@quonfig/cli 0.0.39 → 0.0.41

package/dist/commands/workspace/switch.js

@@ -80,42 +80,6 @@ export default class WorkspaceSwitch extends BaseCommand {
             workspaceSlug: match.workspaceSlug,
         };
     }
-    /**
-     * Resolve the user's positional arg against the candidate list.
-     *
-     * - `org/ws` form (preferred) → match by both org slug and workspace slug.
-     * - UUID → workspaceId match (kept for back-compat with scripts that
-     *   pass IDs straight through). Bare slug is rejected with the same
-     *   migration message used elsewhere in the CLI.
-     */
-    matchByArg(arg, candidates, store) {
-        if (UUID_PATTERN.test(arg)) {
-            const found = candidates.find((w) => w.workspaceId === arg);
-            if (!found)
-                return { error: `Workspace UUID "${arg}" not found among your accessible workspaces.` };
-            return { match: found };
-        }
-        const pin = tryParseWorkspacePin(arg);
-        if (!pin) {
-            return {
-                error: 'Workspace argument must be in `<org-slug>/<workspace-slug>` form (e.g. acme/production). ' +
-                    'Bare workspace slugs are no longer accepted.',
-            };
-        }
-        const orgId = findOrgIdBySlug(store, pin.orgSlug);
-        if (!orgId) {
-            return { error: `No token found for org \`${pin.orgSlug}\`. Run \`qfg login\` to add this org.` };
-        }
-        const found = candidates.find((w) => w.workosOrgId === orgId && w.workspaceSlug === pin.workspaceSlug);
-        if (!found) {
-            const inOrg = candidates.filter((w) => w.workosOrgId === orgId).map((w) => w.workspaceSlug);
-            const available = inOrg.length > 0 ? inOrg.join(', ') : '(none)';
-            return {
-                error: `Workspace "${pin.workspaceSlug}" not found in org "${pin.orgSlug}". Available: ${available}.`,
-            };
-        }
-        return { match: found };
-    }
     /**
      * Iterate every cached org and merge its workspace list. Each org has its
      * own access token; one token only sees one org's workspaces. We tolerate
@@ -160,6 +124,42 @@ export default class WorkspaceSwitch extends BaseCommand {
         }
         return [...merged.values()];
     }
+    /**
+     * Resolve the user's positional arg against the candidate list.
+     *
+     * - `org/ws` form (preferred) → match by both org slug and workspace slug.
+     * - UUID → workspaceId match (kept for back-compat with scripts that
+     *   pass IDs straight through). Bare slug is rejected with the same
+     *   migration message used elsewhere in the CLI.
+     */
+    matchByArg(arg, candidates, store) {
+        if (UUID_PATTERN.test(arg)) {
+            const found = candidates.find((w) => w.workspaceId === arg);
+            if (!found)
+                return { error: `Workspace UUID "${arg}" not found among your accessible workspaces.` };
+            return { match: found };
+        }
+        const pin = tryParseWorkspacePin(arg);
+        if (!pin) {
+            return {
+                error: 'Workspace argument must be in `<org-slug>/<workspace-slug>` form (e.g. acme/production). ' +
+                    'Bare workspace slugs are no longer accepted.',
+            };
+        }
+        const orgId = findOrgIdBySlug(store, pin.orgSlug);
+        if (!orgId) {
+            return { error: `No token found for org \`${pin.orgSlug}\`. Run \`qfg login\` to add this org.` };
+        }
+        const found = candidates.find((w) => w.workosOrgId === orgId && w.workspaceSlug === pin.workspaceSlug);
+        if (!found) {
+            const inOrg = candidates.filter((w) => w.workosOrgId === orgId).map((w) => w.workspaceSlug);
+            const available = inOrg.length > 0 ? inOrg.join(', ') : '(none)';
+            return {
+                error: `Workspace "${pin.workspaceSlug}" not found in org "${pin.orgSlug}". Available: ${available}.`,
+            };
+        }
+        return { match: found };
+    }
 }
 function pinFor(w) {
     const orgSlug = w.organizationSlug ?? slugFromName(w.organizationName) ?? w.workosOrgId;

package/dist/commands/workspace.d.ts

@@ -4,12 +4,6 @@ export default class Workspace extends BaseCommand {
     static description: string;
     static examples: string[];
     run(): Promise<JsonObj | void>;
-    /**
-     * Pin the default-profile workspaceId to org/ws form by looking it up in
-     * the workspaces list. Returns undefined if the auth config is empty or
-     * the saved workspace doesn't appear in the listing.
-     */
-    private profilePin;
     /**
      * QUONFIG_WORKSPACE wins over the default profile (matches the resolution
      * order in get-client.ts/resolve-workspace.ts). Bare slugs are ignored
@@ -17,11 +11,17 @@ export default class Workspace extends BaseCommand {
      * shows the default profile instead.
      */
     private activePin;
-    private fetchWorkspaces;
     /**
      * Fan out across every cached org's token and merge the results. One org's
      * stale token doesn't block the others — we verbose-log and continue.
      */
     private fetchAllOrgsWorkspaces;
+    private fetchWorkspaces;
+    /**
+     * Pin the default-profile workspaceId to org/ws form by looking it up in
+     * the workspaces list. Returns undefined if the auth config is empty or
+     * the saved workspace doesn't appear in the listing.
+     */
+    private profilePin;
     private runApiKeyMode;
 }

package/dist/commands/workspace.js

@@ -17,9 +17,7 @@ export default class Workspace extends BaseCommand {
         }
         const authConfig = await loadAuthConfig();
         const orgEntries = Object.entries(store.tokensByOrg);
-        const orgSlugsWithTokens = orgEntries
-            .map(([orgId, t]) => t.org_slug ?? orgId)
-            .sort((a, b) => a.localeCompare(b));
+        const orgSlugsWithTokens = orgEntries.map(([orgId, t]) => t.org_slug ?? orgId).sort((a, b) => a.localeCompare(b));
         // /userWorkspaces/list is per-token-org-scoped — a single org's JWT
         // only sees that org's workspaces. Iterate every cached org so the
         // listing is comprehensive in multi-org accounts.
@@ -69,26 +67,6 @@ export default class Workspace extends BaseCommand {
             })),
         };
     }
-    /**
-     * Pin the default-profile workspaceId to org/ws form by looking it up in
-     * the workspaces list. Returns undefined if the auth config is empty or
-     * the saved workspace doesn't appear in the listing.
-     */
-    profilePin(authConfig, allWorkspaces) {
-        if (!authConfig)
-            return undefined;
-        const activeProfileName = getActiveProfile();
-        const profile = authConfig.profiles[activeProfileName] || authConfig.profiles[authConfig.defaultProfile || 'default'];
-        if (!profile)
-            return undefined;
-        const match = allWorkspaces.find((w) => w.workspaceId === profile.workspace);
-        if (!match)
-            return undefined;
-        const orgSlug = match.organizationSlug ?? slugFromName(match.organizationName);
-        if (!orgSlug)
-            return undefined;
-        return `${orgSlug}/${match.workspaceSlug}`;
-    }
     /**
      * QUONFIG_WORKSPACE wins over the default profile (matches the resolution
      * order in get-client.ts/resolve-workspace.ts). Bare slugs are ignored
@@ -110,26 +88,6 @@ export default class Workspace extends BaseCommand {
         }
         return fallback;
     }
-    async fetchWorkspaces(jwt) {
-        try {
-            const res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
-                method: 'POST',
-                headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
-                body: JSON.stringify({ json: {} }),
-            });
-            if (!res.ok) {
-                this.verboseLog('workspace: userWorkspaces/list non-OK', { status: res.status });
-                return [];
-            }
-            const body = (await res.json());
-            const list = (body.json ?? body);
-            return Array.isArray(list) ? list : [];
-        }
-        catch (error) {
-            this.verboseLog('workspace: userWorkspaces/list failed', { error: String(error) });
-            return [];
-        }
-    }
     /**
      * Fan out across every cached org's token and merge the results. One org's
      * stale token doesn't block the others — we verbose-log and continue.
@@ -154,6 +112,46 @@ export default class Workspace extends BaseCommand {
         }
         return [...merged.values()];
     }
+    async fetchWorkspaces(jwt) {
+        try {
+            const res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ json: {} }),
+            });
+            if (!res.ok) {
+                this.verboseLog('workspace: userWorkspaces/list non-OK', { status: res.status });
+                return [];
+            }
+            const body = (await res.json());
+            const list = (body.json ?? body);
+            return Array.isArray(list) ? list : [];
+        }
+        catch (error) {
+            this.verboseLog('workspace: userWorkspaces/list failed', { error: String(error) });
+            return [];
+        }
+    }
+    /**
+     * Pin the default-profile workspaceId to org/ws form by looking it up in
+     * the workspaces list. Returns undefined if the auth config is empty or
+     * the saved workspace doesn't appear in the listing.
+     */
+    profilePin(authConfig, allWorkspaces) {
+        if (!authConfig)
+            return undefined;
+        const activeProfileName = getActiveProfile();
+        const profile = authConfig.profiles[activeProfileName] || authConfig.profiles[authConfig.defaultProfile || 'default'];
+        if (!profile)
+            return undefined;
+        const match = allWorkspaces.find((w) => w.workspaceId === profile.workspace);
+        if (!match)
+            return undefined;
+        const orgSlug = match.organizationSlug ?? slugFromName(match.organizationName);
+        if (!orgSlug)
+            return undefined;
+        return `${orgSlug}/${match.workspaceSlug}`;
+    }
     async runApiKeyMode() {
         const override = process.env.QUONFIG_WORKSPACE;
         if (!override) {

package/dist/push/run-push.d.ts

@@ -36,22 +36,6 @@ export interface GitOps {
      * HEAD vs origin/main; for the bare path it's local vs probe-clone.
      */
     diffHeadVsOrigin(dir: string): Promise<FileDelta[]>;
-    /** `git fetch origin` in the given dir. */
-    fetch(dir: string): Promise<void>;
-    /** Returns the `remote.origin.url` for the repo, or undefined if unset / not a repo. */
-    getRemoteOriginUrl(dir: string): Promise<string | undefined>;
-    /** Returns true if the dir has a `.git/` (worktree or repo). */
-    isGitRepo(dir: string): Promise<boolean>;
-    /**
-     * Returns true if origin/main has commits the local HEAD does not have
-     * (local strictly behind, or diverged). False when local is up-to-date
-     * or strictly ahead of origin/main, or when origin/main is unknown.
-     *
-     * The clone-path stale-HEAD guard (qfg-fboj) refuses to push in either
-     * "behind" or "diverged" state because both produce a diff that ships
-     * REVERSAL deltas to the server, silently undoing remote-newer commits.
-     */
-    isLocalBehindRemote(dir: string): Promise<boolean>;
     /**
      * Tracked files (relative paths) with working-tree or staged changes.
      * Used by the clone-path dirty-tree warning to surface uncommitted
@@ -59,6 +43,8 @@ export interface GitOps {
      * files are excluded — same rule as `dirtyTrackedFiles` in git-ops.ts.
      */
     dirtyTrackedFiles(dir: string): Promise<string[]>;
+    /** `git fetch origin` in the given dir. */
+    fetch(dir: string): Promise<void>;
     /**
      * Returns the local SHA of `origin/main` after fetch — the remote tip
      * the diff was computed against — or undefined if no `origin/main` ref
@@ -69,6 +55,20 @@ export interface GitOps {
      * origin moved between fetch and push.
      */
     getOriginMainSha(dir: string): Promise<string | undefined>;
+    /** Returns the `remote.origin.url` for the repo, or undefined if unset / not a repo. */
+    getRemoteOriginUrl(dir: string): Promise<string | undefined>;
+    /** Returns true if the dir has a `.git/` (worktree or repo). */
+    isGitRepo(dir: string): Promise<boolean>;
+    /**
+     * Returns true if origin/main has commits the local HEAD does not have
+     * (local strictly behind, or diverged). False when local is up-to-date
+     * or strictly ahead of origin/main, or when origin/main is unknown.
+     *
+     * The clone-path stale-HEAD guard (qfg-fboj) refuses to push in either
+     * "behind" or "diverged" state because both produce a diff that ships
+     * REVERSAL deltas to the server, silently undoing remote-newer commits.
+     */
+    isLocalBehindRemote(dir: string): Promise<boolean>;
     /** Set origin to `url` (add if missing, set-url if present). */
     setRemoteOrigin(dir: string, url: string): Promise<void>;
 }

package/dist/util/config-value-dto.js

@@ -7,19 +7,23 @@ import { ConfigValueType } from '@quonfig/node';
  * @returns The DTO representation of the config value
  */
 export function mapConfigValueToDto(configValue, valueType) {
-    const dto = {
-        type: mapValueTypeToString(valueType),
-    };
-    // Handle provided (env-var) values
+    // Handle provided (env-var) values. The API's ValueSchema discriminates on
+    // `type`, so a provided value is `{type: 'provided', value: {source, lookup}}`
+    // — NOT `{type: '<scalar>', provided: {…}}`. The outer config.valueType still
+    // describes the resolved type (e.g. "string"); only the defaultValue flips
+    // to `provided`. See qfg-84df for the original repro.
     if (configValue.provided) {
         return {
-            ...dto,
-            provided: {
+            type: 'provided',
+            value: {
                 source: configValue.provided.source,
                 lookup: configValue.provided.lookup,
             },
         };
     }
+    const dto = {
+        type: mapValueTypeToString(valueType),
+    };
     // Extract the actual value based on type
     let value;
     if (configValue.bool !== undefined) {

package/dist/util/git-ops.js

@@ -182,7 +182,8 @@ export const commitPinFixIfPinOnly = async (dir, file, expectedSlug) => {
     // Compare working tree vs HEAD ignoring `workspace`. If anything else
     // differs, the user has additional uncommitted edits — leave alone.
     const stripped = (o) => {
-        const { workspace: _ignored, ...rest } = o;
+        const rest = { ...o };
+        delete rest.workspace;
         return rest;
     };
     const a = JSON.stringify(stripped(workingParsed), Object.keys(stripped(workingParsed)).sort());
@@ -296,13 +297,7 @@ export const gitMergeFfOnly = async (dir) => {
     let newCommits = [];
     try {
         const { stdout: localSha } = await runGit(['-C', dir, 'rev-parse', 'HEAD']);
-        const { stdout: log } = await runGit([
-            '-C',
-            dir,
-            'log',
-            '--pretty=format:%s',
-            `${localSha.trim()}..origin/main`,
-        ]);
+        const { stdout: log } = await runGit(['-C', dir, 'log', '--pretty=format:%s', `${localSha.trim()}..origin/main`]);
         newCommits = log
             .split('\n')
             .map((s) => s.trim())
@@ -371,7 +366,7 @@ export const gitPullRebase = async (dir) => {
         await runGit(['-C', dir, 'pull', '--rebase', 'origin', 'main']);
         return { kind: 'clean', commitsRebased };
     }
-    catch (err) {
+    catch (error) {
         // Distinguish "rebase paused on conflicts" from "rebase never started".
         // Conflicts: `diff --diff-filter=U` lists the unmerged paths and
         // `.git/rebase-merge/` is present.
@@ -388,7 +383,7 @@ export const gitPullRebase = async (dir) => {
         catch {
             // Fall through to 'failed' — diff itself errored.
         }
-        const reason = err instanceof Error ? err.message : String(err);
+        const reason = error instanceof Error ? error.message : String(error);
         return { kind: 'failed', reason };
     }
 };

package/dist/util/open-browser.js

@@ -8,7 +8,7 @@ export const openBrowser = (url) => {
     }
     else if (process.platform === 'win32') {
         command = 'cmd';
-        args = ['/c', 'start', '""', url.replace(/&/g, '^&')];
+        args = ['/c', 'start', '""', url.replaceAll('&', '^&')];
     }
     else {
         command = 'xdg-open';

package/dist/util/parse-run-env-spec.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Parsers for `qfg run` env-var → config-key mappings.
+ *
+ * Two callers, one grammar:
+ *   - `--env VAR=key.path`  (inline)
+ *   - `--env-file=PATH`     (one VAR=key.path per line)
+ *
+ * Grammar choices that are intentionally narrow:
+ *   - Separator is `=`, not `:`. Matches `docker -e VAR=value` muscle memory.
+ *     A line like `VAR:key.path` is rejected, not silently re-interpreted.
+ *   - Split on the FIRST `=` only, so future config keys can theoretically
+ *     contain `=` (rare, but cheap to support).
+ *   - VAR side trimmed; key side trimmed once (whitespace inside the key
+ *     is preserved if it's somehow legal — but we don't go out of our way).
+ *   - Env files: blank lines and `#` comments are skipped. Errors include
+ *     the 1-based line number so users can `vim +N file.env` to the spot.
+ */
+export interface RunEnvSpec {
+    configKey: string;
+    varName: string;
+}
+export declare const parseInlineEnvSpec: (raw: string) => RunEnvSpec;
+export declare const parseEnvFileContents: (contents: string) => RunEnvSpec[];

package/dist/util/parse-run-env-spec.js

@@ -0,0 +1,56 @@
+/**
+ * Parsers for `qfg run` env-var → config-key mappings.
+ *
+ * Two callers, one grammar:
+ *   - `--env VAR=key.path`  (inline)
+ *   - `--env-file=PATH`     (one VAR=key.path per line)
+ *
+ * Grammar choices that are intentionally narrow:
+ *   - Separator is `=`, not `:`. Matches `docker -e VAR=value` muscle memory.
+ *     A line like `VAR:key.path` is rejected, not silently re-interpreted.
+ *   - Split on the FIRST `=` only, so future config keys can theoretically
+ *     contain `=` (rare, but cheap to support).
+ *   - VAR side trimmed; key side trimmed once (whitespace inside the key
+ *     is preserved if it's somehow legal — but we don't go out of our way).
+ *   - Env files: blank lines and `#` comments are skipped. Errors include
+ *     the 1-based line number so users can `vim +N file.env` to the spot.
+ */
+const splitOnFirstEquals = (raw) => {
+    const idx = raw.indexOf('=');
+    if (idx === -1)
+        return undefined;
+    return [raw.slice(0, idx), raw.slice(idx + 1)];
+};
+export const parseInlineEnvSpec = (raw) => {
+    const split = splitOnFirstEquals(raw);
+    if (!split) {
+        throw new Error(`Invalid --env value "${raw}": expected VAR=key.path`);
+    }
+    const varName = split[0].trim();
+    const configKey = split[1].trim();
+    if (varName === '') {
+        throw new Error(`Invalid --env value "${raw}": empty VAR name (left of =)`);
+    }
+    if (configKey === '') {
+        throw new Error(`Invalid --env value "${raw}": empty config key (right of =)`);
+    }
+    return { varName, configKey };
+};
+export const parseEnvFileContents = (contents) => {
+    const out = [];
+    let lineNumber = 0;
+    for (const raw of contents.split('\n')) {
+        lineNumber += 1;
+        const trimmed = raw.trim();
+        if (trimmed === '' || trimmed.startsWith('#'))
+            continue;
+        try {
+            out.push(parseInlineEnvSpec(trimmed));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new Error(`${detail} (line ${lineNumber})`);
+        }
+    }
+    return out;
+};

package/dist/util/quonfig-json.js

@@ -177,12 +177,12 @@ export function upsertWorkspaceKey(raw, slug) {
     const after = raw.slice(endOfLastValue + 1);
     const hasOtherKeys = Object.keys(parsed).length > 0;
     // Detect indent from the first nested key. Default to two spaces.
-    const indentMatch = raw.match(/\n([ \t]+)"/);
+    const indentMatch = raw.match(/\n([\t ]+)"/);
     const indent = indentMatch ? indentMatch[1] : '  ';
     // If the original used a multi-line object (closing brace on its own
     // line), keep that shape. Otherwise the original was a single-line
     // object like `{}` or `{"k":v}` — emit on one line.
-    const isMultiline = /\n\s*\}\s*$/.test(raw) || /\n/.test(raw.slice(0, closingIdx));
+    const isMultiline = /\n\s*}\s*$/.test(raw) || /\n/.test(raw.slice(0, closingIdx));
     let insertion;
     if (isMultiline) {
         insertion = hasOtherKeys ? `,\n${indent}"workspace": ${slugJson}` : `\n${indent}"workspace": ${slugJson}`;

package/dist/util/resolve-run-environment.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Resolve the auth/environment mode for `qfg run`.
+ *
+ * The rule is **binary and mutually exclusive** — never resolve in
+ * precedence order, because a "match-only" exception drifts silently and
+ * masks misconfiguration in CI.
+ *
+ *   Mode A — `QUONFIG_BACKEND_SDK_KEY` set:
+ *     The SDK key encodes both project and environment. If `--environment`
+ *     OR `QUONFIG_ENVIRONMENT` is also present, return an `error` — even
+ *     if they would agree, because tolerating that case lets a stale env
+ *     var quietly drift past us until the day it disagrees.
+ *
+ *   Mode B — no SDK key:
+ *     Require EXACTLY ONE of `--environment` flag or `QUONFIG_ENVIRONMENT`
+ *     env var. Both → error. Neither → error. There is no interactive
+ *     prompt — `qfg run` is scripted, and prompting mid-`&&`-chain is
+ *     worse UX than failing loud.
+ *
+ * Empty strings are treated as "unset" because shells routinely emit
+ * `EXPORT_FOO=` when a var is declared but has no value, and silently
+ * picking Mode A with an empty key would surface as a confusing 401 from
+ * api-delivery much later.
+ */
+export interface ResolveRunEnvironmentInput {
+    /** Value of the `--environment` flag (or undefined). */
+    envFlag: string | undefined;
+    /** Value of `QUONFIG_ENVIRONMENT` env var (or undefined). */
+    envFromEnvironment: string | undefined;
+    /** Value of `QUONFIG_BACKEND_SDK_KEY` (or undefined). */
+    sdkKey: string | undefined;
+}
+export type ResolveRunEnvironmentResult = {
+    mode: 'sdk-key';
+    sdkKey: string;
+} | {
+    mode: 'user';
+    environmentName: string;
+} | {
+    mode: 'error';
+    message: string;
+};
+export declare const RUN_MODE_AMBIGUOUS_ERROR: string;
+export declare const RUN_MODE_NO_ENV_ERROR: string;
+export declare const RUN_MODE_BOTH_ENV_ERROR = "qfg run: pass exactly one of --environment or QUONFIG_ENVIRONMENT (both are set).";
+export declare const resolveRunEnvironmentMode: (input: ResolveRunEnvironmentInput) => ResolveRunEnvironmentResult;

package/dist/util/resolve-run-environment.js

@@ -0,0 +1,52 @@
+/**
+ * Resolve the auth/environment mode for `qfg run`.
+ *
+ * The rule is **binary and mutually exclusive** — never resolve in
+ * precedence order, because a "match-only" exception drifts silently and
+ * masks misconfiguration in CI.
+ *
+ *   Mode A — `QUONFIG_BACKEND_SDK_KEY` set:
+ *     The SDK key encodes both project and environment. If `--environment`
+ *     OR `QUONFIG_ENVIRONMENT` is also present, return an `error` — even
+ *     if they would agree, because tolerating that case lets a stale env
+ *     var quietly drift past us until the day it disagrees.
+ *
+ *   Mode B — no SDK key:
+ *     Require EXACTLY ONE of `--environment` flag or `QUONFIG_ENVIRONMENT`
+ *     env var. Both → error. Neither → error. There is no interactive
+ *     prompt — `qfg run` is scripted, and prompting mid-`&&`-chain is
+ *     worse UX than failing loud.
+ *
+ * Empty strings are treated as "unset" because shells routinely emit
+ * `EXPORT_FOO=` when a var is declared but has no value, and silently
+ * picking Mode A with an empty key would surface as a confusing 401 from
+ * api-delivery much later.
+ */
+export const RUN_MODE_AMBIGUOUS_ERROR = 'qfg run: QUONFIG_BACKEND_SDK_KEY is set, which encodes the environment.\n' +
+    'Remove --environment and unset QUONFIG_ENVIRONMENT, or remove the SDK key.';
+export const RUN_MODE_NO_ENV_ERROR = 'qfg run: no environment specified.\n' +
+    'Either set QUONFIG_BACKEND_SDK_KEY (which encodes env) or\n' +
+    'set QUONFIG_ENVIRONMENT / pass --environment after `qfg login`.';
+export const RUN_MODE_BOTH_ENV_ERROR = 'qfg run: pass exactly one of --environment or QUONFIG_ENVIRONMENT (both are set).';
+const blank = (s) => s === undefined || s === '';
+export const resolveRunEnvironmentMode = (input) => {
+    const hasSdkKey = !blank(input.sdkKey);
+    const hasFlag = !blank(input.envFlag);
+    const hasEnvVar = !blank(input.envFromEnvironment);
+    if (hasSdkKey) {
+        if (hasFlag || hasEnvVar) {
+            return { mode: 'error', message: RUN_MODE_AMBIGUOUS_ERROR };
+        }
+        return { mode: 'sdk-key', sdkKey: input.sdkKey };
+    }
+    if (hasFlag && hasEnvVar) {
+        return { mode: 'error', message: RUN_MODE_BOTH_ENV_ERROR };
+    }
+    if (hasFlag) {
+        return { mode: 'user', environmentName: input.envFlag };
+    }
+    if (hasEnvVar) {
+        return { mode: 'user', environmentName: input.envFromEnvironment };
+    }
+    return { mode: 'error', message: RUN_MODE_NO_ENV_ERROR };
+};

package/dist/util/resolve-workspace.d.ts

@@ -1,6 +1,5 @@
 import type { BaseCommand } from '../index.js';
 export interface ResolvedWorkspace {
-    workspaceId: string;
     /**
      * Org slug that owns workspaceId. Empty string in the QUONFIG_API_KEY
      * path because API keys are workspace-scoped and the slug is never
@@ -8,6 +7,7 @@ export interface ResolvedWorkspace {
      * on the env key before consulting it.
      */
     orgSlug: string;
+    workspaceId: string;
 }
 /**
  * Resolve the target workspace UUID + owning org slug for commands that

package/dist/util/token-storage.d.ts

@@ -4,9 +4,8 @@ export interface TokenStorageOptions {
 export interface TokenSet {
     access_token: string;
     expires_at: number;
-    refresh_token: string;
-    user_email?: string;
-    user_id?: string;
+    /** Org display name for `qfg whoami` / `qfg workspace`. */
+    org_name?: string;
     /**
      * Human-readable org slug (e.g. "acme") — populated by the per-org login
      * flow so the CLI can resolve `acme/foo`-form workspace addresses against
@@ -14,8 +13,9 @@ export interface TokenSet {
      * project/plans/multi-org-cli-auth.md (qfg-kr7).
      */
     org_slug?: string;
-    /** Org display name for `qfg whoami` / `qfg workspace`. */
-    org_name?: string;
+    refresh_token: string;
+    user_email?: string;
+    user_id?: string;
 }
 /**
  * Schema version of tokens.json. Stamped on every saveTokens write so a
@@ -24,11 +24,11 @@ export interface TokenSet {
  */
 export declare const TOKEN_STORE_VERSION = 2;
 export interface TokenStore {
-    version?: number;
     defaultOrgId?: string;
     tokensByOrg: {
         [workosOrgId: string]: TokenSet;
     };
+    version?: number;
 }
 export declare const getTokenForOrg: (store: TokenStore, workosOrgId: string) => TokenSet | undefined;
 /**

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.39";
+declare const _default: "0.0.41";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.39';
+export default '0.0.41';