@quonfig/cli 0.0.1

package/dist/util/get-client.d.ts

@@ -0,0 +1,7 @@
+import type { RequestResult } from '../result.js';
+import { APICommand } from '../index.js';
+import { Client } from '@quonfig/node';
+export declare const resetClientCache: () => void;
+declare const getClient: (command: APICommand, sdkKey?: string, profile?: string) => Promise<Client>;
+export declare const unwrapRequest: (command: APICommand, promise: Promise<Response>) => Promise<RequestResult>;
+export default getClient;

package/dist/util/get-client.js

@@ -0,0 +1,127 @@
+import { Client } from '@quonfig/node';
+import { getApiUrl } from '../util/domain-urls.js';
+import jsonMaybe from '../util/json-maybe.js';
+import { decodeJWT, refreshAccessToken } from '../util/oauth-client.js';
+import { getActiveProfile, loadAuthConfig, loadTokens, saveTokens } from '../util/token-storage.js';
+import version from '../version.js';
+let clientInstance;
+let cachedWorkspaceId;
+export const resetClientCache = () => {
+    clientInstance = undefined;
+    cachedWorkspaceId = undefined;
+};
+const getClient = async (command, sdkKey, profile) => {
+    // If client exists, still set workspaceId on command if available
+    if (clientInstance) {
+        if (cachedWorkspaceId) {
+            command.workspaceId = cachedWorkspaceId;
+        }
+        return clientInstance;
+    }
+    let jwt;
+    let workspaceId;
+    // If no SDK key provided, use WorkOS OAuth tokens
+    if (!sdkKey) {
+        const authConfig = await loadAuthConfig();
+        let tokens = await loadTokens();
+        command.verboseLog('OAuth auth', {
+            hasAuthConfig: Boolean(authConfig),
+            hasAccessToken: Boolean(tokens?.accessToken),
+        });
+        if (!authConfig || !tokens?.accessToken) {
+            command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
+        }
+        // Check if token is expired and refresh if needed.
+        // Prefer the JWT's actual exp claim over the stored expiresAt.
+        let tokenExpired = tokens.expiresAt ? tokens.expiresAt < Date.now() : false;
+        try {
+            const payload = decodeJWT(tokens.accessToken);
+            if (typeof payload.exp === 'number') {
+                tokenExpired = payload.exp * 1000 < Date.now();
+            }
+        }
+        catch {
+            // If we can't decode, fall back to stored expiresAt
+        }
+        if (tokenExpired && tokens.refreshToken) {
+            command.verboseLog('Token expired, refreshing...');
+            try {
+                const refreshed = await refreshAccessToken(tokens.refreshToken);
+                // Use the JWT's actual exp claim for expiry, not a hardcoded duration
+                let expiresAt = Date.now() + 300 * 1000; // fallback: 5 minutes
+                try {
+                    const payload = decodeJWT(refreshed.access_token);
+                    if (typeof payload.exp === 'number') {
+                        expiresAt = payload.exp * 1000; // convert seconds to ms
+                    }
+                }
+                catch {
+                    // Use fallback
+                }
+                tokens = {
+                    ...tokens,
+                    accessToken: refreshed.access_token,
+                    expiresAt,
+                    refreshToken: refreshed.refresh_token,
+                };
+                await saveTokens(tokens);
+                command.verboseLog('Token refreshed successfully');
+            }
+            catch (error) {
+                command.error('Session expired. Please run `qfg login` to re-authenticate.', { exit: 401 });
+            }
+        }
+        // Get the active profile to find the workspace
+        const activeProfile = getActiveProfile(profile);
+        const profileData = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
+        command.verboseLog('Profile lookup', {
+            activeProfile,
+            hasProfileData: Boolean(profileData),
+            workspaceId: profileData?.workspace,
+        });
+        if (profileData) {
+            workspaceId = profileData.workspace;
+        }
+        // Use the WorkOS access token directly as the JWT
+        jwt = tokens.accessToken;
+        // If still no JWT, user needs to login
+        if (!jwt) {
+            command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
+        }
+    }
+    // Store workspaceId on the command for use in building URLs and cache it
+    if (workspaceId) {
+        command.workspaceId = workspaceId;
+        cachedWorkspaceId = workspaceId;
+    }
+    clientInstance = new Client({
+        jwt,
+        sdkKey,
+        apiUrl: getApiUrl(),
+        clientIdentifier: `cli-${version}`,
+        log: command.verboseLog,
+    });
+    return clientInstance;
+};
+export const unwrapRequest = async (command, promise) => {
+    const request = await promise;
+    if (request.status.toString().startsWith('2')) {
+        const json = (await request.json());
+        command.verboseLog('ApiClient', { response: json });
+        return { json, ok: true, status: request.status };
+    }
+    // Handle 403 with a user-friendly message
+    if (request.status === 403) {
+        return {
+            error: { error: 'You do not have permission to perform this action. Please check your workspace permissions.' },
+            ok: false,
+            status: request.status,
+        };
+    }
+    const error = jsonMaybe(await request.text());
+    if (typeof error === 'string') {
+        return { error: { error }, ok: false, status: request.status };
+    }
+    return { error, ok: false, status: request.status };
+};
+export default getClient;

package/dist/util/is-interactive.d.ts

@@ -0,0 +1,5 @@
+type Flags = {
+    interactive?: boolean;
+};
+declare const isInteractive: (flags: Flags) => boolean | undefined;
+export default isInteractive;

package/dist/util/is-interactive.js

@@ -0,0 +1,7 @@
+const isInteractive = (flags) => {
+    if (flags.interactive === false) {
+        return false;
+    }
+    return (process.stdout.isTTY && process.stdin.isTTY) || flags.interactive;
+};
+export default isInteractive;

package/dist/util/json-maybe.d.ts

@@ -0,0 +1,3 @@
+import type { JsonObj } from '../result.js';
+declare const jsonMaybe: (json: JsonObj | string) => JsonObj | string;
+export default jsonMaybe;

package/dist/util/json-maybe.js

@@ -0,0 +1,14 @@
+// Sometimes we get JSON from the server but if there's an exception, we might get a string.
+// This function will try to parse the string as JSON and return the parsed object or the original string.
+const jsonMaybe = (json) => {
+    if (typeof json === 'string') {
+        try {
+            return JSON.parse(json);
+        }
+        catch {
+            return json;
+        }
+    }
+    return json;
+};
+export default jsonMaybe;

package/dist/util/name-arg.d.ts

@@ -0,0 +1,4 @@
+declare const nameArg: {
+    name: import("@oclif/core/lib/interfaces/parser.js").Arg<string | undefined, Record<string, unknown>>;
+};
+export default nameArg;

package/dist/util/name-arg.js

@@ -0,0 +1,3 @@
+import { Args } from '@oclif/core';
+const nameArg = { name: Args.string({ description: 'config/feature-flag/etc. name' }) };
+export default nameArg;

package/dist/util/oauth-client.d.ts

@@ -0,0 +1,30 @@
+export interface DeviceCodeResponse {
+    device_code: string;
+    expires_in: number;
+    interval: number;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+}
+export interface WorkOSUser {
+    email: string;
+    email_verified: boolean;
+    first_name: string | null;
+    id: string;
+    last_name: string | null;
+    organization_id?: string;
+}
+export interface DeviceTokenResponse {
+    access_token: string;
+    authentication_method: string;
+    refresh_token: string;
+    user: WorkOSUser;
+}
+export interface TokenRefreshResponse {
+    access_token: string;
+    refresh_token: string;
+}
+export declare const requestDeviceCode: () => Promise<DeviceCodeResponse>;
+export declare const pollForToken: (deviceCode: string, interval: number, expiresIn: number, verbose?: boolean) => Promise<DeviceTokenResponse>;
+export declare const refreshAccessToken: (refreshToken: string) => Promise<TokenRefreshResponse>;
+export declare const decodeJWT: (token: string) => Record<string, unknown>;

package/dist/util/oauth-client.js

@@ -0,0 +1,99 @@
+import { getDomain } from './domain-urls.js';
+const WORKOS_BASE_URL = 'https://api.workos.com';
+// WorkOS Client IDs for the CLI (public client — no secret needed)
+const WORKOS_CLIENT_ID_PRODUCTION = 'client_01KKCCWMNB2K8HYQZQ96G1MXE0';
+const WORKOS_CLIENT_ID_STAGING = 'client_01KKCCWM4K87JS0MKS8PHZ0ZY1';
+const getClientId = () => {
+    if (process.env.WORKOS_CLIENT_ID) {
+        return process.env.WORKOS_CLIENT_ID;
+    }
+    const domain = getDomain();
+    if (domain === 'quonfig-staging.com') {
+        return WORKOS_CLIENT_ID_STAGING;
+    }
+    return WORKOS_CLIENT_ID_PRODUCTION;
+};
+// --- Device Code Flow ---
+export const requestDeviceCode = async () => {
+    const response = await fetch(`${WORKOS_BASE_URL}/user_management/authorize/device`, {
+        body: new URLSearchParams({
+            client_id: getClientId(),
+        }),
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        method: 'POST',
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to request device code: ${errorText}`);
+    }
+    return response.json();
+};
+export const pollForToken = async (deviceCode, interval, expiresIn, verbose) => {
+    const deadline = Date.now() + expiresIn * 1000;
+    let pollInterval = interval * 1000;
+    while (Date.now() < deadline) {
+        // eslint-disable-next-line no-await-in-loop
+        await new Promise((resolve) => {
+            setTimeout(resolve, pollInterval);
+        });
+        if (verbose) {
+            console.error('[pollForToken] Polling for device authorization...');
+        }
+        // eslint-disable-next-line no-await-in-loop
+        const response = await fetch(`${WORKOS_BASE_URL}/user_management/authenticate`, {
+            body: new URLSearchParams({
+                client_id: getClientId(),
+                device_code: deviceCode,
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            }),
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            method: 'POST',
+        });
+        if (response.ok) {
+            return response.json();
+        }
+        // eslint-disable-next-line no-await-in-loop
+        const error = await response.json().catch(() => ({}));
+        const errorCode = error.error || error.code;
+        if (errorCode === 'authorization_pending') {
+            continue;
+        }
+        if (errorCode === 'slow_down') {
+            pollInterval += 1000;
+            continue;
+        }
+        if (errorCode === 'access_denied') {
+            throw new Error('Authorization was denied by the user.');
+        }
+        if (errorCode === 'expired_token') {
+            throw new Error('Device code expired. Please try logging in again.');
+        }
+        throw new Error(`Authentication failed: ${JSON.stringify(error)}`);
+    }
+    throw new Error('Device code expired. Please try logging in again.');
+};
+// --- Token Refresh ---
+export const refreshAccessToken = async (refreshToken) => {
+    const response = await fetch(`${WORKOS_BASE_URL}/user_management/authenticate`, {
+        body: new URLSearchParams({
+            client_id: getClientId(),
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        }),
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        method: 'POST',
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Failed to refresh token: ${errorText}`);
+    }
+    return response.json();
+};
+// --- JWT Utilities ---
+export const decodeJWT = (token) => {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw new Error('Invalid JWT format');
+    }
+    return JSON.parse(Buffer.from(parts[1], 'base64').toString('utf8'));
+};

package/dist/util/secret-flags.d.ts

@@ -0,0 +1,13 @@
+declare const secretFlags: (secretDescription: string) => {
+    secret: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    'secret-key-name': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+};
+export type Secret = {
+    keyName: string;
+    selected: boolean;
+};
+export declare const parsedSecretFlags: (flags: {
+    secret: boolean;
+    "secret-key-name": string;
+}) => Secret;
+export default secretFlags;

package/dist/util/secret-flags.js

@@ -0,0 +1,13 @@
+import { Flags } from '@oclif/core';
+const secretFlags = (secretDescription) => ({
+    secret: Flags.boolean({ default: false, description: secretDescription }),
+    'secret-key-name': Flags.string({
+        default: 'quonfig.secrets.encryption.key',
+        description: 'name of the secret key to use for encryption/decryption',
+    }),
+});
+export const parsedSecretFlags = (flags) => ({
+    keyName: flags['secret-key-name'],
+    selected: flags.secret,
+});
+export default secretFlags;

package/dist/util/token-storage.d.ts

@@ -0,0 +1,25 @@
+export interface TokenStorageOptions {
+    quonfigDir?: string;
+}
+export interface TokenData {
+    accessToken: string;
+    expiresAt: number;
+    refreshToken: string;
+    userEmail?: string;
+    userId?: string;
+}
+export interface AuthConfig {
+    defaultProfile?: string;
+    profiles: {
+        [profileName: string]: {
+            workspace: string;
+            workspaceName?: string;
+        };
+    };
+}
+export declare const saveTokens: (tokens: TokenData, options?: TokenStorageOptions) => Promise<void>;
+export declare const loadTokens: (options?: TokenStorageOptions) => Promise<TokenData | null>;
+export declare const saveAuthConfig: (config: AuthConfig, options?: TokenStorageOptions) => Promise<void>;
+export declare const loadAuthConfig: (options?: TokenStorageOptions) => Promise<AuthConfig | null>;
+export declare const getActiveProfile: (profileArg?: string) => string;
+export declare const clearAuth: (options?: TokenStorageOptions) => Promise<void>;

package/dist/util/token-storage.js

@@ -0,0 +1,90 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const getQuonfigDir = (options) => options?.quonfigDir || path.join(os.homedir(), '.quonfig');
+const getTokenFile = (options) => path.join(getQuonfigDir(options), 'tokens.json');
+const getConfigFile = (options) => path.join(getQuonfigDir(options), 'config');
+const ensureQuonfigDir = async (options) => {
+    const quonfigDir = getQuonfigDir(options);
+    try {
+        await fs.promises.access(quonfigDir, fs.constants.F_OK);
+    }
+    catch {
+        await fs.promises.mkdir(quonfigDir, { recursive: true });
+    }
+};
+export const saveTokens = async (tokens, options) => {
+    await ensureQuonfigDir(options);
+    await fs.promises.writeFile(getTokenFile(options), JSON.stringify(tokens, null, 2), 'utf8');
+};
+export const loadTokens = async (options) => {
+    try {
+        const data = await fs.promises.readFile(getTokenFile(options), 'utf8');
+        return JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+};
+export const saveAuthConfig = async (config, options) => {
+    await ensureQuonfigDir(options);
+    let configContent = '';
+    // Write default profile if specified
+    if (config.defaultProfile) {
+        configContent += `default_profile = ${config.defaultProfile}\n\n`;
+    }
+    // Write each profile
+    for (const [profileName, profileData] of Object.entries(config.profiles)) {
+        configContent += `[profile ${profileName}]\n`;
+        configContent += `workspace = ${profileData.workspace}`;
+        if (profileData.workspaceName) {
+            configContent += ` # ${profileData.workspaceName}`;
+        }
+        configContent += '\n\n';
+    }
+    await fs.promises.writeFile(getConfigFile(options), configContent, 'utf8');
+};
+export const loadAuthConfig = async (options) => {
+    try {
+        const data = await fs.promises.readFile(getConfigFile(options), 'utf8');
+        const config = {
+            profiles: {},
+        };
+        // Parse default profile
+        const defaultMatch = data.match(/default_profile\s*=\s*(.+)/);
+        if (defaultMatch && defaultMatch[1]) {
+            config.defaultProfile = defaultMatch[1].trim();
+        }
+        // Parse profiles
+        const profileRegex = /\[profile\s+(\w+)]\s*\n\s*workspace\s*=\s*([^\s#]+)(?:\s*#\s*(.+))?/g;
+        let match;
+        while ((match = profileRegex.exec(data)) !== null) {
+            const profileName = match[1];
+            const workspace = match[2];
+            const workspaceName = match[3]?.trim();
+            config.profiles[profileName] = {
+                workspace,
+                workspaceName,
+            };
+        }
+        return Object.keys(config.profiles).length > 0 ? config : null;
+    }
+    catch {
+        return null;
+    }
+};
+export const getActiveProfile = (profileArg) => profileArg || process.env.QUONFIG_PROFILE || 'default';
+export const clearAuth = async (options) => {
+    try {
+        await fs.promises.unlink(getTokenFile(options));
+    }
+    catch {
+        // Ignore if file doesn't exist
+    }
+    try {
+        await fs.promises.unlink(getConfigFile(options));
+    }
+    catch {
+        // Ignore if file doesn't exist
+    }
+};

package/dist/validations/value.d.ts

@@ -0,0 +1,4 @@
+import { Quonfig } from '@quonfig/node';
+import { Result } from '../result.js';
+declare const validateValue: (quonfig: Quonfig, key: string, value: string) => Result<string>;
+export default validateValue;

package/dist/validations/value.js

@@ -0,0 +1,11 @@
+import { failure, success } from '../result.js';
+const validateValue = (quonfig, key, value) => {
+    const config = quonfig.rawConfig(key);
+    if (!config) {
+        return failure(`Could not find config named ${key}`);
+    }
+    // In the new quonfig format, allowableValues are not yet supported at the config level.
+    // This validation is a placeholder — the server enforces schema constraints.
+    return success(value);
+};
+export default validateValue;

package/dist/verify/standalone.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+/**
+ * Standalone workspace validator.
+ *
+ * Usage:
+ *   qfg-verify <workspace-dir>      Validate a workspace directory on disk
+ *   qfg-verify --git-hook           Run as git pre-receive hook (reads stdin for refs,
+ *                                   uses git commands to read files from the pushed commit)
+ *
+ * Exit codes:
+ *   0  All checks pass
+ *   1  Validation errors found
+ */
+export {};

package/dist/verify/standalone.js

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+/**
+ * Standalone workspace validator.
+ *
+ * Usage:
+ *   qfg-verify <workspace-dir>      Validate a workspace directory on disk
+ *   qfg-verify --git-hook           Run as git pre-receive hook (reads stdin for refs,
+ *                                   uses git commands to read files from the pushed commit)
+ *
+ * Exit codes:
+ *   0  All checks pass
+ *   1  Validation errors found
+ */
+import { execSync } from "node:child_process";
+import * as readline from "node:readline";
+import { formatResult, validateFileMap, validateWorkspace } from "./validate.js";
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.includes("--git-hook")) {
+        await runGitHook();
+    }
+    else if (args.includes("--help") || args.includes("-h")) {
+        printUsage();
+    }
+    else {
+        const dir = args[0] || ".";
+        runDiskValidation(dir);
+    }
+}
+function printUsage() {
+    console.log(`qfg-verify - Quonfig workspace validator
+
+Usage:
+  qfg-verify [path]           Validate workspace directory (default: .)
+  qfg-verify --git-hook       Run as git pre-receive hook
+  qfg-verify --help           Show this help
+
+Exit codes:
+  0  All checks pass
+  1  Validation errors found`);
+}
+function runDiskValidation(dir) {
+    const result = validateWorkspace(dir);
+    console.log(formatResult(result));
+    process.exit(result.valid ? 0 : 1);
+}
+/**
+ * Git pre-receive hook mode.
+ *
+ * Reads stdin for pushed refs (one line per ref: <old-oid> <new-oid> <ref-name>).
+ * For each new commit, lists all config files and validates them.
+ */
+async function runGitHook() {
+    const refs = [];
+    // Read all of stdin (ref lines). Use callback API for bun compatibility.
+    await new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin });
+        rl.on("line", (line) => {
+            const parts = line.trim().split(" ");
+            if (parts.length >= 3) {
+                refs.push({ oldOid: parts[0], newOid: parts[1], refName: parts[2] });
+            }
+        });
+        rl.on("close", resolve);
+    });
+    if (refs.length === 0) {
+        console.log("qfg-verify: no refs received");
+        process.exit(0);
+    }
+    // Validate the latest pushed commit for each ref
+    let hasErrors = false;
+    for (const ref of refs) {
+        // Skip deletions
+        if (ref.newOid === "0000000000000000000000000000000000000000")
+            continue;
+        console.log(`qfg-verify: validating ${ref.refName} (${ref.newOid.slice(0, 8)})`);
+        try {
+            const files = readFilesFromCommit(ref.newOid);
+            const result = validateFileMap(files);
+            console.log(formatResult(result));
+            if (!result.valid) {
+                hasErrors = true;
+            }
+        }
+        catch (err) {
+            console.error(`qfg-verify: error reading commit ${ref.newOid}: ${err.message}`);
+            hasErrors = true;
+        }
+    }
+    process.exit(hasErrors ? 1 : 0);
+}
+/**
+ * Read all JSON config files from a git commit using `git show`.
+ * Works in bare repos (no working tree needed).
+ */
+function readFilesFromCommit(commitOid) {
+    const files = new Map();
+    const dirs = ["configs", "feature-flags", "segments", "log-levels", "schemas", "schemas-protected"];
+    for (const dir of dirs) {
+        // List files in this directory at the given commit
+        let listing;
+        try {
+            listing = execSync(`git ls-tree --name-only ${commitOid} ${dir}/`, {
+                encoding: "utf-8",
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        catch {
+            // Directory doesn't exist in this commit
+            continue;
+        }
+        const filenames = listing.trim().split("\n").filter(Boolean);
+        for (const filePath of filenames) {
+            if (!filePath.endsWith(".json") || filePath.includes("/."))
+                continue;
+            try {
+                const content = execSync(`git show ${commitOid}:${filePath}`, {
+                    encoding: "utf-8",
+                    stdio: ["pipe", "pipe", "pipe"],
+                });
+                files.set(filePath, content);
+            }
+            catch {
+                // File can't be read, skip
+            }
+        }
+    }
+    return files;
+}
+main().catch((err) => {
+    console.error(`qfg-verify: fatal: ${err.message}`);
+    process.exit(1);
+});

package/dist/verify/validate.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Workspace validation logic.
+ *
+ * This module validates a Quonfig workspace directory against the StoredConfig
+ * schema. It can be used from both the oclif CLI (`qfg verify`) and the
+ * standalone compiled binary (git pre-receive hook).
+ *
+ * Validation checks:
+ *  - Valid JSON
+ *  - Schema compliance (StoredConfigSchema from Zod)
+ *  - Key matches filename
+ *  - Key constraints (1-512 chars, no slashes, not "new")
+ *  - Config type matches directory
+ *  - Segment constraints (valueType=bool, sendToClientSdk=false)
+ *  - Log level constraints (valueType=log_level)
+ *  - Referential integrity (IN_SEG/NOT_IN_SEG reference existing segments)
+ *  - schemaKey references existing schemas
+ *  - Rule structure (criteria + value present)
+ *  - Value type consistency
+ *  - Weighted values non-empty and consistent
+ */
+export type Severity = "error" | "warning";
+export interface ValidationIssue {
+    file: string;
+    message: string;
+    severity: Severity;
+    suggestion?: string;
+}
+export interface ValidationResult {
+    issues: ValidationIssue[];
+    filesChecked: number;
+    valid: boolean;
+}
+/**
+ * Validate an entire workspace directory on disk.
+ */
+export declare function validateWorkspace(workspaceDir: string): ValidationResult;
+/**
+ * Validate configs provided as a map of { "dir/file.json": jsonString }.
+ * Used by the pre-receive hook which reads files from git objects.
+ */
+export declare function validateFileMap(files: Map<string, string>): ValidationResult;
+export declare function formatResult(result: ValidationResult): string;