@quonfig/cli 0.0.12 → 0.0.14

package/dist/migrate/local-write.js

@@ -0,0 +1,85 @@
+import { execFile as execFileCb, spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as util from 'node:util';
+import { removeQfFromGitignore, writeImportState } from './import-state.js';
+import { writeMigrationReport } from './migration-report.js';
+import { MIGRATOR_IDENTITY } from './push-strategy.js';
+const execFile = util.promisify(execFileCb);
+const isGitRepo = async (dir) => {
+    try {
+        await execFile('git', ['-C', dir, 'rev-parse', '--git-dir']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const hasStagedChanges = async (dir) => {
+    const { stdout } = await execFile('git', ['-C', dir, 'status', '--porcelain']);
+    return stdout.trim().length > 0;
+};
+const gitCommitFromStdin = (cwd, message, env) => new Promise((resolve, reject) => {
+    const child = spawn('git', ['-C', cwd, 'commit', '-F', '-'], { env });
+    let stderr = '';
+    child.stderr.on('data', (d) => {
+        stderr += d.toString();
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+        if (code === 0)
+            resolve();
+        else
+            reject(new Error(`git commit exited ${code}: ${stderr}`));
+    });
+    child.stdin.end(message);
+});
+const ensureQuonfigJson = (dir, environments) => {
+    const filePath = path.join(dir, 'quonfig.json');
+    if (fs.existsSync(filePath))
+        return;
+    const sorted = [...new Set(environments)].sort();
+    fs.writeFileSync(filePath, JSON.stringify({ environments: sorted }, null, 2) + '\n', 'utf8');
+};
+const ensureLocalRepo = async (localDir, branch) => {
+    fs.mkdirSync(localDir, { recursive: true });
+    if (await isGitRepo(localDir))
+        return 'reused';
+    await execFile('git', ['init', `--initial-branch=${branch}`, localDir]);
+    return 'initialized';
+};
+const writeQuonfigFiles = (dir, changes, source) => {
+    for (const change of changes) {
+        const files = source.translate(change);
+        for (const file of files) {
+            const full = path.join(dir, file.path);
+            fs.mkdirSync(path.dirname(full), { recursive: true });
+            fs.writeFileSync(full, file.contents);
+        }
+    }
+};
+export const applyLocalMigration = async (opts) => {
+    const branch = opts.branch ?? 'main';
+    const author = opts.author ?? MIGRATOR_IDENTITY;
+    const action = await ensureLocalRepo(opts.localDir, branch);
+    await execFile('git', ['-C', opts.localDir, 'config', 'user.name', author.name]);
+    await execFile('git', ['-C', opts.localDir, 'config', 'user.email', author.email]);
+    ensureQuonfigJson(opts.localDir, opts.environments);
+    writeQuonfigFiles(opts.localDir, opts.changes, opts.source);
+    removeQfFromGitignore(opts.localDir);
+    writeImportState(opts.localDir, opts.importState);
+    writeMigrationReport(opts.localDir, opts.reportData);
+    await execFile('git', ['-C', opts.localDir, 'add', '--all']);
+    if (!(await hasStagedChanges(opts.localDir))) {
+        return { action, committed: false, commitSha: null };
+    }
+    await gitCommitFromStdin(opts.localDir, opts.commitMessage, {
+        ...process.env,
+        GIT_AUTHOR_EMAIL: author.email,
+        GIT_AUTHOR_NAME: author.name,
+        GIT_COMMITTER_EMAIL: author.email,
+        GIT_COMMITTER_NAME: author.name,
+    });
+    const { stdout: sha } = await execFile('git', ['-C', opts.localDir, 'rev-parse', 'HEAD']);
+    return { action, commitSha: sha.trim(), committed: true };
+};

package/dist/migrate/migration-report.js

@@ -73,15 +73,7 @@ export const buildMigrationReport = (data) => {
     if (data.dryRun) {
         sections.push('> **DRY RUN** — no files were written to the workspace during this run.');
     }
-    sections.push(`# Migration Report (from ${data.source})`);
-    sections.push(`_Reflects only the changes produced by this run. Re-running overwrites this file._`);
-    sections.push(renderCounts(data.counts));
-    sections.push(renderCleanMappings(data.cleanMappings));
-    sections.push(renderLossyMappings(data.lossyMappings));
-    sections.push(renderUnsupported(data.unsupportedFeatures));
-    sections.push(renderEnvironmentMap(data.environmentMap));
-    sections.push(renderIdentifierMap(data.identifierMap));
-    sections.push(renderFollowUp(data.followUp));
+    sections.push(`# Migration Report (from ${data.source})`, `_Reflects only the changes produced by this run. Re-running overwrites this file._`, renderCounts(data.counts), renderCleanMappings(data.cleanMappings), renderLossyMappings(data.lossyMappings), renderUnsupported(data.unsupportedFeatures), renderEnvironmentMap(data.environmentMap), renderIdentifierMap(data.identifierMap), renderFollowUp(data.followUp));
     return sections.join('\n\n') + '\n';
 };
 export const migrationReportPath = (outputDir) => path.join(outputDir, 'MIGRATION_REPORT.md');

package/dist/migrate/push-strategy.js

@@ -82,13 +82,7 @@ const ensureCloneOrReuse = async (remoteUrl, localDir, branch) => {
         }
     }
     fs.mkdirSync(path.dirname(localDir), { recursive: true });
-    await runGit(path.dirname(localDir) || '.', [
-        'clone',
-        '--branch',
-        branch,
-        remoteUrl,
-        localDir,
-    ]);
+    await runGit(path.dirname(localDir) || '.', ['clone', '--branch', branch, remoteUrl, localDir]);
     return 'cloned';
 };
 const hasStagedChanges = async (dir) => {

package/dist/migrate/push-to-cloud.js

@@ -2,7 +2,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { removeQfFromGitignore, writeImportState } from './import-state.js';
 import { writeMigrationReport } from './migration-report.js';
-import { cloneAndStackPush, } from './push-strategy.js';
+import { cloneAndStackPush } from './push-strategy.js';
 const writeQuonfigFiles = (dir, changes, source) => {
     for (const change of changes) {
         const files = source.translate(change);

package/dist/migrate/sources/flagsmith.js

@@ -1,3 +1,13 @@
+// Stub — `qfg migrate --from flagsmith` is not yet wired up. Before replacing this with a real
+// implementation, investigate:
+//   - Flagsmith API shape: what the admin/REST API returns for features, segments, identities,
+//     environments, and multivariate variations, and how that maps onto Quonfig's JSON schema.
+//   - Delta/cursor support: whether Flagsmith exposes an audit-log or change-feed endpoint with a
+//     stable cursor we can persist in `.qf/import-state.json` for re-runnable incremental
+//     imports, or whether we have to full-reimport + diff on every run (as is likely for LD).
+//   - Auth model: API key scopes (server-side vs. admin), org/project/environment hierarchy.
+//   - Schema gaps: Flagsmith's identity overrides and segment rules vs. Quonfig's rule operators
+//     — document any unsupported primitives the way `launchdarkly.README.md` does for LD.
 import { NotYetImplementedError } from '../source.js';
 const SOURCE_NAME = 'flagsmith';
 export const flagsmithSource = {

package/dist/quonfig.d.ts

@@ -7,7 +7,7 @@ type Flags = {
 type FlagsOrDatafile = Flags | string;
 export declare const initQuonfig: (_ctx: CommandLike, flagsOrDatafile: FlagsOrDatafile) => Promise<Quonfig>;
 export declare const getQuonfig: () => Quonfig;
-export declare const overrideFor: ({ currentEnvironmentId, key, }: {
+export declare const overrideFor: ({ currentEnvironmentId: _currentEnvironmentId, key, }: {
     currentEnvironmentId: string;
     key: string;
 }) => Value | undefined;

package/dist/quonfig.js

@@ -32,16 +32,12 @@ export const getQuonfig = () => quonfig;
  * Get the raw ConfigResponse for a key (new quonfig JSON format).
  * The new format uses `default.rules` and `environment.rules` instead of `rows`.
  */
-const getRawConfig = (key) => {
-    return quonfig.rawConfig?.(key);
-};
+const getRawConfig = (key) => quonfig.rawConfig?.(key);
 /**
  * Find rules in an environment that target a specific user via criteria.
  */
-const getEnvironmentRules = (config) => {
-    return config.environment?.rules;
-};
-export const overrideFor = ({ currentEnvironmentId, key, }) => {
+const getEnvironmentRules = (config) => config.environment?.rules;
+export const overrideFor = ({ currentEnvironmentId: _currentEnvironmentId, key, }) => {
     const config = getRawConfig(key);
     if (!config)
         return undefined;
@@ -65,11 +61,11 @@ export const defaultValueFor = (_envId, key) => {
     // In the new format, the default value is the last rule in environment rules, or default rules
     const envRules = config.environment?.rules;
     if (envRules && envRules.length > 0) {
-        return envRules[envRules.length - 1]?.value;
+        return envRules.at(-1)?.value;
     }
     const defaultRules = config.default?.rules;
     if (defaultRules && defaultRules.length > 0) {
-        return defaultRules[defaultRules.length - 1]?.value;
+        return defaultRules.at(-1)?.value;
     }
     return undefined;
 };

package/dist/ui/get-value.js

@@ -38,7 +38,7 @@ const valueToString = (v) => {
         return '';
     return String(v.value);
 };
-const promptForValue = async ({ allowBlank, config, currentDefault, message, }) => {
+const promptForValue = async ({ allowBlank, config: _config, currentDefault, message, }) => {
     // In the new quonfig format, allowable values aren't stored at the config level.
     // Just prompt for a string input.
     if (!currentDefault) {

package/dist/util/config-value-dto.js

@@ -38,7 +38,23 @@ export function mapConfigValueToDto(configValue, valueType) {
         value = configValue.stringList.values;
     }
     else if (configValue.json !== undefined) {
-        value = configValue.json;
+        // ConfigValue.json is wrapped as {json: "<raw JSON string>"} (see coerceIntoType).
+        // The API expects the parsed JSON value, not the wrapper or the raw string —
+        // otherwise the server stores the default as {} (see qfg-c0q).
+        const rawJson = configValue.json.json;
+        if (typeof rawJson === 'string') {
+            try {
+                value = JSON.parse(rawJson);
+            }
+            catch {
+                // Fall back to raw string if somehow it isn't valid JSON — coerceIntoType
+                // should have already rejected this case, so this is defensive only.
+                value = rawJson;
+            }
+        }
+        else {
+            value = rawJson ?? configValue.json;
+        }
     }
     else if (configValue.duration !== undefined) {
         value = configValue.duration;

package/dist/util/encryption.js

@@ -72,7 +72,10 @@ export async function makeConfidentialValue(command, value, secret, environmentI
         });
     }
     // Fetch the encryption key config
-    const configRequest = await command.apiClient.post('/api/v1/metadata/getByKey', { workspaceId: command.workspaceId, key: secret.keyName });
+    const configRequest = await command.apiClient.post('/api/v1/metadata/getByKey', {
+        workspaceId: command.workspaceId,
+        key: secret.keyName,
+    });
     if (!configRequest.ok) {
         const message = configRequest.status === 404
             ? `Failed to create secret: ${secret.keyName} not found`

package/dist/util/friction-log.d.ts

@@ -4,7 +4,7 @@ export interface FrictionEntry {
     exitCode: number;
     ts: string;
 }
-export declare function getFrictionLogPath(envValue: string | undefined, cwd?: string): null | string;
+export declare function getFrictionLogPath(envValue?: string | undefined, cwd?: string): null | string;
 export declare function buildFrictionEntry(opts: {
     argv?: string[];
     binName?: string;

package/dist/util/friction-log.js

@@ -29,8 +29,12 @@ const MAX_STDERR_CAPTURE = 4000;
 export function extractLastErrorLine(stderr) {
     if (!stderr)
         return undefined;
+    // eslint-disable-next-line no-control-regex
     const stripped = stderr.replaceAll(/\u001B\[[\d;]*[A-Za-z]/g, '');
-    const lines = stripped.split('\n').map((l) => l.trim()).filter(Boolean);
+    const lines = stripped
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
     if (lines.length === 0)
         return undefined;
     const errorLine = [...lines].reverse().find((l) => /^(error|»|×|✖)/i.test(l));

package/dist/util/get-client.js

@@ -20,10 +20,58 @@ const getClient = async (command, sdkKey, profile) => {
     }
     let jwt;
     let workspaceId;
-    // If no SDK key provided, use WorkOS OAuth tokens
-    if (!sdkKey) {
+    const apiKey = process.env.QUONFIG_API_KEY;
+    // Auth precedence: explicit SDK key → QUONFIG_API_KEY env (CI) → WorkOS OAuth tokens.
+    if (sdkKey) {
+        // No jwt / workspace resolution — SDK-key path talks to api-delivery.
+    }
+    else if (apiKey && apiKey.length > 0) {
+        // API-key (workspace-scoped bearer) path. getValidAccessToken short-circuits
+        // when QUONFIG_API_KEY is set, so this never touches disk.
+        try {
+            jwt = await getValidAccessToken();
+        }
+        catch (error) {
+            command.error(error instanceof Error ? error.message : String(error), { exit: 1 });
+        }
+        const workspaceOverride = profile ?? process.env.QUONFIG_WORKSPACE;
+        if (!workspaceOverride) {
+            command.error('QUONFIG_API_KEY is set but no workspace was specified. Set QUONFIG_WORKSPACE=<slug-or-uuid> or pass --workspace=<slug-or-uuid>.', { exit: 1 });
+        }
+        const uuidPattern = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
+        if (uuidPattern.test(workspaceOverride)) {
+            workspaceId = workspaceOverride;
+            command.verboseLog('ApiKey auth', { source: 'uuid', workspaceId });
+        }
+        else {
+            let res;
+            try {
+                res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+                    method: 'POST',
+                    headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ json: {} }),
+                });
+            }
+            catch (error) {
+                command.error(`Failed to resolve workspace slug "${workspaceOverride}": ${error instanceof Error ? error.message : String(error)}`, { exit: 1 });
+            }
+            if (!res.ok) {
+                command.error(`Failed to resolve workspace slug "${workspaceOverride}" (HTTP ${res.status}). Check that QUONFIG_API_KEY is valid.`, { exit: 1 });
+            }
+            const body = (await res.json());
+            const entries = body.json ?? body ?? [];
+            const match = entries.find((w) => w.workspaceSlug === workspaceOverride);
+            if (!match) {
+                const available = entries.map((w) => w.workspaceSlug).join(', ') || '(none)';
+                command.error(`No workspace with slug "${workspaceOverride}" is accessible with this API key. Available: ${available}.`, { exit: 1 });
+            }
+            workspaceId = match.workspaceId;
+            command.verboseLog('ApiKey auth', { source: 'slug', slug: workspaceOverride, workspaceId });
+        }
+    }
+    else {
         const authConfig = await loadAuthConfig();
-        let tokens = await loadTokens();
+        const tokens = await loadTokens();
         command.verboseLog('OAuth auth', {
             hasAuthConfig: Boolean(authConfig),
             hasAccessToken: Boolean(tokens?.accessToken),

package/dist/util/get-valid-token.d.ts

@@ -1,5 +1,9 @@
 /**
  * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
  * Throws if not logged in or if refresh fails.
+ *
+ * If `QUONFIG_API_KEY` is set in the environment (non-empty), it is used
+ * directly as a bearer token and no disk reads/writes or refresh calls
+ * are made. This is the non-interactive (CI) path.
  */
 export declare function getValidAccessToken(): Promise<string>;

package/dist/util/get-valid-token.js

@@ -1,10 +1,21 @@
 /**
  * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
  * Throws if not logged in or if refresh fails.
+ *
+ * If `QUONFIG_API_KEY` is set in the environment (non-empty), it is used
+ * directly as a bearer token and no disk reads/writes or refresh calls
+ * are made. This is the non-interactive (CI) path.
  */
 import { decodeJWT, refreshAccessToken } from './oauth-client.js';
 import { loadTokens, saveTokens } from './token-storage.js';
 export async function getValidAccessToken() {
+    const envKey = process.env.QUONFIG_API_KEY;
+    if (envKey && envKey.length > 0) {
+        if (!envKey.startsWith('qf_uk_')) {
+            throw new Error(`QUONFIG_API_KEY must start with "qf_uk_" (got "${envKey.slice(0, 8)}..."). Generate one from the web UI under Settings → API Keys.`);
+        }
+        return envKey;
+    }
     const tokens = await loadTokens();
     if (!tokens?.accessToken) {
         throw new Error('Not authenticated. Please run `qfg login` first.');
@@ -17,7 +28,9 @@ export async function getValidAccessToken() {
             expired = payload.exp * 1000 < Date.now();
         }
     }
-    catch { /* use stored expiresAt */ }
+    catch {
+        /* use stored expiresAt */
+    }
     if (!expired) {
         return tokens.accessToken;
     }
@@ -32,7 +45,9 @@ export async function getValidAccessToken() {
             expiresAt = payload.exp * 1000;
         }
     }
-    catch { /* use fallback */ }
+    catch {
+        /* use fallback */
+    }
     const updated = {
         ...tokens,
         accessToken: refreshed.access_token,

package/dist/util/git-ops.js

@@ -4,7 +4,7 @@ const execFile = util.promisify(execFileCb);
 /**
  * Redact a token from a URL string so it is safe to display to users.
  */
-export const redactToken = (url) => url.replace(/:([^@/]+)@/, ':***@');
+export const redactToken = (url) => url.replace(/:([^/@]+)@/, ':***@');
 /**
  * Wrap execFile errors to strip tokens from the message.
  */
@@ -12,9 +12,9 @@ const safeExec = async (file, args, options) => {
     try {
         return await execFile(file, args, { cwd: options?.cwd });
     }
-    catch (err) {
-        const e = err;
-        const message = redactToken(e.message || String(err));
+    catch (error) {
+        const e = error;
+        const message = redactToken(e.message || String(error));
         const stderr = redactToken(e.stderr ?? '');
         const safeErr = new Error(message);
         safeErr.stderr = stderr;
@@ -136,11 +136,11 @@ export const gitMergeFfOnly = async (dir) => {
  */
 export const gitSetRemote = async (dir, url) => {
     const existing = await getRemoteUrl(dir);
-    if (existing !== null) {
-        await safeExec('git', ['-C', dir, 'remote', 'set-url', 'origin', url]);
+    if (existing === null) {
+        await safeExec('git', ['-C', dir, 'remote', 'add', 'origin', url]);
     }
     else {
-        await safeExec('git', ['-C', dir, 'remote', 'add', 'origin', url]);
+        await safeExec('git', ['-C', dir, 'remote', 'set-url', 'origin', url]);
     }
 };
 export const gitPushForceLease = async (dir) => {

package/dist/util/gitea-api.d.ts

@@ -1,8 +1,8 @@
 import { GiteaTokenEntry } from './gitea-token-storage.js';
 export interface GiteaTokenResponse {
-    token: string;
-    repoUrl: string;
     expiresAt: string | null;
+    repoUrl: string;
+    token: string;
 }
 export declare const mintGiteaToken: (workspaceId: string, scope: "read" | "write", purpose: "pull" | "bootstrap") => Promise<GiteaTokenResponse>;
 /**

package/dist/util/gitea-api.js

@@ -7,7 +7,7 @@ export const mintGiteaToken = async (workspaceId, scope, purpose) => {
     const res = await fetch(`${apiUrl}/api/v1/gitea/token`, {
         method: 'POST',
         headers: {
-            'Authorization': `Bearer ${accessToken}`,
+            Authorization: `Bearer ${accessToken}`,
             'Content-Type': 'application/json',
         },
         body: JSON.stringify({ json: { scope, workspaceId, purpose } }),
@@ -23,10 +23,12 @@ export const mintGiteaToken = async (workspaceId, scope, purpose) => {
             else if (body?.message)
                 message = body.message;
         }
-        catch { /* use raw text */ }
+        catch {
+            /* use raw text */
+        }
         throw new Error(message || text);
     }
-    const body = await res.json();
+    const body = (await res.json());
     const data = body.json ?? body;
     return data;
 };

package/dist/util/gitea-token-storage.d.ts

@@ -1,7 +1,7 @@
 export interface GiteaTokenEntry {
-    token: string;
-    repoUrl: string;
     expiresAt: string | null;
+    repoUrl: string;
+    token: string;
 }
 export declare const loadGiteaToken: (workspaceId: string) => Promise<GiteaTokenEntry | null>;
 export declare const saveGiteaToken: (workspaceId: string, entry: GiteaTokenEntry) => Promise<void>;

package/dist/util/gitea-token-storage.js

@@ -6,7 +6,7 @@ const BUFFER_MS = 5 * 60 * 1000; // 5 minutes
 const getQuonfigDir = () => path.join(os.homedir(), '.quonfig');
 const getGiteaTokenFile = () => {
     const domain = getDomain();
-    const filename = domain !== 'quonfig.com' ? `gitea-tokens-${domain.replaceAll('.', '-')}.json` : 'gitea-tokens.json';
+    const filename = domain === 'quonfig.com' ? 'gitea-tokens.json' : `gitea-tokens-${domain.replaceAll('.', '-')}.json`;
     return path.join(getQuonfigDir(), filename);
 };
 const ensureQuonfigDir = async () => {

package/dist/util/oauth-client.js

@@ -53,7 +53,7 @@ export const pollForToken = async (deviceCode, interval, expiresIn, verbose) =>
             return response.json();
         }
         // eslint-disable-next-line no-await-in-loop
-        const error = await response.json().catch(() => ({}));
+        const error = (await response.json().catch(() => ({})));
         const errorCode = error.error || error.code;
         if (errorCode === 'authorization_pending') {
             continue;

package/dist/util/token-storage.js

@@ -5,7 +5,7 @@ import { getDomain } from './domain-urls.js';
 const getQuonfigDir = (options) => options?.quonfigDir || path.join(os.homedir(), '.quonfig');
 const getTokenFile = (options) => {
     const domain = getDomain();
-    const filename = domain !== 'quonfig.com' ? `tokens-${domain.replaceAll('.', '-')}.json` : 'tokens.json';
+    const filename = domain === 'quonfig.com' ? 'tokens.json' : `tokens-${domain.replaceAll('.', '-')}.json`;
     return path.join(getQuonfigDir(options), filename);
 };
 const getConfigFile = (options) => path.join(getQuonfigDir(options), 'config');
@@ -86,7 +86,7 @@ export const loadAuthConfig = async (options) => {
             config.defaultProfile = defaultMatch[1].trim();
         }
         // Parse profiles — each block starts with [profile name] and contains key=value lines
-        const profileBlockRegex = /\[profile\s+(\w+)]\s*\n((?:[^\[]*\n?)*)/g;
+        const profileBlockRegex = /\[profile\s+(\w+)]\s*\n((?:[^[]*\n?)*)/g;
         let match;
         while ((match = profileBlockRegex.exec(data)) !== null) {
             const profileName = match[1];

package/dist/verify/standalone.d.ts

@@ -1,4 +1,3 @@
-#!/usr/bin/env node
 /**
  * Standalone workspace validator.
  *

package/dist/verify/standalone.js

@@ -1,4 +1,3 @@
-#!/usr/bin/env node
 /**
  * Standalone workspace validator.
  *
@@ -11,19 +10,19 @@
  *   0  All checks pass
  *   1  Validation errors found
  */
-import { execSync } from "node:child_process";
-import * as readline from "node:readline";
-import { formatResult, validateFileMap, validateWorkspace } from "./validate.js";
+import { execSync } from 'node:child_process';
+import * as readline from 'node:readline';
+import { formatResult, validateFileMap, validateWorkspace } from './validate.js';
 async function main() {
     const args = process.argv.slice(2);
-    if (args.includes("--git-hook")) {
+    if (args.includes('--git-hook')) {
         await runGitHook();
     }
-    else if (args.includes("--help") || args.includes("-h")) {
+    else if (args.includes('--help') || args.includes('-h')) {
         printUsage();
     }
     else {
-        const dir = args[0] || ".";
+        const dir = args[0] || '.';
         runDiskValidation(dir);
     }
 }
@@ -55,23 +54,23 @@ async function runGitHook() {
     // Read all of stdin (ref lines). Use callback API for bun compatibility.
     await new Promise((resolve) => {
         const rl = readline.createInterface({ input: process.stdin });
-        rl.on("line", (line) => {
-            const parts = line.trim().split(" ");
+        rl.on('line', (line) => {
+            const parts = line.trim().split(' ');
             if (parts.length >= 3) {
                 refs.push({ oldOid: parts[0], newOid: parts[1], refName: parts[2] });
             }
         });
-        rl.on("close", resolve);
+        rl.on('close', resolve);
     });
     if (refs.length === 0) {
-        console.log("qfg-verify: no refs received");
+        console.log('qfg-verify: no refs received');
         process.exit(0);
     }
     // Validate the latest pushed commit for each ref
     let hasErrors = false;
     for (const ref of refs) {
         // Skip deletions
-        if (ref.newOid === "0000000000000000000000000000000000000000")
+        if (ref.newOid === '0000000000000000000000000000000000000000')
             continue;
         console.log(`qfg-verify: validating ${ref.refName} (${ref.newOid.slice(0, 8)})`);
         try {
@@ -82,8 +81,8 @@ async function runGitHook() {
                 hasErrors = true;
             }
         }
-        catch (err) {
-            console.error(`qfg-verify: error reading commit ${ref.newOid}: ${err.message}`);
+        catch (error) {
+            console.error(`qfg-verify: error reading commit ${ref.newOid}: ${error.message}`);
             hasErrors = true;
         }
     }
@@ -95,28 +94,28 @@ async function runGitHook() {
  */
 function readFilesFromCommit(commitOid) {
     const files = new Map();
-    const dirs = ["configs", "feature-flags", "segments", "log-levels", "schemas", "schemas-protected"];
+    const dirs = ['configs', 'feature-flags', 'segments', 'log-levels', 'schemas', 'schemas-protected'];
     for (const dir of dirs) {
         // List files in this directory at the given commit
         let listing;
         try {
             listing = execSync(`git ls-tree --name-only ${commitOid} ${dir}/`, {
-                encoding: "utf-8",
-                stdio: ["pipe", "pipe", "pipe"],
+                encoding: 'utf8',
+                stdio: ['pipe', 'pipe', 'pipe'],
             });
         }
         catch {
             // Directory doesn't exist in this commit
             continue;
         }
-        const filenames = listing.trim().split("\n").filter(Boolean);
+        const filenames = listing.trim().split('\n').filter(Boolean);
         for (const filePath of filenames) {
-            if (!filePath.endsWith(".json") || filePath.includes("/."))
+            if (!filePath.endsWith('.json') || filePath.includes('/.'))
                 continue;
             try {
                 const content = execSync(`git show ${commitOid}:${filePath}`, {
-                    encoding: "utf-8",
-                    stdio: ["pipe", "pipe", "pipe"],
+                    encoding: 'utf8',
+                    stdio: ['pipe', 'pipe', 'pipe'],
                 });
                 files.set(filePath, content);
             }
@@ -127,7 +126,7 @@ function readFilesFromCommit(commitOid) {
     }
     return files;
 }
-main().catch((err) => {
-    console.error(`qfg-verify: fatal: ${err.message}`);
+main().catch((error) => {
+    console.error(`qfg-verify: fatal: ${error.message}`);
     process.exit(1);
 });