@quonfig/cli 0.0.2 → 0.0.5

package/dist/commands/workspace/bootstrap.js

@@ -0,0 +1,155 @@
+import * as path from 'node:path';
+import { confirm } from '@inquirer/prompts';
+import { Flags } from '@oclif/core';
+import { BaseCommand } from '../../index.js';
+import { getActiveProfile, loadAuthConfig } from '../../util/token-storage.js';
+import { mintGiteaToken } from '../../util/gitea-api.js';
+import { isGitRepo, hasAtLeastOneCommit, gitSetRemote, gitPushForceLease, gitPushForce, getRemoteUrl, displayUrl, } from '../../util/git-ops.js';
+export default class WorkspaceBootstrap extends BaseCommand {
+    static description = 'Push a local git repo to Gitea as this workspace\'s config repository';
+    static examples = [
+        '<%= config.bin %> workspace bootstrap --dir ./our-config',
+        '<%= config.bin %> workspace bootstrap --dir ./launch-migrator/output',
+        '<%= config.bin %> workspace bootstrap --dir ./our-config --skip-validate',
+    ];
+    static flags = {
+        dir: Flags.string({
+            description: 'Local directory to push (defaults to current directory)',
+            required: false,
+        }),
+        force: Flags.boolean({
+            default: false,
+            description: 'Force push even if remote already has commits',
+        }),
+        'skip-validate': Flags.boolean({
+            default: false,
+            description: 'Skip config validation before pushing',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(WorkspaceBootstrap);
+        // Resolve target directory
+        const dir = flags.dir || process.env.QUONFIG_DIR || process.cwd();
+        const resolvedDir = path.resolve(dir);
+        // Load auth
+        const authConfig = await loadAuthConfig();
+        if (!authConfig) {
+            return this.err('Not logged in. Run `qfg login` first.');
+        }
+        const activeProfile = getActiveProfile();
+        const profile = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
+        if (!profile) {
+            return this.err('No active profile found. Run `qfg login` first.');
+        }
+        const workspaceId = profile.workspace;
+        const workspaceName = profile.workspaceSlug || profile.workspaceName || workspaceId;
+        this.verboseLog('WorkspaceBootstrap', { workspaceId, dir: resolvedDir });
+        // Validate: must be a git repo with at least one commit
+        const isRepo = await isGitRepo(resolvedDir);
+        if (!isRepo) {
+            return this.err(`${resolvedDir} is not a git repository.\nInitialize it with \`git init\` and commit your config files first.`);
+        }
+        const hasCommit = await hasAtLeastOneCommit(resolvedDir);
+        if (!hasCommit) {
+            return this.err(`${resolvedDir} has no commits. Commit your config files first.`);
+        }
+        // Verify config before doing anything
+        if (!flags['skip-validate']) {
+            this.log('Verifying config files...');
+            try {
+                const { validateWorkspace } = await import('../../verify/validate.js');
+                const result = validateWorkspace(resolvedDir);
+                const errors = result.issues.filter((i) => i.severity === 'error');
+                if (errors.length > 0) {
+                    this.log(`\nFound ${errors.length} validation error(s):\n`);
+                    for (const issue of errors) {
+                        this.log(`  ${issue.message}`);
+                    }
+                    this.log('\nFix the errors above or run with --skip-validate to bypass.');
+                    return this.err('Validation failed.');
+                }
+                this.log('Validation passed.\n');
+            }
+            catch (err) {
+                this.verboseLog('Validation error', String(err));
+                this.log('Warning: could not run validation. Proceeding anyway.');
+                this.log('Use --skip-validate to suppress this warning.\n');
+            }
+        }
+        // Confirmation prompt
+        const existingRemote = await getRemoteUrl(resolvedDir);
+        this.log(`Directory:  ${resolvedDir}`);
+        this.log(`Workspace:  ${workspaceName}`);
+        if (existingRemote) {
+            this.log(`Remote:     ${displayUrl(existingRemote)} (will be updated)`);
+        }
+        this.log('');
+        const confirmed = await confirm({
+            message: `Push ${path.basename(resolvedDir)} to workspace "${workspaceName}"?`,
+            default: false,
+        });
+        if (!confirmed) {
+            this.log('Aborted.');
+            return;
+        }
+        this.log('');
+        // Mint write token (backend provisions Gitea repo + bot account)
+        this.log('Connecting to Gitea...');
+        let tokenData;
+        try {
+            tokenData = await mintGiteaToken(workspaceId, 'write', 'bootstrap');
+        }
+        catch (err) {
+            return this.err(`Could not get Gitea credentials: ${String(err)}\n\nMake sure the workspace is fully provisioned in the Quonfig app before bootstrapping.`);
+        }
+        const { repoUrl } = tokenData;
+        this.verboseLog('WorkspaceBootstrap', { repoUrl: displayUrl(repoUrl) });
+        // Idempotency: check if remote already has commits
+        if (!flags.force) {
+            const remoteHasCommits = await this.remoteHasCommits(repoUrl);
+            if (remoteHasCommits) {
+                this.log(`\nThe remote repository already has commits.`);
+                this.log(`Run \`qfg pull --dir ${resolvedDir}\` to sync, then re-run bootstrap.`);
+                this.log(`Or run with --force to overwrite the remote.\n`);
+                return this.err('Remote is not empty.');
+            }
+        }
+        // Set remote
+        if (existingRemote) {
+            this.log(`Updating remote origin...`);
+        }
+        else {
+            this.log(`Setting remote origin...`);
+        }
+        await gitSetRemote(resolvedDir, repoUrl);
+        // Push
+        this.log('Pushing to Gitea...');
+        try {
+            if (flags.force) {
+                await gitPushForce(resolvedDir);
+            }
+            else {
+                await gitPushForceLease(resolvedDir);
+            }
+        }
+        catch (err) {
+            return this.err(`Push failed: ${String(err)}`);
+        }
+        this.log(`\nBootstrap complete.`);
+        this.log(`Workspace "${workspaceName}" is now connected to your local directory.`);
+        this.log(`\nTo keep it in sync locally, run:`);
+        this.log(`  qfg sync --watch --dir ${resolvedDir}`);
+        return {
+            dir: resolvedDir,
+            repoUrl: displayUrl(repoUrl),
+            workspaceId,
+        };
+    }
+    async remoteHasCommits(repoUrl) {
+        const { execFile: execFileCb } = await import('node:child_process');
+        const util = await import('node:util');
+        const execFile = util.promisify(execFileCb);
+        const { stdout } = await execFile('git', ['ls-remote', '--heads', repoUrl]);
+        return stdout.trim().length > 0;
+    }
+}

package/dist/init/init-workspace.js

@@ -54,13 +54,13 @@ export function planInit(options) {
         const verb = fs.existsSync(filePath) ? 'Update' : 'Create';
         actions.push({ kind: 'write-file', path: file, description: `${verb} ${file}` });
     }
-    // 3. environments.json — create if missing
-    const envsPath = path.join(dir, 'environments.json');
+    // 3. quonfig.json — create if missing
+    const envsPath = path.join(dir, 'quonfig.json');
     if (fs.existsSync(envsPath)) {
         // leave it alone
     }
     else {
-        actions.push({ kind: 'write-file', path: 'environments.json', description: 'Create environments.json' });
+        actions.push({ kind: 'write-file', path: 'quonfig.json', description: 'Create quonfig.json' });
     }
     // 4. Sample data
     if (includeSamples) {
@@ -108,7 +108,7 @@ export function executeInit(plan, dir) {
         'README.md': readmeTemplate(),
         'CLAUDE.md': claudeMdTemplate(),
         'AGENTS.md': agentsMdTemplate(),
-        'environments.json': JSON.stringify({ environments: [] }, null, 2) + '\n',
+        'quonfig.json': JSON.stringify({ environments: [] }, null, 2) + '\n',
     };
     // Build a lookup for sample content
     const sampleContent = {};

package/dist/init/templates.js

@@ -121,7 +121,7 @@ See \`quonfig.schema.json\` for the full operator enum and value type definition
 
 ## Environments
 
-Environment overrides go in the \`environments\` array. Each has an \`id\` (lowercase slug like \`production\`, never a UUID) and its own \`rules\` array. Environment IDs are defined in \`environments.json\` at the repo root.
+Environment overrides go in the \`environments\` array. Each has an \`id\` (lowercase slug like \`production\`, never a UUID) and its own \`rules\` array. Environment IDs are defined in \`quonfig.json\` at the repo root.
 
 ## Cross-File Validation Rules
 

package/dist/util/coerce.js

@@ -17,7 +17,8 @@ export const coerceIntoType = (type, value) => {
         }
         case 'int': {
             try {
-                const int = BigInt(value);
+                const bigInt = BigInt(value);
+                const int = Number(bigInt);
                 return [{ int }, TYPE_MAPPING[type]];
             }
             catch {

package/dist/util/get-client.js

@@ -1,8 +1,8 @@
 import { Client } from '@quonfig/node';
 import { getApiUrl } from '../util/domain-urls.js';
 import jsonMaybe from '../util/json-maybe.js';
-import { decodeJWT, refreshAccessToken } from '../util/oauth-client.js';
-import { getActiveProfile, loadAuthConfig, loadTokens, saveTokens } from '../util/token-storage.js';
+import { getActiveProfile, loadAuthConfig, loadTokens } from '../util/token-storage.js';
+import { getValidAccessToken } from '../util/get-valid-token.js';
 import version from '../version.js';
 let clientInstance;
 let cachedWorkspaceId;
@@ -31,45 +31,13 @@ const getClient = async (command, sdkKey, profile) => {
         if (!authConfig || !tokens?.accessToken) {
             command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
         }
-        // Check if token is expired and refresh if needed.
-        // Prefer the JWT's actual exp claim over the stored expiresAt.
-        let tokenExpired = tokens.expiresAt ? tokens.expiresAt < Date.now() : false;
+        command.verboseLog('Checking token validity...');
         try {
-            const payload = decodeJWT(tokens.accessToken);
-            if (typeof payload.exp === 'number') {
-                tokenExpired = payload.exp * 1000 < Date.now();
-            }
+            jwt = await getValidAccessToken();
+            command.verboseLog('Token valid (or refreshed)');
         }
         catch {
-            // If we can't decode, fall back to stored expiresAt
-        }
-        if (tokenExpired && tokens.refreshToken) {
-            command.verboseLog('Token expired, refreshing...');
-            try {
-                const refreshed = await refreshAccessToken(tokens.refreshToken);
-                // Use the JWT's actual exp claim for expiry, not a hardcoded duration
-                let expiresAt = Date.now() + 300 * 1000; // fallback: 5 minutes
-                try {
-                    const payload = decodeJWT(refreshed.access_token);
-                    if (typeof payload.exp === 'number') {
-                        expiresAt = payload.exp * 1000; // convert seconds to ms
-                    }
-                }
-                catch {
-                    // Use fallback
-                }
-                tokens = {
-                    ...tokens,
-                    accessToken: refreshed.access_token,
-                    expiresAt,
-                    refreshToken: refreshed.refresh_token,
-                };
-                await saveTokens(tokens);
-                command.verboseLog('Token refreshed successfully');
-            }
-            catch (error) {
-                command.error('Session expired. Please run `qfg login` to re-authenticate.', { exit: 401 });
-            }
+            command.error('Session expired. Please run `qfg login` to re-authenticate.', { exit: 401 });
         }
         // Get the active profile to find the workspace
         const activeProfile = getActiveProfile(profile);
@@ -82,12 +50,6 @@ const getClient = async (command, sdkKey, profile) => {
         if (profileData) {
             workspaceId = profileData.workspace;
         }
-        // Use the WorkOS access token directly as the JWT
-        jwt = tokens.accessToken;
-        // If still no JWT, user needs to login
-        if (!jwt) {
-            command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
-        }
     }
     // Store workspaceId on the command for use in building URLs and cache it
     if (workspaceId) {

package/dist/util/get-valid-token.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
+ * Throws if not logged in or if refresh fails.
+ */
+export declare function getValidAccessToken(): Promise<string>;

package/dist/util/get-valid-token.js

@@ -0,0 +1,44 @@
+/**
+ * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
+ * Throws if not logged in or if refresh fails.
+ */
+import { decodeJWT, refreshAccessToken } from './oauth-client.js';
+import { loadTokens, saveTokens } from './token-storage.js';
+export async function getValidAccessToken() {
+    const tokens = await loadTokens();
+    if (!tokens?.accessToken) {
+        throw new Error('Not authenticated. Please run `qfg login` first.');
+    }
+    // Check expiry using the JWT's exp claim, falling back to stored expiresAt
+    let expired = tokens.expiresAt ? tokens.expiresAt < Date.now() : false;
+    try {
+        const payload = decodeJWT(tokens.accessToken);
+        if (typeof payload.exp === 'number') {
+            expired = payload.exp * 1000 < Date.now();
+        }
+    }
+    catch { /* use stored expiresAt */ }
+    if (!expired) {
+        return tokens.accessToken;
+    }
+    if (!tokens.refreshToken) {
+        throw new Error('Session expired. Please run `qfg login` to re-authenticate.');
+    }
+    const refreshed = await refreshAccessToken(tokens.refreshToken);
+    let expiresAt = Date.now() + 300 * 1000;
+    try {
+        const payload = decodeJWT(refreshed.access_token);
+        if (typeof payload.exp === 'number') {
+            expiresAt = payload.exp * 1000;
+        }
+    }
+    catch { /* use fallback */ }
+    const updated = {
+        ...tokens,
+        accessToken: refreshed.access_token,
+        expiresAt,
+        refreshToken: refreshed.refresh_token,
+    };
+    await saveTokens(updated);
+    return refreshed.access_token;
+}

package/dist/util/git-ops.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Redact a token from a URL string so it is safe to display to users.
+ */
+export declare const redactToken: (url: string) => string;
+export declare const gitClone: (repoUrl: string, dir: string) => Promise<void>;
+export declare const isGitRepo: (dir: string) => Promise<boolean>;
+export declare const getRemoteUrl: (dir: string) => Promise<string | null>;
+export declare const isWorkingTreeClean: (dir: string) => Promise<boolean>;
+export declare const gitFetch: (dir: string) => Promise<void>;
+/**
+ * Returns true if origin/main has commits that can be fast-forwarded into the local branch.
+ */
+export declare const canFastForward: (dir: string) => Promise<boolean>;
+/**
+ * Returns true if local has commits not reachable from origin/main (diverged).
+ */
+export declare const hasDivergedFromRemote: (dir: string) => Promise<boolean>;
+/**
+ * Performs a fast-forward-only merge of origin/main. Returns list of new commit subjects.
+ */
+export declare const gitMergeFfOnly: (dir: string) => Promise<string[]>;
+/**
+ * Adds or updates the origin remote for a repo.
+ */
+export declare const gitSetRemote: (dir: string, url: string) => Promise<void>;
+export declare const gitPushForceLease: (dir: string) => Promise<void>;
+export declare const gitPushForce: (dir: string) => Promise<void>;
+export declare const hasAtLeastOneCommit: (dir: string) => Promise<boolean>;
+/**
+ * Get the URL stripped of credentials for display purposes.
+ */
+export declare const displayUrl: (url: string) => string;

package/dist/util/git-ops.js

@@ -0,0 +1,164 @@
+import { execFile as execFileCb } from 'node:child_process';
+import * as util from 'node:util';
+const execFile = util.promisify(execFileCb);
+/**
+ * Redact a token from a URL string so it is safe to display to users.
+ */
+export const redactToken = (url) => url.replace(/:([^@/]+)@/, ':***@');
+/**
+ * Wrap execFile errors to strip tokens from the message.
+ */
+const safeExec = async (file, args, options) => {
+    try {
+        return await execFile(file, args, { cwd: options?.cwd });
+    }
+    catch (err) {
+        const e = err;
+        const message = redactToken(e.message || String(err));
+        const stderr = redactToken(e.stderr ?? '');
+        const safeErr = new Error(message);
+        safeErr.stderr = stderr;
+        throw safeErr;
+    }
+};
+export const gitClone = async (repoUrl, dir) => {
+    await safeExec('git', ['clone', repoUrl, dir]);
+};
+export const isGitRepo = async (dir) => {
+    try {
+        await execFile('git', ['-C', dir, 'rev-parse', '--git-dir']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const getRemoteUrl = async (dir) => {
+    try {
+        const { stdout } = await execFile('git', ['-C', dir, 'remote', 'get-url', 'origin']);
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+};
+export const isWorkingTreeClean = async (dir) => {
+    const { stdout } = await execFile('git', ['-C', dir, 'status', '--porcelain']);
+    return stdout.trim() === '';
+};
+export const gitFetch = async (dir) => {
+    await safeExec('git', ['-C', dir, 'fetch', 'origin']);
+};
+/**
+ * Returns true if origin/main has commits that can be fast-forwarded into the local branch.
+ */
+export const canFastForward = async (dir) => {
+    try {
+        // Get the local HEAD and origin/main SHAs
+        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: remoteSha } = await execFile('git', ['-C', dir, 'rev-parse', 'origin/main']);
+        const local = localSha.trim();
+        const remote = remoteSha.trim();
+        if (local === remote)
+            return false; // already up to date
+        // Check if local is an ancestor of remote (i.e. ff is possible)
+        try {
+            await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
+            return true; // exit code 0 means local is an ancestor of remote
+        }
+        catch {
+            return false; // local has diverged
+        }
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Returns true if local has commits not reachable from origin/main (diverged).
+ */
+export const hasDivergedFromRemote = async (dir) => {
+    try {
+        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: remoteSha } = await execFile('git', ['-C', dir, 'rev-parse', 'origin/main']);
+        const local = localSha.trim();
+        const remote = remoteSha.trim();
+        if (local === remote)
+            return false;
+        // If remote is an ancestor of local, local is ahead (diverged for our purposes)
+        try {
+            await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', remote, local]);
+            return true;
+        }
+        catch {
+            // Check if truly diverged (neither is ancestor of the other)
+            try {
+                await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
+                return false; // ff possible, not diverged
+            }
+            catch {
+                return true; // truly diverged
+            }
+        }
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Performs a fast-forward-only merge of origin/main. Returns list of new commit subjects.
+ */
+export const gitMergeFfOnly = async (dir) => {
+    // Get commits that will be merged (before merge)
+    let newCommits = [];
+    try {
+        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: log } = await execFile('git', [
+            '-C',
+            dir,
+            'log',
+            '--pretty=format:%s',
+            `${localSha.trim()}..origin/main`,
+        ]);
+        newCommits = log
+            .split('\n')
+            .map((s) => s.trim())
+            .filter(Boolean);
+    }
+    catch {
+        // Non-fatal — we'll still attempt the merge
+    }
+    await safeExec('git', ['-C', dir, 'merge', '--ff-only', 'origin/main']);
+    return newCommits;
+};
+/**
+ * Adds or updates the origin remote for a repo.
+ */
+export const gitSetRemote = async (dir, url) => {
+    const existing = await getRemoteUrl(dir);
+    if (existing !== null) {
+        await safeExec('git', ['-C', dir, 'remote', 'set-url', 'origin', url]);
+    }
+    else {
+        await safeExec('git', ['-C', dir, 'remote', 'add', 'origin', url]);
+    }
+};
+export const gitPushForceLease = async (dir) => {
+    await safeExec('git', ['-C', dir, 'push', 'origin', 'main', '--force-with-lease']);
+};
+export const gitPushForce = async (dir) => {
+    await safeExec('git', ['-C', dir, 'push', 'origin', 'main', '--force']);
+};
+export const hasAtLeastOneCommit = async (dir) => {
+    try {
+        await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Get the URL stripped of credentials for display purposes.
+ */
+export const displayUrl = (url) => redactToken(url);

package/dist/util/gitea-api.d.ts

@@ -0,0 +1,11 @@
+import { GiteaTokenEntry } from './gitea-token-storage.js';
+export interface GiteaTokenResponse {
+    token: string;
+    repoUrl: string;
+    expiresAt: string | null;
+}
+export declare const mintGiteaToken: (workspaceId: string, scope: "read" | "write", purpose: "pull" | "bootstrap") => Promise<GiteaTokenResponse>;
+/**
+ * Mint a Gitea read token, store it, and return the entry.
+ */
+export declare const mintAndStoreGiteaReadToken: (workspaceId: string) => Promise<GiteaTokenEntry>;

package/dist/util/gitea-api.js

@@ -0,0 +1,45 @@
+import { getApiUrl } from './domain-urls.js';
+import { getValidAccessToken } from './get-valid-token.js';
+import { saveGiteaToken } from './gitea-token-storage.js';
+export const mintGiteaToken = async (workspaceId, scope, purpose) => {
+    const accessToken = await getValidAccessToken();
+    const apiUrl = getApiUrl();
+    const res = await fetch(`${apiUrl}/api/v1/gitea/token`, {
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ json: { scope, workspaceId, purpose } }),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        let message = `HTTP ${res.status}`;
+        try {
+            const body = JSON.parse(text);
+            // oRPC error shape
+            if (body?.json?.message)
+                message = body.json.message;
+            else if (body?.message)
+                message = body.message;
+        }
+        catch { /* use raw text */ }
+        throw new Error(message || text);
+    }
+    const body = await res.json();
+    const data = body.json ?? body;
+    return data;
+};
+/**
+ * Mint a Gitea read token, store it, and return the entry.
+ */
+export const mintAndStoreGiteaReadToken = async (workspaceId) => {
+    const data = await mintGiteaToken(workspaceId, 'read', 'pull');
+    const entry = {
+        token: data.token,
+        repoUrl: data.repoUrl,
+        expiresAt: data.expiresAt,
+    };
+    await saveGiteaToken(workspaceId, entry);
+    return entry;
+};

package/dist/util/gitea-token-storage.d.ts

@@ -0,0 +1,8 @@
+export interface GiteaTokenEntry {
+    token: string;
+    repoUrl: string;
+    expiresAt: string | null;
+}
+export declare const loadGiteaToken: (workspaceId: string) => Promise<GiteaTokenEntry | null>;
+export declare const saveGiteaToken: (workspaceId: string, entry: GiteaTokenEntry) => Promise<void>;
+export declare const isGiteaTokenExpired: (entry: GiteaTokenEntry) => boolean;

package/dist/util/gitea-token-storage.js

@@ -0,0 +1,47 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { getDomain } from './domain-urls.js';
+const BUFFER_MS = 5 * 60 * 1000; // 5 minutes
+const getQuonfigDir = () => path.join(os.homedir(), '.quonfig');
+const getGiteaTokenFile = () => {
+    const domain = getDomain();
+    const filename = domain !== 'quonfig.com' ? `gitea-tokens-${domain.replaceAll('.', '-')}.json` : 'gitea-tokens.json';
+    return path.join(getQuonfigDir(), filename);
+};
+const ensureQuonfigDir = async () => {
+    const dir = getQuonfigDir();
+    try {
+        await fs.promises.access(dir, fs.constants.F_OK);
+    }
+    catch {
+        await fs.promises.mkdir(dir, { recursive: true });
+    }
+};
+const loadStore = async () => {
+    try {
+        const data = await fs.promises.readFile(getGiteaTokenFile(), 'utf8');
+        return JSON.parse(data);
+    }
+    catch {
+        return {};
+    }
+};
+export const loadGiteaToken = async (workspaceId) => {
+    const store = await loadStore();
+    return store[workspaceId] ?? null;
+};
+export const saveGiteaToken = async (workspaceId, entry) => {
+    await ensureQuonfigDir();
+    const store = await loadStore();
+    store[workspaceId] = entry;
+    const targetFile = getGiteaTokenFile();
+    const tmpFile = `${targetFile}.tmp`;
+    await fs.promises.writeFile(tmpFile, JSON.stringify(store, null, 2), { encoding: 'utf8', mode: 0o600 });
+    await fs.promises.rename(tmpFile, targetFile);
+};
+export const isGiteaTokenExpired = (entry) => {
+    if (!entry.expiresAt)
+        return false;
+    return new Date(entry.expiresAt).getTime() - BUFFER_MS < Date.now();
+};

package/dist/util/token-storage.d.ts

@@ -14,6 +14,7 @@ export interface AuthConfig {
         [profileName: string]: {
             workspace: string;
             workspaceName?: string;
+            workspaceSlug?: string;
         };
     };
 }