@quonfig/cli 0.0.35 → 0.0.37

package/README.md

@@ -14,7 +14,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.35 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.37 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -91,7 +91,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -176,7 +176,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -222,7 +222,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -425,7 +425,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -448,7 +448,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -480,7 +480,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/get.ts)_
 
 ## `qfg info [NAME]`
 
@@ -528,7 +528,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -568,7 +568,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -598,7 +598,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -638,7 +638,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/list.ts)_
 
 ## `qfg log-level NAME`
 
@@ -703,7 +703,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -728,7 +728,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -751,7 +751,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -805,7 +805,7 @@ EXAMPLES
   $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -843,7 +843,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -875,7 +875,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -906,7 +906,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -961,7 +961,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1008,7 +1008,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1056,7 +1056,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/push.ts)_
 
 ## `qfg schema NAME`
 
@@ -1094,7 +1094,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1121,7 +1121,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1153,7 +1153,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1182,7 +1182,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1209,7 +1209,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1280,7 +1280,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -1357,7 +1357,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -1389,7 +1389,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -1491,7 +1491,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -1514,7 +1514,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -1537,7 +1537,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -1570,7 +1570,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -1604,7 +1604,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -1632,7 +1632,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.35/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.37/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/commands/push.js

@@ -3,7 +3,7 @@ import * as path from 'node:path';
 import { Flags } from '@oclif/core';
 import { BaseCommand } from '../index.js';
 import { mintGiteaToken } from '../util/gitea-api.js';
-import { dirtyTrackedFiles, getRemoteUrl, gitFetch, gitSetRemote, isGitRepo, isLocalBehindOrDivergedFromRemote, runGit } from '../util/git-ops.js';
+import { dirtyTrackedFiles, getOriginMainSha, getRemoteUrl, gitFetch, gitSetRemote, isGitRepo, isLocalBehindOrDivergedFromRemote, runGit } from '../util/git-ops.js';
 import { PushFatalError, runPush, } from '../push/run-push.js';
 import { computeBarePathDiff } from '../push/bare-path-diff.js';
 import { callConfigsPush } from '../push/config-push-client.js';
@@ -225,6 +225,14 @@ export function buildRealDeps(cmd, orgSlug) {
                 return [];
             }
         },
+        async getOriginMainSha(dir) {
+            // qfg-gj3i: clone-path returns the local origin/main SHA after
+            // fetch. Bare path has no `.git/` to rev-parse — return undefined
+            // and let the server apply its bare-path lock policy.
+            if (!(await isGitRepo(dir)))
+                return undefined;
+            return getOriginMainSha(dir);
+        },
     };
     const deps = {
         async mintWriteToken(requestedTarget) {

package/dist/migrate/sources/launch/translate.d.ts

@@ -19,12 +19,14 @@ export declare function normalizeLogLevelKey(key: string): string;
  */
 export declare function normalizeKey(key: string): string;
 /**
- * qfg-l18w: Operators Quonfig accepts in rule criteria. Mirrors the
- * `OperatorSchema` enum in cli/src/verify/validate.ts (and app-quonfig's
- * config-schemas.ts). If we emit an operator outside this set, qfg verify
- * fails — which is what was happening for `PROP_SEMVER_*` in the FormHealth
- * dry-run before this check existed. Keep this list in lockstep with the
- * verify schema; a CI test in this file enforces parity.
+ * qfg-l18w / qfg-0q1f: Operators Quonfig accepts in rule criteria. Mirrors
+ * the `OperatorSchema` enum in cli/src/verify/validate.ts (and app-quonfig's
+ * config-schemas.ts). All currently-known Launch operators are supported;
+ * this allowlist guards against future Launch additions Quonfig hasn't
+ * implemented yet — emitting an unrecognized operator would otherwise be
+ * caught only at qfg verify time, after the migrator has already written
+ * a broken file. Keep this list in lockstep with the verify schema; a CI
+ * test in this file enforces parity.
  */
 export declare const QUONFIG_SUPPORTED_OPERATORS: Set<string>;
 export declare function transformConfig(config: LaunchConfig, envIdMap: Record<string, string>, onDroppedEnv?: (envId: string) => void, onCoercedSentinel?: (envId: string, valueType: string) => void): Record<string, unknown>;

package/dist/migrate/sources/launch/translate.js

@@ -33,12 +33,14 @@ export function normalizeKey(key) {
     return key.replaceAll('/', '.');
 }
 /**
- * qfg-l18w: Operators Quonfig accepts in rule criteria. Mirrors the
- * `OperatorSchema` enum in cli/src/verify/validate.ts (and app-quonfig's
- * config-schemas.ts). If we emit an operator outside this set, qfg verify
- * fails — which is what was happening for `PROP_SEMVER_*` in the FormHealth
- * dry-run before this check existed. Keep this list in lockstep with the
- * verify schema; a CI test in this file enforces parity.
+ * qfg-l18w / qfg-0q1f: Operators Quonfig accepts in rule criteria. Mirrors
+ * the `OperatorSchema` enum in cli/src/verify/validate.ts (and app-quonfig's
+ * config-schemas.ts). All currently-known Launch operators are supported;
+ * this allowlist guards against future Launch additions Quonfig hasn't
+ * implemented yet — emitting an unrecognized operator would otherwise be
+ * caught only at qfg verify time, after the migrator has already written
+ * a broken file. Keep this list in lockstep with the verify schema; a CI
+ * test in this file enforces parity.
  */
 export const QUONFIG_SUPPORTED_OPERATORS = new Set([
     'ALWAYS_TRUE',
@@ -54,6 +56,9 @@ export const QUONFIG_SUPPORTED_OPERATORS = new Set([
     'PROP_LESS_THAN_OR_EQUAL',
     'PROP_GREATER_THAN',
     'PROP_GREATER_THAN_OR_EQUAL',
+    'PROP_SEMVER_LESS_THAN',
+    'PROP_SEMVER_EQUAL',
+    'PROP_SEMVER_GREATER_THAN',
     'PROP_BEFORE',
     'PROP_AFTER',
     'PROP_MATCHES',
@@ -66,12 +71,10 @@ export const QUONFIG_SUPPORTED_OPERATORS = new Set([
 ]);
 /**
  * qfg-l18w: Walk every rule criterion in a transformed config and fail-fast at
- * migrate time if it carries an operator Quonfig does not understand. The
- * primary offender today is `PROP_SEMVER_*` (Launch supports semver
- * comparisons; Quonfig does not have a semver operator at all). Without this
- * check the migrator silently writes invalid JSON and the failure surfaces
- * later at qfg-verify — the customer's local file is broken and re-runs
- * re-clobber any manual fix.
+ * migrate time if it carries an operator Quonfig does not understand. Without
+ * this check the migrator would silently write invalid JSON and the failure
+ * would only surface later at qfg-verify — leaving the customer's local file
+ * broken and re-runs re-clobbering any manual fix.
  *
  * Routes through `InvalidSourceConfigError` so the failure is per-config (the
  * rest of the run still produces a usable workspace, and the offending key

package/dist/push/run-push.d.ts

@@ -59,6 +59,16 @@ export interface GitOps {
      * files are excluded — same rule as `dirtyTrackedFiles` in git-ops.ts.
      */
     dirtyTrackedFiles(dir: string): Promise<string[]>;
+    /**
+     * Returns the local SHA of `origin/main` after fetch — the remote tip
+     * the diff was computed against — or undefined if no `origin/main` ref
+     * exists (bare-path push, or repo never fetched).
+     *
+     * Threaded into the `configs.push` call as `expectedSha` so the
+     * server-side optimistic lock (qfg-gj3i) can reject pushes whose
+     * origin moved between fetch and push.
+     */
+    getOriginMainSha(dir: string): Promise<string | undefined>;
     /** Set origin to `url` (add if missing, set-url if present). */
     setRemoteOrigin(dir: string, url: string): Promise<void>;
 }

package/dist/push/run-push.js

@@ -218,11 +218,17 @@ export async function runPush(input, deps) {
         ...(d.beforeJson === undefined ? {} : { beforeJson: d.beforeJson }),
         ...(d.afterJson === undefined ? {} : { afterJson: d.afterJson }),
     }));
+    // qfg-gj3i: pass origin/main SHA as expectedSha so the server-side
+    // optimistic lock can reject the push if origin moved between fetch
+    // and now. Undefined on bare-path; the server treats absence as
+    // "non-clone client" and applies its bare-path policy.
+    const expectedSha = await deps.gitOps.getOriginMainSha(input.dir);
     log('Sending push to Quonfig cloud...');
     const result = await deps.pushToServer({
         workspaceId: backend.workspaceId,
         files: serverFiles,
         message: commitMessage,
+        ...(expectedSha === undefined ? {} : { expectedSha }),
     });
     if (result.kind === 'denied') {
         errLog(`Push denied for ${result.denials.length} file(s):`);

package/dist/util/git-ops.d.ts

@@ -160,3 +160,19 @@ export type GitPullRebaseResult = {
  * only reports the outcome.
  */
 export declare const gitPullRebase: (dir: string) => Promise<GitPullRebaseResult>;
+/**
+ * Returns the local SHA of `origin/main` (i.e. the remote tip we last
+ * fetched), or undefined if the repo has no `origin/main` ref.
+ *
+ * Used as the `expectedSha` passed to the server-side `configs.push`
+ * optimistic lock (qfg-gj3i): the server compares the value we send
+ * against the current Gitea workspace HEAD and rejects the push if
+ * origin advanced between fetch and push. Belt-and-suspenders next to
+ * the CLI-side stale-HEAD guard from qfg-fboj — closes the gap for
+ * non-CLI clients and CLI regressions.
+ *
+ * Returns undefined on bare-path pushes (no `.git/`) and on any git
+ * error so the caller can fall back to other locks rather than aborting
+ * on an opaque rev-parse failure.
+ */
+export declare const getOriginMainSha: (dir: string) => Promise<string | undefined>;

package/dist/util/git-ops.js

@@ -392,3 +392,28 @@ export const gitPullRebase = async (dir) => {
         return { kind: 'failed', reason };
     }
 };
+/**
+ * Returns the local SHA of `origin/main` (i.e. the remote tip we last
+ * fetched), or undefined if the repo has no `origin/main` ref.
+ *
+ * Used as the `expectedSha` passed to the server-side `configs.push`
+ * optimistic lock (qfg-gj3i): the server compares the value we send
+ * against the current Gitea workspace HEAD and rejects the push if
+ * origin advanced between fetch and push. Belt-and-suspenders next to
+ * the CLI-side stale-HEAD guard from qfg-fboj — closes the gap for
+ * non-CLI clients and CLI regressions.
+ *
+ * Returns undefined on bare-path pushes (no `.git/`) and on any git
+ * error so the caller can fall back to other locks rather than aborting
+ * on an opaque rev-parse failure.
+ */
+export const getOriginMainSha = async (dir) => {
+    try {
+        const { stdout } = await runGit(['-C', dir, 'rev-parse', 'origin/main']);
+        const sha = stdout.trim();
+        return sha.length > 0 ? sha : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};

package/dist/verify/validate.js

@@ -42,6 +42,9 @@ const OperatorSchema = z.enum([
     'PROP_LESS_THAN_OR_EQUAL',
     'PROP_GREATER_THAN',
     'PROP_GREATER_THAN_OR_EQUAL',
+    'PROP_SEMVER_LESS_THAN',
+    'PROP_SEMVER_EQUAL',
+    'PROP_SEMVER_GREATER_THAN',
     'PROP_BEFORE',
     'PROP_AFTER',
     'PROP_MATCHES',
@@ -169,6 +172,9 @@ const PROPERTY_OPERATORS = new Set([
     'PROP_LESS_THAN_OR_EQUAL',
     'PROP_GREATER_THAN',
     'PROP_GREATER_THAN_OR_EQUAL',
+    'PROP_SEMVER_LESS_THAN',
+    'PROP_SEMVER_EQUAL',
+    'PROP_SEMVER_GREATER_THAN',
     'PROP_BEFORE',
     'PROP_AFTER',
     'PROP_MATCHES',

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.35";
+declare const _default: "0.0.37";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.35';
+export default '0.0.37';

package/oclif.manifest.json

@@ -2916,5 +2916,5 @@
       ]
     }
   },
-  "version": "0.0.35"
+  "version": "0.0.37"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.35",
+  "version": "0.0.37",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },