@quonfig/cli 0.0.24 → 0.0.26

package/dist/util/quonfig-json.d.ts

@@ -1,18 +1,24 @@
 /**
  * Reader/writer for the workspace's `quonfig.json` file.
  *
- * Today the file is `{ environments: string[] }`. We are adding an optional
- * `workspace: "<slug>"` pin (Guard 1 in `project/plans/cli-git-sync.md`)
- * so commands like `qfg push` can confirm that the local dir belongs to the
- * cloud workspace they think it does.
+ * The `workspace` pin is stored as `<org-slug>/<workspace-slug>` (Guard 1 in
+ * `project/plans/cli-git-sync.md`, multi-org form in
+ * `project/plans/multi-org-cli-auth.md`). `qfg push` uses it to confirm that
+ * the local dir belongs to the cloud workspace the user thinks it does.
  *
- * The reader is permissive: missing file or missing field returns `undefined`
- * (no throw). It only throws when the file exists but cannot be parsed.
+ * The reader returns `{orgSlug, workspaceSlug}` when the field is present.
+ * Missing file or missing field returns `undefined`. A bare slug (no `/`)
+ * throws with a migration message — bare slugs are no longer accepted.
  *
- * The writer preserves all unknown fields, sticks to 2-space indent, and
- * always ends with a trailing newline — matching how `qfg init` and the
- * migrate flow create the file today.
+ * The writer always emits the `<org>/<ws>` form. It preserves all unknown
+ * fields and, when the file already exists, does a format-stable in-place
+ * edit so the diff is just the pin line. Missing or unparseable files fall
+ * back to canonical 2-space JSON with a trailing newline.
  */
+export interface WorkspacePin {
+    orgSlug: string;
+    workspaceSlug: string;
+}
 /**
  * Shape of `quonfig.json`. Everything is optional from the reader's
  * perspective so a partially-written or in-flight file doesn't blow up
@@ -21,24 +27,55 @@
 export interface QuonfigJson {
     [key: string]: unknown;
     environments?: string[];
-    /** Workspace slug (human-readable, not the UUID). Used as the repo pin. */
+    /** `<org-slug>/<workspace-slug>` pin string. */
     workspace?: string;
 }
 /**
- * Read the workspace slug pin from `<dir>/quonfig.json`.
+ * Non-throwing variant of `parsePinString`. Returns `undefined` when `raw`
+ * isn't in `<org>/<ws>` form (e.g. a bare slug from a transitional backend
+ * response). Callers that want the migration error should use
+ * `readWorkspaceSlug` instead.
+ */
+export declare function tryParseWorkspacePin(raw: string): WorkspacePin | undefined;
+/**
+ * Read the workspace pin from `<dir>/quonfig.json`.
  *
  * Returns `undefined` when the file is missing OR when the `workspace`
- * field is absent OR when the field is present but not a string.
- * Throws only when the file exists but contains malformed JSON, since
- * that is a real bug a caller should surface.
+ * field is absent OR when the field is present but not a string. Throws
+ * when the file is malformed JSON, OR when the workspace value is a bare
+ * slug (no `/`) — bare slugs are rejected with a migration message.
  */
-export declare function readWorkspaceSlug(dir: string): Promise<string | undefined>;
+export declare function readWorkspaceSlug(dir: string): Promise<WorkspacePin | undefined>;
 /**
- * Write the workspace slug pin into `<dir>/quonfig.json`.
+ * Write the workspace pin into `<dir>/quonfig.json`, always in the
+ * `<org-slug>/<workspace-slug>` form.
+ *
+ * If the file exists and is parseable, the existing bytes are preserved
+ * verbatim except for the `workspace` key — either its value is replaced
+ * in place, or the new key is inserted just before the closing brace
+ * using the file's existing indentation. This keeps the git diff to the
+ * single pin line on first backfill (no reflow of `environments` or
+ * unrelated formatting).
+ *
+ * If the file is missing or cannot be parsed, fall back to a canonical
+ * 2-space JSON write with a trailing newline.
+ *
+ * Throws when either component is empty or contains a `/` — bare slugs
+ * are not accepted on the write path.
+ */
+export declare function writeWorkspaceSlug(dir: string, pin: WorkspacePin): Promise<void>;
+/**
+ * Format-stable in-place edit of `quonfig.json`.
+ *
+ * Returns the new file bytes, or `undefined` if the input isn't a shape we
+ * can safely edit (malformed JSON, non-object root, or no closing brace
+ * found). Caller should fall back to a canonical write in that case.
  *
- * If the file exists, all other fields are preserved and only `workspace`
- * is set/overwritten. If the file is missing, a minimal `{workspace: slug}`
- * file is created. Format is 2-space indent + trailing newline to match
- * the file shape produced by `qfg init` and `qfg migrate`.
+ * Two cases:
+ * 1. `workspace` key already present (with a string value) → replace just
+ *    the value bytes via regex. Diff is one token.
+ * 2. `workspace` key absent → splice a new key before the closing brace,
+ *    using indentation detected from the first existing key (or 2-space
+ *    default for an empty object). Other keys are untouched.
  */
-export declare function writeWorkspaceSlug(dir: string, slug: string): Promise<void>;
+export declare function upsertWorkspaceKey(raw: string, slug: string): string | undefined;

package/dist/util/quonfig-json.js

@@ -1,21 +1,25 @@
 /**
  * Reader/writer for the workspace's `quonfig.json` file.
  *
- * Today the file is `{ environments: string[] }`. We are adding an optional
- * `workspace: "<slug>"` pin (Guard 1 in `project/plans/cli-git-sync.md`)
- * so commands like `qfg push` can confirm that the local dir belongs to the
- * cloud workspace they think it does.
+ * The `workspace` pin is stored as `<org-slug>/<workspace-slug>` (Guard 1 in
+ * `project/plans/cli-git-sync.md`, multi-org form in
+ * `project/plans/multi-org-cli-auth.md`). `qfg push` uses it to confirm that
+ * the local dir belongs to the cloud workspace the user thinks it does.
  *
- * The reader is permissive: missing file or missing field returns `undefined`
- * (no throw). It only throws when the file exists but cannot be parsed.
+ * The reader returns `{orgSlug, workspaceSlug}` when the field is present.
+ * Missing file or missing field returns `undefined`. A bare slug (no `/`)
+ * throws with a migration message — bare slugs are no longer accepted.
  *
- * The writer preserves all unknown fields, sticks to 2-space indent, and
- * always ends with a trailing newline — matching how `qfg init` and the
- * migrate flow create the file today.
+ * The writer always emits the `<org>/<ws>` form. It preserves all unknown
+ * fields and, when the file already exists, does a format-stable in-place
+ * edit so the diff is just the pin line. Missing or unparseable files fall
+ * back to canonical 2-space JSON with a trailing newline.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 const QUONFIG_JSON = 'quonfig.json';
+const BARE_SLUG_MIGRATION_MESSAGE = 'quonfig.json workspace value must be in org/workspace form (e.g. acme/foo). ' +
+    'Update your quonfig.json and run `qfg login` if you have not yet migrated.';
 async function readQuonfigJson(dir) {
     const filePath = path.join(dir, QUONFIG_JSON);
     let raw;
@@ -35,31 +39,156 @@ async function readQuonfigJson(dir) {
     return parsed;
 }
 /**
- * Read the workspace slug pin from `<dir>/quonfig.json`.
+ * Parse a `<org-slug>/<workspace-slug>` pin string. Throws with the migration
+ * message when the value is bare or malformed (empty parts, extra slashes).
+ */
+function parsePinString(raw) {
+    const parsed = tryParseWorkspacePin(raw);
+    if (!parsed)
+        throw new Error(BARE_SLUG_MIGRATION_MESSAGE);
+    return parsed;
+}
+/**
+ * Non-throwing variant of `parsePinString`. Returns `undefined` when `raw`
+ * isn't in `<org>/<ws>` form (e.g. a bare slug from a transitional backend
+ * response). Callers that want the migration error should use
+ * `readWorkspaceSlug` instead.
+ */
+export function tryParseWorkspacePin(raw) {
+    const parts = raw.split('/');
+    if (parts.length !== 2 || parts[0].length === 0 || parts[1].length === 0)
+        return undefined;
+    return { orgSlug: parts[0], workspaceSlug: parts[1] };
+}
+/**
+ * Read the workspace pin from `<dir>/quonfig.json`.
  *
  * Returns `undefined` when the file is missing OR when the `workspace`
- * field is absent OR when the field is present but not a string.
- * Throws only when the file exists but contains malformed JSON, since
- * that is a real bug a caller should surface.
+ * field is absent OR when the field is present but not a string. Throws
+ * when the file is malformed JSON, OR when the workspace value is a bare
+ * slug (no `/`) — bare slugs are rejected with a migration message.
  */
 export async function readWorkspaceSlug(dir) {
     const parsed = await readQuonfigJson(dir);
     if (!parsed)
         return undefined;
     const slug = parsed.workspace;
-    return typeof slug === 'string' ? slug : undefined;
+    if (typeof slug !== 'string')
+        return undefined;
+    return parsePinString(slug);
 }
 /**
- * Write the workspace slug pin into `<dir>/quonfig.json`.
+ * Write the workspace pin into `<dir>/quonfig.json`, always in the
+ * `<org-slug>/<workspace-slug>` form.
  *
- * If the file exists, all other fields are preserved and only `workspace`
- * is set/overwritten. If the file is missing, a minimal `{workspace: slug}`
- * file is created. Format is 2-space indent + trailing newline to match
- * the file shape produced by `qfg init` and `qfg migrate`.
+ * If the file exists and is parseable, the existing bytes are preserved
+ * verbatim except for the `workspace` key — either its value is replaced
+ * in place, or the new key is inserted just before the closing brace
+ * using the file's existing indentation. This keeps the git diff to the
+ * single pin line on first backfill (no reflow of `environments` or
+ * unrelated formatting).
+ *
+ * If the file is missing or cannot be parsed, fall back to a canonical
+ * 2-space JSON write with a trailing newline.
+ *
+ * Throws when either component is empty or contains a `/` — bare slugs
+ * are not accepted on the write path.
  */
-export async function writeWorkspaceSlug(dir, slug) {
-    const existing = (await readQuonfigJson(dir)) ?? {};
-    const next = { ...existing, workspace: slug };
+export async function writeWorkspaceSlug(dir, pin) {
+    const slug = formatPin(pin);
     const filePath = path.join(dir, QUONFIG_JSON);
+    let raw;
+    try {
+        raw = await fs.promises.readFile(filePath, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (raw !== undefined) {
+        const updated = upsertWorkspaceKey(raw, slug);
+        if (updated !== undefined) {
+            await fs.promises.writeFile(filePath, updated, 'utf8');
+            return;
+        }
+    }
+    // Fallback: file missing, or existing file is unparseable / has a
+    // shape we can't safely edit in place. Write canonical JSON.
+    const existing = (raw === undefined ? undefined : safeParse(raw)) ?? {};
+    const next = { ...existing, workspace: slug };
     await fs.promises.writeFile(filePath, JSON.stringify(next, null, 2) + '\n', 'utf8');
 }
+function formatPin(pin) {
+    if (pin.orgSlug.length === 0 ||
+        pin.workspaceSlug.length === 0 ||
+        pin.orgSlug.includes('/') ||
+        pin.workspaceSlug.includes('/')) {
+        throw new Error(`Invalid workspace pin: orgSlug=${JSON.stringify(pin.orgSlug)}, workspaceSlug=${JSON.stringify(pin.workspaceSlug)}. Both parts must be non-empty and must not contain '/'.`);
+    }
+    return `${pin.orgSlug}/${pin.workspaceSlug}`;
+}
+function safeParse(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Format-stable in-place edit of `quonfig.json`.
+ *
+ * Returns the new file bytes, or `undefined` if the input isn't a shape we
+ * can safely edit (malformed JSON, non-object root, or no closing brace
+ * found). Caller should fall back to a canonical write in that case.
+ *
+ * Two cases:
+ * 1. `workspace` key already present (with a string value) → replace just
+ *    the value bytes via regex. Diff is one token.
+ * 2. `workspace` key absent → splice a new key before the closing brace,
+ *    using indentation detected from the first existing key (or 2-space
+ *    default for an empty object). Other keys are untouched.
+ */
+export function upsertWorkspaceKey(raw, slug) {
+    const parsed = safeParse(raw);
+    if (parsed === undefined)
+        return undefined;
+    const slugJson = JSON.stringify(slug);
+    if (typeof parsed.workspace === 'string') {
+        // Replace the existing string value. The regex tolerates whitespace
+        // around the colon and any escaped chars in the current value.
+        const re = /("workspace"\s*:\s*)"(?:[^"\\]|\\.)*"/;
+        if (!re.test(raw))
+            return undefined;
+        return raw.replace(re, `$1${slugJson}`);
+    }
+    // Insert a new key. Find the closing brace and walk back over trailing
+    // whitespace to locate the end of the last value (if any).
+    const closingIdx = raw.lastIndexOf('}');
+    if (closingIdx === -1)
+        return undefined;
+    let endOfLastValue = closingIdx - 1;
+    while (endOfLastValue >= 0 && /\s/.test(raw[endOfLastValue]))
+        endOfLastValue--;
+    const before = raw.slice(0, endOfLastValue + 1);
+    const after = raw.slice(endOfLastValue + 1);
+    const hasOtherKeys = Object.keys(parsed).length > 0;
+    // Detect indent from the first nested key. Default to two spaces.
+    const indentMatch = raw.match(/\n([ \t]+)"/);
+    const indent = indentMatch ? indentMatch[1] : '  ';
+    // If the original used a multi-line object (closing brace on its own
+    // line), keep that shape. Otherwise the original was a single-line
+    // object like `{}` or `{"k":v}` — emit on one line.
+    const isMultiline = /\n\s*\}\s*$/.test(raw) || /\n/.test(raw.slice(0, closingIdx));
+    let insertion;
+    if (isMultiline) {
+        insertion = hasOtherKeys ? `,\n${indent}"workspace": ${slugJson}` : `\n${indent}"workspace": ${slugJson}`;
+    }
+    else {
+        insertion = hasOtherKeys ? `, "workspace": ${slugJson}` : `"workspace": ${slugJson}`;
+    }
+    return before + insertion + after;
+}

package/dist/util/resolve-workspace.js

@@ -1,7 +1,10 @@
 import { getApiUrl } from './domain-urls.js';
-import { getValidAccessToken } from './get-valid-token.js';
-import { getActiveProfile, loadAuthConfig, loadTokens, resolveWorkspaceId as resolveOAuthWorkspaceId, saveAuthConfig, } from './token-storage.js';
+import { getValidAccessToken, resolveDefaultOrgId } from './get-valid-token.js';
+import { tryParseWorkspacePin } from './quonfig-json.js';
+import { findOrgIdBySlug, getActiveProfile, loadAuthConfig, loadTokens, saveAuthConfig, } from './token-storage.js';
 const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
+const BARE_SLUG_ENV_MIGRATION_MESSAGE = 'QUONFIG_WORKSPACE must be in org/workspace form (e.g. acme/foo). ' +
+    'Bare workspace slugs are no longer accepted. Update your .env and run `qfg login` if you have not yet migrated.';
 /**
  * Resolve the target workspace UUID for commands that don't extend APICommand
  * (e.g. pull, push — which talk to Gitea, not the oRPC API, but still need to
@@ -26,7 +29,8 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
             return override;
         }
         // Slug — resolve via the server since there's no local auth config in CI mode.
-        const jwt = await getValidAccessToken(command.verboseLog);
+        // API-key path short-circuits before consulting the orgId.
+        const jwt = await getValidAccessToken('', command.verboseLog);
         let res;
         try {
             res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
@@ -53,7 +57,15 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
         command.verboseLog('ApiKey auth', { source: 'slug', slug: override, workspaceId: match.workspaceId });
         return match.workspaceId;
     }
-    // OAuth path.
+    // OAuth path with an explicit override → must be in org/ws form. Parse,
+    // look up the workosOrgId for that org slug in the local token store, and
+    // resolve the workspaceSlug *within that org*. Bare slug is rejected with
+    // a migration message (the API-key branch above is the one exception).
+    if (override) {
+        return resolveOrgScopedWorkspace(command, override);
+    }
+    // No override → fall back to the saved default profile, recovering the
+    // auth config from tokens if the config file is absent.
     let authConfig = await loadAuthConfig();
     if (!authConfig) {
         // Auth config can be missing while tokens.json still holds a valid
@@ -61,22 +73,13 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
         // 0f8bee6) or a partial login that wrote tokens but never the config
         // (qfg-2qj). getValidAccessToken already knows how to refresh, so try
         // that path before declaring "Not logged in".
-        const tokens = await loadTokens();
-        if (!tokens?.refreshToken) {
+        const store = await loadTokens();
+        const tokens = store ? Object.values(store.tokensByOrg)[0] : undefined;
+        if (!tokens?.refresh_token) {
             command.error('Not logged in. Run `qfg login` first (or set QUONFIG_API_KEY for CI).', { exit: 401 });
         }
         authConfig = await recoverAuthConfigFromTokens(command);
     }
-    if (override) {
-        const resolved = resolveOAuthWorkspaceId(authConfig, override);
-        if (resolved)
-            return resolved;
-        // Fall back to treating the override as a profile name.
-        const profileData = authConfig.profiles[override];
-        if (profileData?.workspace)
-            return profileData.workspace;
-        command.error(`Workspace "${override}" not found. Run \`qfg workspace switch\` to pick one.`, { exit: 1 });
-    }
     const activeProfile = getActiveProfile();
     const profileData = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
     if (!profileData?.workspace) {
@@ -84,6 +87,63 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
     }
     return profileData.workspace;
 }
+/**
+ * OAuth-mode resolver for an explicit `<org-slug>/<workspace-slug>` override.
+ *
+ * 1. Parse the override; bare slug → migration error.
+ * 2. Look up workosOrgId via the token store's org_slug index. If the user
+ *    hasn't logged in to that org, error with `qfg login` instructions.
+ * 3. Mint/refresh an org-scoped JWT for that org, call /userWorkspaces/list,
+ *    and pick the entry whose (workosOrgId, workspaceSlug) matches.
+ */
+async function resolveOrgScopedWorkspace(command, override) {
+    const pin = tryParseWorkspacePin(override);
+    if (!pin) {
+        command.error(BARE_SLUG_ENV_MIGRATION_MESSAGE, { exit: 1 });
+    }
+    const { orgSlug, workspaceSlug } = pin;
+    const store = await loadTokens();
+    if (!store) {
+        command.error('Not logged in. Run `qfg login` first (or set QUONFIG_API_KEY for CI).', { exit: 401 });
+    }
+    const workosOrgId = findOrgIdBySlug(store, orgSlug);
+    if (!workosOrgId) {
+        command.error(`No token found for org \`${orgSlug}\`. Run \`qfg login\` to add this org.`, { exit: 401 });
+    }
+    let jwt;
+    try {
+        jwt = await getValidAccessToken(workosOrgId, command.verboseLog);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        command.error(`Session expired for org ${orgSlug}: ${detail}. Run \`qfg login\` to re-authenticate.`, { exit: 401 });
+    }
+    let res;
+    try {
+        res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ json: {} }),
+        });
+    }
+    catch (error) {
+        command.error(`Failed to resolve workspace "${override}": ${error instanceof Error ? error.message : String(error)}`, { exit: 1 });
+    }
+    if (!res.ok) {
+        command.error(`Failed to resolve workspace "${override}" (HTTP ${res.status}).`, { exit: 1 });
+    }
+    const body = (await res.json());
+    const entries = (body.json ?? body);
+    const candidates = Array.isArray(entries) ? entries : [];
+    const match = candidates.find((w) => w.workosOrgId === workosOrgId && w.workspaceSlug === workspaceSlug);
+    if (!match) {
+        const inOrg = candidates.filter((w) => w.workosOrgId === workosOrgId).map((w) => w.workspaceSlug);
+        const available = inOrg.length > 0 ? inOrg.join(', ') : '(none)';
+        command.error(`Workspace "${workspaceSlug}" not found in org "${orgSlug}". Available: ${available}.`, { exit: 1 });
+    }
+    command.verboseLog('OAuth workspace lookup', { orgSlug, workspaceSlug, workosOrgId, workspaceId: match.workspaceId });
+    return match.workspaceId;
+}
 /**
  * Best-effort rebuild of the on-disk auth config from a working refresh_token.
  * Calls /api/v1/userWorkspaces/list to discover the user's workspaces, persists
@@ -95,7 +155,9 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
 async function recoverAuthConfigFromTokens(command) {
     let jwt;
     try {
-        jwt = await getValidAccessToken(command.verboseLog);
+        // TODO(qfg-kr7.5): pick the orgId resolved from the workspace address.
+        const orgId = await resolveDefaultOrgId();
+        jwt = await getValidAccessToken(orgId, command.verboseLog);
     }
     catch (error) {
         const detail = error instanceof Error ? error.message : String(error);

package/dist/util/token-storage.d.ts

@@ -1,13 +1,36 @@
 export interface TokenStorageOptions {
     quonfigDir?: string;
 }
-export interface TokenData {
-    accessToken: string;
-    expiresAt: number;
-    refreshToken: string;
-    userEmail?: string;
-    userId?: string;
+export interface TokenSet {
+    access_token: string;
+    expires_at: number;
+    refresh_token: string;
+    user_email?: string;
+    user_id?: string;
+    /**
+     * Human-readable org slug (e.g. "acme") — populated by the per-org login
+     * flow so the CLI can resolve `acme/foo`-form workspace addresses against
+     * the local store without round-tripping `me.organizations`. See
+     * project/plans/multi-org-cli-auth.md (qfg-kr7).
+     */
+    org_slug?: string;
+    /** Org display name for `qfg whoami` / `qfg workspace`. */
+    org_name?: string;
 }
+export interface TokenStore {
+    defaultOrgId?: string;
+    tokensByOrg: {
+        [workosOrgId: string]: TokenSet;
+    };
+}
+export declare const getTokenForOrg: (store: TokenStore, workosOrgId: string) => TokenSet | undefined;
+/**
+ * Find the workosOrgId in the per-org token store whose TokenSet has the
+ * given org_slug. Returns undefined when no matching slug is present (either
+ * because the user has never logged in to that org, or because tokens were
+ * minted by a pre-qfg-kr7 login flow that didn't persist org_slug).
+ */
+export declare const findOrgIdBySlug: (store: TokenStore, orgSlug: string) => string | undefined;
 export interface AuthConfig {
     defaultProfile?: string;
     profiles: {
@@ -16,6 +39,14 @@ export interface AuthConfig {
             workspaceName?: string;
             workspaceSlug?: string;
             organizationName?: string;
+            /**
+             * WorkOS organization UUID for the saved workspace. Persisted by
+             * `qfg workspace switch` (qfg-kr7.9) so other commands can pick the
+             * matching per-org token without round-tripping `me.organizations`.
+             */
+            workosOrgId?: string;
+            /** Org URL slug — used when rendering the org/ws pin form. */
+            organizationSlug?: string;
         };
     };
 }
@@ -26,8 +57,8 @@ export interface AuthConfig {
 export declare const resolveWorkspaceId: (config: AuthConfig, slug: string) => string | undefined;
 export declare const getTokenFilePath: (options?: TokenStorageOptions) => string;
 export declare const getAuthConfigFilePath: (options?: TokenStorageOptions) => string;
-export declare const saveTokens: (tokens: TokenData, options?: TokenStorageOptions) => Promise<string>;
-export declare const loadTokens: (options?: TokenStorageOptions) => Promise<TokenData | null>;
+export declare const saveTokens: (store: TokenStore, options?: TokenStorageOptions) => Promise<string>;
+export declare const loadTokens: (options?: TokenStorageOptions) => Promise<TokenStore | null>;
 export declare const saveAuthConfig: (config: AuthConfig, options?: TokenStorageOptions) => Promise<string>;
 export declare const loadAuthConfig: (options?: TokenStorageOptions) => Promise<AuthConfig | null>;
 export declare const getActiveProfile: (profileArg?: string) => string;

package/dist/util/token-storage.js

@@ -13,6 +13,20 @@ const getConfigFile = (options) => {
     const filename = domain === 'quonfig.com' ? 'config' : `config-${domain.replaceAll('.', '-')}`;
     return path.join(getQuonfigDir(options), filename);
 };
+export const getTokenForOrg = (store, workosOrgId) => store.tokensByOrg[workosOrgId];
+/**
+ * Find the workosOrgId in the per-org token store whose TokenSet has the
+ * given org_slug. Returns undefined when no matching slug is present (either
+ * because the user has never logged in to that org, or because tokens were
+ * minted by a pre-qfg-kr7 login flow that didn't persist org_slug).
+ */
+export const findOrgIdBySlug = (store, orgSlug) => {
+    for (const [orgId, tokens] of Object.entries(store.tokensByOrg)) {
+        if (tokens.org_slug === orgSlug)
+            return orgId;
+    }
+    return undefined;
+};
 /**
  * Find a workspace ID by slug across all saved profiles.
  * Used to resolve QUONFIG_WORKSPACE and --workspace flag values.
@@ -49,11 +63,11 @@ const verifyWritten = async (filePath, label) => {
         throw new Error(`Failed to persist ${label} to ${filePath}: file is empty or not a regular file after write.`);
     }
 };
-export const saveTokens = async (tokens, options) => {
+export const saveTokens = async (store, options) => {
     await ensureQuonfigDir(options);
     const targetFile = getTokenFile(options);
     const tmpFile = `${targetFile}.tmp`;
-    await fs.promises.writeFile(tmpFile, JSON.stringify(tokens, null, 2), { encoding: 'utf8', mode: 0o600 });
+    await fs.promises.writeFile(tmpFile, JSON.stringify(store, null, 2), { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(tmpFile, targetFile);
     await verifyWritten(targetFile, 'tokens');
     // Round-trip parse to confirm the file on disk is the JSON we just wrote.
@@ -66,14 +80,20 @@ export const saveTokens = async (tokens, options) => {
     }
     return targetFile;
 };
+const isTokenStore = (value) => typeof value === 'object' && value !== null && 'tokensByOrg' in value;
 export const loadTokens = async (options) => {
+    let data;
     try {
-        const data = await fs.promises.readFile(getTokenFile(options), 'utf8');
-        return JSON.parse(data);
+        data = await fs.promises.readFile(getTokenFile(options), 'utf8');
     }
     catch {
         return null;
     }
+    const parsed = JSON.parse(data);
+    if (!isTokenStore(parsed)) {
+        throw new Error('Token store format has changed. Run `qfg login` to re-authenticate.');
+    }
+    return parsed;
 };
 export const saveAuthConfig = async (config, options) => {
     await ensureQuonfigDir(options);
@@ -96,6 +116,12 @@ export const saveAuthConfig = async (config, options) => {
         if (profileData.organizationName) {
             configContent += `organization_name = ${profileData.organizationName}\n`;
         }
+        if (profileData.organizationSlug) {
+            configContent += `organization_slug = ${profileData.organizationSlug}\n`;
+        }
+        if (profileData.workosOrgId) {
+            configContent += `workos_org_id = ${profileData.workosOrgId}\n`;
+        }
         configContent += '\n';
     }
     const configTarget = getConfigFile(options);
@@ -125,6 +151,8 @@ export const loadAuthConfig = async (options) => {
             const workspaceMatch = block.match(/workspace\s*=\s*([^\s#]+)(?:\s*#\s*(.+))?/);
             const slugMatch = block.match(/workspace_slug\s*=\s*(\S+)/);
             const orgMatch = block.match(/organization_name\s*=\s*(.+)/);
+            const orgSlugMatch = block.match(/organization_slug\s*=\s*(\S+)/);
+            const workosOrgIdMatch = block.match(/workos_org_id\s*=\s*(\S+)/);
             if (!workspaceMatch)
                 continue;
             config.profiles[profileName] = {
@@ -132,6 +160,8 @@ export const loadAuthConfig = async (options) => {
                 workspaceName: workspaceMatch[2]?.trim(),
                 workspaceSlug: slugMatch?.[1]?.trim(),
                 organizationName: orgMatch?.[1]?.trim(),
+                organizationSlug: orgSlugMatch?.[1]?.trim(),
+                workosOrgId: workosOrgIdMatch?.[1]?.trim(),
             };
         }
         return Object.keys(config.profiles).length > 0 ? config : null;

package/dist/verify/validate.js

@@ -20,7 +20,11 @@
  *  - Weighted values non-empty and consistent
  */
 import { z } from 'zod';
-import { LOG_LEVELS } from '../util/log-levels.js';
+// Inlined to keep this directory self-contained for the standalone bun-compile
+// build that runs as the qfg-verify pre-receive hook in app-gitea — that build
+// only copies cli/src/verify/, so any out-of-tree imports break it. Source of
+// truth: cli/src/util/log-levels.ts.
+const LOG_LEVELS = ['TRACE', 'DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL'];
 // ── Schemas (subset of app-quonfig config-schemas.ts) ───────────────────
 const ConfigTypeSchema = z.enum(['feature_flag', 'config', 'log_level', 'segment', 'schema']);
 const ValueTypeSchema = z.enum(['bool', 'string', 'int', 'double', 'json', 'string_list', 'duration', 'log_level']);
@@ -408,6 +412,17 @@ export function validateWorkspace(workspaceDir) {
                         severity: 'error',
                     });
                 }
+                // Segments are cross-environment (no per-env values), so `protected-env`
+                // has no meaning — there is no environment to protect. Allow only
+                // support / standard / protected-all-envs. See protecting-access.md §11.
+                if (config.access === 'protected-env') {
+                    issues.push({
+                        file: relPath,
+                        message: `Segment cannot have access "protected-env" — segments are cross-environment. Use "standard" or "protected-all-envs".`,
+                        severity: 'error',
+                        suggestion: `Change access to "standard" or "protected-all-envs"`,
+                    });
+                }
                 segmentKeys.add(config.key);
             }
             if (config.type === 'log_level') {
@@ -707,6 +722,15 @@ export function validateFileMap(files) {
             if (config.sendToClientSdk) {
                 issues.push({ file: relPath, message: `Segment must have sendToClientSdk=false`, severity: 'error' });
             }
+            // Segments are cross-environment — `protected-env` has no meaning. See protecting-access.md §11.
+            if (config.access === 'protected-env') {
+                issues.push({
+                    file: relPath,
+                    message: `Segment cannot have access "protected-env" — segments are cross-environment. Use "standard" or "protected-all-envs".`,
+                    severity: 'error',
+                    suggestion: `Change access to "standard" or "protected-all-envs"`,
+                });
+            }
             segmentKeys.add(config.key);
         }
         if (config.type === 'log_level') {