@quonfig/cli 0.0.11 → 0.0.13

package/dist/verify/validate.js

@@ -19,74 +19,57 @@
  *  - Value type consistency
  *  - Weighted values non-empty and consistent
  */
-import { z } from "zod";
+import { z } from 'zod';
 // ── Schemas (subset of app-quonfig config-schemas.ts) ───────────────────
-const ConfigTypeSchema = z.enum([
-    "feature_flag",
-    "config",
-    "log_level",
-    "segment",
-    "schema",
-]);
-const ValueTypeSchema = z.enum([
-    "bool",
-    "string",
-    "int",
-    "double",
-    "json",
-    "string_list",
-    "duration",
-    "log_level",
-]);
+const ConfigTypeSchema = z.enum(['feature_flag', 'config', 'log_level', 'segment', 'schema']);
+const ValueTypeSchema = z.enum(['bool', 'string', 'int', 'double', 'json', 'string_list', 'duration', 'log_level']);
 const OperatorSchema = z.enum([
-    "ALWAYS_TRUE",
-    "PROP_IS_ONE_OF",
-    "PROP_IS_NOT_ONE_OF",
-    "PROP_STARTS_WITH_ONE_OF",
-    "PROP_DOES_NOT_START_WITH_ONE_OF",
-    "PROP_ENDS_WITH_ONE_OF",
-    "PROP_DOES_NOT_END_WITH_ONE_OF",
-    "PROP_CONTAINS_ONE_OF",
-    "PROP_DOES_NOT_CONTAIN_ONE_OF",
-    "PROP_LESS_THAN",
-    "PROP_LESS_THAN_OR_EQUAL",
-    "PROP_GREATER_THAN",
-    "PROP_GREATER_THAN_OR_EQUAL",
-    "PROP_BEFORE",
-    "PROP_AFTER",
-    "PROP_MATCHES",
-    "PROP_DOES_NOT_MATCH",
-    "IN_SEG",
-    "NOT_IN_SEG",
-    "IN_INT_RANGE",
-    "LOOKUP_KEY_IN",
-    "LOOKUP_KEY_NOT_IN",
+    'ALWAYS_TRUE',
+    'PROP_IS_ONE_OF',
+    'PROP_IS_NOT_ONE_OF',
+    'PROP_STARTS_WITH_ONE_OF',
+    'PROP_DOES_NOT_START_WITH_ONE_OF',
+    'PROP_ENDS_WITH_ONE_OF',
+    'PROP_DOES_NOT_END_WITH_ONE_OF',
+    'PROP_CONTAINS_ONE_OF',
+    'PROP_DOES_NOT_CONTAIN_ONE_OF',
+    'PROP_LESS_THAN',
+    'PROP_LESS_THAN_OR_EQUAL',
+    'PROP_GREATER_THAN',
+    'PROP_GREATER_THAN_OR_EQUAL',
+    'PROP_BEFORE',
+    'PROP_AFTER',
+    'PROP_MATCHES',
+    'PROP_DOES_NOT_MATCH',
+    'IN_SEG',
+    'NOT_IN_SEG',
+    'IN_INT_RANGE',
+    'LOOKUP_KEY_IN',
+    'LOOKUP_KEY_NOT_IN',
 ]);
-const LogLevelSchema = z.enum([
-    "TRACE",
-    "DEBUG",
-    "INFO",
-    "WARN",
-    "ERROR",
-    "FATAL",
-]);
-const BoolValueSchema = z.object({ type: z.literal("bool"), value: z.boolean() });
-const StringValueSchema = z.object({ type: z.literal("string"), value: z.string() });
-const IntValueSchema = z.object({ type: z.literal("int"), value: z.union([z.number(), z.string()]) });
-const DoubleValueSchema = z.object({ type: z.literal("double"), value: z.union([z.number(), z.string()]) });
-const JsonValueSchema = z.object({ type: z.literal("json"), value: z.unknown() });
-const StringListValueSchema = z.object({ type: z.literal("string_list"), value: z.array(z.string()) });
-const DurationValueSchema = z.object({ type: z.literal("duration"), value: z.string() });
-const LogLevelValueSchema = z.object({ type: z.literal("log_level"), value: LogLevelSchema });
+const LogLevelSchema = z.enum(['TRACE', 'DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL']);
+const BoolValueSchema = z.object({ type: z.literal('bool'), value: z.boolean() });
+const StringValueSchema = z.object({ type: z.literal('string'), value: z.string() });
+const IntValueSchema = z.object({ type: z.literal('int'), value: z.union([z.number(), z.string()]) });
+const DoubleValueSchema = z.object({ type: z.literal('double'), value: z.union([z.number(), z.string()]) });
+const JsonValueSchema = z.object({
+    type: z.literal('json'),
+    value: z.any().refine((v) => typeof v !== 'string', {
+        message: 'json values must be native JSON (object/array/number/boolean/null). Stringified JSON is no longer allowed — use { "a": 1 } instead of "{\\"a\\":1}".',
+    }),
+});
+const StringListValueSchema = z.object({ type: z.literal('string_list'), value: z.array(z.string()) });
+const DurationValueSchema = z.object({ type: z.literal('duration'), value: z.string() });
+const LogLevelValueSchema = z.object({ type: z.literal('log_level'), value: LogLevelSchema });
 const SchemaValueSchema = z.object({
-    type: z.literal("schema"),
+    type: z.literal('schema'),
     value: z.object({ schemaType: z.string(), schema: z.string() }),
 });
 const ProvidedValueSchema = z.object({
-    type: z.literal("provided"),
+    type: z.literal('provided'),
     value: z.object({ source: z.string(), lookup: z.string() }),
 });
-const ValueSchema = z.discriminatedUnion("type", [
+const ValueSchema = z.discriminatedUnion('type', [
     BoolValueSchema,
     StringValueSchema,
     IntValueSchema,
@@ -104,10 +87,10 @@ const WeightedValueSchema = z.object({
     weight: z.number().int().min(0).max(MAX_WEIGHT),
 });
 const WeightedValuesSchema = z.object({
-    type: z.literal("weighted_values"),
+    type: z.literal('weighted_values'),
     value: z.object({
         weightedValues: z.array(WeightedValueSchema),
-        hashByPropertyName: z.string().default("user.key"),
+        hashByPropertyName: z.string().default('user.key'),
         splitEvenly: z.boolean().optional(),
     }),
 });
@@ -122,8 +105,8 @@ const ConfigRuleSchema = z.object({
     value: RuleValueSchema,
 });
 /** Environment ID must be a slug: lowercase alphanumeric + dashes, not a UUID. */
-const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SLUG_RE = /^[\da-z]+(?:-[\da-z]+)*$/;
+const UUID_RE = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 const ConfigEnvironmentSchema = z.object({
     id: z.string(),
     rules: z.array(ConfigRuleSchema),
@@ -134,7 +117,8 @@ const VariantSchema = z.object({
     value: ValueSchema,
     description: z.string().optional(),
 });
-const StoredConfigSchema = z.object({
+const StoredConfigSchema = z
+    .object({
     id: z.string().optional(),
     projectId: z.string().optional(),
     key: z.string(),
@@ -151,37 +135,48 @@ const StoredConfigSchema = z.object({
     }),
     environments: z.array(ConfigEnvironmentSchema).default([]),
     variants: z.array(VariantSchema).default([]),
-}).passthrough(); // Allow extra fields (tags, schemaUsageMode, etc.)
+})
+    .passthrough(); // Allow extra fields (tags, schemaUsageMode, etc.)
 const SchemaDocumentSchema = z.object({}).passthrough();
 /** Maps config directory names to their expected config type. */
 const DIR_TO_TYPE = {
-    "configs": "config",
-    "feature-flags": "feature_flag",
-    "segments": "segment",
-    "log-levels": "log_level",
+    configs: 'config',
+    'feature-flags': 'feature_flag',
+    segments: 'segment',
+    'log-levels': 'log_level',
 };
 const CONFIG_DIRS = new Set(Object.keys(DIR_TO_TYPE));
-const SCHEMA_DIRS = new Set(["schemas", "schemas-protected"]);
+const SCHEMA_DIRS = new Set(['schemas', 'schemas-protected']);
 const KNOWN_DIRS = new Set([...CONFIG_DIRS, ...SCHEMA_DIRS]);
 // Operators that reference segments
-const SEGMENT_OPERATORS = new Set(["IN_SEG", "NOT_IN_SEG"]);
+const SEGMENT_OPERATORS = new Set(['IN_SEG', 'NOT_IN_SEG']);
 // Operators that require a propertyName
 const PROPERTY_OPERATORS = new Set([
-    "PROP_IS_ONE_OF", "PROP_IS_NOT_ONE_OF",
-    "PROP_STARTS_WITH_ONE_OF", "PROP_DOES_NOT_START_WITH_ONE_OF",
-    "PROP_ENDS_WITH_ONE_OF", "PROP_DOES_NOT_END_WITH_ONE_OF",
-    "PROP_CONTAINS_ONE_OF", "PROP_DOES_NOT_CONTAIN_ONE_OF",
-    "PROP_LESS_THAN", "PROP_LESS_THAN_OR_EQUAL",
-    "PROP_GREATER_THAN", "PROP_GREATER_THAN_OR_EQUAL",
-    "PROP_BEFORE", "PROP_AFTER",
-    "PROP_MATCHES", "PROP_DOES_NOT_MATCH",
+    'PROP_IS_ONE_OF',
+    'PROP_IS_NOT_ONE_OF',
+    'PROP_STARTS_WITH_ONE_OF',
+    'PROP_DOES_NOT_START_WITH_ONE_OF',
+    'PROP_ENDS_WITH_ONE_OF',
+    'PROP_DOES_NOT_END_WITH_ONE_OF',
+    'PROP_CONTAINS_ONE_OF',
+    'PROP_DOES_NOT_CONTAIN_ONE_OF',
+    'PROP_LESS_THAN',
+    'PROP_LESS_THAN_OR_EQUAL',
+    'PROP_GREATER_THAN',
+    'PROP_GREATER_THAN_OR_EQUAL',
+    'PROP_BEFORE',
+    'PROP_AFTER',
+    'PROP_MATCHES',
+    'PROP_DOES_NOT_MATCH',
 ]);
 // Operators that require a valueToMatch
 const VALUE_REQUIRED_OPERATORS = new Set([
     ...PROPERTY_OPERATORS,
-    "IN_SEG", "NOT_IN_SEG",
-    "IN_INT_RANGE",
-    "LOOKUP_KEY_IN", "LOOKUP_KEY_NOT_IN",
+    'IN_SEG',
+    'NOT_IN_SEG',
+    'IN_INT_RANGE',
+    'LOOKUP_KEY_IN',
+    'LOOKUP_KEY_NOT_IN',
 ]);
 /**
  * Reject `sendToClientSdk` on feature_flag rows — the field is config-only.
@@ -189,21 +184,21 @@ const VALUE_REQUIRED_OPERATORS = new Set([
  * (true or false). Segments are handled separately on the parsed config.
  */
 function checkFeatureFlagForbiddenFields(parsed, file, issues) {
-    if (typeof parsed === "object" &&
+    if (typeof parsed === 'object' &&
         parsed !== null &&
-        parsed.type === "feature_flag" &&
-        Object.prototype.hasOwnProperty.call(parsed, "sendToClientSdk")) {
+        parsed.type === 'feature_flag' &&
+        Object.hasOwn(parsed, 'sendToClientSdk')) {
         issues.push({
             file,
             message: `feature_flag must not set "sendToClientSdk" — this field is only valid on config rows`,
-            severity: "error",
+            severity: 'error',
             suggestion: `Remove the "sendToClientSdk" field from this feature_flag JSON`,
         });
     }
 }
 // ── Validation from filesystem ──────────────────────────────────────────
-import * as fs from "node:fs";
-import * as path from "node:path";
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 /**
  * Validate an entire workspace directory on disk.
  */
@@ -234,80 +229,86 @@ export function validateWorkspace(workspaceDir) {
     try {
         entries = fs.readdirSync(workspaceDir, { withFileTypes: true });
     }
-    catch (err) {
+    catch (error) {
         return {
-            issues: [{
+            issues: [
+                {
                     file: workspaceDir,
-                    message: `Cannot read workspace directory: ${err.message}`,
-                    severity: "error",
-                }],
+                    message: `Cannot read workspace directory: ${error.message}`,
+                    severity: 'error',
+                },
+            ],
             filesChecked: 0,
             valid: false,
             stats,
         };
     }
     for (const entry of entries) {
-        if (entry.name.startsWith("."))
+        if (entry.name.startsWith('.'))
             continue; // skip .git, .qf, etc.
         if (entry.isDirectory() && !KNOWN_DIRS.has(entry.name)) {
             issues.push({
                 file: entry.name,
                 message: `Unexpected directory "${entry.name}"`,
-                severity: "warning",
-                suggestion: `Expected directories: ${[...KNOWN_DIRS].join(", ")}`,
+                severity: 'warning',
+                suggestion: `Expected directories: ${[...KNOWN_DIRS].join(', ')}`,
             });
         }
     }
     // Validate quonfig.json at workspace root
-    const quonfigPath = path.join(workspaceDir, "quonfig.json");
-    if (!fs.existsSync(quonfigPath)) {
-        issues.push({
-            file: "quonfig.json",
-            message: `quonfig.json is missing from workspace root`,
-            severity: "error",
-            suggestion: `Create quonfig.json with format: {"environments": ["production", "staging"]}`,
-        });
-    }
-    else {
+    const quonfigPath = path.join(workspaceDir, 'quonfig.json');
+    if (fs.existsSync(quonfigPath)) {
         let quonfigRaw;
         try {
-            quonfigRaw = fs.readFileSync(quonfigPath, "utf-8");
+            quonfigRaw = fs.readFileSync(quonfigPath, 'utf8');
         }
-        catch (err) {
-            quonfigRaw = "";
-            issues.push({ file: "quonfig.json", message: `Cannot read quonfig.json: ${err.message}`, severity: "error" });
+        catch (error) {
+            quonfigRaw = '';
+            issues.push({
+                file: 'quonfig.json',
+                message: `Cannot read quonfig.json: ${error.message}`,
+                severity: 'error',
+            });
         }
         if (quonfigRaw) {
             let quonfigParsed;
             try {
                 quonfigParsed = JSON.parse(quonfigRaw);
             }
-            catch (err) {
+            catch (error) {
                 quonfigParsed = null;
-                issues.push({ file: "quonfig.json", message: `Invalid JSON: ${err.message}`, severity: "error" });
+                issues.push({ file: 'quonfig.json', message: `Invalid JSON: ${error.message}`, severity: 'error' });
             }
             const quonfigResult = z.object({ environments: z.array(z.string()) }).safeParse(quonfigParsed);
-            if (!quonfigResult.success) {
+            if (quonfigResult.success) {
+                for (const envId of quonfigResult.data.environments) {
+                    declaredEnvIds.add(envId);
+                }
+            }
+            else {
                 issues.push({
-                    file: "quonfig.json",
+                    file: 'quonfig.json',
                     message: `quonfig.json must have an "environments" array of strings`,
-                    severity: "error",
+                    severity: 'error',
                     suggestion: `Format: {"environments": ["production", "staging"]}`,
                 });
             }
-            else {
-                for (const envId of quonfigResult.data.environments) {
-                    declaredEnvIds.add(envId);
-                }
-            }
         }
     }
+    else {
+        issues.push({
+            file: 'quonfig.json',
+            message: `quonfig.json is missing from workspace root`,
+            severity: 'error',
+            suggestion: `Create quonfig.json with format: {"environments": ["production", "staging"]}`,
+        });
+    }
     // First pass: parse all files and collect keys
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
             continue;
-        const files = fs.readdirSync(dirPath).filter(f => f.endsWith(".json") && !f.startsWith("."));
+        const files = fs.readdirSync(dirPath).filter((f) => f.endsWith('.json') && !f.startsWith('.'));
         for (const file of files) {
             const filePath = path.join(dirPath, file);
             const relPath = `${dir}/${file}`;
@@ -315,21 +316,21 @@ export function validateWorkspace(workspaceDir) {
             // Read and parse JSON
             let raw;
             try {
-                raw = fs.readFileSync(filePath, "utf-8");
+                raw = fs.readFileSync(filePath, 'utf8');
             }
-            catch (err) {
-                issues.push({ file: relPath, message: `Cannot read file: ${err.message}`, severity: "error" });
+            catch (error) {
+                issues.push({ file: relPath, message: `Cannot read file: ${error.message}`, severity: 'error' });
                 continue;
             }
             let parsed;
             try {
                 parsed = JSON.parse(raw);
             }
-            catch (err) {
+            catch (error) {
                 issues.push({
                     file: relPath,
-                    message: `Invalid JSON: ${err.message}`,
-                    severity: "error",
+                    message: `Invalid JSON: ${error.message}`,
+                    severity: 'error',
                 });
                 continue;
             }
@@ -339,13 +340,13 @@ export function validateWorkspace(workspaceDir) {
                     for (const issue of result.error.issues) {
                         issues.push({
                             file: relPath,
-                            message: `Schema: ${issue.path.join(".")} - ${issue.message}`,
-                            severity: "error",
+                            message: `Schema: ${issue.path.join('.')} - ${issue.message}`,
+                            severity: 'error',
                         });
                     }
                     continue;
                 }
-                const schemaKey = file.replace(/\.json$/, "");
+                const schemaKey = file.replace(/\.json$/, '');
                 schemaKeys.add(schemaKey);
                 validateKey(schemaKey, relPath, issues);
                 allSchemaFiles.push({ key: schemaKey, file: relPath });
@@ -359,20 +360,20 @@ export function validateWorkspace(workspaceDir) {
                 for (const issue of result.error.issues) {
                     issues.push({
                         file: relPath,
-                        message: `Schema: ${issue.path.join(".")} - ${issue.message}`,
-                        severity: "error",
+                        message: `Schema: ${issue.path.join('.')} - ${issue.message}`,
+                        severity: 'error',
                     });
                 }
                 continue;
             }
             const config = result.data;
-            const expectedKey = file.replace(/\.json$/, "");
+            const expectedKey = file.replace(/\.json$/, '');
             // Key matches filename
             if (config.key !== expectedKey) {
                 issues.push({
                     file: relPath,
                     message: `Key "${config.key}" does not match filename "${expectedKey}"`,
-                    severity: "error",
+                    severity: 'error',
                     suggestion: `Rename file to "${config.key}.json" or set key to "${expectedKey}"`,
                 });
             }
@@ -384,41 +385,41 @@ export function validateWorkspace(workspaceDir) {
                 issues.push({
                     file: relPath,
                     message: `Type "${config.type}" in directory "${dir}" (expected "${expectedType}")`,
-                    severity: "error",
+                    severity: 'error',
                     suggestion: `Move to "${typeToDir(config.type)}/" or change type to "${expectedType}"`,
                 });
             }
             // Type-specific constraints
-            if (config.type === "segment") {
-                if (config.valueType !== "bool") {
+            if (config.type === 'segment') {
+                if (config.valueType !== 'bool') {
                     issues.push({
                         file: relPath,
                         message: `Segment must have valueType "bool", got "${config.valueType}"`,
-                        severity: "error",
+                        severity: 'error',
                     });
                 }
                 if (config.sendToClientSdk) {
                     issues.push({
                         file: relPath,
                         message: `Segment must have sendToClientSdk=false`,
-                        severity: "error",
+                        severity: 'error',
                     });
                 }
                 segmentKeys.add(config.key);
             }
-            if (config.type === "log_level") {
-                if (config.valueType !== "log_level") {
+            if (config.type === 'log_level') {
+                if (config.valueType !== 'log_level') {
                     issues.push({
                         file: relPath,
                         message: `Log level must have valueType "log_level", got "${config.valueType}"`,
-                        severity: "error",
+                        severity: 'error',
                     });
                 }
-                if (!config.key.startsWith("log-level.")) {
+                if (!config.key.startsWith('log-level.')) {
                     issues.push({
                         file: relPath,
                         message: `Log level key "${config.key}" must start with "log-level."`,
-                        severity: "error",
+                        severity: 'error',
                         suggestion: `Rename to "log-level.${config.key}" (and rename the file to "log-level.${config.key}.json")`,
                     });
                 }
@@ -426,22 +427,22 @@ export function validateWorkspace(workspaceDir) {
             // Validate environment IDs are slugs, not UUIDs
             validateEnvironmentIds(config.environments, relPath, issues);
             // Validate rules
-            validateRules(config.default.rules, relPath, "default", config.valueType, issues, config.variants);
+            validateRules(config.default.rules, relPath, 'default', config.valueType, issues, config.variants);
             for (const env of config.environments) {
                 validateRules(env.rules, relPath, `environments[${env.id}]`, config.valueType, issues, config.variants);
             }
             // Count by type
             switch (config.type) {
-                case "config":
+                case 'config':
                     stats.configs++;
                     break;
-                case "feature_flag":
+                case 'feature_flag':
                     stats.featureFlags++;
                     break;
-                case "segment":
+                case 'segment':
                     stats.segments++;
                     break;
-                case "log_level":
+                case 'log_level':
                     stats.logLevels++;
                     break;
             }
@@ -460,7 +461,7 @@ export function validateWorkspace(workspaceDir) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
             continue;
-        const files = fs.readdirSync(dirPath).filter(f => f.endsWith(".json") && !f.startsWith("."));
+        const files = fs.readdirSync(dirPath).filter((f) => f.endsWith('.json') && !f.startsWith('.'));
         for (const file of files) {
             const filePath = path.join(dirPath, file);
             const relPath = `${dir}/${file}`;
@@ -469,7 +470,7 @@ export function validateWorkspace(workspaceDir) {
             }
             let raw;
             try {
-                raw = fs.readFileSync(filePath, "utf-8");
+                raw = fs.readFileSync(filePath, 'utf8');
             }
             catch {
                 continue;
@@ -493,7 +494,7 @@ export function validateWorkspace(workspaceDir) {
                     issues.push({
                         file: relPath,
                         message: `References segment "${ref}" which does not exist`,
-                        severity: "error",
+                        severity: 'error',
                         suggestion: `Create segments/${ref}.json or remove the segment reference`,
                     });
                 }
@@ -505,7 +506,7 @@ export function validateWorkspace(workspaceDir) {
                     issues.push({
                         file: relPath,
                         message: `References schema "${config.schemaKey}" which does not exist`,
-                        severity: "error",
+                        severity: 'error',
                         suggestion: `Create schemas/${config.schemaKey}.json or schemas-protected/${config.schemaKey}.json, or remove schemaKey`,
                     });
                 }
@@ -518,7 +519,7 @@ export function validateWorkspace(workspaceDir) {
                         issues.push({
                             file: relPath,
                             message: `References environment "${env.id}" which is not declared in quonfig.json`,
-                            severity: "error",
+                            severity: 'error',
                             suggestion: `Add "${env.id}" to the environments array in quonfig.json, or remove this environment override`,
                         });
                     }
@@ -536,9 +537,9 @@ export function validateWorkspace(workspaceDir) {
     for (const [key, files] of keyToFiles) {
         if (files.length > 1) {
             issues.push({
-                file: files.join(", "),
+                file: files.join(', '),
                 message: `Duplicate key "${key}" found in multiple files`,
-                severity: "error",
+                severity: 'error',
                 suggestion: `Each key must be unique across the workspace`,
             });
         }
@@ -552,23 +553,31 @@ export function validateWorkspace(workspaceDir) {
     for (const [key, files] of schemaKeyToFiles) {
         if (files.length > 1) {
             issues.push({
-                file: files.join(", "),
+                file: files.join(', '),
                 message: `Duplicate schema key "${key}" found in multiple files`,
-                severity: "error",
+                severity: 'error',
                 suggestion: `Each schema key must be unique across schema directories`,
             });
         }
     }
     stats.uniqueKeysVerified = keyToFiles.size + schemaKeyToFiles.size;
-    const hasErrors = issues.some(i => i.severity === "error");
+    const hasErrors = issues.some((i) => i.severity === 'error');
     return { issues, filesChecked, valid: !hasErrors, stats };
 }
 // Default empty stats for validateFileMap (which doesn't track detailed stats)
 function emptyStats() {
     return {
-        configs: 0, featureFlags: 0, segments: 0, logLevels: 0, schemas: 0,
-        environmentOverrides: 0, rules: 0, segmentRefsChecked: 0,
-        schemaRefsChecked: 0, envRefsChecked: 0, uniqueKeysVerified: 0,
+        configs: 0,
+        featureFlags: 0,
+        segments: 0,
+        logLevels: 0,
+        schemas: 0,
+        environmentOverrides: 0,
+        rules: 0,
+        segmentRefsChecked: 0,
+        schemaRefsChecked: 0,
+        envRefsChecked: 0,
+        uniqueKeysVerified: 0,
     };
 }
 // ── Validate from in-memory file map (for git hook) ─────────────────────
@@ -586,50 +595,50 @@ export function validateFileMap(files) {
     const parsedConfigs = [];
     const declaredEnvIds = new Set();
     // Validate quonfig.json if it's included in the file map (it may not be in every commit)
-    const quonfigContent = files.get("quonfig.json");
+    const quonfigContent = files.get('quonfig.json');
     if (quonfigContent !== undefined) {
         let quonfigParsed;
         try {
             quonfigParsed = JSON.parse(quonfigContent);
         }
-        catch (err) {
+        catch (error) {
             quonfigParsed = null;
-            issues.push({ file: "quonfig.json", message: `Invalid JSON: ${err.message}`, severity: "error" });
+            issues.push({ file: 'quonfig.json', message: `Invalid JSON: ${error.message}`, severity: 'error' });
         }
         if (quonfigParsed !== null) {
             const quonfigResult = z.object({ environments: z.array(z.string()) }).safeParse(quonfigParsed);
-            if (!quonfigResult.success) {
+            if (quonfigResult.success) {
+                for (const envId of quonfigResult.data.environments) {
+                    declaredEnvIds.add(envId);
+                }
+            }
+            else {
                 issues.push({
-                    file: "quonfig.json",
+                    file: 'quonfig.json',
                     message: `quonfig.json must have an "environments" array of strings`,
-                    severity: "error",
+                    severity: 'error',
                     suggestion: `Format: {"environments": ["production", "staging"]}`,
                 });
             }
-            else {
-                for (const envId of quonfigResult.data.environments) {
-                    declaredEnvIds.add(envId);
-                }
-            }
         }
     }
     for (const [relPath, content] of files) {
-        const parts = relPath.split("/");
+        const parts = relPath.split('/');
         if (parts.length < 2)
             continue;
         const dir = parts[0];
-        const file = parts[parts.length - 1];
+        const file = parts.at(-1);
         if (!KNOWN_DIRS.has(dir))
             continue;
-        if (!file.endsWith(".json") || file.startsWith("."))
+        if (!file || !file.endsWith('.json') || file.startsWith('.'))
             continue;
         filesChecked++;
         let parsed;
         try {
             parsed = JSON.parse(content);
         }
-        catch (err) {
-            issues.push({ file: relPath, message: `Invalid JSON: ${err.message}`, severity: "error" });
+        catch (error) {
+            issues.push({ file: relPath, message: `Invalid JSON: ${error.message}`, severity: 'error' });
             continue;
         }
         if (SCHEMA_DIRS.has(dir)) {
@@ -638,13 +647,13 @@ export function validateFileMap(files) {
                 for (const issue of result.error.issues) {
                     issues.push({
                         file: relPath,
-                        message: `Schema: ${issue.path.join(".")} - ${issue.message}`,
-                        severity: "error",
+                        message: `Schema: ${issue.path.join('.')} - ${issue.message}`,
+                        severity: 'error',
                     });
                 }
                 continue;
             }
-            const schemaKey = file.replace(/\.json$/, "");
+            const schemaKey = file.replace(/\.json$/, '');
             schemaKeys.add(schemaKey);
             validateKey(schemaKey, relPath, issues);
             allSchemaFiles.push({ key: schemaKey, file: relPath });
@@ -656,19 +665,19 @@ export function validateFileMap(files) {
             for (const issue of result.error.issues) {
                 issues.push({
                     file: relPath,
-                    message: `Schema: ${issue.path.join(".")} - ${issue.message}`,
-                    severity: "error",
+                    message: `Schema: ${issue.path.join('.')} - ${issue.message}`,
+                    severity: 'error',
                 });
             }
             continue;
         }
         const config = result.data;
-        const expectedKey = file.replace(/\.json$/, "");
+        const expectedKey = file.replace(/\.json$/, '');
         if (config.key !== expectedKey) {
             issues.push({
                 file: relPath,
                 message: `Key "${config.key}" does not match filename "${expectedKey}"`,
-                severity: "error",
+                severity: 'error',
                 suggestion: `Rename file to "${config.key}.json" or set key to "${expectedKey}"`,
             });
         }
@@ -678,34 +687,42 @@ export function validateFileMap(files) {
             issues.push({
                 file: relPath,
                 message: `Type "${config.type}" in directory "${dir}" (expected "${expectedType}")`,
-                severity: "error",
+                severity: 'error',
                 suggestion: `Move to "${typeToDir(config.type)}/" or change type to "${expectedType}"`,
             });
         }
-        if (config.type === "segment") {
-            if (config.valueType !== "bool") {
-                issues.push({ file: relPath, message: `Segment must have valueType "bool", got "${config.valueType}"`, severity: "error" });
+        if (config.type === 'segment') {
+            if (config.valueType !== 'bool') {
+                issues.push({
+                    file: relPath,
+                    message: `Segment must have valueType "bool", got "${config.valueType}"`,
+                    severity: 'error',
+                });
             }
             if (config.sendToClientSdk) {
-                issues.push({ file: relPath, message: `Segment must have sendToClientSdk=false`, severity: "error" });
+                issues.push({ file: relPath, message: `Segment must have sendToClientSdk=false`, severity: 'error' });
             }
             segmentKeys.add(config.key);
         }
-        if (config.type === "log_level") {
-            if (config.valueType !== "log_level") {
-                issues.push({ file: relPath, message: `Log level must have valueType "log_level", got "${config.valueType}"`, severity: "error" });
+        if (config.type === 'log_level') {
+            if (config.valueType !== 'log_level') {
+                issues.push({
+                    file: relPath,
+                    message: `Log level must have valueType "log_level", got "${config.valueType}"`,
+                    severity: 'error',
+                });
             }
-            if (!config.key.startsWith("log-level.")) {
+            if (!config.key.startsWith('log-level.')) {
                 issues.push({
                     file: relPath,
                     message: `Log level key "${config.key}" must start with "log-level."`,
-                    severity: "error",
+                    severity: 'error',
                     suggestion: `Rename to "log-level.${config.key}" (and rename the file to "log-level.${config.key}.json")`,
                 });
             }
         }
         validateEnvironmentIds(config.environments, relPath, issues);
-        validateRules(config.default.rules, relPath, "default", config.valueType, issues, config.variants);
+        validateRules(config.default.rules, relPath, 'default', config.valueType, issues, config.variants);
         for (const env of config.environments) {
             validateRules(env.rules, relPath, `environments[${env.id}]`, config.valueType, issues, config.variants);
         }
@@ -720,7 +737,7 @@ export function validateFileMap(files) {
                 issues.push({
                     file: relPath,
                     message: `References segment "${ref}" which does not exist`,
-                    severity: "error",
+                    severity: 'error',
                     suggestion: `Create segments/${ref}.json or remove the segment reference`,
                 });
             }
@@ -729,7 +746,7 @@ export function validateFileMap(files) {
             issues.push({
                 file: relPath,
                 message: `References schema "${config.schemaKey}" which does not exist`,
-                severity: "error",
+                severity: 'error',
                 suggestion: `Create schemas/${config.schemaKey}.json or schemas-protected/${config.schemaKey}.json, or remove schemaKey`,
             });
         }
@@ -740,7 +757,7 @@ export function validateFileMap(files) {
                     issues.push({
                         file: relPath,
                         message: `References environment "${env.id}" which is not declared in quonfig.json`,
-                        severity: "error",
+                        severity: 'error',
                         suggestion: `Add "${env.id}" to the environments array in quonfig.json, or remove this environment override`,
                     });
                 }
@@ -757,9 +774,9 @@ export function validateFileMap(files) {
     for (const [key, fileList] of keyToFiles) {
         if (fileList.length > 1) {
             issues.push({
-                file: fileList.join(", "),
+                file: fileList.join(', '),
                 message: `Duplicate key "${key}" found in multiple files`,
-                severity: "error",
+                severity: 'error',
             });
         }
     }
@@ -772,13 +789,13 @@ export function validateFileMap(files) {
     for (const [key, fileList] of schemaKeyToFiles) {
         if (fileList.length > 1) {
             issues.push({
-                file: fileList.join(", "),
+                file: fileList.join(', '),
                 message: `Duplicate schema key "${key}" found in multiple files`,
-                severity: "error",
+                severity: 'error',
             });
         }
     }
-    const hasErrors = issues.some(i => i.severity === "error");
+    const hasErrors = issues.some((i) => i.severity === 'error');
     return { issues, filesChecked, valid: !hasErrors, stats: emptyStats() };
 }
 // ── Helpers ─────────────────────────────────────────────────────────────
@@ -788,7 +805,7 @@ function validateEnvironmentIds(environments, file, issues) {
             issues.push({
                 file,
                 message: `Environment ID "${env.id}" is a UUID — must be a human-readable slug (e.g., "production", "my-ci-env")`,
-                severity: "error",
+                severity: 'error',
                 suggestion: `Replace the UUID with the environment's slugified name`,
             });
         }
@@ -796,7 +813,7 @@ function validateEnvironmentIds(environments, file, issues) {
             issues.push({
                 file,
                 message: `Environment ID "${env.id}" is not a valid slug (expected lowercase alphanumeric + dashes)`,
-                severity: "error",
+                severity: 'error',
                 suggestion: `Use a slugified name like "production" or "my-ci-env"`,
             });
         }
@@ -804,67 +821,64 @@ function validateEnvironmentIds(environments, file, issues) {
 }
 function validateKey(key, file, issues) {
     if (key.length === 0) {
-        issues.push({ file, message: `Key is empty`, severity: "error" });
+        issues.push({ file, message: `Key is empty`, severity: 'error' });
     }
     if (key.length > 512) {
-        issues.push({ file, message: `Key exceeds 512 characters (${key.length})`, severity: "error" });
+        issues.push({ file, message: `Key exceeds 512 characters (${key.length})`, severity: 'error' });
     }
-    if (key === "new") {
-        issues.push({ file, message: `Key cannot be "new" (reserved)`, severity: "error" });
+    if (key === 'new') {
+        issues.push({ file, message: `Key cannot be "new" (reserved)`, severity: 'error' });
     }
     if (/[/\\]/.test(key)) {
-        issues.push({ file, message: `Key contains slash or backslash`, severity: "error" });
+        issues.push({ file, message: `Key contains slash or backslash`, severity: 'error' });
     }
 }
 function validateRules(rules, file, context, expectedValueType, issues, variants = []) {
     if (rules.length === 0) {
-        issues.push({ file, message: `${context}: no rules defined`, severity: "warning" });
+        issues.push({ file, message: `${context}: no rules defined`, severity: 'warning' });
     }
     // Pre-compute serialized variant values for matching
-    const variantValues = variants.map(v => JSON.stringify(v.value));
-    for (let i = 0; i < rules.length; i++) {
-        const rule = rules[i];
+    const variantValues = new Set(variants.map((v) => JSON.stringify(v.value)));
+    for (const [i, rule] of rules.entries()) {
         const ruleCtx = `${context}.rules[${i}]`;
         // Check value type consistency
         // Skip weighted_values (contains its own values), schema, and provided (special types)
-        const SPECIAL_VALUE_TYPES = new Set(["weighted_values", "schema", "provided"]);
+        const SPECIAL_VALUE_TYPES = new Set(['weighted_values', 'schema', 'provided']);
         if (!SPECIAL_VALUE_TYPES.has(rule.value.type)) {
             if (rule.value.type !== expectedValueType) {
                 issues.push({
                     file,
                     message: `${ruleCtx}: value type "${rule.value.type}" does not match config valueType "${expectedValueType}"`,
-                    severity: "error",
+                    severity: 'error',
                 });
             }
             // Check that value matches one of the defined variants
             if (variants.length > 0) {
                 const serialized = JSON.stringify(rule.value);
-                if (!variantValues.includes(serialized)) {
+                if (!variantValues.has(serialized)) {
                     issues.push({
                         file,
                         message: `${ruleCtx}: value does not match any defined variant`,
-                        severity: "error",
+                        severity: 'error',
                         suggestion: `Rule value must be one of the defined variants`,
                     });
                 }
             }
         }
-        else if (rule.value.type === "weighted_values") {
+        else if (rule.value.type === 'weighted_values') {
             // Validate weighted values
             const wv = rule.value.value;
             if (wv.weightedValues.length === 0) {
-                issues.push({ file, message: `${ruleCtx}: weighted values list is empty`, severity: "error" });
+                issues.push({ file, message: `${ruleCtx}: weighted values list is empty`, severity: 'error' });
             }
             // Percentage rollouts must reference named variants — the UI cannot edit
             // a rollout when variants is empty. Bool configs are exempt because the
             // UI supplies implicit true/false variants.
-            if (wv.weightedValues.length > 0 &&
-                variants.length === 0 &&
-                expectedValueType !== "bool") {
+            if (wv.weightedValues.length > 0 && variants.length === 0 && expectedValueType !== 'bool') {
                 issues.push({
                     file,
                     message: `${ruleCtx}: weighted_values rollout requires at least one variant, but variants is empty`,
-                    severity: "error",
+                    severity: 'error',
                     suggestion: `Define variants for the possible rollout values, then reference them from weightedValues.`,
                 });
             }
@@ -873,17 +887,17 @@ function validateRules(rules, file, context, expectedValueType, issues, variants
                     issues.push({
                         file,
                         message: `${ruleCtx}.weightedValues[${j}]: value type "${wv.weightedValues[j].value.type}" does not match config valueType "${expectedValueType}"`,
-                        severity: "error",
+                        severity: 'error',
                     });
                 }
                 // Check that each weighted value matches one of the defined variants
                 if (variants.length > 0) {
                     const serialized = JSON.stringify(wv.weightedValues[j].value);
-                    if (!variantValues.includes(serialized)) {
+                    if (!variantValues.has(serialized)) {
                         issues.push({
                             file,
                             message: `${ruleCtx}.weightedValues[${j}]: value does not match any defined variant`,
-                            severity: "error",
+                            severity: 'error',
                             suggestion: `Weighted value must be one of the defined variants`,
                         });
                     }
@@ -898,14 +912,14 @@ function validateRules(rules, file, context, expectedValueType, issues, variants
                 issues.push({
                     file,
                     message: `${critCtx}: operator "${criterion.operator}" requires propertyName`,
-                    severity: "error",
+                    severity: 'error',
                 });
             }
             if (VALUE_REQUIRED_OPERATORS.has(criterion.operator) && !criterion.valueToMatch) {
                 issues.push({
                     file,
                     message: `${critCtx}: operator "${criterion.operator}" requires valueToMatch`,
-                    severity: "error",
+                    severity: 'error',
                 });
             }
         }
@@ -919,10 +933,10 @@ function collectSegmentReferences(config) {
                 if (SEGMENT_OPERATORS.has(criterion.operator) && criterion.valueToMatch) {
                     // The segment key is stored in the valueToMatch string value
                     const val = criterion.valueToMatch;
-                    if (val.type === "string") {
+                    if (val.type === 'string') {
                         refs.push(val.value);
                     }
-                    else if (val.type === "string_list") {
+                    else if (val.type === 'string_list') {
                         refs.push(...val.value);
                     }
                 }
@@ -950,8 +964,8 @@ export function formatResult(result) {
         lines.push(`OK: ${result.filesChecked} files checked, no errors found.\n`);
     }
     else {
-        const errors = result.issues.filter(i => i.severity === "error");
-        const warnings = result.issues.filter(i => i.severity === "warning");
+        const errors = result.issues.filter((i) => i.severity === 'error');
+        const warnings = result.issues.filter((i) => i.severity === 'warning');
         lines.push(`FAILED: ${errors.length} error(s), ${warnings.length} warning(s) in ${result.filesChecked} files.\n`);
     }
     // Show what was checked
@@ -967,13 +981,10 @@ export function formatResult(result) {
     if (s.schemas > 0)
         fileCounts.push(`${s.schemas} schemas`);
     if (fileCounts.length > 0) {
-        lines.push(`  Files:       ${fileCounts.join(", ")}`);
+        lines.push(`  Files:       ${fileCounts.join(', ')}`);
     }
     const checks = [];
-    checks.push(`${result.filesChecked} JSON parsed`);
-    checks.push(`${result.filesChecked} schema-validated`);
-    checks.push(`${s.uniqueKeysVerified} unique keys`);
-    checks.push(`${s.rules} rules checked`);
+    checks.push(`${result.filesChecked} JSON parsed`, `${result.filesChecked} schema-validated`, `${s.uniqueKeysVerified} unique keys`, `${s.rules} rules checked`);
     if (s.environmentOverrides > 0)
         checks.push(`${s.environmentOverrides} env overrides`);
     if (s.segmentRefsChecked > 0)
@@ -982,7 +993,7 @@ export function formatResult(result) {
         checks.push(`${s.schemaRefsChecked} schema refs`);
     if (s.envRefsChecked > 0)
         checks.push(`${s.envRefsChecked} env refs`);
-    lines.push(`  Checks:      ${checks.join(", ")}`);
+    lines.push(`  Checks:      ${checks.join(', ')}`);
     // Group issues by file
     const byFile = new Map();
     for (const issue of result.issues) {
@@ -991,24 +1002,24 @@ export function formatResult(result) {
         byFile.set(issue.file, existing);
     }
     if (byFile.size > 0) {
-        lines.push("");
+        lines.push('');
     }
     for (const [file, fileIssues] of byFile) {
         lines.push(`  ${file}:`);
         for (const issue of fileIssues) {
-            const prefix = issue.severity === "error" ? "ERROR" : "WARN ";
+            const prefix = issue.severity === 'error' ? 'ERROR' : 'WARN ';
             lines.push(`    ${prefix}: ${issue.message}`);
             if (issue.suggestion) {
                 lines.push(`           -> ${issue.suggestion}`);
             }
         }
-        lines.push("");
+        lines.push('');
     }
     if (result.issues.length > 0) {
-        const warnings = result.issues.filter(i => i.severity === "warning");
+        const warnings = result.issues.filter((i) => i.severity === 'warning');
         if (warnings.length > 0 && result.valid) {
             lines.push(`\n${warnings.length} warning(s) found.`);
         }
     }
-    return lines.join("\n");
+    return lines.join('\n');
 }