment-specific config first
-    if (keyConfig.environments && environmentId) {
+    // Check environment-specific config first. environments[].id is the env slug
+    // (e.g. "production") as stored in the git file — match by slug, not UUID.
+    if (keyConfig.environments && environmentName) {
+        const targetSlug = String(environmentName).toLowerCase();
         /* eslint-disable @typescript-eslint/no-explicit-any */
-        const envConfig = keyConfig.environments.find((env) => String(env.id) === String(environmentId));
+        const envConfig = keyConfig.environments.find((env) => String(env.id).toLowerCase() === targetSlug);
         /* eslint-enable @typescript-eslint/no-explicit-any */
         const ruleValue = envConfig?.rules?.[0]?.value;
         // Check if it's a provided value (env var)
@@ -139,7 +144,7 @@ export async function makeConfidentialValue(command, value, secret, environmentI
         command.verboseLog(`Using literal value from ${secret.keyName} to encrypt secret`);
     }
     if (!secretKey) {
-        return failure(`Failed to create secret: ${secret.keyName} does not have a value configured for environment ${environmentId || 'default'} or default env`, {
+        return failure(`Failed to create secret: ${secret.keyName} does not have a value configured for environment ${environmentName || 'default'} or default env`, {
             phase: 'finding-secret',
         });
     }

package/dist/util/resolve-workspace.js

@@ -1,6 +1,6 @@
 import { getApiUrl } from './domain-urls.js';
 import { getValidAccessToken } from './get-valid-token.js';
-import { getActiveProfile, loadAuthConfig, resolveWorkspaceId as resolveOAuthWorkspaceId, } from './token-storage.js';
+import { getActiveProfile, loadAuthConfig, loadTokens, resolveWorkspaceId as resolveOAuthWorkspaceId, saveAuthConfig, } from './token-storage.js';
 const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 /**
  * Resolve the target workspace UUID for commands that don't extend APICommand
@@ -52,9 +52,18 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
         return match.workspaceId;
     }
     // OAuth path.
-    const authConfig = await loadAuthConfig();
+    let authConfig = await loadAuthConfig();
     if (!authConfig) {
-        command.error('Not logged in. Run `qfg login` first (or set QUONFIG_API_KEY for CI).', { exit: 401 });
+        // Auth config can be missing while tokens.json still holds a valid
+        // refresh_token — e.g. after the domain-scoped config split (commit
+        // 0f8bee6) or a partial login that wrote tokens but never the config
+        // (qfg-2qj). getValidAccessToken already knows how to refresh, so try
+        // that path before declaring "Not logged in".
+        const tokens = await loadTokens();
+        if (!tokens?.refreshToken) {
+            command.error('Not logged in. Run `qfg login` first (or set QUONFIG_API_KEY for CI).', { exit: 401 });
+        }
+        authConfig = await recoverAuthConfigFromTokens(command);
     }
     if (override) {
         const resolved = resolveOAuthWorkspaceId(authConfig, override);
@@ -73,3 +82,60 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
     }
     return profileData.workspace;
 }
+/**
+ * Best-effort rebuild of the on-disk auth config from a working refresh_token.
+ * Calls /api/v1/userWorkspaces/list to discover the user's workspaces, persists
+ * the first one as the default profile, and returns the recovered config.
+ *
+ * Bails to command.error on any failure (refresh, network, no workspaces) with
+ * a message that points the user at `qfg login`.
+ */
+async function recoverAuthConfigFromTokens(command) {
+    let jwt;
+    try {
+        jwt = await getValidAccessToken(command.verboseLog);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        command.error(`Tokens found but refresh failed: ${detail}. Run \`qfg login\` to repopulate.`, { exit: 401 });
+    }
+    let res;
+    try {
+        res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ json: {} }),
+        });
+    }
+    catch (error) {
+        command.error(`Tokens found but failed to fetch workspaces: ${error instanceof Error ? error.message : String(error)}. Run \`qfg login\` to repopulate.`, { exit: 401 });
+    }
+    if (!res.ok) {
+        command.error(`Tokens found but workspace list returned HTTP ${res.status}. Run \`qfg login\` to repopulate.`, { exit: 401 });
+    }
+    const body = (await res.json());
+    const entries = (body.json ?? body);
+    const candidates = Array.isArray(entries) ? entries : [];
+    if (candidates.length === 0) {
+        command.error('Tokens found but no workspace profile on disk. Run `qfg login` to repopulate.', { exit: 401 });
+    }
+    const match = candidates[0];
+    const recovered = {
+        defaultProfile: 'default',
+        profiles: {
+            default: {
+                workspace: match.workspaceId,
+                workspaceName: match.workspaceSlug,
+                workspaceSlug: match.workspaceSlug,
+                organizationName: match.organizationName,
+            },
+        },
+    };
+    await saveAuthConfig(recovered);
+    command.verboseLog('resolve-workspace: recovered auth config from tokens', {
+        workspaceId: match.workspaceId,
+        workspaceSlug: match.workspaceSlug,
+        candidateCount: candidates.length,
+    });
+    return recovered;
+}

package/dist/util/token-storage.d.ts

@@ -24,9 +24,11 @@ export interface AuthConfig {
  * Used to resolve QUONFIG_WORKSPACE and --workspace flag values.
  */
 export declare const resolveWorkspaceId: (config: AuthConfig, slug: string) => string | undefined;
-export declare const saveTokens: (tokens: TokenData, options?: TokenStorageOptions) => Promise<void>;
+export declare const getTokenFilePath: (options?: TokenStorageOptions) => string;
+export declare const getAuthConfigFilePath: (options?: TokenStorageOptions) => string;
+export declare const saveTokens: (tokens: TokenData, options?: TokenStorageOptions) => Promise<string>;
 export declare const loadTokens: (options?: TokenStorageOptions) => Promise<TokenData | null>;
-export declare const saveAuthConfig: (config: AuthConfig, options?: TokenStorageOptions) => Promise<void>;
+export declare const saveAuthConfig: (config: AuthConfig, options?: TokenStorageOptions) => Promise<string>;
 export declare const loadAuthConfig: (options?: TokenStorageOptions) => Promise<AuthConfig | null>;
 export declare const getActiveProfile: (profileArg?: string) => string;
 export declare const clearAuth: (options?: TokenStorageOptions) => Promise<void>;

package/dist/util/token-storage.js

@@ -34,12 +34,37 @@ const ensureQuonfigDir = async (options) => {
         await fs.promises.mkdir(quonfigDir, { recursive: true });
     }
 };
+export const getTokenFilePath = (options) => getTokenFile(options);
+export const getAuthConfigFilePath = (options) => getConfigFile(options);
+const verifyWritten = async (filePath, label) => {
+    let stat;
+    try {
+        stat = await fs.promises.stat(filePath);
+    }
+    catch (error) {
+        throw new Error(`Failed to persist ${label} to ${filePath}: file is missing after write (${error.message}). ` +
+            `This can happen if a concurrent process (e.g. npm install -g) clobbered the install. Re-run after it finishes.`);
+    }
+    if (!stat.isFile() || stat.size === 0) {
+        throw new Error(`Failed to persist ${label} to ${filePath}: file is empty or not a regular file after write.`);
+    }
+};
 export const saveTokens = async (tokens, options) => {
     await ensureQuonfigDir(options);
     const targetFile = getTokenFile(options);
     const tmpFile = `${targetFile}.tmp`;
     await fs.promises.writeFile(tmpFile, JSON.stringify(tokens, null, 2), { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(tmpFile, targetFile);
+    await verifyWritten(targetFile, 'tokens');
+    // Round-trip parse to confirm the file on disk is the JSON we just wrote.
+    try {
+        const onDisk = await fs.promises.readFile(targetFile, 'utf8');
+        JSON.parse(onDisk);
+    }
+    catch (error) {
+        throw new Error(`Failed to verify tokens at ${targetFile}: ${error.message}`);
+    }
+    return targetFile;
 };
 export const loadTokens = async (options) => {
     try {
@@ -77,6 +102,8 @@ export const saveAuthConfig = async (config, options) => {
     const configTmp = `${configTarget}.tmp`;
     await fs.promises.writeFile(configTmp, configContent, { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(configTmp, configTarget);
+    await verifyWritten(configTarget, 'auth config');
+    return configTarget;
 };
 export const loadAuthConfig = async (options) => {
     try {

package/oclif.manifest.json

@@ -69,7 +69,7 @@
           "required": true
         }
       },
-      "description": "Create a new feature flag, config value, or other item.\n\nUse --type to specify the kind of item:\n  boolean-flag  On/off feature flag (sendToClientSdk defaults to true; best for gradual rollouts)\n  string        A string configuration value\n  int           An integer configuration value\n  double        A floating-point configuration value\n  string-list   A comma-separated list of strings\n  json          An arbitrary JSON blob\n  boolean       A plain boolean (not a feature flag)\n  log_level     A dynamic log level (value must be one of TRACE/DEBUG/INFO/WARN/ERROR/FATAL)\n\nThis sets the global default value. Override per-environment with:\n  qfg set-default my.flag --environment production --value true\n\nFor a percentage rollout (gradual rollout / A/B test / canary deploy), use:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nOr edit the JSON config file directly for complex targeting rules:\n  qfg config-schema          # full operator reference + examples\n  qfg pull --dir ./config    # clone workspace, then edit JSON and git push\n\nLog levels:\n  qfg create log-level.my-app --type log_level --value WARN\n  # Log-level keys must start with \"log-level.\".\n  # For per-logger targeting, create ONE log-level config per service and add\n  # rules on the \"quonfig-sdk-logging.key\" context property (e.g.\n  # PROP_STARTS_WITH_ONE_OF MyPackage.) rather than one config per logger.",
+      "description": "Create a new feature flag, config value, or other item.\n\nUse --type to specify the kind of item:\n  boolean-flag  On/off feature flag (sendToClientSdk defaults to true; best for gradual rollouts)\n  string        A string configuration value\n  int           An integer configuration value\n  double        A floating-point configuration value\n  string-list   A comma-separated list of strings\n  json          An arbitrary JSON blob\n  boolean       A plain boolean (not a feature flag)\n  duration      An ISO 8601 duration string, e.g. PT30S, PT5M, PT1H30M (SDK returns milliseconds)\n  log_level     A dynamic log level (value must be one of TRACE/DEBUG/INFO/WARN/ERROR/FATAL)\n\nThis sets the global default value. Override per-environment with:\n  qfg set-default my.flag --environment production --value true\n\nFor a percentage rollout (gradual rollout / A/B test / canary deploy), use:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nOr edit the JSON config file directly for complex targeting rules:\n  qfg config-schema          # full operator reference + examples\n  qfg pull --dir ./config    # clone workspace, then edit JSON and git push\n\nLog levels:\n  qfg create log-level.my-app --type log_level --value WARN\n  # Log-level keys must start with \"log-level.\".\n  # For per-logger targeting, create ONE log-level config per service and add\n  # rules on the \"quonfig-sdk-logging.key\" context property (e.g.\n  # PROP_STARTS_WITH_ONE_OF MyPackage.) rather than one config per logger.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.new.flag --type boolean-flag",
         "<%= config.bin %> <%= command.id %> my.new.flag --type boolean-flag --value=true",
@@ -77,6 +77,7 @@
         "<%= config.bin %> <%= command.id %> my.new.string --type string --value=\"hello world\" --secret",
         "<%= config.bin %> <%= command.id %> my.new.string --type string --env-var=MY_ENV_VAR_NAME",
         "<%= config.bin %> <%= command.id %> my.new.string --type json --value=\"{\\\"key\\\": \\\"value\\\"}\"",
+        "<%= config.bin %> <%= command.id %> my.timeout --type duration --value PT90S",
         "<%= config.bin %> <%= command.id %> log-level.my-app --type log_level --value WARN",
         "# After creating a flag, set a 20% rollout in production:",
         "<%= config.bin %> set-rollout my.new.flag --environment production --true-percent 20"
@@ -158,6 +159,7 @@
             "int",
             "string-list",
             "json",
+            "duration",
             "log_level"
           ],
           "type": "option"
@@ -295,7 +297,7 @@
           "type": "boolean"
         },
         "dir": {
-          "description": "Path to local QUONFIG_DIR (defaults to QUONFIG_DIR env var)",
+          "description": "Path to local QUONFIG_DIR (defaults to QUONFIG_DIR env var). When omitted, fetches the workspace from the server using your active credentials.",
           "env": "QUONFIG_DIR",
           "name": "dir",
           "hasDynamicHelp": false,
@@ -317,6 +319,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "workspace": {
+          "char": "w",
+          "description": "Workspace slug or UUID for the remote-fetch path (defaults to QUONFIG_WORKSPACE env var or active profile). Only used when --dir is omitted.",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -1190,16 +1200,21 @@
       "aliases": [],
       "args": {
         "name": {
-          "description": "config/feature-flag/etc. name",
+          "description": "flag/config key to override",
           "name": "name"
+        },
+        "value": {
+          "description": "new value (type inferred: bool/int/double/json/string)",
+          "name": "value"
         }
       },
-      "description": "Override the value of an item for your user/SDK key combo.\n\nTo target users other than yourself, or to express rules like \"user.email == X → value Y\",\nyou cannot use override — see:\n  qfg config-schema   # operator reference + worked multi-rule example\n  qfg pull            # clone the workspace so you can edit JSON directly",
+      "description": "Override a flag value for your dev user.\n\nWrites a top-priority rule keyed on the dev-only quonfig-user.email property,\nso the override only fires for SDK clients that set quonfig-user.email in\ntheir context. Production SDKs typically don't set this property, which makes\noverrides effectively inert in production.\n\nExamples\n  qfg override                                # list flags where you have an override\n  qfg override my.flag true                   # set bool override\n  qfg override my.flag 42                     # set int override\n  qfg override my.flag '{\"a\":1}'              # set json override\n  qfg override my.flag --remove               # remove your override on my.flag\n  qfg override --clear                        # remove ALL of your overrides in this env",
       "examples": [
-        "<%= config.bin %> <%= command.id %> # will prompt for name and value",
-        "<%= config.bin %> <%= command.id %> my.flag.name --value=true",
-        "<%= config.bin %> <%= command.id %> my.flag.name --remove",
-        "<%= config.bin %> <%= command.id %> my.double.config --value=3.14159"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> my.flag true",
+        "<%= config.bin %> <%= command.id %> my.flag --remove",
+        "<%= config.bin %> <%= command.id %> --clear",
+        "<%= config.bin %> <%= command.id %> my.flag true --env=staging"
       ],
       "flags": {
         "json": {
@@ -1252,25 +1267,24 @@
           "multiple": false,
           "type": "option"
         },
-        "environment": {
-          "description": "environment to override in",
-          "name": "environment",
+        "clear": {
+          "description": "remove ALL of your overrides in this env",
+          "name": "clear",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "env": {
+          "description": "environment to operate in (default: $QUONFIG_ENVIRONMENT)",
+          "name": "env",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
         "remove": {
-          "description": "remove your override (if present)",
+          "description": "remove your override on this key",
           "name": "remove",
           "allowNo": false,
           "type": "boolean"
-        },
-        "value": {
-          "description": "value to use for your override",
-          "name": "value",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -2882,5 +2896,5 @@
       ]
     }
   },
-  "version": "0.0.19"
+  "version": "0.0.21"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.19",
+  "version": "0.0.21",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },