@quonfig/cli 0.0.2 → 0.0.4

package/dist/util/git-ops.js

@@ -0,0 +1,164 @@
+import { execFile as execFileCb } from 'node:child_process';
+import * as util from 'node:util';
+const execFile = util.promisify(execFileCb);
+/**
+ * Redact a token from a URL string so it is safe to display to users.
+ */
+export const redactToken = (url) => url.replace(/:([^@/]+)@/, ':***@');
+/**
+ * Wrap execFile errors to strip tokens from the message.
+ */
+const safeExec = async (file, args, options) => {
+    try {
+        return await execFile(file, args, { cwd: options?.cwd });
+    }
+    catch (err) {
+        const e = err;
+        const message = redactToken(e.message || String(err));
+        const stderr = redactToken(e.stderr ?? '');
+        const safeErr = new Error(message);
+        safeErr.stderr = stderr;
+        throw safeErr;
+    }
+};
+export const gitClone = async (repoUrl, dir) => {
+    await safeExec('git', ['clone', repoUrl, dir]);
+};
+export const isGitRepo = async (dir) => {
+    try {
+        await execFile('git', ['-C', dir, 'rev-parse', '--git-dir']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const getRemoteUrl = async (dir) => {
+    try {
+        const { stdout } = await execFile('git', ['-C', dir, 'remote', 'get-url', 'origin']);
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+};
+export const isWorkingTreeClean = async (dir) => {
+    const { stdout } = await execFile('git', ['-C', dir, 'status', '--porcelain']);
+    return stdout.trim() === '';
+};
+export const gitFetch = async (dir) => {
+    await safeExec('git', ['-C', dir, 'fetch', 'origin']);
+};
+/**
+ * Returns true if origin/main has commits that can be fast-forwarded into the local branch.
+ */
+export const canFastForward = async (dir) => {
+    try {
+        // Get the local HEAD and origin/main SHAs
+        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: remoteSha } = await execFile('git', ['-C', dir, 'rev-parse', 'origin/main']);
+        const local = localSha.trim();
+        const remote = remoteSha.trim();
+        if (local === remote)
+            return false; // already up to date
+        // Check if local is an ancestor of remote (i.e. ff is possible)
+        try {
+            await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
+            return true; // exit code 0 means local is an ancestor of remote
+        }
+        catch {
+            return false; // local has diverged
+        }
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Returns true if local has commits not reachable from origin/main (diverged).
+ */
+export const hasDivergedFromRemote = async (dir) => {
+    try {
+        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: remoteSha } = await execFile('git', ['-C', dir, 'rev-parse', 'origin/main']);
+        const local = localSha.trim();
+        const remote = remoteSha.trim();
+        if (local === remote)
+            return false;
+        // If remote is an ancestor of local, local is ahead (diverged for our purposes)
+        try {
+            await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', remote, local]);
+            return true;
+        }
+        catch {
+            // Check if truly diverged (neither is ancestor of the other)
+            try {
+                await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
+                return false; // ff possible, not diverged
+            }
+            catch {
+                return true; // truly diverged
+            }
+        }
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Performs a fast-forward-only merge of origin/main. Returns list of new commit subjects.
+ */
+export const gitMergeFfOnly = async (dir) => {
+    // Get commits that will be merged (before merge)
+    let newCommits = [];
+    try {
+        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: log } = await execFile('git', [
+            '-C',
+            dir,
+            'log',
+            '--pretty=format:%s',
+            `${localSha.trim()}..origin/main`,
+        ]);
+        newCommits = log
+            .split('\n')
+            .map((s) => s.trim())
+            .filter(Boolean);
+    }
+    catch {
+        // Non-fatal — we'll still attempt the merge
+    }
+    await safeExec('git', ['-C', dir, 'merge', '--ff-only', 'origin/main']);
+    return newCommits;
+};
+/**
+ * Adds or updates the origin remote for a repo.
+ */
+export const gitSetRemote = async (dir, url) => {
+    const existing = await getRemoteUrl(dir);
+    if (existing !== null) {
+        await safeExec('git', ['-C', dir, 'remote', 'set-url', 'origin', url]);
+    }
+    else {
+        await safeExec('git', ['-C', dir, 'remote', 'add', 'origin', url]);
+    }
+};
+export const gitPushForceLease = async (dir) => {
+    await safeExec('git', ['-C', dir, 'push', 'origin', 'main', '--force-with-lease']);
+};
+export const gitPushForce = async (dir) => {
+    await safeExec('git', ['-C', dir, 'push', 'origin', 'main', '--force']);
+};
+export const hasAtLeastOneCommit = async (dir) => {
+    try {
+        await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Get the URL stripped of credentials for display purposes.
+ */
+export const displayUrl = (url) => redactToken(url);

package/dist/util/gitea-api.d.ts

@@ -0,0 +1,11 @@
+import { GiteaTokenEntry } from './gitea-token-storage.js';
+export interface GiteaTokenResponse {
+    token: string;
+    repoUrl: string;
+    expiresAt: string | null;
+}
+export declare const mintGiteaToken: (workspaceId: string, scope: "read" | "write", purpose: "pull" | "bootstrap") => Promise<GiteaTokenResponse>;
+/**
+ * Mint a Gitea read token, store it, and return the entry.
+ */
+export declare const mintAndStoreGiteaReadToken: (workspaceId: string) => Promise<GiteaTokenEntry>;

package/dist/util/gitea-api.js

@@ -0,0 +1,45 @@
+import { getApiUrl } from './domain-urls.js';
+import { getValidAccessToken } from './get-valid-token.js';
+import { saveGiteaToken } from './gitea-token-storage.js';
+export const mintGiteaToken = async (workspaceId, scope, purpose) => {
+    const accessToken = await getValidAccessToken();
+    const apiUrl = getApiUrl();
+    const res = await fetch(`${apiUrl}/api/v1/gitea/token`, {
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ json: { scope, workspaceId, purpose } }),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        let message = `HTTP ${res.status}`;
+        try {
+            const body = JSON.parse(text);
+            // oRPC error shape
+            if (body?.json?.message)
+                message = body.json.message;
+            else if (body?.message)
+                message = body.message;
+        }
+        catch { /* use raw text */ }
+        throw new Error(message || text);
+    }
+    const body = await res.json();
+    const data = body.json ?? body;
+    return data;
+};
+/**
+ * Mint a Gitea read token, store it, and return the entry.
+ */
+export const mintAndStoreGiteaReadToken = async (workspaceId) => {
+    const data = await mintGiteaToken(workspaceId, 'read', 'pull');
+    const entry = {
+        token: data.token,
+        repoUrl: data.repoUrl,
+        expiresAt: data.expiresAt,
+    };
+    await saveGiteaToken(workspaceId, entry);
+    return entry;
+};

package/dist/util/gitea-token-storage.d.ts

@@ -0,0 +1,8 @@
+export interface GiteaTokenEntry {
+    token: string;
+    repoUrl: string;
+    expiresAt: string | null;
+}
+export declare const loadGiteaToken: (workspaceId: string) => Promise<GiteaTokenEntry | null>;
+export declare const saveGiteaToken: (workspaceId: string, entry: GiteaTokenEntry) => Promise<void>;
+export declare const isGiteaTokenExpired: (entry: GiteaTokenEntry) => boolean;

package/dist/util/gitea-token-storage.js

@@ -0,0 +1,47 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { getDomain } from './domain-urls.js';
+const BUFFER_MS = 5 * 60 * 1000; // 5 minutes
+const getQuonfigDir = () => path.join(os.homedir(), '.quonfig');
+const getGiteaTokenFile = () => {
+    const domain = getDomain();
+    const filename = domain !== 'quonfig.com' ? `gitea-tokens-${domain.replaceAll('.', '-')}.json` : 'gitea-tokens.json';
+    return path.join(getQuonfigDir(), filename);
+};
+const ensureQuonfigDir = async () => {
+    const dir = getQuonfigDir();
+    try {
+        await fs.promises.access(dir, fs.constants.F_OK);
+    }
+    catch {
+        await fs.promises.mkdir(dir, { recursive: true });
+    }
+};
+const loadStore = async () => {
+    try {
+        const data = await fs.promises.readFile(getGiteaTokenFile(), 'utf8');
+        return JSON.parse(data);
+    }
+    catch {
+        return {};
+    }
+};
+export const loadGiteaToken = async (workspaceId) => {
+    const store = await loadStore();
+    return store[workspaceId] ?? null;
+};
+export const saveGiteaToken = async (workspaceId, entry) => {
+    await ensureQuonfigDir();
+    const store = await loadStore();
+    store[workspaceId] = entry;
+    const targetFile = getGiteaTokenFile();
+    const tmpFile = `${targetFile}.tmp`;
+    await fs.promises.writeFile(tmpFile, JSON.stringify(store, null, 2), { encoding: 'utf8', mode: 0o600 });
+    await fs.promises.rename(tmpFile, targetFile);
+};
+export const isGiteaTokenExpired = (entry) => {
+    if (!entry.expiresAt)
+        return false;
+    return new Date(entry.expiresAt).getTime() - BUFFER_MS < Date.now();
+};

package/dist/util/token-storage.d.ts

@@ -14,6 +14,7 @@ export interface AuthConfig {
         [profileName: string]: {
             workspace: string;
             workspaceName?: string;
+            workspaceSlug?: string;
         };
     };
 }

package/dist/util/token-storage.js

@@ -20,7 +20,10 @@ const ensureQuonfigDir = async (options) => {
 };
 export const saveTokens = async (tokens, options) => {
     await ensureQuonfigDir(options);
-    await fs.promises.writeFile(getTokenFile(options), JSON.stringify(tokens, null, 2), 'utf8');
+    const targetFile = getTokenFile(options);
+    const tmpFile = `${targetFile}.tmp`;
+    await fs.promises.writeFile(tmpFile, JSON.stringify(tokens, null, 2), { encoding: 'utf8', mode: 0o600 });
+    await fs.promises.rename(tmpFile, targetFile);
 };
 export const loadTokens = async (options) => {
     try {
@@ -45,9 +48,16 @@ export const saveAuthConfig = async (config, options) => {
         if (profileData.workspaceName) {
             configContent += ` # ${profileData.workspaceName}`;
         }
-        configContent += '\n\n';
+        configContent += '\n';
+        if (profileData.workspaceSlug) {
+            configContent += `workspace_slug = ${profileData.workspaceSlug}\n`;
+        }
+        configContent += '\n';
     }
-    await fs.promises.writeFile(getConfigFile(options), configContent, 'utf8');
+    const configTarget = getConfigFile(options);
+    const configTmp = `${configTarget}.tmp`;
+    await fs.promises.writeFile(configTmp, configContent, { encoding: 'utf8', mode: 0o600 });
+    await fs.promises.rename(configTmp, configTarget);
 };
 export const loadAuthConfig = async (options) => {
     try {
@@ -60,16 +70,20 @@ export const loadAuthConfig = async (options) => {
         if (defaultMatch && defaultMatch[1]) {
             config.defaultProfile = defaultMatch[1].trim();
         }
-        // Parse profiles
-        const profileRegex = /\[profile\s+(\w+)]\s*\n\s*workspace\s*=\s*([^\s#]+)(?:\s*#\s*(.+))?/g;
+        // Parse profiles — each block starts with [profile name] and contains key=value lines
+        const profileBlockRegex = /\[profile\s+(\w+)]\s*\n((?:[^\[]*\n?)*)/g;
         let match;
-        while ((match = profileRegex.exec(data)) !== null) {
+        while ((match = profileBlockRegex.exec(data)) !== null) {
             const profileName = match[1];
-            const workspace = match[2];
-            const workspaceName = match[3]?.trim();
+            const block = match[2];
+            const workspaceMatch = block.match(/workspace\s*=\s*([^\s#]+)(?:\s*#\s*(.+))?/);
+            const slugMatch = block.match(/workspace_slug\s*=\s*(\S+)/);
+            if (!workspaceMatch)
+                continue;
             config.profiles[profileName] = {
-                workspace,
-                workspaceName,
+                workspace: workspaceMatch[1],
+                workspaceName: workspaceMatch[2]?.trim(),
+                workspaceSlug: slugMatch?.[1]?.trim(),
             };
         }
         return Object.keys(config.profiles).length > 0 ? config : null;

package/dist/verify/validate.d.ts

@@ -36,6 +36,7 @@ export interface ValidationStats {
     rules: number;
     segmentRefsChecked: number;
     schemaRefsChecked: number;
+    envRefsChecked: number;
     uniqueKeysVerified: number;
 }
 export interface ValidationResult {

package/dist/verify/validate.js

@@ -202,6 +202,7 @@ export function validateWorkspace(workspaceDir) {
         rules: 0,
         segmentRefsChecked: 0,
         schemaRefsChecked: 0,
+        envRefsChecked: 0,
         uniqueKeysVerified: 0,
     };
     // Collect all configs for cross-reference checks
@@ -209,6 +210,7 @@ export function validateWorkspace(workspaceDir) {
     const allSchemaFiles = [];
     const segmentKeys = new Set();
     const schemaKeys = new Set();
+    const declaredEnvIds = new Set();
     // Check for unexpected top-level entries
     let entries;
     try {
@@ -238,6 +240,50 @@ export function validateWorkspace(workspaceDir) {
             });
         }
     }
+    // Validate quonfig.json at workspace root
+    const quonfigPath = path.join(workspaceDir, "quonfig.json");
+    if (!fs.existsSync(quonfigPath)) {
+        issues.push({
+            file: "quonfig.json",
+            message: `quonfig.json is missing from workspace root`,
+            severity: "error",
+            suggestion: `Create quonfig.json with format: {"environments": ["production", "staging"]}`,
+        });
+    }
+    else {
+        let quonfigRaw;
+        try {
+            quonfigRaw = fs.readFileSync(quonfigPath, "utf-8");
+        }
+        catch (err) {
+            quonfigRaw = "";
+            issues.push({ file: "quonfig.json", message: `Cannot read quonfig.json: ${err.message}`, severity: "error" });
+        }
+        if (quonfigRaw) {
+            let quonfigParsed;
+            try {
+                quonfigParsed = JSON.parse(quonfigRaw);
+            }
+            catch (err) {
+                quonfigParsed = null;
+                issues.push({ file: "quonfig.json", message: `Invalid JSON: ${err.message}`, severity: "error" });
+            }
+            const quonfigResult = z.object({ environments: z.array(z.string()) }).safeParse(quonfigParsed);
+            if (!quonfigResult.success) {
+                issues.push({
+                    file: "quonfig.json",
+                    message: `quonfig.json must have an "environments" array of strings`,
+                    severity: "error",
+                    suggestion: `Format: {"environments": ["production", "staging"]}`,
+                });
+            }
+            else {
+                for (const envId of quonfigResult.data.environments) {
+                    declaredEnvIds.add(envId);
+                }
+            }
+        }
+    }
     // First pass: parse all files and collect keys
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
@@ -351,9 +397,9 @@ export function validateWorkspace(workspaceDir) {
             // Validate environment IDs are slugs, not UUIDs
             validateEnvironmentIds(config.environments, relPath, issues);
             // Validate rules
-            validateRules(config.default.rules, relPath, "default", config.valueType, issues);
+            validateRules(config.default.rules, relPath, "default", config.valueType, issues, config.variants);
             for (const env of config.environments) {
-                validateRules(env.rules, relPath, `environments[${env.id}]`, config.valueType, issues);
+                validateRules(env.rules, relPath, `environments[${env.id}]`, config.valueType, issues, config.variants);
             }
             // Count by type
             switch (config.type) {
@@ -435,6 +481,20 @@ export function validateWorkspace(workspaceDir) {
                     });
                 }
             }
+            // Check environment IDs referenced in config exist in quonfig.json
+            if (declaredEnvIds.size > 0) {
+                for (const env of config.environments) {
+                    stats.envRefsChecked++;
+                    if (!declaredEnvIds.has(env.id)) {
+                        issues.push({
+                            file: relPath,
+                            message: `References environment "${env.id}" which is not declared in quonfig.json`,
+                            severity: "error",
+                            suggestion: `Add "${env.id}" to the environments array in quonfig.json, or remove this environment override`,
+                        });
+                    }
+                }
+            }
         }
     }
     // Check for duplicate keys across directories
@@ -479,7 +539,7 @@ function emptyStats() {
     return {
         configs: 0, featureFlags: 0, segments: 0, logLevels: 0, schemas: 0,
         environmentOverrides: 0, rules: 0, segmentRefsChecked: 0,
-        schemaRefsChecked: 0, uniqueKeysVerified: 0,
+        schemaRefsChecked: 0, envRefsChecked: 0, uniqueKeysVerified: 0,
     };
 }
 // ── Validate from in-memory file map (for git hook) ─────────────────────
@@ -495,6 +555,35 @@ export function validateFileMap(files) {
     const allSchemaFiles = [];
     const allConfigs = [];
     const parsedConfigs = [];
+    const declaredEnvIds = new Set();
+    // Validate quonfig.json if it's included in the file map (it may not be in every commit)
+    const quonfigContent = files.get("quonfig.json");
+    if (quonfigContent !== undefined) {
+        let quonfigParsed;
+        try {
+            quonfigParsed = JSON.parse(quonfigContent);
+        }
+        catch (err) {
+            quonfigParsed = null;
+            issues.push({ file: "quonfig.json", message: `Invalid JSON: ${err.message}`, severity: "error" });
+        }
+        if (quonfigParsed !== null) {
+            const quonfigResult = z.object({ environments: z.array(z.string()) }).safeParse(quonfigParsed);
+            if (!quonfigResult.success) {
+                issues.push({
+                    file: "quonfig.json",
+                    message: `quonfig.json must have an "environments" array of strings`,
+                    severity: "error",
+                    suggestion: `Format: {"environments": ["production", "staging"]}`,
+                });
+            }
+            else {
+                for (const envId of quonfigResult.data.environments) {
+                    declaredEnvIds.add(envId);
+                }
+            }
+        }
+    }
     for (const [relPath, content] of files) {
         const parts = relPath.split("/");
         if (parts.length < 2)
@@ -576,9 +665,9 @@ export function validateFileMap(files) {
             issues.push({ file: relPath, message: `Log level must have valueType "log_level", got "${config.valueType}"`, severity: "error" });
         }
         validateEnvironmentIds(config.environments, relPath, issues);
-        validateRules(config.default.rules, relPath, "default", config.valueType, issues);
+        validateRules(config.default.rules, relPath, "default", config.valueType, issues, config.variants);
         for (const env of config.environments) {
-            validateRules(env.rules, relPath, `environments[${env.id}]`, config.valueType, issues);
+            validateRules(env.rules, relPath, `environments[${env.id}]`, config.valueType, issues, config.variants);
         }
         allConfigs.push({ key: config.key, file: relPath });
         parsedConfigs.push({ relPath, config, dir });
@@ -604,6 +693,19 @@ export function validateFileMap(files) {
                 suggestion: `Create schemas/${config.schemaKey}.json or schemas-protected/${config.schemaKey}.json, or remove schemaKey`,
             });
         }
+        // Check environment IDs referenced in config exist in quonfig.json
+        if (declaredEnvIds.size > 0) {
+            for (const env of config.environments) {
+                if (!declaredEnvIds.has(env.id)) {
+                    issues.push({
+                        file: relPath,
+                        message: `References environment "${env.id}" which is not declared in quonfig.json`,
+                        severity: "error",
+                        suggestion: `Add "${env.id}" to the environments array in quonfig.json, or remove this environment override`,
+                    });
+                }
+            }
+        }
     }
     // Duplicate keys
     const keyToFiles = new Map();
@@ -674,10 +776,12 @@ function validateKey(key, file, issues) {
         issues.push({ file, message: `Key contains slash or backslash`, severity: "error" });
     }
 }
-function validateRules(rules, file, context, expectedValueType, issues) {
+function validateRules(rules, file, context, expectedValueType, issues, variants = []) {
     if (rules.length === 0) {
         issues.push({ file, message: `${context}: no rules defined`, severity: "warning" });
     }
+    // Pre-compute serialized variant values for matching
+    const variantValues = variants.map(v => JSON.stringify(v.value));
     for (let i = 0; i < rules.length; i++) {
         const rule = rules[i];
         const ruleCtx = `${context}.rules[${i}]`;
@@ -692,6 +796,18 @@ function validateRules(rules, file, context, expectedValueType, issues) {
                     severity: "error",
                 });
             }
+            // Check that value matches one of the defined variants
+            if (variants.length > 0) {
+                const serialized = JSON.stringify(rule.value);
+                if (!variantValues.includes(serialized)) {
+                    issues.push({
+                        file,
+                        message: `${ruleCtx}: value does not match any defined variant`,
+                        severity: "error",
+                        suggestion: `Rule value must be one of the defined variants`,
+                    });
+                }
+            }
         }
         else if (rule.value.type === "weighted_values") {
             // Validate weighted values
@@ -707,6 +823,18 @@ function validateRules(rules, file, context, expectedValueType, issues) {
                         severity: "error",
                     });
                 }
+                // Check that each weighted value matches one of the defined variants
+                if (variants.length > 0) {
+                    const serialized = JSON.stringify(wv.weightedValues[j].value);
+                    if (!variantValues.includes(serialized)) {
+                        issues.push({
+                            file,
+                            message: `${ruleCtx}.weightedValues[${j}]: value does not match any defined variant`,
+                            severity: "error",
+                            suggestion: `Weighted value must be one of the defined variants`,
+                        });
+                    }
+                }
             }
         }
         // Check criteria
@@ -799,6 +927,8 @@ export function formatResult(result) {
         checks.push(`${s.segmentRefsChecked} segment refs`);
     if (s.schemaRefsChecked > 0)
         checks.push(`${s.schemaRefsChecked} schema refs`);
+    if (s.envRefsChecked > 0)
+        checks.push(`${s.envRefsChecked} env refs`);
     lines.push(`  Checks:      ${checks.join(", ")}`);
     // Group issues by file
     const byFile = new Map();