@quonfig/cli 0.0.25 → 0.0.26

package/dist/util/git-ops.js

@@ -1,16 +1,34 @@
-import { execFile as execFileCb } from 'node:child_process';
+import { execFile as execFileCb, spawn } from 'node:child_process';
 import * as util from 'node:util';
 const execFile = util.promisify(execFileCb);
+/**
+ * Args prepended to every git invocation. Empty `credential.helper` resets the
+ * helper chain for this child process only — prevents macOS git's osxkeychain
+ * helper from popping a "Keychain Not Found" dialog when qfg-managed creds are
+ * embedded in the URL.
+ */
+export const GIT_SAFE_ARGS = ['-c', 'credential.helper='];
+/**
+ * Env additions for every git invocation. Suppress tty prompts and Git
+ * Credential Manager interactive flows.
+ */
+export const GIT_SAFE_ENV = {
+    GIT_TERMINAL_PROMPT: '0',
+    GCM_INTERACTIVE: 'Never',
+};
 /**
  * Redact a token from a URL string so it is safe to display to users.
  */
 export const redactToken = (url) => url.replace(/:([^/@]+)@/, ':***@');
 /**
- * Wrap execFile errors to strip tokens from the message.
+ * Canonical entry point for shelling out to git from the CLI. Always prepends
+ * `GIT_SAFE_ARGS` and merges `GIT_SAFE_ENV` so credential prompts never leak
+ * to the user. Errors are re-thrown with tokens redacted from message/stderr.
  */
-const safeExec = async (file, args, options) => {
+export const runGit = async (args, options) => {
+    const env = { ...process.env, ...GIT_SAFE_ENV, ...options?.env };
     try {
-        return await execFile(file, args, { cwd: options?.cwd });
+        return await execFile('git', [...GIT_SAFE_ARGS, ...args], { cwd: options?.cwd, env });
     }
     catch (error) {
         const e = error;
@@ -21,12 +39,33 @@ const safeExec = async (file, args, options) => {
         throw safeErr;
     }
 };
+/**
+ * Spawn-based git invocation for cases where stdin needs to be piped (e.g.
+ * `git commit -F -`). Same safe-args/env injection as `runGit`.
+ */
+export const spawnGit = (args, options) => new Promise((resolve, reject) => {
+    const env = { ...process.env, ...GIT_SAFE_ENV, ...options?.env };
+    const child = spawn('git', [...GIT_SAFE_ARGS, ...args], { cwd: options?.cwd, env });
+    let stderr = '';
+    child.stderr.on('data', (d) => {
+        stderr += d.toString();
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+        if (code === 0)
+            resolve();
+        else
+            reject(new Error(`git ${args[0] ?? ''} exited ${code}: ${redactToken(stderr)}`));
+    });
+    if (options?.stdin !== undefined)
+        child.stdin.end(options.stdin);
+});
 export const gitClone = async (repoUrl, dir) => {
-    await safeExec('git', ['clone', repoUrl, dir]);
+    await runGit(['clone', repoUrl, dir]);
 };
 export const isGitRepo = async (dir) => {
     try {
-        await execFile('git', ['-C', dir, 'rev-parse', '--git-dir']);
+        await runGit(['-C', dir, 'rev-parse', '--git-dir']);
         return true;
     }
     catch {
@@ -35,7 +74,7 @@ export const isGitRepo = async (dir) => {
 };
 export const getRemoteUrl = async (dir) => {
     try {
-        const { stdout } = await execFile('git', ['-C', dir, 'remote', 'get-url', 'origin']);
+        const { stdout } = await runGit(['-C', dir, 'remote', 'get-url', 'origin']);
         return stdout.trim() || null;
     }
     catch {
@@ -43,11 +82,120 @@ export const getRemoteUrl = async (dir) => {
     }
 };
 export const isWorkingTreeClean = async (dir) => {
-    const { stdout } = await execFile('git', ['-C', dir, 'status', '--porcelain']);
+    const { stdout } = await runGit(['-C', dir, 'status', '--porcelain']);
     return stdout.trim() === '';
 };
+/**
+ * Returns true if `file` (relative to `dir`) has any working-tree or
+ * staged change, false if its tracked content matches HEAD.
+ */
+export const hasFileChanges = async (dir, file) => {
+    const { stdout } = await runGit(['-C', dir, 'status', '--porcelain', '--', file]);
+    return stdout.trim() !== '';
+};
+/**
+ * Returns the list of tracked files (relative paths) with working-tree
+ * or staged modifications. Untracked files (`??`) are excluded — they
+ * are not considered "dirty" by callers that want to know whether the
+ * user has work-in-progress that should not be swept into a commit.
+ */
+export const dirtyTrackedFiles = async (dir) => {
+    const { stdout } = await runGit(['-C', dir, 'status', '--porcelain']);
+    return stdout
+        .split('\n')
+        .filter(Boolean)
+        .filter((line) => !line.startsWith('??'))
+        .map((line) => line.slice(3).trim());
+};
+/**
+ * Stage and commit a single file with the given message. The path argument
+ * to `git commit` ensures only this file is committed even if other files
+ * are already staged in the index.
+ *
+ * Returns true if a commit was created, false if there was nothing to
+ * commit (file matches HEAD already). Throws on real git errors.
+ */
+export const addAndCommitFile = async (dir, file, message) => {
+    if (!(await hasFileChanges(dir, file)))
+        return false;
+    await runGit(['-C', dir, 'add', '--', file]);
+    await runGit(['-C', dir, 'commit', '-m', message, '--', file]);
+    return true;
+};
+/**
+ * Read the contents of `file` (relative to `dir`) at HEAD. Returns
+ * `undefined` if the file does not exist at HEAD or if HEAD itself is
+ * unset (empty repo).
+ */
+export const readFileAtHead = async (dir, file) => {
+    try {
+        const { stdout } = await runGit(['-C', dir, 'show', `HEAD:${file}`]);
+        return stdout;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Migration helper for legacy state where `qfg pull` wrote the workspace
+ * pin to the working tree but never committed it (qfg-0fn). If
+ * `quonfig.json` is dirty AND its only diff vs HEAD is an added or
+ * changed `workspace` key matching `expectedSlug`, stage and commit the
+ * file so push's HEAD-vs-origin delta picks it up.
+ *
+ * Skips (returns `kind: 'skipped'`) when the dirty file has any other
+ * changes, when the pin doesn't match the backend slug, or when JSON
+ * parsing fails — leaving the user's working tree alone.
+ */
+export const commitPinFixIfPinOnly = async (dir, file, expectedSlug) => {
+    if (!(await hasFileChanges(dir, file)))
+        return { kind: 'clean' };
+    let workingTreeRaw;
+    try {
+        const { readFile } = await import('node:fs/promises');
+        const { join } = await import('node:path');
+        workingTreeRaw = await readFile(join(dir, file), 'utf8');
+    }
+    catch {
+        return { kind: 'skipped', reason: 'could not read working-tree file' };
+    }
+    const headRaw = await readFileAtHead(dir, file);
+    let workingParsed;
+    try {
+        workingParsed = JSON.parse(workingTreeRaw);
+    }
+    catch {
+        return { kind: 'skipped', reason: 'working-tree file is not valid JSON' };
+    }
+    if (typeof workingParsed.workspace !== 'string' || workingParsed.workspace !== expectedSlug) {
+        return { kind: 'skipped', reason: 'working-tree workspace pin does not match backend slug' };
+    }
+    let headParsed = {};
+    if (headRaw !== undefined) {
+        try {
+            headParsed = JSON.parse(headRaw);
+        }
+        catch {
+            return { kind: 'skipped', reason: 'HEAD file is not valid JSON' };
+        }
+    }
+    // Compare working tree vs HEAD ignoring `workspace`. If anything else
+    // differs, the user has additional uncommitted edits — leave alone.
+    const stripped = (o) => {
+        const { workspace: _ignored, ...rest } = o;
+        return rest;
+    };
+    const a = JSON.stringify(stripped(workingParsed), Object.keys(stripped(workingParsed)).sort());
+    const b = JSON.stringify(stripped(headParsed), Object.keys(stripped(headParsed)).sort());
+    if (a !== b) {
+        return { kind: 'skipped', reason: 'working-tree file has changes beyond the workspace pin' };
+    }
+    await runGit(['-C', dir, 'add', '--', file]);
+    await runGit(['-C', dir, 'commit', '-m', `qfg: pin workspace = ${expectedSlug}`, '--', file]);
+    return { kind: 'committed', slug: expectedSlug };
+};
 export const gitFetch = async (dir) => {
-    await safeExec('git', ['-C', dir, 'fetch', 'origin']);
+    await runGit(['-C', dir, 'fetch', 'origin']);
 };
 /**
  * Returns true if origin/main has commits that can be fast-forwarded into the local branch.
@@ -55,15 +203,15 @@ export const gitFetch = async (dir) => {
 export const canFastForward = async (dir) => {
     try {
         // Get the local HEAD and origin/main SHAs
-        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
-        const { stdout: remoteSha } = await execFile('git', ['-C', dir, 'rev-parse', 'origin/main']);
+        const { stdout: localSha } = await runGit(['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: remoteSha } = await runGit(['-C', dir, 'rev-parse', 'origin/main']);
         const local = localSha.trim();
         const remote = remoteSha.trim();
         if (local === remote)
             return false; // already up to date
         // Check if local is an ancestor of remote (i.e. ff is possible)
         try {
-            await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
+            await runGit(['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
             return true; // exit code 0 means local is an ancestor of remote
         }
         catch {
@@ -79,21 +227,21 @@ export const canFastForward = async (dir) => {
  */
 export const hasDivergedFromRemote = async (dir) => {
     try {
-        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
-        const { stdout: remoteSha } = await execFile('git', ['-C', dir, 'rev-parse', 'origin/main']);
+        const { stdout: localSha } = await runGit(['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: remoteSha } = await runGit(['-C', dir, 'rev-parse', 'origin/main']);
         const local = localSha.trim();
         const remote = remoteSha.trim();
         if (local === remote)
             return false;
         // If remote is an ancestor of local, local is ahead (diverged for our purposes)
         try {
-            await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', remote, local]);
+            await runGit(['-C', dir, 'merge-base', '--is-ancestor', remote, local]);
             return true;
         }
         catch {
             // Check if truly diverged (neither is ancestor of the other)
             try {
-                await execFile('git', ['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
+                await runGit(['-C', dir, 'merge-base', '--is-ancestor', local, remote]);
                 return false; // ff possible, not diverged
             }
             catch {
@@ -112,8 +260,8 @@ export const gitMergeFfOnly = async (dir) => {
     // Get commits that will be merged (before merge)
     let newCommits = [];
     try {
-        const { stdout: localSha } = await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
-        const { stdout: log } = await execFile('git', [
+        const { stdout: localSha } = await runGit(['-C', dir, 'rev-parse', 'HEAD']);
+        const { stdout: log } = await runGit([
             '-C',
             dir,
             'log',
@@ -128,7 +276,7 @@ export const gitMergeFfOnly = async (dir) => {
     catch {
         // Non-fatal — we'll still attempt the merge
     }
-    await safeExec('git', ['-C', dir, 'merge', '--ff-only', 'origin/main']);
+    await runGit(['-C', dir, 'merge', '--ff-only', 'origin/main']);
     return newCommits;
 };
 /**
@@ -137,21 +285,21 @@ export const gitMergeFfOnly = async (dir) => {
 export const gitSetRemote = async (dir, url) => {
     const existing = await getRemoteUrl(dir);
     if (existing === null) {
-        await safeExec('git', ['-C', dir, 'remote', 'add', 'origin', url]);
+        await runGit(['-C', dir, 'remote', 'add', 'origin', url]);
     }
     else {
-        await safeExec('git', ['-C', dir, 'remote', 'set-url', 'origin', url]);
+        await runGit(['-C', dir, 'remote', 'set-url', 'origin', url]);
     }
 };
 export const gitPushForceLease = async (dir) => {
-    await safeExec('git', ['-C', dir, 'push', 'origin', 'main', '--force-with-lease']);
+    await runGit(['-C', dir, 'push', 'origin', 'main', '--force-with-lease']);
 };
 export const gitPushForce = async (dir) => {
-    await safeExec('git', ['-C', dir, 'push', 'origin', 'main', '--force']);
+    await runGit(['-C', dir, 'push', 'origin', 'main', '--force']);
 };
 export const hasAtLeastOneCommit = async (dir) => {
     try {
-        await execFile('git', ['-C', dir, 'rev-parse', 'HEAD']);
+        await runGit(['-C', dir, 'rev-parse', 'HEAD']);
         return true;
     }
     catch {

package/dist/util/gitea-api.js

@@ -1,8 +1,10 @@
 import { getApiUrl } from './domain-urls.js';
-import { getValidAccessToken } from './get-valid-token.js';
+import { getValidAccessToken, resolveDefaultOrgId } from './get-valid-token.js';
 import { saveGiteaToken } from './gitea-token-storage.js';
 export const mintGiteaToken = async (workspaceId, scope, purpose) => {
-    const accessToken = await getValidAccessToken();
+    // TODO(qfg-kr7.5): thread workosOrgId through from the resolved workspace address.
+    const orgId = await resolveDefaultOrgId();
+    const accessToken = await getValidAccessToken(orgId);
     const apiUrl = getApiUrl();
     const res = await fetch(`${apiUrl}/api/v1/gitea/token`, {
         method: 'POST',

package/dist/util/local-config-writer.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Subdirectory under QUONFIG_DIR where each entity type lives. Mirrors the
+ * `directory` field on app-quonfig's CRUD configs (see
+ * `app-quonfig/src/lib/orpc/routes/{flags,configs,log-levels}.ts`). Keep these
+ * in lock-step or `qfg pull` and `qfg create` will disagree on file paths.
+ */
+export type EntitySubdir = 'feature-flags' | 'configs' | 'log-levels';
+export interface WriteResult {
+    /** True when the file was committed to local git too. */
+    committed: boolean;
+    /** Absolute path of the file written. */
+    filePath: string;
+    /** Reason for skipping git commit, when applicable (verbose-log only). */
+    skippedCommitReason?: string;
+}
+/**
+ * Write the StoredConfig the server returned to
+ * `${QUONFIG_DIR}/<subdir>/<key>.json` so users don't need to run `qfg pull`
+ * after every `qfg create`. Closes qfg-d5t.
+ *
+ * Best-effort: returns null when QUONFIG_DIR is unset, the directory does not
+ * exist, or the workspace dir lacks a `quonfig.json`. Throws only on real
+ * filesystem write errors — callers should treat those as fatal because
+ * silent corruption (e.g., unwriteable workspace dir) is worse than a noisy
+ * failure.
+ */
+export declare const writeStoredConfigToWorkspace: (opts: {
+    subdir: EntitySubdir;
+    key: string;
+    storedConfig: Record<string, unknown>;
+    /** Override QUONFIG_DIR for testing. */
+    quonfigDir?: string;
+}) => Promise<WriteResult | null>;

package/dist/util/local-config-writer.js

@@ -0,0 +1,63 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { addAndCommitFile, isGitRepo } from './git-ops.js';
+/**
+ * Strip server-only metadata fields from the API response so the on-disk file
+ * matches what app-quonfig itself stores in git (see
+ * `config-crud-handlers.ts:writeAndCommit` — it serializes the StoredConfig
+ * shape, not the FlagDetail shape).
+ */
+const stripServerMetadata = (storedConfig) => {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const { commitSha: _commitSha, ...rest } = storedConfig;
+    return rest;
+};
+/**
+ * Write the StoredConfig the server returned to
+ * `${QUONFIG_DIR}/<subdir>/<key>.json` so users don't need to run `qfg pull`
+ * after every `qfg create`. Closes qfg-d5t.
+ *
+ * Best-effort: returns null when QUONFIG_DIR is unset, the directory does not
+ * exist, or the workspace dir lacks a `quonfig.json`. Throws only on real
+ * filesystem write errors — callers should treat those as fatal because
+ * silent corruption (e.g., unwriteable workspace dir) is worse than a noisy
+ * failure.
+ */
+export const writeStoredConfigToWorkspace = async (opts) => {
+    const dir = opts.quonfigDir ?? process.env.QUONFIG_DIR;
+    if (!dir)
+        return null;
+    const resolvedDir = path.resolve(dir);
+    // Skip silently if the workspace dir isn't there yet — first-time users
+    // who have run `qfg login` but not `qfg pull` shouldn't get a hard error.
+    if (!fs.existsSync(resolvedDir))
+        return null;
+    // Refuse to write into a directory that doesn't look like a Quonfig
+    // workspace. This avoids accidentally seeding `feature-flags/` files into
+    // an unrelated directory the user happened to point QUONFIG_DIR at.
+    if (!fs.existsSync(path.join(resolvedDir, 'quonfig.json')))
+        return null;
+    const subdirPath = path.join(resolvedDir, opts.subdir);
+    await fs.promises.mkdir(subdirPath, { recursive: true });
+    const filePath = path.join(subdirPath, `${opts.key}.json`);
+    const cleaned = stripServerMetadata(opts.storedConfig);
+    await fs.promises.writeFile(filePath, JSON.stringify(cleaned, null, 2) + '\n', 'utf8');
+    // If the workspace is a git repo, commit the new file with the same
+    // message format app-quonfig's createEntity uses. This keeps the next
+    // `qfg pull` clean: when origin has the equivalent server-side commit,
+    // a fast-forward reconciles cleanly because both histories share the
+    // pre-create base. (If they diverge, pull will say so — better than an
+    // "untracked file would be overwritten" trap.)
+    if (await isGitRepo(resolvedDir)) {
+        const relPath = path.relative(resolvedDir, filePath);
+        const entityLabel = opts.subdir === 'feature-flags' ? 'flag' : opts.subdir === 'log-levels' ? 'log level' : 'config';
+        try {
+            const committed = await addAndCommitFile(resolvedDir, relPath, `Create ${entityLabel}: ${opts.key}`);
+            return { filePath, committed };
+        }
+        catch (error) {
+            return { filePath, committed: false, skippedCommitReason: String(error) };
+        }
+    }
+    return { filePath, committed: false, skippedCommitReason: 'not a git repo' };
+};

package/dist/util/login-orchestrator.d.ts

@@ -0,0 +1,42 @@
+import type { TokenStore } from './token-storage.js';
+export interface OrgMembership {
+    name: string;
+    role: string;
+    slug: string;
+    workosOrgId: string;
+}
+export interface OrchestrateLoginInput {
+    apiUrl: string;
+    initialAccessToken: string;
+    initialRefreshToken: string;
+    user: {
+        email?: string;
+        id: string;
+    };
+}
+export interface OrchestrateLoginResult {
+    defaultOrg: OrgMembership;
+    defaultOrgId: string;
+    email?: string;
+    mintedOrgSlugs: string[];
+    organizations: OrgMembership[];
+    skippedOrgSlugs: string[];
+    tokenStore: TokenStore;
+    userId: string;
+}
+/**
+ * Multi-org token minting orchestration (qfg-mol-k27, plan item 7).
+ *
+ * Given the device-auth result, this:
+ *   1. Calls /api/v1/me/organizations to enumerate all orgs the user belongs to.
+ *   2. For each org (capped at 10 alphabetically — see plan rate-limit guard),
+ *      calls WorkOS /user_management/authenticate with grant_type=refresh_token
+ *      + organization_id in parallel to mint an org-scoped TokenSet.
+ *   3. Builds the per-org TokenStore with a defaultOrgId set to the only org
+ *      (single-org user) or the first slug alphabetically (multi-org).
+ *
+ * Returns the in-memory TokenStore plus enough metadata for login.ts to print
+ * the user-facing summary; persistence is the caller's responsibility so we
+ * keep this helper free of filesystem side effects (testable in isolation).
+ */
+export declare const orchestrateMultiOrgLogin: (input: OrchestrateLoginInput) => Promise<OrchestrateLoginResult>;

package/dist/util/login-orchestrator.js

@@ -0,0 +1,79 @@
+import { authenticateWithOrg } from './oauth-client.js';
+const MAX_EAGER_ORGS = 10;
+/**
+ * Fetch all org memberships for the authenticated user from app-quonfig.
+ * Uses the initial user-scoped access token (no org_id) so the call works
+ * before any per-org tokens have been minted.
+ */
+const fetchOrganizations = async (apiUrl, accessToken) => {
+    const res = await fetch(`${apiUrl}/api/v1/me/organizations`, {
+        body: JSON.stringify({ json: {} }),
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+        },
+        method: 'POST',
+    });
+    if (!res.ok) {
+        throw new Error(`Failed to fetch organizations: ${res.status} ${await res.text()}`);
+    }
+    const body = (await res.json());
+    const list = (body.json ?? body);
+    if (!Array.isArray(list)) {
+        throw new TypeError('Failed to fetch organizations: response was not a list');
+    }
+    return list;
+};
+/**
+ * Multi-org token minting orchestration (qfg-mol-k27, plan item 7).
+ *
+ * Given the device-auth result, this:
+ *   1. Calls /api/v1/me/organizations to enumerate all orgs the user belongs to.
+ *   2. For each org (capped at 10 alphabetically — see plan rate-limit guard),
+ *      calls WorkOS /user_management/authenticate with grant_type=refresh_token
+ *      + organization_id in parallel to mint an org-scoped TokenSet.
+ *   3. Builds the per-org TokenStore with a defaultOrgId set to the only org
+ *      (single-org user) or the first slug alphabetically (multi-org).
+ *
+ * Returns the in-memory TokenStore plus enough metadata for login.ts to print
+ * the user-facing summary; persistence is the caller's responsibility so we
+ * keep this helper free of filesystem side effects (testable in isolation).
+ */
+export const orchestrateMultiOrgLogin = async (input) => {
+    const allOrgs = await fetchOrganizations(input.apiUrl, input.initialAccessToken);
+    if (allOrgs.length === 0) {
+        throw new Error('Login failed: this user is not a member of any organization. Have an admin invite you, then re-run `qfg login`.');
+    }
+    const sorted = [...allOrgs].sort((a, b) => a.slug.localeCompare(b.slug));
+    const minted = sorted.slice(0, MAX_EAGER_ORGS);
+    const skipped = sorted.slice(MAX_EAGER_ORGS);
+    const tokenSets = await Promise.all(minted.map(async (org) => {
+        const set = await authenticateWithOrg(input.initialRefreshToken, org.workosOrgId);
+        return [
+            org.workosOrgId,
+            {
+                ...set,
+                org_name: org.name,
+                org_slug: org.slug,
+            },
+        ];
+    }));
+    const tokensByOrg = {};
+    for (const [orgId, set] of tokenSets) {
+        tokensByOrg[orgId] = set;
+    }
+    const defaultOrg = minted[0];
+    return {
+        defaultOrg,
+        defaultOrgId: defaultOrg.workosOrgId,
+        email: input.user.email,
+        mintedOrgSlugs: minted.map((o) => o.slug),
+        organizations: sorted,
+        skippedOrgSlugs: skipped.map((o) => o.slug),
+        tokenStore: {
+            defaultOrgId: defaultOrg.workosOrgId,
+            tokensByOrg,
+        },
+        userId: input.user.id,
+    };
+};

package/dist/util/oauth-client.d.ts

@@ -1,3 +1,4 @@
+import type { TokenSet } from './token-storage.js';
 export interface DeviceCodeResponse {
     device_code: string;
     expires_in: number;
@@ -27,4 +28,5 @@ export interface TokenRefreshResponse {
 export declare const requestDeviceCode: () => Promise<DeviceCodeResponse>;
 export declare const pollForToken: (deviceCode: string, interval: number, expiresIn: number, verbose?: boolean) => Promise<DeviceTokenResponse>;
 export declare const refreshAccessToken: (refreshToken: string) => Promise<TokenRefreshResponse>;
+export declare const authenticateWithOrg: (refreshToken: string, organizationId: string) => Promise<TokenSet>;
 export declare const decodeJWT: (token: string) => Record<string, unknown>;

package/dist/util/oauth-client.js

@@ -89,6 +89,36 @@ export const refreshAccessToken = async (refreshToken) => {
     }
     return response.json();
 };
+// --- Org-Scoped Authentication ---
+// WorkOS access tokens are org-scoped: there is no single token that authorizes
+// work across two orgs. Exchange a refresh_token for a per-org TokenSet so the
+// CLI can hold one token per organization the user belongs to.
+export const authenticateWithOrg = async (refreshToken, organizationId) => {
+    const response = await fetch(`${WORKOS_BASE_URL}/user_management/authenticate`, {
+        body: new URLSearchParams({
+            client_id: getClientId(),
+            grant_type: 'refresh_token',
+            organization_id: organizationId,
+            refresh_token: refreshToken,
+        }),
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        method: 'POST',
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to authenticate with org ${organizationId}: ${errorText}`);
+    }
+    const data = (await response.json());
+    const payload = decodeJWT(data.access_token);
+    const expiresAt = typeof payload.exp === 'number' ? payload.exp * 1000 : Date.now() + 300 * 1000;
+    return {
+        access_token: data.access_token,
+        expires_at: expiresAt,
+        refresh_token: data.refresh_token,
+        user_email: data.user?.email,
+        user_id: data.user?.id,
+    };
+};
 // --- JWT Utilities ---
 export const decodeJWT = (token) => {
     const parts = token.split('.');