@quonfig/cli 0.0.2 → 0.0.4

package/dist/commands/sync.js

@@ -0,0 +1,142 @@
+import * as path from 'node:path';
+import { Flags } from '@oclif/core';
+import { BaseCommand } from '../index.js';
+import { getActiveProfile, loadAuthConfig } from '../util/token-storage.js';
+import { loadGiteaToken, isGiteaTokenExpired, saveGiteaToken } from '../util/gitea-token-storage.js';
+import { mintGiteaToken } from '../util/gitea-api.js';
+import { isGitRepo, isWorkingTreeClean, gitFetch, canFastForward, hasDivergedFromRemote, gitMergeFfOnly, gitSetRemote, } from '../util/git-ops.js';
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export default class Sync extends BaseCommand {
+    static description = 'Continuously poll for workspace config updates and apply them locally';
+    static examples = [
+        '<%= config.bin %> sync --watch',
+        '<%= config.bin %> sync --watch --interval 10',
+        '<%= config.bin %> sync --watch --dir ./our-config --interval 30',
+    ];
+    static flags = {
+        dir: Flags.string({
+            description: 'Local directory to sync (defaults to QUONFIG_DIR env var)',
+        }),
+        interval: Flags.integer({
+            default: 60,
+            description: 'Poll interval in seconds',
+        }),
+        watch: Flags.boolean({
+            description: 'Run as a continuous polling daemon (required)',
+            required: true,
+        }),
+    };
+    workspaceId;
+    resolvedDir;
+    async run() {
+        const { flags } = await this.parse(Sync);
+        // Resolve directory
+        const dir = flags.dir || process.env.QUONFIG_DIR;
+        if (!dir) {
+            return this.err('No directory specified. Use --dir <path> or set QUONFIG_DIR.');
+        }
+        this.resolvedDir = path.resolve(dir);
+        // Resolve workspace ID
+        const authConfig = await loadAuthConfig();
+        if (!authConfig) {
+            return this.err('Not logged in. Please run `qfg login` first.');
+        }
+        const activeProfile = getActiveProfile();
+        const profile = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
+        if (!profile) {
+            return this.err('No active profile found. Please run `qfg login` first.');
+        }
+        this.workspaceId = profile.workspace;
+        // Validate the directory is a git repo
+        const isRepo = await isGitRepo(this.resolvedDir);
+        if (!isRepo) {
+            return this.err(`${this.resolvedDir} is not a git repository. Run \`qfg pull --dir ${this.resolvedDir}\` first.`);
+        }
+        const intervalSec = flags.interval;
+        this.log(`Watching ${this.resolvedDir} — polling every ${intervalSec}s. Press Ctrl+C to stop.`);
+        // Ensure remote URL is up to date before starting
+        await this.ensureRemoteUrl();
+        // Run initial sync
+        await this.runSync();
+        // Poll loop
+        // eslint-disable-next-line no-constant-condition
+        while (true) {
+            await sleep(intervalSec * 1000);
+            await this.runSync();
+        }
+    }
+    async runSync() {
+        const timestamp = new Date().toISOString();
+        try {
+            // Ensure token is valid
+            await this.ensureRemoteUrl();
+            // Fetch
+            this.verboseLog('Sync', 'Fetching...');
+            await gitFetch(this.resolvedDir);
+            // Check if there's anything to do
+            const ff = await canFastForward(this.resolvedDir);
+            if (!ff) {
+                // Check if diverged
+                const diverged = await hasDivergedFromRemote(this.resolvedDir);
+                if (diverged) {
+                    this.log(`[${timestamp}] Skipped: local commits diverge from remote. Resolve manually.`);
+                    return;
+                }
+                this.log(`[${timestamp}] Already up to date.`);
+                return;
+            }
+            // Check working tree
+            const clean = await isWorkingTreeClean(this.resolvedDir);
+            if (!clean) {
+                this.log(`[${timestamp}] Skipped: local changes present. Commit or stash first.`);
+                return;
+            }
+            // Merge
+            const newCommits = await gitMergeFfOnly(this.resolvedDir);
+            if (newCommits.length > 0) {
+                this.log(`[${timestamp}] Pulled ${newCommits.length} new commit(s):`);
+                for (const msg of newCommits) {
+                    this.log(`  - ${msg}`);
+                }
+            }
+            else {
+                this.log(`[${timestamp}] Updated.`);
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (this.looksLike401(err)) {
+                this.log(`[${timestamp}] Token expired, refreshing...`);
+                try {
+                    await this.refreshToken();
+                    await this.ensureRemoteUrl();
+                }
+                catch (refreshErr) {
+                    this.log(`[${timestamp}] Warning: could not refresh token: ${String(refreshErr)}`);
+                }
+            }
+            else {
+                this.log(`[${timestamp}] Warning: sync failed: ${msg}`);
+            }
+        }
+    }
+    async ensureRemoteUrl() {
+        const entry = await loadGiteaToken(this.workspaceId);
+        if (!entry || isGiteaTokenExpired(entry)) {
+            await this.refreshToken();
+            return;
+        }
+        await gitSetRemote(this.resolvedDir, entry.repoUrl);
+    }
+    async refreshToken() {
+        const data = await mintGiteaToken(this.workspaceId, 'read', 'pull');
+        const entry = { token: data.token, repoUrl: data.repoUrl, expiresAt: data.expiresAt };
+        await saveGiteaToken(this.workspaceId, entry);
+        await gitSetRemote(this.resolvedDir, entry.repoUrl);
+        this.verboseLog('Sync', 'Token refreshed.');
+    }
+    looksLike401(err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return msg.includes('401') || msg.toLowerCase().includes('authentication failed');
+    }
+}

package/dist/commands/whoami.js

@@ -38,7 +38,10 @@ export default class Whoami extends BaseCommand {
         // Display user information
         this.log(`Logged in as: ${userEmail || 'Unknown'}`);
         this.log(`Active profile: ${activeProfile}`);
-        this.log(`Active workspace: ${profile.workspaceName || profile.workspace}`);
+        const workspaceDisplay = profile.workspaceName
+            ? `${profile.workspaceName} (${profile.workspace})`
+            : profile.workspace;
+        this.log(`Active workspace: ${workspaceDisplay}`);
         return {
             email: userEmail,
             loggedIn: true,

package/dist/commands/workspace/bootstrap.d.ts

@@ -0,0 +1,13 @@
+import type { JsonObj } from '../../result.js';
+import { BaseCommand } from '../../index.js';
+export default class WorkspaceBootstrap extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        dir: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        force: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'skip-validate': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<JsonObj | void>;
+    private remoteHasCommits;
+}

package/dist/commands/workspace/bootstrap.js

@@ -0,0 +1,155 @@
+import * as path from 'node:path';
+import { confirm } from '@inquirer/prompts';
+import { Flags } from '@oclif/core';
+import { BaseCommand } from '../../index.js';
+import { getActiveProfile, loadAuthConfig } from '../../util/token-storage.js';
+import { mintGiteaToken } from '../../util/gitea-api.js';
+import { isGitRepo, hasAtLeastOneCommit, gitSetRemote, gitPushForceLease, gitPushForce, getRemoteUrl, displayUrl, } from '../../util/git-ops.js';
+export default class WorkspaceBootstrap extends BaseCommand {
+    static description = 'Push a local git repo to Gitea as this workspace\'s config repository';
+    static examples = [
+        '<%= config.bin %> workspace bootstrap --dir ./our-config',
+        '<%= config.bin %> workspace bootstrap --dir ./launch-migrator/output',
+        '<%= config.bin %> workspace bootstrap --dir ./our-config --skip-validate',
+    ];
+    static flags = {
+        dir: Flags.string({
+            description: 'Local directory to push (defaults to current directory)',
+            required: false,
+        }),
+        force: Flags.boolean({
+            default: false,
+            description: 'Force push even if remote already has commits',
+        }),
+        'skip-validate': Flags.boolean({
+            default: false,
+            description: 'Skip config validation before pushing',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(WorkspaceBootstrap);
+        // Resolve target directory
+        const dir = flags.dir || process.env.QUONFIG_DIR || process.cwd();
+        const resolvedDir = path.resolve(dir);
+        // Load auth
+        const authConfig = await loadAuthConfig();
+        if (!authConfig) {
+            return this.err('Not logged in. Run `qfg login` first.');
+        }
+        const activeProfile = getActiveProfile();
+        const profile = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
+        if (!profile) {
+            return this.err('No active profile found. Run `qfg login` first.');
+        }
+        const workspaceId = profile.workspace;
+        const workspaceName = profile.workspaceSlug || profile.workspaceName || workspaceId;
+        this.verboseLog('WorkspaceBootstrap', { workspaceId, dir: resolvedDir });
+        // Validate: must be a git repo with at least one commit
+        const isRepo = await isGitRepo(resolvedDir);
+        if (!isRepo) {
+            return this.err(`${resolvedDir} is not a git repository.\nInitialize it with \`git init\` and commit your config files first.`);
+        }
+        const hasCommit = await hasAtLeastOneCommit(resolvedDir);
+        if (!hasCommit) {
+            return this.err(`${resolvedDir} has no commits. Commit your config files first.`);
+        }
+        // Verify config before doing anything
+        if (!flags['skip-validate']) {
+            this.log('Verifying config files...');
+            try {
+                const { validateWorkspace } = await import('../../verify/validate.js');
+                const result = validateWorkspace(resolvedDir);
+                const errors = result.issues.filter((i) => i.severity === 'error');
+                if (errors.length > 0) {
+                    this.log(`\nFound ${errors.length} validation error(s):\n`);
+                    for (const issue of errors) {
+                        this.log(`  ${issue.message}`);
+                    }
+                    this.log('\nFix the errors above or run with --skip-validate to bypass.');
+                    return this.err('Validation failed.');
+                }
+                this.log('Validation passed.\n');
+            }
+            catch (err) {
+                this.verboseLog('Validation error', String(err));
+                this.log('Warning: could not run validation. Proceeding anyway.');
+                this.log('Use --skip-validate to suppress this warning.\n');
+            }
+        }
+        // Confirmation prompt
+        const existingRemote = await getRemoteUrl(resolvedDir);
+        this.log(`Directory:  ${resolvedDir}`);
+        this.log(`Workspace:  ${workspaceName}`);
+        if (existingRemote) {
+            this.log(`Remote:     ${displayUrl(existingRemote)} (will be updated)`);
+        }
+        this.log('');
+        const confirmed = await confirm({
+            message: `Push ${path.basename(resolvedDir)} to workspace "${workspaceName}"?`,
+            default: false,
+        });
+        if (!confirmed) {
+            this.log('Aborted.');
+            return;
+        }
+        this.log('');
+        // Mint write token (backend provisions Gitea repo + bot account)
+        this.log('Connecting to Gitea...');
+        let tokenData;
+        try {
+            tokenData = await mintGiteaToken(workspaceId, 'write', 'bootstrap');
+        }
+        catch (err) {
+            return this.err(`Could not get Gitea credentials: ${String(err)}\n\nMake sure the workspace is fully provisioned in the Quonfig app before bootstrapping.`);
+        }
+        const { repoUrl } = tokenData;
+        this.verboseLog('WorkspaceBootstrap', { repoUrl: displayUrl(repoUrl) });
+        // Idempotency: check if remote already has commits
+        if (!flags.force) {
+            const remoteHasCommits = await this.remoteHasCommits(repoUrl);
+            if (remoteHasCommits) {
+                this.log(`\nThe remote repository already has commits.`);
+                this.log(`Run \`qfg pull --dir ${resolvedDir}\` to sync, then re-run bootstrap.`);
+                this.log(`Or run with --force to overwrite the remote.\n`);
+                return this.err('Remote is not empty.');
+            }
+        }
+        // Set remote
+        if (existingRemote) {
+            this.log(`Updating remote origin...`);
+        }
+        else {
+            this.log(`Setting remote origin...`);
+        }
+        await gitSetRemote(resolvedDir, repoUrl);
+        // Push
+        this.log('Pushing to Gitea...');
+        try {
+            if (flags.force) {
+                await gitPushForce(resolvedDir);
+            }
+            else {
+                await gitPushForceLease(resolvedDir);
+            }
+        }
+        catch (err) {
+            return this.err(`Push failed: ${String(err)}`);
+        }
+        this.log(`\nBootstrap complete.`);
+        this.log(`Workspace "${workspaceName}" is now connected to your local directory.`);
+        this.log(`\nTo keep it in sync locally, run:`);
+        this.log(`  qfg sync --watch --dir ${resolvedDir}`);
+        return {
+            dir: resolvedDir,
+            repoUrl: displayUrl(repoUrl),
+            workspaceId,
+        };
+    }
+    async remoteHasCommits(repoUrl) {
+        const { execFile: execFileCb } = await import('node:child_process');
+        const util = await import('node:util');
+        const execFile = util.promisify(execFileCb);
+        const { stdout } = await execFile('git', ['ls-remote', '--heads', repoUrl]);
+        return stdout.trim().length > 0;
+    }
+}

package/dist/init/init-workspace.js

@@ -54,13 +54,13 @@ export function planInit(options) {
         const verb = fs.existsSync(filePath) ? 'Update' : 'Create';
         actions.push({ kind: 'write-file', path: file, description: `${verb} ${file}` });
     }
-    // 3. environments.json — create if missing
-    const envsPath = path.join(dir, 'environments.json');
+    // 3. quonfig.json — create if missing
+    const envsPath = path.join(dir, 'quonfig.json');
     if (fs.existsSync(envsPath)) {
         // leave it alone
     }
     else {
-        actions.push({ kind: 'write-file', path: 'environments.json', description: 'Create environments.json' });
+        actions.push({ kind: 'write-file', path: 'quonfig.json', description: 'Create quonfig.json' });
     }
     // 4. Sample data
     if (includeSamples) {
@@ -108,7 +108,7 @@ export function executeInit(plan, dir) {
         'README.md': readmeTemplate(),
         'CLAUDE.md': claudeMdTemplate(),
         'AGENTS.md': agentsMdTemplate(),
-        'environments.json': JSON.stringify({ environments: [] }, null, 2) + '\n',
+        'quonfig.json': JSON.stringify({ environments: [] }, null, 2) + '\n',
     };
     // Build a lookup for sample content
     const sampleContent = {};

package/dist/init/templates.js

@@ -121,7 +121,7 @@ See \`quonfig.schema.json\` for the full operator enum and value type definition
 
 ## Environments
 
-Environment overrides go in the \`environments\` array. Each has an \`id\` (lowercase slug like \`production\`, never a UUID) and its own \`rules\` array. Environment IDs are defined in \`environments.json\` at the repo root.
+Environment overrides go in the \`environments\` array. Each has an \`id\` (lowercase slug like \`production\`, never a UUID) and its own \`rules\` array. Environment IDs are defined in \`quonfig.json\` at the repo root.
 
 ## Cross-File Validation Rules
 

package/dist/util/coerce.js

@@ -17,7 +17,8 @@ export const coerceIntoType = (type, value) => {
         }
         case 'int': {
             try {
-                const int = BigInt(value);
+                const bigInt = BigInt(value);
+                const int = Number(bigInt);
                 return [{ int }, TYPE_MAPPING[type]];
             }
             catch {

package/dist/util/get-client.js

@@ -1,8 +1,8 @@
 import { Client } from '@quonfig/node';
 import { getApiUrl } from '../util/domain-urls.js';
 import jsonMaybe from '../util/json-maybe.js';
-import { decodeJWT, refreshAccessToken } from '../util/oauth-client.js';
-import { getActiveProfile, loadAuthConfig, loadTokens, saveTokens } from '../util/token-storage.js';
+import { getActiveProfile, loadAuthConfig, loadTokens } from '../util/token-storage.js';
+import { getValidAccessToken } from '../util/get-valid-token.js';
 import version from '../version.js';
 let clientInstance;
 let cachedWorkspaceId;
@@ -31,45 +31,13 @@ const getClient = async (command, sdkKey, profile) => {
         if (!authConfig || !tokens?.accessToken) {
             command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
         }
-        // Check if token is expired and refresh if needed.
-        // Prefer the JWT's actual exp claim over the stored expiresAt.
-        let tokenExpired = tokens.expiresAt ? tokens.expiresAt < Date.now() : false;
+        command.verboseLog('Checking token validity...');
         try {
-            const payload = decodeJWT(tokens.accessToken);
-            if (typeof payload.exp === 'number') {
-                tokenExpired = payload.exp * 1000 < Date.now();
-            }
+            jwt = await getValidAccessToken();
+            command.verboseLog('Token valid (or refreshed)');
         }
         catch {
-            // If we can't decode, fall back to stored expiresAt
-        }
-        if (tokenExpired && tokens.refreshToken) {
-            command.verboseLog('Token expired, refreshing...');
-            try {
-                const refreshed = await refreshAccessToken(tokens.refreshToken);
-                // Use the JWT's actual exp claim for expiry, not a hardcoded duration
-                let expiresAt = Date.now() + 300 * 1000; // fallback: 5 minutes
-                try {
-                    const payload = decodeJWT(refreshed.access_token);
-                    if (typeof payload.exp === 'number') {
-                        expiresAt = payload.exp * 1000; // convert seconds to ms
-                    }
-                }
-                catch {
-                    // Use fallback
-                }
-                tokens = {
-                    ...tokens,
-                    accessToken: refreshed.access_token,
-                    expiresAt,
-                    refreshToken: refreshed.refresh_token,
-                };
-                await saveTokens(tokens);
-                command.verboseLog('Token refreshed successfully');
-            }
-            catch (error) {
-                command.error('Session expired. Please run `qfg login` to re-authenticate.', { exit: 401 });
-            }
+            command.error('Session expired. Please run `qfg login` to re-authenticate.', { exit: 401 });
         }
         // Get the active profile to find the workspace
         const activeProfile = getActiveProfile(profile);
@@ -82,12 +50,6 @@ const getClient = async (command, sdkKey, profile) => {
         if (profileData) {
             workspaceId = profileData.workspace;
         }
-        // Use the WorkOS access token directly as the JWT
-        jwt = tokens.accessToken;
-        // If still no JWT, user needs to login
-        if (!jwt) {
-            command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
-        }
     }
     // Store workspaceId on the command for use in building URLs and cache it
     if (workspaceId) {

package/dist/util/get-valid-token.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
+ * Throws if not logged in or if refresh fails.
+ */
+export declare function getValidAccessToken(): Promise<string>;

package/dist/util/get-valid-token.js

@@ -0,0 +1,44 @@
+/**
+ * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
+ * Throws if not logged in or if refresh fails.
+ */
+import { decodeJWT, refreshAccessToken } from './oauth-client.js';
+import { loadTokens, saveTokens } from './token-storage.js';
+export async function getValidAccessToken() {
+    const tokens = await loadTokens();
+    if (!tokens?.accessToken) {
+        throw new Error('Not authenticated. Please run `qfg login` first.');
+    }
+    // Check expiry using the JWT's exp claim, falling back to stored expiresAt
+    let expired = tokens.expiresAt ? tokens.expiresAt < Date.now() : false;
+    try {
+        const payload = decodeJWT(tokens.accessToken);
+        if (typeof payload.exp === 'number') {
+            expired = payload.exp * 1000 < Date.now();
+        }
+    }
+    catch { /* use stored expiresAt */ }
+    if (!expired) {
+        return tokens.accessToken;
+    }
+    if (!tokens.refreshToken) {
+        throw new Error('Session expired. Please run `qfg login` to re-authenticate.');
+    }
+    const refreshed = await refreshAccessToken(tokens.refreshToken);
+    let expiresAt = Date.now() + 300 * 1000;
+    try {
+        const payload = decodeJWT(refreshed.access_token);
+        if (typeof payload.exp === 'number') {
+            expiresAt = payload.exp * 1000;
+        }
+    }
+    catch { /* use fallback */ }
+    const updated = {
+        ...tokens,
+        accessToken: refreshed.access_token,
+        expiresAt,
+        refreshToken: refreshed.refresh_token,
+    };
+    await saveTokens(updated);
+    return refreshed.access_token;
+}

package/dist/util/git-ops.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Redact a token from a URL string so it is safe to display to users.
+ */
+export declare const redactToken: (url: string) => string;
+export declare const gitClone: (repoUrl: string, dir: string) => Promise<void>;
+export declare const isGitRepo: (dir: string) => Promise<boolean>;
+export declare const getRemoteUrl: (dir: string) => Promise<string | null>;
+export declare const isWorkingTreeClean: (dir: string) => Promise<boolean>;
+export declare const gitFetch: (dir: string) => Promise<void>;
+/**
+ * Returns true if origin/main has commits that can be fast-forwarded into the local branch.
+ */
+export declare const canFastForward: (dir: string) => Promise<boolean>;
+/**
+ * Returns true if local has commits not reachable from origin/main (diverged).
+ */
+export declare const hasDivergedFromRemote: (dir: string) => Promise<boolean>;
+/**
+ * Performs a fast-forward-only merge of origin/main. Returns list of new commit subjects.
+ */
+export declare const gitMergeFfOnly: (dir: string) => Promise<string[]>;
+/**
+ * Adds or updates the origin remote for a repo.
+ */
+export declare const gitSetRemote: (dir: string, url: string) => Promise<void>;
+export declare const gitPushForceLease: (dir: string) => Promise<void>;
+export declare const gitPushForce: (dir: string) => Promise<void>;
+export declare const hasAtLeastOneCommit: (dir: string) => Promise<boolean>;
+/**
+ * Get the URL stripped of credentials for display purposes.
+ */
+export declare const displayUrl: (url: string) => string;