@quonfig/cli 0.0.29 → 0.0.30

package/dist/util/resolve-workspace.js

@@ -1,14 +1,14 @@
 import { getApiUrl } from './domain-urls.js';
-import { getValidAccessToken, resolveDefaultOrgId } from './get-valid-token.js';
+import { getValidAccessToken } from './get-valid-token.js';
 import { tryParseWorkspacePin } from './quonfig-json.js';
 import { findOrgIdBySlug, getActiveProfile, loadAuthConfig, loadTokens, saveAuthConfig, } from './token-storage.js';
 const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 const BARE_SLUG_ENV_MIGRATION_MESSAGE = 'QUONFIG_WORKSPACE must be in org/workspace form (e.g. acme/foo). ' +
     'Bare workspace slugs are no longer accepted. Update your .env and run `qfg login` if you have not yet migrated.';
 /**
- * Resolve the target workspace UUID for commands that don't extend APICommand
- * (e.g. pull, push — which talk to Gitea, not the oRPC API, but still need to
- * know which workspace to mint a Gitea token for).
+ * Resolve the target workspace UUID + owning org slug for commands that
+ * don't extend APICommand (e.g. pull, push — which talk to Gitea, not the
+ * oRPC API, but still need to mint a Gitea token for the right org).
  *
  * Handles all three auth paths in the same order as util/get-client.ts:
  *   1. QUONFIG_API_KEY + QUONFIG_WORKSPACE (or --workspace flag) — CI/headless.
@@ -26,7 +26,7 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
         }
         if (UUID_PATTERN.test(override)) {
             command.verboseLog('ApiKey auth', { source: 'uuid', workspaceId: override });
-            return override;
+            return { workspaceId: override, orgSlug: '' };
         }
         // Slug — resolve via the server since there's no local auth config in CI mode.
         // API-key path short-circuits before consulting the orgId.
@@ -55,12 +55,9 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
             });
         }
         command.verboseLog('ApiKey auth', { source: 'slug', slug: override, workspaceId: match.workspaceId });
-        return match.workspaceId;
+        return { workspaceId: match.workspaceId, orgSlug: '' };
     }
-    // OAuth path with an explicit override → must be in org/ws form. Parse,
-    // look up the workosOrgId for that org slug in the local token store, and
-    // resolve the workspaceSlug *within that org*. Bare slug is rejected with
-    // a migration message (the API-key branch above is the one exception).
+    // OAuth path with an explicit override → must be in org/ws form.
     if (override) {
         return resolveOrgScopedWorkspace(command, override);
     }
@@ -68,11 +65,6 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
     // auth config from tokens if the config file is absent.
     let authConfig = await loadAuthConfig();
     if (!authConfig) {
-        // Auth config can be missing while tokens.json still holds a valid
-        // refresh_token — e.g. after the domain-scoped config split (commit
-        // 0f8bee6) or a partial login that wrote tokens but never the config
-        // (qfg-2qj). getValidAccessToken already knows how to refresh, so try
-        // that path before declaring "Not logged in".
         const store = await loadTokens();
         const tokens = store ? Object.values(store.tokensByOrg)[0] : undefined;
         if (!tokens?.refresh_token) {
@@ -85,7 +77,10 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
     if (!profileData?.workspace) {
         command.error('No active workspace. Run `qfg login` / `qfg workspace switch`, or set QUONFIG_API_KEY + QUONFIG_WORKSPACE.', { exit: 1 });
     }
-    return profileData.workspace;
+    if (!profileData.organizationSlug) {
+        command.error('Saved profile is missing organization_slug. Run `qfg login` to refresh, or `qfg workspace switch <org>/<ws>`.', { exit: 1 });
+    }
+    return { workspaceId: profileData.workspace, orgSlug: profileData.organizationSlug };
 }
 /**
  * OAuth-mode resolver for an explicit `<org-slug>/<workspace-slug>` override.
@@ -142,7 +137,7 @@ async function resolveOrgScopedWorkspace(command, override) {
         command.error(`Workspace "${workspaceSlug}" not found in org "${orgSlug}". Available: ${available}.`, { exit: 1 });
     }
     command.verboseLog('OAuth workspace lookup', { orgSlug, workspaceSlug, workosOrgId, workspaceId: match.workspaceId });
-    return match.workspaceId;
+    return { workspaceId: match.workspaceId, orgSlug };
 }
 /**
  * Best-effort rebuild of the on-disk auth config from a working refresh_token.
@@ -153,11 +148,21 @@ async function resolveOrgScopedWorkspace(command, override) {
  * a message that points the user at `qfg login`.
  */
 async function recoverAuthConfigFromTokens(command) {
+    const store = await loadTokens();
+    if (!store) {
+        command.error('Not logged in. Run `qfg login` first.', { exit: 401 });
+    }
+    // Pick any logged-in org's tokens to call /userWorkspaces/list. The list is
+    // org-scoped, so a single first-org JWT only sees that org's workspaces —
+    // but we only need one workspace to seed the default profile, and the user
+    // can always `qfg workspace switch` to a different one afterwards.
+    const [seedOrgId, seedTokens] = Object.entries(store.tokensByOrg)[0] ?? [];
+    if (!seedOrgId || !seedTokens) {
+        command.error('Not logged in. Run `qfg login` first.', { exit: 401 });
+    }
     let jwt;
     try {
-        // TODO(qfg-kr7.5): pick the orgId resolved from the workspace address.
-        const orgId = await resolveDefaultOrgId();
-        jwt = await getValidAccessToken(orgId, command.verboseLog);
+        jwt = await getValidAccessToken(seedOrgId, command.verboseLog);
     }
     catch (error) {
         const detail = error instanceof Error ? error.message : String(error);
@@ -186,6 +191,12 @@ async function recoverAuthConfigFromTokens(command) {
         command.error('Tokens found but no workspace profile on disk. Run `qfg login` to repopulate.', { exit: 401 });
     }
     const match = candidates[0];
+    // Prefer the slug the server returned; fall back to the slug we have
+    // cached on the seed token (qfg-kr7 stores this on every login).
+    const orgSlug = match.organizationSlug ?? seedTokens.org_slug;
+    if (!orgSlug) {
+        command.error('Tokens found but org slug is missing. Run `qfg login` to repopulate.', { exit: 401 });
+    }
     const recovered = {
         defaultProfile: 'default',
         profiles: {
@@ -194,6 +205,7 @@ async function recoverAuthConfigFromTokens(command) {
                 workspaceName: match.workspaceSlug,
                 workspaceSlug: match.workspaceSlug,
                 organizationName: match.organizationName,
+                organizationSlug: orgSlug,
             },
         },
     };

package/dist/util/token-storage.d.ts

@@ -17,7 +17,14 @@ export interface TokenSet {
     /** Org display name for `qfg whoami` / `qfg workspace`. */
     org_name?: string;
 }
+/**
+ * Schema version of tokens.json. Stamped on every saveTokens write so a
+ * future CLI can refuse files written by an even-newer CLI with a clear
+ * "upgrade your CLI" error.
+ */
+export declare const TOKEN_STORE_VERSION = 2;
 export interface TokenStore {
+    version?: number;
     defaultOrgId?: string;
     tokensByOrg: {
         [workosOrgId: string]: TokenSet;
@@ -40,12 +47,10 @@ export interface AuthConfig {
             workspaceSlug?: string;
             organizationName?: string;
             /**
-             * WorkOS organization UUID for the saved workspace. Persisted by
-             * `qfg workspace switch` (qfg-kr7.9) so other commands can pick the
-             * matching per-org token without round-tripping `me.organizations`.
+             * Org URL slug. Used both for rendering the org/ws pin form and as
+             * the lookup key into the token store (slug → workosOrgId via
+             * findOrgIdBySlug) when a command needs an org-scoped JWT.
              */
-            workosOrgId?: string;
-            /** Org URL slug — used when rendering the org/ws pin form. */
             organizationSlug?: string;
         };
     };

package/dist/util/token-storage.js

@@ -13,6 +13,12 @@ const getConfigFile = (options) => {
     const filename = domain === 'quonfig.com' ? 'config' : `config-${domain.replaceAll('.', '-')}`;
     return path.join(getQuonfigDir(options), filename);
 };
+/**
+ * Schema version of tokens.json. Stamped on every saveTokens write so a
+ * future CLI can refuse files written by an even-newer CLI with a clear
+ * "upgrade your CLI" error.
+ */
+export const TOKEN_STORE_VERSION = 2;
 export const getTokenForOrg = (store, workosOrgId) => store.tokensByOrg[workosOrgId];
 /**
  * Find the workosOrgId in the per-org token store whose TokenSet has the
@@ -67,7 +73,8 @@ export const saveTokens = async (store, options) => {
     await ensureQuonfigDir(options);
     const targetFile = getTokenFile(options);
     const tmpFile = `${targetFile}.tmp`;
-    await fs.promises.writeFile(tmpFile, JSON.stringify(store, null, 2), { encoding: 'utf8', mode: 0o600 });
+    const stamped = { ...store, version: TOKEN_STORE_VERSION };
+    await fs.promises.writeFile(tmpFile, JSON.stringify(stamped, null, 2), { encoding: 'utf8', mode: 0o600 });
     await fs.promises.rename(tmpFile, targetFile);
     await verifyWritten(targetFile, 'tokens');
     // Round-trip parse to confirm the file on disk is the JSON we just wrote.
@@ -91,7 +98,12 @@ export const loadTokens = async (options) => {
     }
     const parsed = JSON.parse(data);
     if (!isTokenStore(parsed)) {
-        throw new Error('Token store format has changed. Run `qfg login` to re-authenticate.');
+        throw new Error('Token store malformed. Run `qfg login` to re-authenticate.');
+    }
+    const fileVersion = parsed.version ?? TOKEN_STORE_VERSION;
+    if (fileVersion > TOKEN_STORE_VERSION) {
+        throw new Error(`Token store version ${fileVersion} is from a newer CLI than this one supports (max ${TOKEN_STORE_VERSION}). ` +
+            'Upgrade with `npm i -g @quonfig/cli@latest`.');
     }
     return parsed;
 };
@@ -119,9 +131,6 @@ export const saveAuthConfig = async (config, options) => {
         if (profileData.organizationSlug) {
             configContent += `organization_slug = ${profileData.organizationSlug}\n`;
         }
-        if (profileData.workosOrgId) {
-            configContent += `workos_org_id = ${profileData.workosOrgId}\n`;
-        }
         configContent += '\n';
     }
     const configTarget = getConfigFile(options);
@@ -152,7 +161,6 @@ export const loadAuthConfig = async (options) => {
             const slugMatch = block.match(/workspace_slug\s*=\s*(\S+)/);
             const orgMatch = block.match(/organization_name\s*=\s*(.+)/);
             const orgSlugMatch = block.match(/organization_slug\s*=\s*(\S+)/);
-            const workosOrgIdMatch = block.match(/workos_org_id\s*=\s*(\S+)/);
             if (!workspaceMatch)
                 continue;
             config.profiles[profileName] = {
@@ -161,7 +169,6 @@ export const loadAuthConfig = async (options) => {
                 workspaceSlug: slugMatch?.[1]?.trim(),
                 organizationName: orgMatch?.[1]?.trim(),
                 organizationSlug: orgSlugMatch?.[1]?.trim(),
-                workosOrgId: workosOrgIdMatch?.[1]?.trim(),
             };
         }
         return Object.keys(config.profiles).length > 0 ? config : null;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.29";
+declare const _default: "0.0.30";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.29';
+export default '0.0.30';

package/oclif.manifest.json

@@ -2910,5 +2910,5 @@
       ]
     }
   },
-  "version": "0.0.29"
+  "version": "0.0.30"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.29",
+  "version": "0.0.30",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },