@quonfig/cli 0.0.20 → 0.0.21

package/dist/commands/login.js

@@ -3,7 +3,7 @@ import { select } from '@inquirer/prompts';
 import { BaseCommand } from '../index.js';
 import { decodeJWT, pollForToken, requestDeviceCode } from '../util/oauth-client.js';
 import { getApiUrl } from '../util/domain-urls.js';
-import { loadAuthConfig, saveAuthConfig, saveTokens } from '../util/token-storage.js';
+import { getAuthConfigFilePath, getTokenFilePath, loadAuthConfig, saveAuthConfig, saveTokens, } from '../util/token-storage.js';
 export default class Login extends BaseCommand {
     static description = 'Log in to Quonfig via WorkOS device authorization';
     static examples = ['<%= config.bin %> <%= command.id %>', '<%= config.bin %> <%= command.id %> --profile myprofile'];
@@ -47,14 +47,22 @@ export default class Login extends BaseCommand {
         if (typeof jwtPayload.exp === 'number') {
             expiresAt = jwtPayload.exp * 1000;
         }
-        // Save tokens
-        await saveTokens({
-            accessToken: tokenResponse.access_token,
-            expiresAt,
-            refreshToken: tokenResponse.refresh_token,
-            userEmail,
-            userId: user.id,
-        });
+        // Save tokens — verifies the file actually persisted before returning.
+        this.verboseLog('Saving tokens to', getTokenFilePath());
+        let tokensPath;
+        try {
+            tokensPath = await saveTokens({
+                accessToken: tokenResponse.access_token,
+                expiresAt,
+                refreshToken: tokenResponse.refresh_token,
+                userEmail,
+                userId: user.id,
+            });
+        }
+        catch (error) {
+            return this.err(`Login failed: could not save tokens. ${error.message}`);
+        }
+        this.verboseLog('Tokens saved at', tokensPath);
         // Resolve org_id → workspace UUID via the API
         let workspaceId;
         let workspaceName;
@@ -113,18 +121,26 @@ export default class Login extends BaseCommand {
         // Save auth config
         const isFirstProfile = !existingConfig || Object.keys(existingConfig.profiles).length === 0;
         const shouldSetDefault = isFirstProfile || profileName === 'default' || !existingConfig?.defaultProfile;
-        await saveAuthConfig({
-            defaultProfile: shouldSetDefault ? profileName : existingConfig?.defaultProfile,
-            profiles: {
-                ...existingConfig?.profiles,
-                [profileName]: {
-                    workspace: workspaceId || orgId || 'unknown',
-                    workspaceName: workspaceName || (orgId ? `org:${orgId}` : undefined),
-                    workspaceSlug,
-                    organizationName,
+        this.verboseLog('Saving auth config to', getAuthConfigFilePath());
+        let configPath;
+        try {
+            configPath = await saveAuthConfig({
+                defaultProfile: shouldSetDefault ? profileName : existingConfig?.defaultProfile,
+                profiles: {
+                    ...existingConfig?.profiles,
+                    [profileName]: {
+                        workspace: workspaceId || orgId || 'unknown',
+                        workspaceName: workspaceName || (orgId ? `org:${orgId}` : undefined),
+                        workspaceSlug,
+                        organizationName,
+                    },
                 },
-            },
-        });
+            });
+        }
+        catch (error) {
+            return this.err(`Login failed: could not save auth config. ${error.message}`);
+        }
+        this.verboseLog('Auth config saved at', configPath);
         this.log('\nSuccessfully logged in!');
         if (userEmail) {
             this.log(`Logged in as: ${userEmail}`);

package/dist/commands/override.d.ts

@@ -1,17 +1,23 @@
 import { APICommand } from '../index.js';
-import { JsonObj } from '../result.js';
+import type { JsonObj } from '../result.js';
 export default class Override extends APICommand {
     static args: {
         name: import("@oclif/core/lib/interfaces/parser.js").Arg<string | undefined, Record<string, unknown>>;
+        value: import("@oclif/core/lib/interfaces/parser.js").Arg<string | undefined, Record<string, unknown>>;
     };
     static description: string;
     static examples: string[];
     static flags: {
-        environment: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        clear: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        env: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         remove: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
-        value: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
     };
     run(): Promise<JsonObj | void>;
-    private removeOverride;
-    private setOverride;
+    private callFindOrCreate;
+    private callRemove;
+    private fetchFlag;
+    private runClear;
+    private runList;
+    private runRemove;
+    private runSet;
 }

package/dist/commands/override.js

@@ -1,173 +1,269 @@
-import { Flags } from '@oclif/core';
+import { Args, Flags } from '@oclif/core';
 import { APICommand } from '../index.js';
-import getEnvironment from '../ui/get-environment.js';
-import getString from '../ui/get-string.js';
-import autocomplete from '../util/autocomplete.js';
 import { checkmark } from '../util/color.js';
-import isInteractive from '../util/is-interactive.js';
-import nameArg from '../util/name-arg.js';
+import { loadTokens } from '../util/token-storage.js';
+const OVERRIDE_PROP = 'quonfig-user.email';
+const OVERRIDE_OP = 'PROP_IS_ONE_OF';
+/**
+ * Parse the fresh SHA out of a 409 conflict message of the form
+ *   "<path> was modified (expected <oldSha>, got <newSha>)"
+ * Returns undefined if the message doesn't match.
+ */
+function parseFreshShaFromConflict(message) {
+    if (!message)
+        return undefined;
+    const match = message.match(/got\s+([\w.-]+)\)/);
+    return match?.[1];
+}
+/**
+ * Coerce a raw CLI value string into the typed Value the server expects.
+ * Order matters: bool → int → double → json → string.
+ */
+function inferValue(raw) {
+    if (raw === 'true' || raw === 'false') {
+        return { type: 'bool', value: raw === 'true' };
+    }
+    if (/^-?\d+$/.test(raw)) {
+        return { type: 'int', value: Number.parseInt(raw, 10) };
+    }
+    if (/^-?\d+\.\d+$/.test(raw)) {
+        return { type: 'double', value: Number.parseFloat(raw) };
+    }
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            return { type: 'json', value: JSON.parse(trimmed) };
+        }
+        catch {
+            // Fall through to string — looked like JSON but didn't parse.
+        }
+    }
+    return { type: 'string', value: raw };
+}
+/**
+ * Find the existing override rule for a user in a specific env. Returns the
+ * value the user is currently overridden to, or undefined.
+ */
+function findExistingOverride(flag, env, userEmail) {
+    const envEntry = flag.environments?.find((e) => e.id === env);
+    for (const rule of envEntry?.rules ?? []) {
+        if (!rule.criteria || rule.criteria.length !== 1)
+            continue;
+        const c = rule.criteria[0];
+        if (c.propertyName !== OVERRIDE_PROP || c.operator !== OVERRIDE_OP)
+            continue;
+        const emails = c.valueToMatch?.value ?? [];
+        if (emails.includes(userEmail) && rule.value) {
+            return rule.value;
+        }
+    }
+    return undefined;
+}
+function valuesEqual(a, b) {
+    if (a.type !== b.type)
+        return false;
+    return JSON.stringify(a.value) === JSON.stringify(b.value);
+}
 export default class Override extends APICommand {
-    static args = { ...nameArg };
-    static description = `Override the value of an item for your user/SDK key combo.
+    static args = {
+        name: Args.string({ description: 'flag/config key to override' }),
+        value: Args.string({ description: 'new value (type inferred: bool/int/double/json/string)' }),
+    };
+    static description = `Override a flag value for your dev user.
 
-To target users other than yourself, or to express rules like "user.email == X → value Y",
-you cannot use override — see:
-  qfg config-schema   # operator reference + worked multi-rule example
-  qfg pull            # clone the workspace so you can edit JSON directly`;
+Writes a top-priority rule keyed on the dev-only quonfig-user.email property,
+so the override only fires for SDK clients that set quonfig-user.email in
+their context. Production SDKs typically don't set this property, which makes
+overrides effectively inert in production.
+
+Examples
+  qfg override                                # list flags where you have an override
+  qfg override my.flag true                   # set bool override
+  qfg override my.flag 42                     # set int override
+  qfg override my.flag '{"a":1}'              # set json override
+  qfg override my.flag --remove               # remove your override on my.flag
+  qfg override --clear                        # remove ALL of your overrides in this env`;
     static examples = [
-        '<%= config.bin %> <%= command.id %> # will prompt for name and value',
-        '<%= config.bin %> <%= command.id %> my.flag.name --value=true',
-        '<%= config.bin %> <%= command.id %> my.flag.name --remove',
-        '<%= config.bin %> <%= command.id %> my.double.config --value=3.14159',
+        '<%= config.bin %> <%= command.id %>',
+        '<%= config.bin %> <%= command.id %> my.flag true',
+        '<%= config.bin %> <%= command.id %> my.flag --remove',
+        '<%= config.bin %> <%= command.id %> --clear',
+        '<%= config.bin %> <%= command.id %> my.flag true --env=staging',
     ];
     static flags = {
-        environment: Flags.string({ description: 'environment to override in' }),
-        remove: Flags.boolean({ default: false, description: 'remove your override (if present)' }),
-        value: Flags.string({ description: 'value to use for your override' }),
+        clear: Flags.boolean({ default: false, description: 'remove ALL of your overrides in this env' }),
+        env: Flags.string({ description: 'environment to operate in (default: $QUONFIG_ENVIRONMENT)' }),
+        remove: Flags.boolean({ default: false, description: 'remove your override on this key' }),
     };
     async run() {
         const { args, flags } = await this.parse(Override);
-        if (flags.remove && flags.value) {
-            this.err('remove and value flags are mutually exclusive');
-        }
-        // Fetch all configs from metadata endpoint
-        const metadataRequest = await this.apiClient.post('/api/v1/metadata/list', { workspaceId: this.workspaceId });
-        if (!metadataRequest.ok) {
-            const errorMsg = metadataRequest.error?.error || `Failed to fetch configs: ${metadataRequest.status}`;
-            return this.err(errorMsg, { serverError: metadataRequest.error });
-        }
-        const metadataResponse = metadataRequest.json;
-        const configs = metadataResponse.configs;
-        // Get the environment
-        const environment = await getEnvironment({
-            command: this,
-            flags,
-            message: 'Which environment would you like to override in?',
-            providedEnvironment: flags.environment,
-        });
-        if (!environment) {
-            return;
-        }
-        // Get the key - from args or prompt
-        let key = args.name;
-        if (!key && isInteractive(flags)) {
-            const configKeys = configs.map((c) => c.key);
-            const selectedKey = await autocomplete({
-                message: 'Which item would you like to override?',
-                source: configKeys,
-            });
-            if (selectedKey) {
-                key = selectedKey;
-            }
+        const tokens = await loadTokens();
+        const userEmail = tokens?.userEmail;
+        if (!userEmail) {
+            return this.err('Not logged in. Run `qfg login` first.');
         }
-        if (!key) {
-            return this.err('Key is required');
+        const env = flags.env || process.env.QUONFIG_ENVIRONMENT;
+        if (!env) {
+            return this.err('No environment specified. Pass --env=<env> or set QUONFIG_ENVIRONMENT.');
         }
-        const config = configs.find((c) => c.key === key);
-        if (!config) {
-            return this.err(`Could not find config named ${key}`);
+        if (env === 'production') {
+            this.warn('Overrides on production are inert for SDK clients that do not set quonfig-user.email (most production SDKs do not). Continuing anyway.');
         }
-        this.verboseLog('Selected config:', config);
-        if (flags.remove) {
-            return this.removeOverride(key, environment.id, config.version);
-        }
-        // Get the value
-        let value = flags.value;
-        if (!value && isInteractive(flags)) {
-            value = await getString({
-                allowBlank: false,
-                message: 'Override value',
-            });
+        if (flags.clear) {
+            return this.runClear({ env, userEmail });
         }
-        if (!value) {
-            return this.err('Value is required');
+        if (!args.name) {
+            return this.runList({ env, userEmail });
         }
-        return this.setOverride(config, value, environment.id);
-    }
-    async removeOverride(key, environmentId, currentVersionId) {
-        const request = await this.apiClient.post('/internal/ops/v1/remove-variant', {
-            configKey: key,
-            currentVersionId,
-            environmentId,
-        });
-        if (request.ok) {
-            this.log(`${checkmark} Override removed`);
-            return;
+        if (flags.remove) {
+            return this.runRemove({ env, key: args.name, userEmail });
         }
-        // Handle 404 case - no override exists to remove
-        if (request.status === 404) {
-            this.log(`No override found for ${key}`);
-            return;
+        if (args.value === undefined) {
+            return this.err('Missing value. Usage: qfg override <key> <value> [--env=<env>]');
         }
-        this.err(`Failed to remove override: ${request.status}`, { key, serverError: request.error });
+        return this.runSet({ env, key: args.name, rawValue: args.value, userEmail });
     }
-    async setOverride(config, value, environmentId) {
-        const { key, valueType, version } = config;
-        // Map the valueType to the format expected by the API
-        const typeMapping = {
-            bool: 'bool',
-            string: 'string',
-            int: 'int',
-            double: 'double',
-            string_list: 'stringList',
-            json: 'json',
-            limit_definition: 'limitDefinition',
-            duration: 'duration',
-            int_range: 'intRange',
-        };
-        const type = typeMapping[valueType.toLowerCase()] || valueType;
-        // Parse the value based on type and build variant object
-        let variantValue = value;
-        let variantType = type;
-        switch (type) {
-            case 'stringList': {
-                variantValue = value.split(',');
-                variantType = 'string_list';
-                break;
-            }
-            case 'bool': {
-                variantValue = value.toLowerCase() === 'true';
-                break;
-            }
-            case 'int': {
-                variantValue = Number.parseInt(value, 10);
-                break;
-            }
-            case 'double': {
-                variantValue = Number.parseFloat(value);
-                break;
+    async callFindOrCreate(opts) {
+        let sha = opts.currentSha;
+        let attempt = 0;
+        // One stale-SHA retry: parse the fresh SHA from the 409 message and try again.
+        while (attempt < 2) {
+            attempt += 1;
+            // eslint-disable-next-line no-await-in-loop
+            const res = await this.apiClient.post('/api/v1/flags/findOrCreateOverride', {
+                currentSha: sha,
+                env: opts.env,
+                flagKey: opts.key,
+                userEmail: opts.userEmail,
+                value: opts.value,
+                workspaceId: this.workspaceId,
+            });
+            if (res.ok) {
+                const commitSha = res.json?.commitSha;
+                return this.ok(`${checkmark} Set override ${opts.key}=${JSON.stringify(opts.value.value)} (${opts.value.type}) for ${opts.userEmail} in env=${opts.env} (commit ${commitSha}).`, { commitSha, env: opts.env, key: opts.key, value: opts.value });
             }
-            case 'json': {
-                try {
-                    variantValue = JSON.parse(value);
-                }
-                catch {
-                    return this.err(`Invalid JSON value: ${value}`);
+            if (res.status === 409 && attempt === 1) {
+                const fresh = parseFreshShaFromConflict(res.error?.message);
+                if (fresh) {
+                    this.verboseLog(`Stale SHA — retrying once with fresh SHA ${fresh}`);
+                    sha = fresh;
+                    continue;
                 }
-                break;
             }
-            case 'string': {
-                variantValue = value;
-                break;
+            return this.err(`Failed to set override on ${opts.key}: ${res.status} ${JSON.stringify(res.error)}`);
+        }
+    }
+    async callRemove(opts) {
+        let sha = opts.flag.commitSha ?? '';
+        let attempt = 0;
+        while (attempt < 2) {
+            attempt += 1;
+            // eslint-disable-next-line no-await-in-loop
+            const res = await this.apiClient.post('/api/v1/flags/removeOverride', {
+                currentSha: sha,
+                env: opts.env,
+                flagKey: opts.key,
+                userEmail: opts.userEmail,
+                workspaceId: this.workspaceId,
+            });
+            if (res.ok)
+                return true;
+            if (res.status === 409 && attempt === 1) {
+                const fresh = parseFreshShaFromConflict(res.error?.message);
+                if (fresh) {
+                    this.verboseLog(`Stale SHA — retrying remove with fresh SHA ${fresh}`);
+                    sha = fresh;
+                    continue;
+                }
             }
-            // No default
-        }
-        const request = await this.apiClient.post('/internal/ops/v1/assign-variant', {
-            configKey: key,
-            currentVersionId: version,
-            environmentId,
-            variant: {
-                type: variantType,
-                value: variantValue,
-            },
+            this.err(`Failed to remove override on ${opts.key}: ${res.status} ${JSON.stringify(res.error)}`);
+            return false;
+        }
+        return false;
+    }
+    async fetchFlag(key) {
+        const res = await this.apiClient.post('/api/v1/flags/getByKey', {
+            flagKey: key,
+            workspaceId: this.workspaceId,
+        });
+        if (!res.ok) {
+            if (res.status === 404)
+                return undefined;
+            this.err(`Failed to fetch flag ${key}: ${res.status} ${JSON.stringify(res.error)}`);
+            return undefined;
+        }
+        return res.json;
+    }
+    async runClear(opts) {
+        const res = await this.apiClient.post('/api/v1/flags/list', { workspaceId: this.workspaceId });
+        if (!res.ok) {
+            return this.err(`Failed to list flags: ${res.status} ${JSON.stringify(res.error)}`);
+        }
+        const flags = res.json ?? [];
+        const targets = flags.filter((f) => findExistingOverride(f, opts.env, opts.userEmail) !== undefined);
+        if (targets.length === 0) {
+            return this.ok(`No overrides to clear in env=${opts.env}.`);
+        }
+        const cleared = [];
+        for (const f of targets) {
+            // eslint-disable-next-line no-await-in-loop
+            const removed = await this.callRemove({
+                env: opts.env,
+                flag: f,
+                key: f.key,
+                userEmail: opts.userEmail,
+            });
+            if (removed)
+                cleared.push(f.key);
+        }
+        return this.ok(`${checkmark} Cleared ${cleared.length} override(s) in env=${opts.env}: ${cleared.join(', ')}`);
+    }
+    async runList(opts) {
+        const res = await this.apiClient.post('/api/v1/flags/list', { workspaceId: this.workspaceId });
+        if (!res.ok) {
+            return this.err(`Failed to list flags: ${res.status} ${JSON.stringify(res.error)}`);
+        }
+        const flags = res.json ?? [];
+        const overridden = flags.filter((f) => findExistingOverride(f, opts.env, opts.userEmail) !== undefined);
+        if (overridden.length === 0) {
+            return this.ok(`You have no overrides in env=${opts.env}.`);
+        }
+        this.log(`Your overrides in env=${opts.env}:`);
+        for (const f of overridden) {
+            const v = findExistingOverride(f, opts.env, opts.userEmail);
+            this.log(`  ${f.key} = ${JSON.stringify(v?.value)} (${v?.type})`);
+        }
+        return { env: opts.env, overrides: overridden.map((f) => f.key) };
+    }
+    async runRemove(opts) {
+        const flag = await this.fetchFlag(opts.key);
+        if (!flag) {
+            return this.err(`Flag ${opts.key} not found.`);
+        }
+        const existing = findExistingOverride(flag, opts.env, opts.userEmail);
+        if (!existing) {
+            return this.ok(`You have no override on ${opts.key} in env=${opts.env}.`);
+        }
+        const removed = await this.callRemove({ env: opts.env, flag, key: opts.key, userEmail: opts.userEmail });
+        return removed ? this.ok(`${checkmark} Removed override on ${opts.key} in env=${opts.env}.`) : undefined;
+    }
+    async runSet(opts) {
+        const value = inferValue(opts.rawValue);
+        const flag = await this.fetchFlag(opts.key);
+        if (!flag) {
+            return this.err(`Flag ${opts.key} not found.`);
+        }
+        const existing = findExistingOverride(flag, opts.env, opts.userEmail);
+        if (existing && valuesEqual(existing, value)) {
+            return this.ok(`${opts.key} is already set to ${JSON.stringify(value.value)} (${value.type}) for ${opts.userEmail} in env=${opts.env}.`);
+        }
+        const sha = flag.commitSha ?? '';
+        return this.callFindOrCreate({
+            currentSha: sha,
+            env: opts.env,
+            key: opts.key,
+            userEmail: opts.userEmail,
+            value,
         });
-        if (request.ok) {
-            this.log(`${checkmark} Override set`);
-            return { key, success: true };
-        }
-        const errMsg = request.status === 400
-            ? `Failed to override value: ${request.status} -- is ${value} a valid ${type}?`
-            : `Failed to override value: ${request.status}`;
-        this.err(errMsg, { key, serverError: request.error });
     }
 }

package/dist/util/coerce.js

@@ -1,10 +1,21 @@
-import { ConfigValueType } from '@quonfig/node';
+import { ConfigValueType, durationToMilliseconds } from '@quonfig/node';
 const TRUE_VALUES = new Set(['true', '1', 't']);
 const BOOLEAN_VALUES = new Set([...TRUE_VALUES, 'false', '0', 'f']);
+// Strict ISO 8601 duration: at least one of D/H/M/S must be present (i.e. bare "P"
+// or "PT" alone are rejected). Mirrors the lenient pattern in @quonfig/node but
+// adds anchors and a non-empty check.
+const ISO_DURATION_PATTERN = /^P(?:\d+(?:\.\d+)?D)?(?:T(?:\d+(?:\.\d+)?H)?(?:\d+(?:\.\d+)?M)?(?:\d+(?:\.\d+)?S)?)?$/;
+const isValidIsoDuration = (value) => {
+    if (!ISO_DURATION_PATTERN.test(value))
+        return false;
+    // Reject "P", "PT" — pattern allows them but they have no components.
+    return value !== 'P' && value !== 'PT';
+};
 export const TYPE_MAPPING = {
     bool: ConfigValueType.Bool,
     boolean: ConfigValueType.Bool,
     double: ConfigValueType.Double,
+    duration: ConfigValueType.Duration,
     int: ConfigValueType.Int,
     string: ConfigValueType.String,
     'string-list': ConfigValueType.StringList,
@@ -50,6 +61,15 @@ export const coerceIntoType = (type, value) => {
                 throw new TypeError(`Invalid default value for JSON: ${value}`);
             }
         }
+        case 'duration': {
+            // durationToMilliseconds() returns 0 on no-match instead of throwing, so
+            // we anchor-check the format ourselves before delegating.
+            if (!isValidIsoDuration(value)) {
+                throw new TypeError(`Invalid default value for duration: ${value}. Expected ISO 8601 duration like PT30S, PT5M, PT1H30M.`);
+            }
+            const millis = durationToMilliseconds(value);
+            return [{ duration: { definition: value, millis } }, ConfigValueType.Duration];
+        }
         default: {
             return undefined;
         }

package/dist/util/config-value-dto.js

@@ -57,7 +57,9 @@ export function mapConfigValueToDto(configValue, valueType) {
         }
     }
     else if (configValue.duration !== undefined) {
-        value = configValue.duration;
+        // Storage / API expects {type: 'duration', value: '<ISO 8601 string>'} — not the
+        // internal {definition, millis} envelope used by the SDK's ConfigValue type.
+        value = configValue.duration.definition;
     }
     else if (configValue.intRange !== undefined) {
         value = configValue.intRange;