@quonfig/cli 0.0.52 → 0.0.54

package/dist/serve/handlers/evalContext.js

@@ -0,0 +1,141 @@
+/**
+ * Handler for `GET /api/v2/configs/eval-with-context/{base64url(ctx)}`.
+ *
+ * Mirrors api-delivery/internal/serve/eval_context.go so SDK clients see the
+ * same EvalEnvelope shape they get in production. The fields are:
+ *
+ *   { evaluations: { [key]: {
+ *       value: { type, value, confidential?, decryptWith? },
+ *       configId, configType, valueType, reason,
+ *       ruleIndex?, weightedValueIndex?
+ *     } },
+ *     meta: { version, environment }
+ *   }
+ *
+ * `reason` follows the cross-SDK spec
+ * `project/plans/openfeature-resolution-details.md`:
+ *   - "SPLIT"            for weighted-value flags
+ *   - "TARGETING_MATCH"  for configs whose matched rule has a non-ALWAYS_TRUE criterion
+ *   - "STATIC"           otherwise
+ *
+ * `ruleIndex` and `weightedValueIndex` are emitted only when the reason class
+ * carries useful information (TARGETING_MATCH or SPLIT). This matches the Go
+ * handler's "omit, don't null" rule.
+ */
+/**
+ * G6 (qfg-38sf.1 audit): cap on the raw base64 context token length before
+ * we allocate a Buffer for it. 64 KB is well above the realistic size of any
+ * SDK-sent context envelope (Quonfig contexts are typically a few hundred
+ * bytes; the SDK base64-encodes a small JSON object) while still bounded
+ * enough to prevent a malicious client from forcing the server to allocate
+ * a multi-megabyte buffer per request.
+ */
+const MAX_CTX_TOKEN_BYTES = 64 * 1024;
+export async function handleEvalContext(req, res, ctxToken, deps) {
+    // G6: bound the token size BEFORE we decode it. The 64KB cap is way above
+    // realistic context payloads and small enough that a malicious caller
+    // can't trick us into allocating gigabytes. 414 URI Too Long is the right
+    // status — RFC 7231 §6.5.12 covers exactly this case (the URL is the
+    // request-target, the ctx is a path segment, so it's a URI-length problem,
+    // not a body-length problem).
+    if (ctxToken.length > MAX_CTX_TOKEN_BYTES) {
+        res.writeHead(414, { 'Content-Type': 'text/plain' });
+        res.end('context token too large');
+        return;
+    }
+    // base64url decode → JSON. We accept the URL-safe alphabet and the
+    // standard one because the Go handler does (`base64.URLEncoding`,
+    // `StdEncoding`, `RawURLEncoding` — Node's "base64url" parser already
+    // covers the no-padding URL-safe case; we try standard as a fallback).
+    let contextData;
+    try {
+        let json;
+        try {
+            json = Buffer.from(ctxToken, 'base64url').toString('utf8');
+        }
+        catch {
+            json = Buffer.from(ctxToken, 'base64').toString('utf8');
+        }
+        contextData = JSON.parse(json);
+    }
+    catch {
+        res.writeHead(400, { 'Content-Type': 'text/plain' });
+        res.end('invalid context token encoding');
+        return;
+    }
+    const snap = deps.getSnapshot();
+    const evaluations = {};
+    // The SDK's Evaluator takes a `Contexts` map shaped exactly like the JSON
+    // we just decoded: { [contextName]: { [key]: value } }. No translation
+    // needed.
+    for (const key of snap.store.keys()) {
+        const cfg = snap.store.get(key);
+        if (!cfg)
+            continue;
+        // F3 (qfg-38sf.1 audit): UNCONDITIONAL sendToClientSdk filter. Every qfg
+        // serve consumer is a frontend client by definition, so we apply the
+        // same gate api-delivery uses for frontend SDK keys
+        // (eval_context.go:103) regardless of whether --frontend-sdk-key was
+        // passed. Feature flags bypass the filter, matching the Go behavior.
+        if (cfg.type !== 'feature_flag' && !cfg.sendToClientSdk) {
+            continue;
+        }
+        const match = snap.evaluator.evaluateConfig(cfg, snap.environment, contextData);
+        if (!match.isMatch || match.value === undefined)
+            continue;
+        const reason = resolutionReason(cfg, match);
+        const result = {
+            value: {
+                type: match.value.type,
+                value: match.value.value,
+            },
+            configId: cfg.id,
+            configType: cfg.type,
+            valueType: cfg.valueType,
+            reason,
+        };
+        if (match.value.confidential !== undefined)
+            result.value.confidential = match.value.confidential;
+        if (match.value.decryptWith !== undefined)
+            result.value.decryptWith = match.value.decryptWith;
+        if (reason === 'TARGETING_MATCH' || reason === 'SPLIT') {
+            result.ruleIndex = match.ruleIndex;
+        }
+        if (reason === 'SPLIT') {
+            result.weightedValueIndex = match.weightedValueIndex;
+        }
+        evaluations[cfg.key] = result;
+    }
+    const envelope = {
+        evaluations,
+        meta: { version: snap.version, environment: snap.environment },
+    };
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(envelope));
+}
+function resolutionReason(cfg, _match) {
+    if (cfg.valueType === 'weighted_values')
+        return 'SPLIT';
+    if (hasResolutionTargeting(cfg))
+        return 'TARGETING_MATCH';
+    return 'STATIC';
+}
+function hasResolutionTargeting(cfg) {
+    if (rulesAreTargeted(cfg.default?.rules))
+        return true;
+    const envRules = cfg.environment?.rules;
+    if (rulesAreTargeted(envRules))
+        return true;
+    return false;
+}
+function rulesAreTargeted(rules) {
+    if (!rules)
+        return false;
+    for (const rule of rules) {
+        for (const criterion of rule.criteria) {
+            if (criterion.operator !== 'ALWAYS_TRUE')
+                return true;
+        }
+    }
+    return false;
+}

package/dist/serve/server.d.ts

@@ -0,0 +1,53 @@
+/**
+ * HTTP server for `qfg serve`. Boots a single `@quonfig/node` Quonfig client
+ * with `{datadir, dataDirAutoReload}` so file changes flow into a shared
+ * snapshot (mirror of the SDK's `ConfigStore`). All requests evaluate against
+ * that snapshot — see plan project/plans/qfg-serve.md §5 ("Integration with
+ * auto-reload work").
+ *
+ * Bound by default to 127.0.0.1. Auth and CORS are configured per plan §4.
+ */
+import type { ConfigResponse } from '@quonfig/node';
+export interface Logger {
+    log: (msg: string) => void;
+    warn: (msg: string) => void;
+}
+export interface ServeOptions {
+    allowNonLoopback: boolean;
+    corsOrigins: string[];
+    datadir: string;
+    environment: string;
+    /**
+     * Test-only escape hatch — startServer treats this string as the bind host
+     * for the loopback / non-loopback policy check, while still actually
+     * binding to `host`. Lets unit tests assert the WARN path without binding
+     * 0.0.0.0 in CI (which some networks forbid). NOT a public option.
+     */
+    forceNonLoopbackForTest?: string;
+    frontendSdkKey?: string;
+    host: string;
+    logger: Logger;
+    port: number;
+    verbose: boolean;
+    watch: boolean;
+    /** Override the SDK's 200ms default debounce; lets tests check the watch path quickly. */
+    watchDebounceMs?: number;
+}
+export interface ServeHandle {
+    /** Stop watching, close all sockets, await SDK close. Idempotent. */
+    close(): Promise<void>;
+    host: string;
+    port: number;
+}
+export declare function startServer(opts: ServeOptions): Promise<ServeHandle>;
+/**
+ * G8 (qfg-38sf.6): compute meta.version as sha256 of the canonicalized
+ * configs array. Canonical form is `JSON.stringify(configs, sortedKeys)` so
+ * two snapshots with identical config content produce the same hash regardless
+ * of object-key order. The hash replaces the prior `datadir:<abs-path>#<ts>`
+ * shape, which leaked operator filesystem layout and changed on every reload
+ * even when the data was unchanged.
+ *
+ * Exported for unit tests that want to assert determinism / stability.
+ */
+export declare function computeVersion(configs: ConfigResponse[]): string;

package/dist/serve/server.js

@@ -0,0 +1,355 @@
+/**
+ * HTTP server for `qfg serve`. Boots a single `@quonfig/node` Quonfig client
+ * with `{datadir, dataDirAutoReload}` so file changes flow into a shared
+ * snapshot (mirror of the SDK's `ConfigStore`). All requests evaluate against
+ * that snapshot — see plan project/plans/qfg-serve.md §5 ("Integration with
+ * auto-reload work").
+ *
+ * Bound by default to 127.0.0.1. Auth and CORS are configured per plan §4.
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as http from 'node:http';
+import { ConfigStore, Evaluator, Quonfig } from '@quonfig/node';
+import { handleEvalContext } from './handlers/evalContext.js';
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
+const isLoopback = (host) => LOOPBACK_HOSTS.has(host);
+export async function startServer(opts) {
+    // Loopback policy — plan §4 auth note. Refuse non-loopback binds without
+    // an explicit opt-in; this prevents the developer from accidentally
+    // exposing an unauthenticated server to their LAN.
+    const policyHost = opts.forceNonLoopbackForTest ?? opts.host;
+    if (!isLoopback(policyHost) && !opts.allowNonLoopback) {
+        throw new Error(`Refusing to bind ${opts.host}: pass --allow-non-loopback to confirm the server should be reachable from the LAN.`);
+    }
+    if (!isLoopback(policyHost) && opts.allowNonLoopback) {
+        opts.logger.warn(`qfg serve is bound to ${opts.host}: any device on your LAN can reach it. ` +
+            `Anyone with the URL gets the datadir contents; do not run this on an untrusted network ` +
+            `without --frontend-sdk-key.`);
+    }
+    // Canonicalize the datadir to its long-name absolute path before handing
+    // it to the SDK. On Windows, os.tmpdir() and short-name paths like
+    // `C:\Users\RUNNER~1\...` trip a libuv assertion in fs-event.c when
+    // fs.watch compares the registered dir against incoming event filenames
+    // (the input is the short name, the events come back as long names).
+    // realpathSync.native delegates to uv_fs_realpath, which returns the same
+    // canonical form libuv uses internally — so the assertion never fires.
+    // No-op on POSIX where short names don't exist.
+    const datadir = (() => {
+        try {
+            return fs.realpathSync.native(opts.datadir);
+        }
+        catch {
+            return opts.datadir;
+        }
+    })();
+    // The Quonfig client owns datadir loading + file watching via the
+    // `dataDirAutoReload` option that landed in sdk-node 0.0.30 (qfg-zx3y).
+    // We hold a parallel ConfigStore + Evaluator that mirror the client's
+    // internal state so the eval handler can call evaluator.evaluateConfig()
+    // directly — Quonfig's public surface (`get`, `rawConfig`, `getRawMatch`)
+    // doesn't return the typed Value object the EvalEnvelope shape needs.
+    let store = new ConfigStore();
+    let evaluator = new Evaluator(store);
+    const environment = opts.environment;
+    let version = '';
+    const refreshSnapshot = (client) => {
+        // Pull every config out of the client and stuff it into our parallel
+        // store. `keys()` and `rawConfig()` are public; they return the
+        // ConfigResponse exactly as the client loaded it from disk.
+        //
+        // NOTE: the SDK fires `onConfigUpdate` from inside its initial
+        // `loadLocalData()` call, BEFORE `init()` has flipped `initialized` to
+        // true. Calling `client.keys()` during that window would throw "Not
+        // initialized." We swallow that one case here — the post-init manual
+        // refresh covers the initial load.
+        let keys;
+        try {
+            keys = client.keys();
+        }
+        catch {
+            return;
+        }
+        const configs = [];
+        for (const key of keys) {
+            const cfg = client.rawConfig(key);
+            if (cfg)
+                configs.push(cfg);
+        }
+        // G8 (qfg-38sf.6): version is a content hash of the canonicalized
+        // configs, not the absolute datadir path. The old shape leaked operator
+        // filesystem layout on every response and changed on every reload even
+        // when the data was unchanged, defeating ETag-style caching.
+        version = computeVersion(configs);
+        const envelope = {
+            configs,
+            meta: { version, environment },
+        };
+        store = new ConfigStore();
+        evaluator = new Evaluator(store);
+        store.loadFromDatafile(envelope);
+    };
+    // qfg-zx3y's auto-reload fires `onConfigUpdate` after the SDK has installed
+    // the new envelope. We re-sync our snapshot from the client at that point.
+    const client = new Quonfig({
+        sdkKey: 'qfg-serve-local',
+        datadir,
+        environment: opts.environment,
+        dataDirAutoReload: opts.watch,
+        dataDirAutoReloadDebounceMs: opts.watchDebounceMs,
+        // Telemetry is intentionally OFF — qfg serve has no Quonfig backend to
+        // post to, and the SDK's default-on collectors would just buffer forever.
+        collectEvaluationSummaries: false,
+        contextUploadMode: 'none',
+        enableSSE: false,
+        fallbackPollEnabled: false,
+        onConfigUpdate() {
+            refreshSnapshot(client);
+            if (opts.verbose)
+                opts.logger.log(`qfg-serve: reloaded datadir (version=${version})`);
+        },
+    });
+    await client.init();
+    // Initial snapshot — the SDK fires onConfigUpdate during init() so this is
+    // mostly insurance against an init path that doesn't, but it's cheap.
+    if (store.keys().length === 0) {
+        refreshSnapshot(client);
+    }
+    // CORS resolution per request. Three shapes:
+    //  - `*` anywhere in the list → wildcard (no Vary)
+    //  - exactly one origin → fixed value (no Vary; caller pinned it)
+    //  - 2+ origins → allow-list: echo the request Origin if it matches and emit
+    //    `Vary: Origin`; omit the header entirely on a miss (qfg-38sf.5). The
+    //    CORS spec does not permit a comma-joined Access-Control-Allow-Origin,
+    //    so the previous `.join(', ')` was silently breaking browser clients.
+    const corsAllowList = new Set(opts.corsOrigins);
+    const corsMode = corsAllowList.has('*')
+        ? 'wildcard'
+        : opts.corsOrigins.length <= 1
+            ? 'fixed'
+            : 'allowlist';
+    const fixedCorsOrigin = corsMode === 'fixed' ? (opts.corsOrigins[0] ?? '*') : null;
+    // qfg-38sf.1 security audit F3: the sendToClientSdk filter is UNCONDITIONAL.
+    // Every qfg serve consumer is by definition a frontend client (browser /
+    // react-native — server SDKs use datadir mode directly). There is no flag
+    // that turns this off. See evalContext.ts for the filter itself.
+    // Bump maxHeaderSize so that oversized base64 context tokens reach our
+    // application-level 414 handler rather than getting bounced by Node's
+    // default 16KB header parser. Our app cap is 64KB (see evalContext.ts G6
+    // check); 256KB leaves room for the path plus normal Authorization /
+    // Cookie / Accept headers.
+    const server = http.createServer({ maxHeaderSize: 256 * 1024 }, async (req, res) => {
+        const startedAt = Date.now();
+        // CORS — emit on every response, including 401 and 404, so browser
+        // clients surface the real status code instead of an opaque CORS error.
+        if (corsMode === 'wildcard') {
+            res.setHeader('Access-Control-Allow-Origin', '*');
+        }
+        else if (corsMode === 'fixed' && fixedCorsOrigin !== null) {
+            res.setHeader('Access-Control-Allow-Origin', fixedCorsOrigin);
+        }
+        else if (corsMode === 'allowlist') {
+            const reqOrigin = req.headers.origin;
+            // Vary: Origin regardless of match — caches must not reuse a
+            // matched-Origin response for a request from a different Origin.
+            res.setHeader('Vary', 'Origin');
+            if (typeof reqOrigin === 'string' && corsAllowList.has(reqOrigin)) {
+                res.setHeader('Access-Control-Allow-Origin', reqOrigin);
+            }
+        }
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+        res.setHeader('Access-Control-Expose-Headers', 'ETag');
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204);
+            res.end();
+            logRequest(req, res, startedAt, opts);
+            return;
+        }
+        // Auth — plan §4. If --frontend-sdk-key was set, every non-OPTIONS
+        // request must present `Authorization: Basic base64("1:<key>")`. If it
+        // wasn't set, no check.
+        if (opts.frontendSdkKey) {
+            const ok = checkBasicAuth(req.headers.authorization, opts.frontendSdkKey);
+            if (!ok) {
+                res.writeHead(401, {
+                    'Content-Type': 'text/plain',
+                    'WWW-Authenticate': 'Basic realm="qfg-serve"',
+                });
+                res.end('unauthorized');
+                logRequest(req, res, startedAt, opts);
+                return;
+            }
+        }
+        const url = req.url ?? '/';
+        const [pathOnly] = url.split('?');
+        // GET /api/v2/configs/eval-with-context/{base64url}
+        const evalPrefix = '/api/v2/configs/eval-with-context/';
+        if (req.method === 'GET' && pathOnly.startsWith(evalPrefix)) {
+            const ctxToken = pathOnly.slice(evalPrefix.length);
+            if (!ctxToken) {
+                res.writeHead(400, { 'Content-Type': 'text/plain' });
+                res.end('missing context token');
+                logRequest(req, res, startedAt, opts);
+                return;
+            }
+            try {
+                await handleEvalContext(req, res, ctxToken, {
+                    getSnapshot: () => ({ store, evaluator, environment, version }),
+                });
+            }
+            catch (error) {
+                opts.logger.warn(`qfg-serve: eval-with-context handler threw: ${error.message}`);
+                if (!res.headersSent) {
+                    res.writeHead(500, { 'Content-Type': 'text/plain' });
+                    res.end('internal error');
+                }
+            }
+            logRequest(req, res, startedAt, opts);
+            return;
+        }
+        // POST /api/v1/telemetry/  → 404 with a helpful body. Plan §2: we
+        // intentionally don't accept telemetry — silently 200-OK-and-dropping
+        // would hide a misconfig.
+        if (req.method === 'POST' && pathOnly === '/api/v1/telemetry/') {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: 'qfg serve does not accept telemetry',
+                hint: 'Disable client-side telemetry by passing `collectEvaluationSummaries: false` ' +
+                    '(and `contextUploadMode: "none"`) to your SDK init, or point the SDK\'s ' +
+                    'telemetryUrl at a real Quonfig telemetry endpoint.',
+            }));
+            logRequest(req, res, startedAt, opts);
+            return;
+        }
+        res.writeHead(404, { 'Content-Type': 'text/plain' });
+        res.end('not found');
+        logRequest(req, res, startedAt, opts);
+    });
+    // Bind. EADDRINUSE is the only common failure here; surface it with a
+    // pointed message so the developer doesn't have to read a stack trace.
+    await new Promise((resolve, reject) => {
+        const onError = (err) => {
+            server.removeListener('listening', onListening);
+            if (err.code === 'EADDRINUSE') {
+                reject(new Error(`Port ${opts.port} is already in use. Pass --port <n> to pick another.`));
+            }
+            else {
+                reject(err);
+            }
+        };
+        const onListening = () => {
+            server.removeListener('error', onError);
+            resolve();
+        };
+        server.once('error', onError);
+        server.once('listening', onListening);
+        server.listen(opts.port, opts.host);
+    });
+    const boundPort = server.address().port;
+    let closed = false;
+    const close = async () => {
+        if (closed)
+            return;
+        closed = true;
+        await new Promise((resolve) => {
+            server.close(() => resolve());
+        });
+        try {
+            await client.close();
+        }
+        catch {
+            /* best effort */
+        }
+    };
+    return { port: boundPort, host: opts.host, close };
+}
+/**
+ * G8 (qfg-38sf.6): compute meta.version as sha256 of the canonicalized
+ * configs array. Canonical form is `JSON.stringify(configs, sortedKeys)` so
+ * two snapshots with identical config content produce the same hash regardless
+ * of object-key order. The hash replaces the prior `datadir:<abs-path>#<ts>`
+ * shape, which leaked operator filesystem layout and changed on every reload
+ * even when the data was unchanged.
+ *
+ * Exported for unit tests that want to assert determinism / stability.
+ */
+export function computeVersion(configs) {
+    const canonical = JSON.stringify(configs, sortedKeyReplacer);
+    return `sha256:${crypto.createHash('sha256').update(canonical, 'utf8').digest('hex')}`;
+}
+/**
+ * Replacer for JSON.stringify that emits object keys in sorted order. Arrays
+ * keep their original order (array order is semantically meaningful for rules
+ * and weighted-values).
+ */
+function sortedKeyReplacer(_key, value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        const sorted = {};
+        for (const k of Object.keys(value).sort()) {
+            sorted[k] = value[k];
+        }
+        return sorted;
+    }
+    return value;
+}
+/**
+ * Validate `Authorization: Basic base64("1:<key>")` against the configured
+ * SDK key. The browser SDKs build this header in
+ * `sdk-javascript/src/apiHelpers.ts:7`.
+ *
+ * G4: use `crypto.timingSafeEqual` instead of `===`. The frontend SDK key is
+ * publicly-available by design (plan §4) so this isn't a hard security
+ * boundary, but `timingSafeEqual` is the right default — cheap, correct, and
+ * removes a class of timing-leak nits from any future audit.
+ *
+ * Length check first because `timingSafeEqual` throws on mismatched buffer
+ * lengths; that throw is itself a timing side-channel (and an exception path).
+ */
+function checkBasicAuth(header, expectedKey) {
+    if (!header || !header.toLowerCase().startsWith('basic '))
+        return false;
+    const b64 = header.slice('basic '.length).trim();
+    let decoded;
+    try {
+        decoded = Buffer.from(b64, 'base64').toString('utf8');
+    }
+    catch {
+        return false;
+    }
+    const expected = `1:${expectedKey}`;
+    const decodedBuf = Buffer.from(decoded, 'utf8');
+    const expectedBuf = Buffer.from(expected, 'utf8');
+    if (decodedBuf.length !== expectedBuf.length)
+        return false;
+    return crypto.timingSafeEqual(decodedBuf, expectedBuf);
+}
+/**
+ * Verbose-mode request log. G1 (qfg-38sf.1 audit): redact the base64-encoded
+ * context token from the URL — it contains caller PII (email, user id,
+ * arbitrary attributes). Format matches api-delivery's LoggingMiddleware
+ * shape: `METHOD PATH STATUS DURATION_MS`. We elide the ctx segment so the
+ * path collapses to e.g.
+ *   `GET /api/v2/configs/eval-with-context/<ctx-redacted> 200 3ms`
+ * which still tells the developer which route fired without leaking the
+ * payload.
+ */
+function logRequest(req, res, startedAt, opts) {
+    if (!opts.verbose)
+        return;
+    const method = req.method ?? '-';
+    const rawUrl = req.url ?? '/';
+    const [pathOnly, query] = rawUrl.split('?', 2);
+    const evalPrefix = '/api/v2/configs/eval-with-context/';
+    let safePath = pathOnly;
+    if (pathOnly.startsWith(evalPrefix)) {
+        safePath = `${evalPrefix}<ctx-redacted>`;
+    }
+    // Drop query string entirely — collectContextMode and friends are fine to
+    // surface but we have no allowlist parser today, so be conservative.
+    if (query && query.length > 0)
+        safePath += '?<redacted>';
+    const status = res.statusCode;
+    const duration = Date.now() - startedAt;
+    opts.logger.log(`qfg-serve: ${method} ${safePath} ${status} ${duration}ms`);
+}

package/dist/util/friction-log.d.ts

@@ -4,7 +4,13 @@ export interface FrictionEntry {
     exitCode: number;
     ts: string;
 }
-export declare function getDefaultFrictionLogPath(home?: string): string;
+/**
+ * Default friction-log location: a `friction.log` file inside the shared
+ * Quonfig config home (`~/.quonfig`, the same dir as tokens/profile config).
+ * Honors `QUONFIG_CONFIG_HOME` via `getQuonfigConfigHome()` so tests and
+ * isolated environments redirect it along with everything else.
+ */
+export declare function getDefaultFrictionLogPath(configHome?: string): string;
 export declare function getFrictionLogPath(envValue?: string | undefined, cwd?: string): null | string;
 export declare function buildFrictionEntry(opts: {
     argv?: string[];

package/dist/util/friction-log.js

@@ -1,8 +1,14 @@
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
-export function getDefaultFrictionLogPath(home = os.homedir()) {
-    return path.join(home, '.qfg', 'friction.log');
+import { getQuonfigConfigHome } from './quonfig-home.js';
+/**
+ * Default friction-log location: a `friction.log` file inside the shared
+ * Quonfig config home (`~/.quonfig`, the same dir as tokens/profile config).
+ * Honors `QUONFIG_CONFIG_HOME` via `getQuonfigConfigHome()` so tests and
+ * isolated environments redirect it along with everything else.
+ */
+export function getDefaultFrictionLogPath(configHome = getQuonfigConfigHome()) {
+    return path.join(configHome, 'friction.log');
 }
 export function getFrictionLogPath(envValue, cwd = process.cwd()) {
     if (envValue === undefined)

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.52";
+declare const _default: "0.0.54";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.52';
+export default '0.0.54';