@quonfig/cli 0.0.20 → 0.0.22

package/dist/commands/override.js

@@ -1,173 +1,269 @@
-import { Flags } from '@oclif/core';
+import { Args, Flags } from '@oclif/core';
 import { APICommand } from '../index.js';
-import getEnvironment from '../ui/get-environment.js';
-import getString from '../ui/get-string.js';
-import autocomplete from '../util/autocomplete.js';
 import { checkmark } from '../util/color.js';
-import isInteractive from '../util/is-interactive.js';
-import nameArg from '../util/name-arg.js';
+import { loadTokens } from '../util/token-storage.js';
+const OVERRIDE_PROP = 'quonfig-user.email';
+const OVERRIDE_OP = 'PROP_IS_ONE_OF';
+/**
+ * Parse the fresh SHA out of a 409 conflict message of the form
+ *   "<path> was modified (expected <oldSha>, got <newSha>)"
+ * Returns undefined if the message doesn't match.
+ */
+function parseFreshShaFromConflict(message) {
+    if (!message)
+        return undefined;
+    const match = message.match(/got\s+([\w.-]+)\)/);
+    return match?.[1];
+}
+/**
+ * Coerce a raw CLI value string into the typed Value the server expects.
+ * Order matters: bool → int → double → json → string.
+ */
+function inferValue(raw) {
+    if (raw === 'true' || raw === 'false') {
+        return { type: 'bool', value: raw === 'true' };
+    }
+    if (/^-?\d+$/.test(raw)) {
+        return { type: 'int', value: Number.parseInt(raw, 10) };
+    }
+    if (/^-?\d+\.\d+$/.test(raw)) {
+        return { type: 'double', value: Number.parseFloat(raw) };
+    }
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            return { type: 'json', value: JSON.parse(trimmed) };
+        }
+        catch {
+            // Fall through to string — looked like JSON but didn't parse.
+        }
+    }
+    return { type: 'string', value: raw };
+}
+/**
+ * Find the existing override rule for a user in a specific env. Returns the
+ * value the user is currently overridden to, or undefined.
+ */
+function findExistingOverride(flag, env, userEmail) {
+    const envEntry = flag.environments?.find((e) => e.id === env);
+    for (const rule of envEntry?.rules ?? []) {
+        if (!rule.criteria || rule.criteria.length !== 1)
+            continue;
+        const c = rule.criteria[0];
+        if (c.propertyName !== OVERRIDE_PROP || c.operator !== OVERRIDE_OP)
+            continue;
+        const emails = c.valueToMatch?.value ?? [];
+        if (emails.includes(userEmail) && rule.value) {
+            return rule.value;
+        }
+    }
+    return undefined;
+}
+function valuesEqual(a, b) {
+    if (a.type !== b.type)
+        return false;
+    return JSON.stringify(a.value) === JSON.stringify(b.value);
+}
 export default class Override extends APICommand {
-    static args = { ...nameArg };
-    static description = `Override the value of an item for your user/SDK key combo.
+    static args = {
+        name: Args.string({ description: 'flag/config key to override' }),
+        value: Args.string({ description: 'new value (type inferred: bool/int/double/json/string)' }),
+    };
+    static description = `Override a flag value for your dev user.
 
-To target users other than yourself, or to express rules like "user.email == X → value Y",
-you cannot use override — see:
-  qfg config-schema   # operator reference + worked multi-rule example
-  qfg pull            # clone the workspace so you can edit JSON directly`;
+Writes a top-priority rule keyed on the dev-only quonfig-user.email property,
+so the override only fires for SDK clients that set quonfig-user.email in
+their context. Production SDKs typically don't set this property, which makes
+overrides effectively inert in production.
+
+Examples
+  qfg override                                # list flags where you have an override
+  qfg override my.flag true                   # set bool override
+  qfg override my.flag 42                     # set int override
+  qfg override my.flag '{"a":1}'              # set json override
+  qfg override my.flag --remove               # remove your override on my.flag
+  qfg override --clear                        # remove ALL of your overrides in this env`;
     static examples = [
-        '<%= config.bin %> <%= command.id %> # will prompt for name and value',
-        '<%= config.bin %> <%= command.id %> my.flag.name --value=true',
-        '<%= config.bin %> <%= command.id %> my.flag.name --remove',
-        '<%= config.bin %> <%= command.id %> my.double.config --value=3.14159',
+        '<%= config.bin %> <%= command.id %>',
+        '<%= config.bin %> <%= command.id %> my.flag true',
+        '<%= config.bin %> <%= command.id %> my.flag --remove',
+        '<%= config.bin %> <%= command.id %> --clear',
+        '<%= config.bin %> <%= command.id %> my.flag true --env=staging',
     ];
     static flags = {
-        environment: Flags.string({ description: 'environment to override in' }),
-        remove: Flags.boolean({ default: false, description: 'remove your override (if present)' }),
-        value: Flags.string({ description: 'value to use for your override' }),
+        clear: Flags.boolean({ default: false, description: 'remove ALL of your overrides in this env' }),
+        env: Flags.string({ description: 'environment to operate in (default: $QUONFIG_ENVIRONMENT)' }),
+        remove: Flags.boolean({ default: false, description: 'remove your override on this key' }),
     };
     async run() {
         const { args, flags } = await this.parse(Override);
-        if (flags.remove && flags.value) {
-            this.err('remove and value flags are mutually exclusive');
-        }
-        // Fetch all configs from metadata endpoint
-        const metadataRequest = await this.apiClient.post('/api/v1/metadata/list', { workspaceId: this.workspaceId });
-        if (!metadataRequest.ok) {
-            const errorMsg = metadataRequest.error?.error || `Failed to fetch configs: ${metadataRequest.status}`;
-            return this.err(errorMsg, { serverError: metadataRequest.error });
-        }
-        const metadataResponse = metadataRequest.json;
-        const configs = metadataResponse.configs;
-        // Get the environment
-        const environment = await getEnvironment({
-            command: this,
-            flags,
-            message: 'Which environment would you like to override in?',
-            providedEnvironment: flags.environment,
-        });
-        if (!environment) {
-            return;
-        }
-        // Get the key - from args or prompt
-        let key = args.name;
-        if (!key && isInteractive(flags)) {
-            const configKeys = configs.map((c) => c.key);
-            const selectedKey = await autocomplete({
-                message: 'Which item would you like to override?',
-                source: configKeys,
-            });
-            if (selectedKey) {
-                key = selectedKey;
-            }
+        const tokens = await loadTokens();
+        const userEmail = tokens?.userEmail;
+        if (!userEmail) {
+            return this.err('Not logged in. Run `qfg login` first.');
         }
-        if (!key) {
-            return this.err('Key is required');
+        const env = flags.env || process.env.QUONFIG_ENVIRONMENT;
+        if (!env) {
+            return this.err('No environment specified. Pass --env=<env> or set QUONFIG_ENVIRONMENT.');
         }
-        const config = configs.find((c) => c.key === key);
-        if (!config) {
-            return this.err(`Could not find config named ${key}`);
+        if (env === 'production') {
+            this.warn('Overrides on production are inert for SDK clients that do not set quonfig-user.email (most production SDKs do not). Continuing anyway.');
         }
-        this.verboseLog('Selected config:', config);
-        if (flags.remove) {
-            return this.removeOverride(key, environment.id, config.version);
-        }
-        // Get the value
-        let value = flags.value;
-        if (!value && isInteractive(flags)) {
-            value = await getString({
-                allowBlank: false,
-                message: 'Override value',
-            });
+        if (flags.clear) {
+            return this.runClear({ env, userEmail });
         }
-        if (!value) {
-            return this.err('Value is required');
+        if (!args.name) {
+            return this.runList({ env, userEmail });
         }
-        return this.setOverride(config, value, environment.id);
-    }
-    async removeOverride(key, environmentId, currentVersionId) {
-        const request = await this.apiClient.post('/internal/ops/v1/remove-variant', {
-            configKey: key,
-            currentVersionId,
-            environmentId,
-        });
-        if (request.ok) {
-            this.log(`${checkmark} Override removed`);
-            return;
+        if (flags.remove) {
+            return this.runRemove({ env, key: args.name, userEmail });
         }
-        // Handle 404 case - no override exists to remove
-        if (request.status === 404) {
-            this.log(`No override found for ${key}`);
-            return;
+        if (args.value === undefined) {
+            return this.err('Missing value. Usage: qfg override <key> <value> [--env=<env>]');
         }
-        this.err(`Failed to remove override: ${request.status}`, { key, serverError: request.error });
+        return this.runSet({ env, key: args.name, rawValue: args.value, userEmail });
     }
-    async setOverride(config, value, environmentId) {
-        const { key, valueType, version } = config;
-        // Map the valueType to the format expected by the API
-        const typeMapping = {
-            bool: 'bool',
-            string: 'string',
-            int: 'int',
-            double: 'double',
-            string_list: 'stringList',
-            json: 'json',
-            limit_definition: 'limitDefinition',
-            duration: 'duration',
-            int_range: 'intRange',
-        };
-        const type = typeMapping[valueType.toLowerCase()] || valueType;
-        // Parse the value based on type and build variant object
-        let variantValue = value;
-        let variantType = type;
-        switch (type) {
-            case 'stringList': {
-                variantValue = value.split(',');
-                variantType = 'string_list';
-                break;
-            }
-            case 'bool': {
-                variantValue = value.toLowerCase() === 'true';
-                break;
-            }
-            case 'int': {
-                variantValue = Number.parseInt(value, 10);
-                break;
-            }
-            case 'double': {
-                variantValue = Number.parseFloat(value);
-                break;
+    async callFindOrCreate(opts) {
+        let sha = opts.currentSha;
+        let attempt = 0;
+        // One stale-SHA retry: parse the fresh SHA from the 409 message and try again.
+        while (attempt < 2) {
+            attempt += 1;
+            // eslint-disable-next-line no-await-in-loop
+            const res = await this.apiClient.post('/api/v1/flags/findOrCreateOverride', {
+                currentSha: sha,
+                env: opts.env,
+                flagKey: opts.key,
+                userEmail: opts.userEmail,
+                value: opts.value,
+                workspaceId: this.workspaceId,
+            });
+            if (res.ok) {
+                const commitSha = res.json?.commitSha;
+                return this.ok(`${checkmark} Set override ${opts.key}=${JSON.stringify(opts.value.value)} (${opts.value.type}) for ${opts.userEmail} in env=${opts.env} (commit ${commitSha}).`, { commitSha, env: opts.env, key: opts.key, value: opts.value });
             }
-            case 'json': {
-                try {
-                    variantValue = JSON.parse(value);
-                }
-                catch {
-                    return this.err(`Invalid JSON value: ${value}`);
+            if (res.status === 409 && attempt === 1) {
+                const fresh = parseFreshShaFromConflict(res.error?.message);
+                if (fresh) {
+                    this.verboseLog(`Stale SHA — retrying once with fresh SHA ${fresh}`);
+                    sha = fresh;
+                    continue;
                 }
-                break;
             }
-            case 'string': {
-                variantValue = value;
-                break;
+            return this.err(`Failed to set override on ${opts.key}: ${res.status} ${JSON.stringify(res.error)}`);
+        }
+    }
+    async callRemove(opts) {
+        let sha = opts.flag.commitSha ?? '';
+        let attempt = 0;
+        while (attempt < 2) {
+            attempt += 1;
+            // eslint-disable-next-line no-await-in-loop
+            const res = await this.apiClient.post('/api/v1/flags/removeOverride', {
+                currentSha: sha,
+                env: opts.env,
+                flagKey: opts.key,
+                userEmail: opts.userEmail,
+                workspaceId: this.workspaceId,
+            });
+            if (res.ok)
+                return true;
+            if (res.status === 409 && attempt === 1) {
+                const fresh = parseFreshShaFromConflict(res.error?.message);
+                if (fresh) {
+                    this.verboseLog(`Stale SHA — retrying remove with fresh SHA ${fresh}`);
+                    sha = fresh;
+                    continue;
+                }
             }
-            // No default
-        }
-        const request = await this.apiClient.post('/internal/ops/v1/assign-variant', {
-            configKey: key,
-            currentVersionId: version,
-            environmentId,
-            variant: {
-                type: variantType,
-                value: variantValue,
-            },
+            this.err(`Failed to remove override on ${opts.key}: ${res.status} ${JSON.stringify(res.error)}`);
+            return false;
+        }
+        return false;
+    }
+    async fetchFlag(key) {
+        const res = await this.apiClient.post('/api/v1/flags/getByKey', {
+            flagKey: key,
+            workspaceId: this.workspaceId,
+        });
+        if (!res.ok) {
+            if (res.status === 404)
+                return undefined;
+            this.err(`Failed to fetch flag ${key}: ${res.status} ${JSON.stringify(res.error)}`);
+            return undefined;
+        }
+        return res.json;
+    }
+    async runClear(opts) {
+        const res = await this.apiClient.post('/api/v1/flags/list', { workspaceId: this.workspaceId });
+        if (!res.ok) {
+            return this.err(`Failed to list flags: ${res.status} ${JSON.stringify(res.error)}`);
+        }
+        const flags = res.json ?? [];
+        const targets = flags.filter((f) => findExistingOverride(f, opts.env, opts.userEmail) !== undefined);
+        if (targets.length === 0) {
+            return this.ok(`No overrides to clear in env=${opts.env}.`);
+        }
+        const cleared = [];
+        for (const f of targets) {
+            // eslint-disable-next-line no-await-in-loop
+            const removed = await this.callRemove({
+                env: opts.env,
+                flag: f,
+                key: f.key,
+                userEmail: opts.userEmail,
+            });
+            if (removed)
+                cleared.push(f.key);
+        }
+        return this.ok(`${checkmark} Cleared ${cleared.length} override(s) in env=${opts.env}: ${cleared.join(', ')}`);
+    }
+    async runList(opts) {
+        const res = await this.apiClient.post('/api/v1/flags/list', { workspaceId: this.workspaceId });
+        if (!res.ok) {
+            return this.err(`Failed to list flags: ${res.status} ${JSON.stringify(res.error)}`);
+        }
+        const flags = res.json ?? [];
+        const overridden = flags.filter((f) => findExistingOverride(f, opts.env, opts.userEmail) !== undefined);
+        if (overridden.length === 0) {
+            return this.ok(`You have no overrides in env=${opts.env}.`);
+        }
+        this.log(`Your overrides in env=${opts.env}:`);
+        for (const f of overridden) {
+            const v = findExistingOverride(f, opts.env, opts.userEmail);
+            this.log(`  ${f.key} = ${JSON.stringify(v?.value)} (${v?.type})`);
+        }
+        return { env: opts.env, overrides: overridden.map((f) => f.key) };
+    }
+    async runRemove(opts) {
+        const flag = await this.fetchFlag(opts.key);
+        if (!flag) {
+            return this.err(`Flag ${opts.key} not found.`);
+        }
+        const existing = findExistingOverride(flag, opts.env, opts.userEmail);
+        if (!existing) {
+            return this.ok(`You have no override on ${opts.key} in env=${opts.env}.`);
+        }
+        const removed = await this.callRemove({ env: opts.env, flag, key: opts.key, userEmail: opts.userEmail });
+        return removed ? this.ok(`${checkmark} Removed override on ${opts.key} in env=${opts.env}.`) : undefined;
+    }
+    async runSet(opts) {
+        const value = inferValue(opts.rawValue);
+        const flag = await this.fetchFlag(opts.key);
+        if (!flag) {
+            return this.err(`Flag ${opts.key} not found.`);
+        }
+        const existing = findExistingOverride(flag, opts.env, opts.userEmail);
+        if (existing && valuesEqual(existing, value)) {
+            return this.ok(`${opts.key} is already set to ${JSON.stringify(value.value)} (${value.type}) for ${opts.userEmail} in env=${opts.env}.`);
+        }
+        const sha = flag.commitSha ?? '';
+        return this.callFindOrCreate({
+            currentSha: sha,
+            env: opts.env,
+            key: opts.key,
+            userEmail: opts.userEmail,
+            value,
         });
-        if (request.ok) {
-            this.log(`${checkmark} Override set`);
-            return { key, success: true };
-        }
-        const errMsg = request.status === 400
-            ? `Failed to override value: ${request.status} -- is ${value} a valid ${type}?`
-            : `Failed to override value: ${request.status}`;
-        this.err(errMsg, { key, serverError: request.error });
     }
 }

package/dist/quonfig.js

@@ -1,4 +1,5 @@
 import { Quonfig } from '@quonfig/node';
+import { getDeliveryUrl } from './util/domain-urls.js';
 let quonfig;
 const DEFAULT_CONTEXT_USER_ID_NAMESPACE = 'prefab-api-key';
 const DEFAULT_CONTEXT_USER_ID = 'user-id';
@@ -14,7 +15,7 @@ export const initQuonfig = async (_ctx, flagsOrDatafile) => {
         }
         sdkKey = flagsOrDatafile['sdk-key'];
     }
-    const apiUrl = process.env.QUONFIG_API_URL || 'https://api.quonfig.com';
+    const apiUrl = getDeliveryUrl();
     quonfig = new Quonfig({
         sdkKey,
         collectEvaluationSummaries: false,

package/dist/util/coerce.js

@@ -1,10 +1,21 @@
-import { ConfigValueType } from '@quonfig/node';
+import { ConfigValueType, durationToMilliseconds } from '@quonfig/node';
 const TRUE_VALUES = new Set(['true', '1', 't']);
 const BOOLEAN_VALUES = new Set([...TRUE_VALUES, 'false', '0', 'f']);
+// Strict ISO 8601 duration: at least one of D/H/M/S must be present (i.e. bare "P"
+// or "PT" alone are rejected). Mirrors the lenient pattern in @quonfig/node but
+// adds anchors and a non-empty check.
+const ISO_DURATION_PATTERN = /^P(?:\d+(?:\.\d+)?D)?(?:T(?:\d+(?:\.\d+)?H)?(?:\d+(?:\.\d+)?M)?(?:\d+(?:\.\d+)?S)?)?$/;
+const isValidIsoDuration = (value) => {
+    if (!ISO_DURATION_PATTERN.test(value))
+        return false;
+    // Reject "P", "PT" — pattern allows them but they have no components.
+    return value !== 'P' && value !== 'PT';
+};
 export const TYPE_MAPPING = {
     bool: ConfigValueType.Bool,
     boolean: ConfigValueType.Bool,
     double: ConfigValueType.Double,
+    duration: ConfigValueType.Duration,
     int: ConfigValueType.Int,
     string: ConfigValueType.String,
     'string-list': ConfigValueType.StringList,
@@ -50,6 +61,15 @@ export const coerceIntoType = (type, value) => {
                 throw new TypeError(`Invalid default value for JSON: ${value}`);
             }
         }
+        case 'duration': {
+            // durationToMilliseconds() returns 0 on no-match instead of throwing, so
+            // we anchor-check the format ourselves before delegating.
+            if (!isValidIsoDuration(value)) {
+                throw new TypeError(`Invalid default value for duration: ${value}. Expected ISO 8601 duration like PT30S, PT5M, PT1H30M.`);
+            }
+            const millis = durationToMilliseconds(value);
+            return [{ duration: { definition: value, millis } }, ConfigValueType.Duration];
+        }
         default: {
             return undefined;
         }

package/dist/util/config-value-dto.js

@@ -57,7 +57,9 @@ export function mapConfigValueToDto(configValue, valueType) {
         }
     }
     else if (configValue.duration !== undefined) {
-        value = configValue.duration;
+        // Storage / API expects {type: 'duration', value: '<ISO 8601 string>'} — not the
+        // internal {definition, millis} envelope used by the SDK's ConfigValue type.
+        value = configValue.duration.definition;
     }
     else if (configValue.intRange !== undefined) {
         value = configValue.intRange;

package/dist/util/domain-urls.d.ts

@@ -1,3 +1,4 @@
 export declare const getDomain: () => string;
 export declare const getApiUrl: (domain?: string) => string;
 export declare const getAppUrl: (domain?: string) => string;
+export declare const getDeliveryUrl: (domain?: string) => string;

package/dist/util/domain-urls.js

@@ -16,3 +16,10 @@ export const getAppUrl = (domain) => {
     const actualDomain = domain || getDomain();
     return `https://app.${actualDomain}`;
 };
+export const getDeliveryUrl = (domain) => {
+    if (process.env.QUONFIG_API_URL) {
+        return process.env.QUONFIG_API_URL;
+    }
+    const actualDomain = domain || getDomain();
+    return `https://primary.${actualDomain}`;
+};

package/dist/util/resolve-workspace.js

@@ -1,6 +1,6 @@
 import { getApiUrl } from './domain-urls.js';
 import { getValidAccessToken } from './get-valid-token.js';
-import { getActiveProfile, loadAuthConfig, resolveWorkspaceId as resolveOAuthWorkspaceId, } from './token-storage.js';
+import { getActiveProfile, loadAuthConfig, loadTokens, resolveWorkspaceId as resolveOAuthWorkspaceId, saveAuthConfig, } from './token-storage.js';
 const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 /**
  * Resolve the target workspace UUID for commands that don't extend APICommand
@@ -52,9 +52,18 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
         return match.workspaceId;
     }
     // OAuth path.
-    const authConfig = await loadAuthConfig();
+    let authConfig = await loadAuthConfig();
     if (!authConfig) {
-        command.error('Not logged in. Run `qfg login` first (or set QUONFIG_API_KEY for CI).', { exit: 401 });
+        // Auth config can be missing while tokens.json still holds a valid
+        // refresh_token — e.g. after the domain-scoped config split (commit
+        // 0f8bee6) or a partial login that wrote tokens but never the config
+        // (qfg-2qj). getValidAccessToken already knows how to refresh, so try
+        // that path before declaring "Not logged in".
+        const tokens = await loadTokens();
+        if (!tokens?.refreshToken) {
+            command.error('Not logged in. Run `qfg login` first (or set QUONFIG_API_KEY for CI).', { exit: 401 });
+        }
+        authConfig = await recoverAuthConfigFromTokens(command);
     }
     if (override) {
         const resolved = resolveOAuthWorkspaceId(authConfig, override);
@@ -73,3 +82,60 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
     }
     return profileData.workspace;
 }
+/**
+ * Best-effort rebuild of the on-disk auth config from a working refresh_token.
+ * Calls /api/v1/userWorkspaces/list to discover the user's workspaces, persists
+ * the first one as the default profile, and returns the recovered config.
+ *
+ * Bails to command.error on any failure (refresh, network, no workspaces) with
+ * a message that points the user at `qfg login`.
+ */
+async function recoverAuthConfigFromTokens(command) {
+    let jwt;
+    try {
+        jwt = await getValidAccessToken(command.verboseLog);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        command.error(`Tokens found but refresh failed: ${detail}. Run \`qfg login\` to repopulate.`, { exit: 401 });
+    }
+    let res;
+    try {
+        res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ json: {} }),
+        });
+    }
+    catch (error) {
+        command.error(`Tokens found but failed to fetch workspaces: ${error instanceof Error ? error.message : String(error)}. Run \`qfg login\` to repopulate.`, { exit: 401 });
+    }
+    if (!res.ok) {
+        command.error(`Tokens found but workspace list returned HTTP ${res.status}. Run \`qfg login\` to repopulate.`, { exit: 401 });
+    }
+    const body = (await res.json());
+    const entries = (body.json ?? body);
+    const candidates = Array.isArray(entries) ? entries : [];
+    if (candidates.length === 0) {
+        command.error('Tokens found but no workspace profile on disk. Run `qfg login` to repopulate.', { exit: 401 });
+    }
+    const match = candidates[0];
+    const recovered = {
+        defaultProfile: 'default',
+        profiles: {
+            default: {
+                workspace: match.workspaceId,
+                workspaceName: match.workspaceSlug,
+                workspaceSlug: match.workspaceSlug,
+                organizationName: match.organizationName,
+            },
+        },
+    };
+    await saveAuthConfig(recovered);
+    command.verboseLog('resolve-workspace: recovered auth config from tokens', {
+        workspaceId: match.workspaceId,
+        workspaceSlug: match.workspaceSlug,
+        candidateCount: candidates.length,
+    });
+    return recovered;
+}

package/dist/util/token-storage.d.ts

@@ -24,9 +24,11 @@ export interface AuthConfig {
  * Used to resolve QUONFIG_WORKSPACE and --workspace flag values.
  */
 export declare const resolveWorkspaceId: (config: AuthConfig, slug: string) => string | undefined;
-export declare const saveTokens: (tokens: TokenData, options?: TokenStorageOptions) => Promise<void>;
+export declare const getTokenFilePath: (options?: TokenStorageOptions) => string;
+export declare const getAuthConfigFilePath: (options?: TokenStorageOptions) => string;
+export declare const saveTokens: (tokens: TokenData, options?: TokenStorageOptions) => Promise<string>;
 export declare const loadTokens: (options?: TokenStorageOptions) => Promise<TokenData | null>;
-export declare const saveAuthConfig: (config: AuthConfig, options?: TokenStorageOptions) => Promise<void>;
+export declare const saveAuthConfig: (config: AuthConfig, options?: TokenStorageOptions) => Promise<string>;
 export declare const loadAuthConfig: (options?: TokenStorageOptions) => Promise<AuthConfig | null>;
 export declare const getActiveProfile: (profileArg?: string) => string;
 export declare const clearAuth: (options?: TokenStorageOptions) => Promise<void>;

package/dist/util/token-storage.js

@@ -34,12 +34,37 @@ const ensureQuonfigDir = async (options) => {
         await fs.promises.mkdir(quonfigDir, { recursive: true });
     }
 };
+export const getTokenFilePath = (options) => getTokenFile(options);
+export const getAuthConfigFilePath = (options) => getConfigFile(options);
+const verifyWritten = async (filePath, label) => {
+    let stat;
+    try {
+        stat = await fs.promises.stat(filePath);
+    }
+    catch (error) {
+        throw new Error(`Failed to persist ${label} to ${filePath}: file is missing after write (${error.message}). ` +
+            `This can happen if a concurrent process (e.g. npm install -g) clobbered the install. Re-run after it finishes.`);
+    }
+    if (!stat.isFile() || stat.size === 0) {
+        throw new Error(`Failed to persist ${label} to ${filePath}: file is empty or not a regular file after write.`);
+    }
+};
 export const saveTokens = async (tokens, options) => {
     await ensureQuonfigDir(options);
     const targetFile = getTokenFile(options);
     const tmpFile = `${targetFile}.tmp`;
     await fs.promises.writeFile(tmpFile, JSON.stringify(tokens, null, 2), { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(tmpFile, targetFile);
+    await verifyWritten(targetFile, 'tokens');
+    // Round-trip parse to confirm the file on disk is the JSON we just wrote.
+    try {
+        const onDisk = await fs.promises.readFile(targetFile, 'utf8');
+        JSON.parse(onDisk);
+    }
+    catch (error) {
+        throw new Error(`Failed to verify tokens at ${targetFile}: ${error.message}`);
+    }
+    return targetFile;
 };
 export const loadTokens = async (options) => {
     try {
@@ -77,6 +102,8 @@ export const saveAuthConfig = async (config, options) => {
     const configTmp = `${configTarget}.tmp`;
     await fs.promises.writeFile(configTmp, configContent, { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(configTmp, configTarget);
+    await verifyWritten(configTarget, 'auth config');
+    return configTarget;
 };
 export const loadAuthConfig = async (options) => {
     try {