@quonfig/cli 0.0.39 → 0.0.40

package/dist/commands/run.d.ts

@@ -0,0 +1,46 @@
+import { APICommand } from '../index.js';
+/**
+ * `qfg run` — resolve Quonfig configs into env vars and exec a child process.
+ *
+ * Use this for tools that read env vars at module import (drizzle-kit migrate,
+ * next-auth's AUTH_SECRET, build steps, one-shot scripts) where going through
+ * `instrumentation.ts` / SDK init isn't possible.
+ *
+ * The flag separator `--` is REQUIRED between `qfg run` flags and the child
+ * command. Flags that look like child flags (e.g. `--silent`) without `--`
+ * would otherwise be eaten by oclif.
+ *
+ * Auth/env mode is binary — see resolve-run-environment.ts for the full rule.
+ */
+export default class Run extends APICommand {
+    static args: {
+        command: import("@oclif/core/lib/interfaces/parser.js").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        env: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string[], import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        'env-file': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        'preserve-env': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    static strict: boolean;
+    /**
+     * Override APICommand.init() — that base eagerly calls getClient(), which
+     * walks the OAuth path and fails before we've even validated the mode rule.
+     * For `qfg run` in Mode A (SDK key), we never need a JWT at all; for Mode B
+     * we'll mint the client on demand from run().
+     */
+    init(): Promise<void>;
+    run(): Promise<void>;
+    private execChild;
+    /**
+     * Resolve a single RawConfigWithDependencies into a stringified env value.
+     * Mirrors the providedBy / decryptWith handling in commands/get.ts so the
+     * two paths agree on what "the value of this key on the CLI host" means.
+     */
+    private resolveOne;
+    private resolveValues;
+    private resolveViaSdkKey;
+    private resolveViaUserAuth;
+}

package/dist/commands/run.js

@@ -0,0 +1,324 @@
+import { Args, Flags } from '@oclif/core';
+import { Quonfig } from '@quonfig/node';
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { APICommand } from '../index.js';
+import { decrypt } from '../util/encryption.js';
+import { getDeliveryUrl } from '../util/domain-urls.js';
+import getClient from '../util/get-client.js';
+import { parseEnvFileContents, parseInlineEnvSpec } from '../util/parse-run-env-spec.js';
+import { resolveRunEnvironmentMode } from '../util/resolve-run-environment.js';
+/**
+ * `qfg run` — resolve Quonfig configs into env vars and exec a child process.
+ *
+ * Use this for tools that read env vars at module import (drizzle-kit migrate,
+ * next-auth's AUTH_SECRET, build steps, one-shot scripts) where going through
+ * `instrumentation.ts` / SDK init isn't possible.
+ *
+ * The flag separator `--` is REQUIRED between `qfg run` flags and the child
+ * command. Flags that look like child flags (e.g. `--silent`) without `--`
+ * would otherwise be eaten by oclif.
+ *
+ * Auth/env mode is binary — see resolve-run-environment.ts for the full rule.
+ */
+export default class Run extends APICommand {
+    // Hidden positional that holds the child command and its args. The user
+    // is expected to put `--` before it; oclif moves everything after `--`
+    // into argv. We document the `--` requirement in the description.
+    static args = {
+        command: Args.string({ description: "child command (after '--')", required: false }),
+    };
+    static description = `Run a child process with Quonfig configs injected as env vars.
+
+Resolves --env VAR=key.path mappings (and --env-file lines) against your
+workspace, merges them into the parent env, and exec's the child command.
+Exits with the child's exit code. Missing keys → fail before spawning.
+
+Auth / environment is BINARY:
+  Mode A — QUONFIG_BACKEND_SDK_KEY set: env is encoded in the key.
+           Setting --environment OR QUONFIG_ENVIRONMENT alongside is an error.
+  Mode B — no SDK key: pass exactly one of --environment or QUONFIG_ENVIRONMENT.
+
+The flag separator '--' is REQUIRED between qfg flags and the child command.`;
+    static examples = [
+        '<%= config.bin %> <%= command.id %> --env DATABASE_URL=db.url --environment=staging -- env',
+        '<%= config.bin %> <%= command.id %> --env-file=.qfg.env --environment=staging -- npm run migrate',
+        '<%= config.bin %> <%= command.id %> --env DATABASE_URL=db.url -- ./bin/migrate.js   # Mode A: relies on QUONFIG_BACKEND_SDK_KEY',
+        '<%= config.bin %> <%= command.id %> --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test',
+    ];
+    static flags = {
+        env: Flags.string({
+            default: [],
+            description: 'Inline env mapping in VAR=key.path form. Repeatable.',
+            multiple: true,
+        }),
+        'env-file': Flags.string({
+            description: 'Path to a file with one VAR=key.path per line (# comments and blank lines OK).',
+            required: false,
+        }),
+        environment: Flags.string({
+            description: 'Quonfig environment to evaluate in (Mode B). Mutually exclusive with QUONFIG_ENVIRONMENT.',
+            required: false,
+        }),
+        'preserve-env': Flags.boolean({
+            default: false,
+            description: 'Skip vars that are already set in the parent env. Default: override.',
+        }),
+    };
+    // We collect everything after `--` ourselves; oclif then leaves us alone.
+    static strict = false;
+    /**
+     * Override APICommand.init() — that base eagerly calls getClient(), which
+     * walks the OAuth path and fails before we've even validated the mode rule.
+     * For `qfg run` in Mode A (SDK key), we never need a JWT at all; for Mode B
+     * we'll mint the client on demand from run().
+     */
+    async init() {
+        // Skip APICommand.init — call BaseCommand.init via the prototype chain.
+        // Object.getPrototypeOf(APICommand.prototype) is BaseCommand.prototype.
+        const baseInit = Object.getPrototypeOf(APICommand.prototype).init;
+        await baseInit.call(this);
+    }
+    async run() {
+        const { argv, flags } = await this.parse(Run);
+        // 1. Resolve mode (binary: Mode A SDK key, or Mode B user auth).
+        const sdkKey = process.env.QUONFIG_BACKEND_SDK_KEY;
+        const envEnv = process.env.QUONFIG_ENVIRONMENT;
+        const mode = resolveRunEnvironmentMode({
+            sdkKey,
+            envFlag: flags.environment,
+            envFromEnvironment: envEnv,
+        });
+        if (mode.mode === 'error') {
+            this.error(mode.message, { exit: 1 });
+        }
+        // 2. Collect VAR=key.path mappings from --env (inline) and --env-file.
+        const specs = [];
+        for (const inline of flags.env ?? []) {
+            try {
+                specs.push(parseInlineEnvSpec(inline));
+            }
+            catch (error) {
+                this.error(error instanceof Error ? error.message : String(error), { exit: 1 });
+            }
+        }
+        if (flags['env-file']) {
+            let contents;
+            try {
+                contents = readFileSync(flags['env-file'], 'utf8');
+            }
+            catch (error) {
+                this.error(`Failed to read --env-file ${flags['env-file']}: ${error instanceof Error ? error.message : String(error)}`, { exit: 1 });
+            }
+            try {
+                specs.push(...parseEnvFileContents(contents));
+            }
+            catch (error) {
+                this.error(`In ${flags['env-file']}: ${error instanceof Error ? error.message : String(error)}`, { exit: 1 });
+            }
+        }
+        // Detect duplicate VARs early. Last-write-wins would silently swallow
+        // typos; we'd rather fail loud.
+        const seen = new Map();
+        for (const s of specs) {
+            const prev = seen.get(s.varName);
+            if (prev !== undefined && prev !== s.configKey) {
+                this.error(`Duplicate --env entry for ${s.varName} (${prev} vs ${s.configKey}). Pick one.`, { exit: 1 });
+            }
+            seen.set(s.varName, s.configKey);
+        }
+        // 3. Locate the child command. argv after `--` is what we want; the
+        // oclif parser already strips the `--` token itself. If argv is empty
+        // after parsing flags, the user forgot to specify a child.
+        const childArgs = [...argv];
+        if (childArgs.length === 0) {
+            this.error('No child command specified. Usage: qfg run [flags] -- <cmd> [args...]', { exit: 1 });
+        }
+        const [childCmd, ...childRest] = childArgs;
+        // 4. Resolve config values from Quonfig. Fail-fast on any miss.
+        const resolved = await this.resolveValues(specs, mode, flags.workspace);
+        // 5. Build the child env. Default: override. --preserve-env: skip set.
+        const childEnv = { ...process.env };
+        for (const [varName, value] of Object.entries(resolved)) {
+            if (flags['preserve-env'] && childEnv[varName] !== undefined && childEnv[varName] !== '') {
+                this.verboseLog('preserve-env: keeping parent env', { varName });
+                continue;
+            }
+            childEnv[varName] = value;
+        }
+        // 6. Spawn. stdio:inherit so the child gets the real TTY where applicable.
+        await this.execChild(childCmd, childRest, childEnv);
+    }
+    async execChild(cmd, args, env) {
+        this.verboseLog('qfg run: spawning child', { cmd, args, varCount: Object.keys(env).length });
+        const exitCode = await new Promise((resolve) => {
+            const child = spawn(cmd, args, { env, stdio: 'inherit' });
+            child.on('error', (error) => {
+                // ENOENT etc. — fires before 'exit'. 127 is the conventional shell
+                // exit code for "command not found".
+                const msg = error instanceof Error ? error.message : String(error);
+                process.stderr.write(`qfg run: failed to spawn '${cmd}': ${msg}\n`);
+                resolve(127);
+            });
+            child.on('exit', (code, signal) => {
+                if (signal) {
+                    // Mirror the shell convention: signal-killed → 128 + signal number.
+                    const signalNumbers = { SIGINT: 2, SIGTERM: 15, SIGHUP: 1, SIGKILL: 9 };
+                    resolve(128 + (signalNumbers[signal] ?? 0));
+                    return;
+                }
+                resolve(code ?? 0);
+            });
+        });
+        // process.exit so the child's exit code becomes our exit code, even if
+        // oclif's outer catch handler would otherwise mask non-zero codes.
+        // In NODE_ENV=test we throw a typed error instead so the test runner
+        // can inspect it without process.exit killing the harness.
+        if (process.env.NODE_ENV === 'test') {
+            const err = new Error(`__test_child_exit__:${exitCode}`);
+            err.childExitCode = exitCode;
+            throw err;
+        }
+        // qfg run: propagating the child's exit code is the whole feature; we
+        // can't `throw` here because oclif's outer catch handler masks the
+        // numeric code with 1.
+        // eslint-disable-next-line n/no-process-exit, unicorn/no-process-exit
+        process.exit(exitCode);
+    }
+    /**
+     * Resolve a single RawConfigWithDependencies into a stringified env value.
+     * Mirrors the providedBy / decryptWith handling in commands/get.ts so the
+     * two paths agree on what "the value of this key on the CLI host" means.
+     */
+    resolveOne(key, config) {
+        let value = config.value;
+        const providedBy = config.dependencies?.find((d) => d.dependencyType === 'providedBy');
+        if (providedBy) {
+            const envVarName = providedBy.source;
+            const envValue = process.env[envVarName];
+            if (envValue === undefined) {
+                throw new Error(`provided by env var '${envVarName}' which is not set`);
+            }
+            value = envValue;
+        }
+        const decryptWith = config.dependencies?.find((d) => d.dependencyType === 'decryptWith');
+        if (decryptWith?.config) {
+            const encKeyConfig = decryptWith.config;
+            const keyProvided = encKeyConfig.dependencies?.find((d) => d.dependencyType === 'providedBy');
+            if (keyProvided) {
+                const envVarName = keyProvided.source;
+                const encryptionKey = process.env[envVarName];
+                if (encryptionKey === undefined) {
+                    throw new Error(`decryptWith key '${encKeyConfig.key}' is provided by env var '${envVarName}' which is not set`);
+                }
+                if (typeof value !== 'string') {
+                    throw new TypeError(`marked decryptWith but value is not a string`);
+                }
+                value = decrypt(value, encryptionKey);
+            }
+        }
+        if (value === null || value === undefined)
+            return undefined;
+        if (typeof value === 'string')
+            return value;
+        if (typeof value === 'number' || typeof value === 'boolean')
+            return String(value);
+        return JSON.stringify(value);
+    }
+    async resolveValues(specs, mode, workspaceFlag) {
+        if (specs.length === 0) {
+            this.warn('qfg run: no --env or --env-file mappings provided. The child will run with the parent env unchanged.');
+            return {};
+        }
+        if (mode.mode === 'sdk-key') {
+            return this.resolveViaSdkKey(specs, mode.sdkKey);
+        }
+        return this.resolveViaUserAuth(specs, mode.environmentName, workspaceFlag);
+    }
+    async resolveViaSdkKey(specs, sdkKey) {
+        // Mode A — talk to api-delivery via the @quonfig/node Quonfig SDK so we
+        // get the same evaluation path production apps use.
+        const quonfig = new Quonfig({
+            sdkKey,
+            collectEvaluationSummaries: false,
+            collectLoggerCounts: false,
+            contextUploadMode: 'none',
+            enableSSE: false,
+            apiUrls: [getDeliveryUrl()],
+        });
+        try {
+            await quonfig.init();
+        }
+        catch (error) {
+            this.error(`qfg run: failed to initialize Quonfig with QUONFIG_BACKEND_SDK_KEY: ${error instanceof Error ? error.message : String(error)}`, { exit: 1 });
+        }
+        const resolved = {};
+        const missing = [];
+        for (const spec of specs) {
+            const value = quonfig.get(spec.configKey);
+            if (value === undefined || value === null) {
+                missing.push(spec.configKey);
+                continue;
+            }
+            resolved[spec.varName] = String(value);
+        }
+        if (missing.length > 0) {
+            this.error(`qfg run: missing config key(s) in workspace (mode=sdk-key): ${missing.join(', ')}. Child not spawned.`, { exit: 1 });
+        }
+        return resolved;
+    }
+    async resolveViaUserAuth(specs, environmentName, workspaceFlag) {
+        // Mode B — same path as `qfg get`: POST /api/v1/evaluations/evaluate
+        // with workspaceId + environmentName, then resolve providedBy /
+        // decryptWith chains locally on the CLI host (qfg-c7d).
+        this.rawApiClient = await getClient(this, undefined, workspaceFlag);
+        const metadataRequest = await this.apiClient.post('/api/v1/metadata/list', { workspaceId: this.workspaceId });
+        if (!metadataRequest.ok) {
+            const detail = metadataRequest.error?.error ?? `HTTP ${metadataRequest.status}`;
+            this.error(`qfg run: failed to fetch configs: ${detail}`, { exit: 1 });
+        }
+        const metaJson = metadataRequest.json;
+        const allKeys = new Set((metaJson.configs ?? []).map((c) => c.key));
+        const missingMeta = specs.filter((s) => !allKeys.has(s.configKey)).map((s) => s.configKey);
+        if (missingMeta.length > 0) {
+            this.error(`qfg run: missing config key(s) in workspace: ${missingMeta.join(', ')}. Child not spawned.`, {
+                exit: 1,
+            });
+        }
+        const evalRequest = await this.apiClient.post('/api/v1/evaluations/evaluate', {
+            workspaceId: this.workspaceId,
+            environmentName,
+            context: {},
+        });
+        if (!evalRequest.ok) {
+            const detail = evalRequest.error?.error ?? `HTTP ${evalRequest.status}`;
+            this.error(`qfg run: failed to evaluate configs: ${detail}`, { exit: 1 });
+        }
+        const results = (Array.isArray(evalRequest.json) ? evalRequest.json : []);
+        const byKey = new Map(results.map((r) => [r.key, r]));
+        const resolved = {};
+        const errors = [];
+        for (const spec of specs) {
+            const config = byKey.get(spec.configKey);
+            if (!config) {
+                errors.push(`${spec.configKey}: not evaluable in environment "${environmentName}"`);
+                continue;
+            }
+            try {
+                const value = this.resolveOne(spec.configKey, config);
+                if (value === undefined) {
+                    errors.push(`${spec.configKey}: produced no value`);
+                    continue;
+                }
+                resolved[spec.varName] = value;
+            }
+            catch (error) {
+                errors.push(`${spec.configKey}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        if (errors.length > 0) {
+            this.error(`qfg run: failed to resolve ${errors.length} config(s). Child not spawned.\n  - ${errors.join('\n  - ')}`, { exit: 1 });
+        }
+        return resolved;
+    }
+}

package/dist/commands/sync.d.ts

@@ -8,9 +8,9 @@ export default class Sync extends BaseCommand {
         interval: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         watch: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
     };
+    private orgSlug;
     private resolvedDir;
     private workspaceId;
-    private orgSlug;
     run(): Promise<JsonObj | void>;
     private ensureRemoteUrl;
     private looksLike401;

package/dist/commands/sync.js

@@ -28,9 +28,9 @@ export default class Sync extends BaseCommand {
             required: true,
         }),
     };
+    orgSlug;
     resolvedDir;
     workspaceId;
-    orgSlug;
     async run() {
         const { flags } = await this.parse(Sync);
         // Resolve directory

package/dist/commands/whoami.d.ts

@@ -4,6 +4,12 @@ export default class Whoami extends BaseCommand {
     static description: string;
     static examples: string[];
     run(): Promise<JsonObj | void>;
+    /**
+     * Best-effort fetch of `me.organizations` for role enrichment. Failure
+     * (network, unauthenticated) is non-fatal — whoami still works from the
+     * local store, just without role labels.
+     */
+    private fetchOrganizations;
     /**
      * Pick the "active" org for display. Order:
      *   1. QUONFIG_WORKSPACE in `org/ws` form → look up org by slug in the store.
@@ -11,10 +17,4 @@ export default class Whoami extends BaseCommand {
      *   3. The first token entry — gives a stable marker rather than nothing.
      */
     private resolveActiveOrgId;
-    /**
-     * Best-effort fetch of `me.organizations` for role enrichment. Failure
-     * (network, unauthenticated) is non-fatal — whoami still works from the
-     * local store, just without role labels.
-     */
-    private fetchOrganizations;
 }

package/dist/commands/whoami.js

@@ -64,33 +64,6 @@ export default class Whoami extends BaseCommand {
             })),
         };
     }
-    /**
-     * Pick the "active" org for display. Order:
-     *   1. QUONFIG_WORKSPACE in `org/ws` form → look up org by slug in the store.
-     *   2. The token store's defaultOrgId, if it points at an entry we have.
-     *   3. The first token entry — gives a stable marker rather than nothing.
-     */
-    async resolveActiveOrgId(defaultOrgId) {
-        const env = process.env.QUONFIG_WORKSPACE;
-        if (env) {
-            const pin = tryParseWorkspacePin(env);
-            if (pin) {
-                const store = await loadTokens();
-                if (store) {
-                    const matched = findOrgIdBySlug(store, pin.orgSlug);
-                    if (matched)
-                        return matched;
-                }
-            }
-        }
-        if (defaultOrgId)
-            return defaultOrgId;
-        // Fall back to the first token entry — gives a stable marker rather than nothing.
-        const store = await loadTokens();
-        if (!store)
-            return undefined;
-        return Object.keys(store.tokensByOrg)[0];
-    }
     /**
      * Best-effort fetch of `me.organizations` for role enrichment. Failure
      * (network, unauthenticated) is non-fatal — whoami still works from the
@@ -130,6 +103,33 @@ export default class Whoami extends BaseCommand {
             return [];
         }
     }
+    /**
+     * Pick the "active" org for display. Order:
+     *   1. QUONFIG_WORKSPACE in `org/ws` form → look up org by slug in the store.
+     *   2. The token store's defaultOrgId, if it points at an entry we have.
+     *   3. The first token entry — gives a stable marker rather than nothing.
+     */
+    async resolveActiveOrgId(defaultOrgId) {
+        const env = process.env.QUONFIG_WORKSPACE;
+        if (env) {
+            const pin = tryParseWorkspacePin(env);
+            if (pin) {
+                const store = await loadTokens();
+                if (store) {
+                    const matched = findOrgIdBySlug(store, pin.orgSlug);
+                    if (matched)
+                        return matched;
+                }
+            }
+        }
+        if (defaultOrgId)
+            return defaultOrgId;
+        // Fall back to the first token entry — gives a stable marker rather than nothing.
+        const store = await loadTokens();
+        if (!store)
+            return undefined;
+        return Object.keys(store.tokensByOrg)[0];
+    }
 }
 /**
  * Combine the locally-cached orgs (one entry per token) with the server's

package/dist/commands/workspace/create.d.ts

@@ -11,6 +11,12 @@ export default class WorkspaceCreate extends BaseCommand {
         org: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
     };
     run(): Promise<JsonObj | void>;
+    /**
+     * oRPC surfaces structured errors as {json: {code, message, ...}} or
+     * {error: {...}}. Extract the message for display; fall back to raw
+     * text when the body isn't JSON.
+     */
+    private extractErrorMessage;
     /**
      * Pick the org for the new workspace from the per-org token store.
      *
@@ -26,10 +32,4 @@ export default class WorkspaceCreate extends BaseCommand {
      * lacks `org_slug`, errors with a `qfg login` hint.
      */
     private resolveOrgFromTokens;
-    /**
-     * oRPC surfaces structured errors as {json: {code, message, ...}} or
-     * {error: {...}}. Extract the message for display; fall back to raw
-     * text when the body isn't JSON.
-     */
-    private extractErrorMessage;
 }

package/dist/commands/workspace/create.js

@@ -17,6 +17,14 @@ function slugify(value) {
         .replaceAll(/[^\da-z]+/g, '-')
         .replaceAll(/^-|-$/g, '');
 }
+function requireSlug(workosOrgId, orgSlug) {
+    if (!orgSlug) {
+        return {
+            error: `Org \`${workosOrgId}\` is missing its slug locally. Run \`qfg login\` to refresh your org list.`,
+        };
+    }
+    return { workosOrgId, orgSlug };
+}
 export default class WorkspaceCreate extends BaseCommand {
     static args = {
         slug: Args.string({
@@ -138,6 +146,25 @@ export default class WorkspaceCreate extends BaseCommand {
             environments: created.environments,
         };
     }
+    /**
+     * oRPC surfaces structured errors as {json: {code, message, ...}} or
+     * {error: {...}}. Extract the message for display; fall back to raw
+     * text when the body isn't JSON.
+     */
+    async extractErrorMessage(res) {
+        try {
+            const body = (await res.clone().json());
+            return body.json?.message || body.error?.message || body.message || '';
+        }
+        catch {
+            try {
+                return await res.text();
+            }
+            catch {
+                return '';
+            }
+        }
+    }
     /**
      * Pick the org for the new workspace from the per-org token store.
      *
@@ -158,17 +185,13 @@ export default class WorkspaceCreate extends BaseCommand {
             return { error: 'No orgs found. Run `qfg login` first.' };
         }
         const entries = Object.entries(store.tokensByOrg);
-        const requireSlug = (workosOrgId, orgSlug) => {
-            if (!orgSlug) {
-                return { error: `Org \`${workosOrgId}\` is missing its slug locally. Run \`qfg login\` to refresh your org list.` };
-            }
-            return { workosOrgId, orgSlug };
-        };
         if (flagOrg) {
             if (UUID_PATTERN.test(flagOrg)) {
                 const tokens = store.tokensByOrg[flagOrg];
                 if (!tokens) {
-                    return { error: `Org \`${flagOrg}\` not found in your token store. Run \`qfg login\` to refresh your org list.` };
+                    return {
+                        error: `Org \`${flagOrg}\` not found in your token store. Run \`qfg login\` to refresh your org list.`,
+                    };
                 }
                 return requireSlug(flagOrg, tokens.org_slug);
             }
@@ -184,30 +207,11 @@ export default class WorkspaceCreate extends BaseCommand {
         }
         const slugList = entries
             .map(([, tokens]) => tokens.org_slug)
-            .filter((s) => Boolean(s))
+            .filter(Boolean)
             .join(', ');
         const orgList = slugList || entries.map(([orgId]) => orgId).join(', ');
         return {
             error: `You are a member of multiple orgs. Specify --org <org-slug> to indicate which org to create the workspace in. Your orgs: ${orgList}.`,
         };
     }
-    /**
-     * oRPC surfaces structured errors as {json: {code, message, ...}} or
-     * {error: {...}}. Extract the message for display; fall back to raw
-     * text when the body isn't JSON.
-     */
-    async extractErrorMessage(res) {
-        try {
-            const body = (await res.clone().json());
-            return body.json?.message || body.error?.message || body.message || '';
-        }
-        catch {
-            try {
-                return await res.text();
-            }
-            catch {
-                return '';
-            }
-        }
-    }
 }

package/dist/commands/workspace/switch.d.ts

@@ -7,6 +7,13 @@ export default class WorkspaceSwitch extends BaseCommand {
     static description: string;
     static examples: string[];
     run(): Promise<JsonObj | void>;
+    /**
+     * Iterate every cached org and merge its workspace list. Each org has its
+     * own access token; one token only sees one org's workspaces. We tolerate
+     * a single org's failure (verbose-log it) so a stale token in one org
+     * doesn't block switching into a working one.
+     */
+    private fetchAllOrgsWorkspaces;
     /**
      * Resolve the user's positional arg against the candidate list.
      *
@@ -16,11 +23,4 @@ export default class WorkspaceSwitch extends BaseCommand {
      *   migration message used elsewhere in the CLI.
      */
     private matchByArg;
-    /**
-     * Iterate every cached org and merge its workspace list. Each org has its
-     * own access token; one token only sees one org's workspaces. We tolerate
-     * a single org's failure (verbose-log it) so a stale token in one org
-     * doesn't block switching into a working one.
-     */
-    private fetchAllOrgsWorkspaces;
 }