@quonfig/cli 0.0.63 → 0.0.65

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.63 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.65 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -201,7 +201,7 @@ EXAMPLES
   $ qfg activity restore my.flag --yes
 ```
 
-_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/activity.ts)_
+_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity.ts)_
 
 ## `qfg activity deleted`
 
@@ -230,7 +230,7 @@ EXAMPLES
   $ qfg activity deleted --json
 ```
 
-_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/activity/deleted.ts)_
+_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/deleted.ts)_
 
 ## `qfg activity feed`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ qfg activity feed --json
 ```
 
-_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/activity/feed.ts)_
+_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/feed.ts)_
 
 ## `qfg activity history [NAME]`
 
@@ -299,7 +299,7 @@ EXAMPLES
   $ qfg activity history request.timeout --json
 ```
 
-_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/activity/history.ts)_
+_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/history.ts)_
 
 ## `qfg activity restore [NAME]`
 
@@ -338,7 +338,7 @@ EXAMPLES
   $ qfg activity restore request.timeout --type config --yes
 ```
 
-_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/activity/restore.ts)_
+_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/restore.ts)_
 
 ## `qfg audit-log [NAME]`
 
@@ -366,7 +366,7 @@ EXAMPLES
   $ qfg audit-log my.flag
 ```
 
-_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/audit-log.ts)_
+_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/audit-log.ts)_
 
 ## `qfg cleanup`
 
@@ -407,7 +407,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key
 ```
 
-_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/cleanup.ts)_
+_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup.ts)_
 
 ## `qfg cleanup list`
 
@@ -453,7 +453,7 @@ EXAMPLES
   $ qfg cleanup list --json
 ```
 
-_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/cleanup/list.ts)_
+_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/list.ts)_
 
 ## `qfg cleanup remove [NAME]`
 
@@ -498,7 +498,7 @@ EXAMPLES
   $ qfg cleanup remove my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/cleanup/remove.ts)_
+_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/remove.ts)_
 
 ## `qfg cleanup status [NAME]`
 
@@ -538,7 +538,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/cleanup/status.ts)_
+_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/status.ts)_
 
 ## `qfg cleanup verify [NAME]`
 
@@ -584,7 +584,7 @@ EXAMPLES
   $ qfg cleanup verify my.flag.key && qfg delete my.flag.key
 ```
 
-_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/cleanup/verify.ts)_
+_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/verify.ts)_
 
 ## `qfg config-schema`
 
@@ -613,7 +613,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -700,7 +700,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -746,7 +746,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -950,7 +950,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -973,7 +973,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/get.ts)_
 
 ## `qfg history NAME`
 
@@ -1031,7 +1031,7 @@ EXAMPLES
   $ qfg history my.flag
 ```
 
-_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/history.ts)_
+_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/history.ts)_
 
 ## `qfg info [NAME]`
 
@@ -1079,7 +1079,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -1119,7 +1119,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -1149,7 +1149,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -1189,7 +1189,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/list.ts)_
 
 ## `qfg log`
 
@@ -1214,7 +1214,7 @@ EXAMPLES
   $ qfg log --limit 5
 ```
 
-_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/log.ts)_
+_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/log.ts)_
 
 ## `qfg log-level NAME`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -1304,7 +1304,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -1327,7 +1327,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -1390,7 +1390,7 @@ EXAMPLES
   $ qfg migrate --from launch --source-api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -1428,7 +1428,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -1460,7 +1460,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -1491,7 +1491,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -1546,7 +1546,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1594,7 +1594,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1643,7 +1643,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/push.ts)_
 
 ## `qfg run [COMMAND]`
 
@@ -1694,7 +1694,7 @@ EXAMPLES
   $ qfg run --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test
 ```
 
-_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/run.ts)_
+_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/run.ts)_
 
 ## `qfg schema NAME`
 
@@ -1732,7 +1732,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1759,7 +1759,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1791,7 +1791,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1820,7 +1820,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1847,7 +1847,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg serve`
 
@@ -1904,7 +1904,7 @@ EXAMPLES
   $ qfg serve --port 6581 --frontend-sdk-key PUBLIC_KEY
 ```
 
-_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/serve.ts)_
+_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/serve.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1975,7 +1975,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -2052,7 +2052,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -2084,7 +2084,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -2186,7 +2186,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -2209,7 +2209,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -2232,7 +2232,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -2265,7 +2265,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -2299,7 +2299,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -2327,7 +2327,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.63/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/migrate/quonfig-target/ruleset.js

@@ -83,8 +83,11 @@ export function clauseToCriterion(clause, ctx) {
         return null;
     }
     const { operator } = mapping;
-    const propertyName = normalizeAttribute(clause.contextKind, clause.attribute);
-    const criterion = { operator, propertyName };
+    // Segment matches key off valueToMatch alone — LD's pseudo-attribute
+    // ("segmentMatch") must not leak in as a propertyName (qfg-gc3u).
+    const criterion = operator === 'IN_SEG' || operator === 'NOT_IN_SEG'
+        ? { operator }
+        : { operator, propertyName: normalizeAttribute(clause.contextKind, clause.attribute) };
     criterion.valueToMatch = valueToMatchFor(operator, clause, ctx);
     return criterion;
 }

package/dist/verify/validate.d.ts

@@ -9,7 +9,8 @@
  *  - Valid JSON
  *  - Schema compliance (StoredConfigSchema from Zod)
  *  - Key matches filename
- *  - Key constraints (1-512 chars, no slashes, not "new")
+ *  - Key constraints (1-200 chars, no slashes, not "new", FS-safety floor)
+ *  - Case-insensitive key uniqueness (no Foo/foo collisions)
  *  - Config type matches directory
  *  - Segment constraints (valueType=bool, sendToClientSdk=false)
  *  - Log level constraints (valueType=log_level)
@@ -55,4 +56,5 @@ export declare function validateWorkspace(workspaceDir: string): ValidationResul
  * Used by the pre-receive hook which reads files from git objects.
  */
 export declare function validateFileMap(files: Map<string, string>): ValidationResult;
+export declare function validateKey(key: string, file: string, issues: ValidationIssue[]): void;
 export declare function formatResult(result: ValidationResult): string;

package/dist/verify/validate.js

@@ -9,7 +9,8 @@
  *  - Valid JSON
  *  - Schema compliance (StoredConfigSchema from Zod)
  *  - Key matches filename
- *  - Key constraints (1-512 chars, no slashes, not "new")
+ *  - Key constraints (1-200 chars, no slashes, not "new", FS-safety floor)
+ *  - Case-insensitive key uniqueness (no Foo/foo collisions)
  *  - Config type matches directory
  *  - Segment constraints (valueType=bool, sendToClientSdk=false)
  *  - Log level constraints (valueType=log_level)
@@ -552,40 +553,11 @@ export function validateWorkspace(workspaceDir) {
             }
         }
     }
-    // Check for duplicate keys across directories
-    const keyToFiles = new Map();
-    for (const c of allConfigs) {
-        const existing = keyToFiles.get(c.key) || [];
-        existing.push(c.file);
-        keyToFiles.set(c.key, existing);
-    }
-    for (const [key, files] of keyToFiles) {
-        if (files.length > 1) {
-            issues.push({
-                file: files.join(', '),
-                message: `Duplicate key "${key}" found in multiple files`,
-                severity: 'error',
-                suggestion: `Each key must be unique across the workspace`,
-            });
-        }
-    }
-    const schemaKeyToFiles = new Map();
-    for (const schemaFile of allSchemaFiles) {
-        const existing = schemaKeyToFiles.get(schemaFile.key) || [];
-        existing.push(schemaFile.file);
-        schemaKeyToFiles.set(schemaFile.key, existing);
-    }
-    for (const [key, files] of schemaKeyToFiles) {
-        if (files.length > 1) {
-            issues.push({
-                file: files.join(', '),
-                message: `Duplicate schema key "${key}" found in multiple files`,
-                severity: 'error',
-                suggestion: `Each schema key must be unique across schema directories`,
-            });
-        }
-    }
-    stats.uniqueKeysVerified = keyToFiles.size + schemaKeyToFiles.size;
+    // Check for duplicate keys across directories (case-insensitive — see
+    // detectDuplicateKeys).
+    const uniqueConfigKeys = detectDuplicateKeys(allConfigs, 'key', issues);
+    const uniqueSchemaKeys = detectDuplicateKeys(allSchemaFiles, 'schema key', issues);
+    stats.uniqueKeysVerified = uniqueConfigKeys + uniqueSchemaKeys;
     const hasErrors = issues.some((i) => i.severity === 'error');
     return { issues, filesChecked, valid: !hasErrors, stats };
 }
@@ -800,37 +772,9 @@ export function validateFileMap(files) {
             }
         }
     }
-    // Duplicate keys
-    const keyToFiles = new Map();
-    for (const c of allConfigs) {
-        const existing = keyToFiles.get(c.key) || [];
-        existing.push(c.file);
-        keyToFiles.set(c.key, existing);
-    }
-    for (const [key, fileList] of keyToFiles) {
-        if (fileList.length > 1) {
-            issues.push({
-                file: fileList.join(', '),
-                message: `Duplicate key "${key}" found in multiple files`,
-                severity: 'error',
-            });
-        }
-    }
-    const schemaKeyToFiles = new Map();
-    for (const schemaFile of allSchemaFiles) {
-        const existing = schemaKeyToFiles.get(schemaFile.key) || [];
-        existing.push(schemaFile.file);
-        schemaKeyToFiles.set(schemaFile.key, existing);
-    }
-    for (const [key, fileList] of schemaKeyToFiles) {
-        if (fileList.length > 1) {
-            issues.push({
-                file: fileList.join(', '),
-                message: `Duplicate schema key "${key}" found in multiple files`,
-                severity: 'error',
-            });
-        }
-    }
+    // Duplicate keys (case-insensitive — see detectDuplicateKeys).
+    detectDuplicateKeys(allConfigs, 'key', issues);
+    detectDuplicateKeys(allSchemaFiles, 'schema key', issues);
     const hasErrors = issues.some((i) => i.severity === 'error');
     return { issues, filesChecked, valid: !hasErrors, stats: emptyStats() };
 }
@@ -855,12 +799,42 @@ function validateEnvironmentIds(environments, file, issues) {
         }
     }
 }
-function validateKey(key, file, issues) {
+// FS-safety floor checks (qfg-6na9.4). These are the names that pass the loose
+// historical rule but produce a file that cannot be cloned/checked-out on a
+// customer machine (macOS/Windows). The audit (project/plans/26-06-tighter-naming.md,
+// "FS-safety floor") found ZERO existing violations, so every one is a hard
+// error from day one.
+//
+// IMPORTANT: this floor must stay conceptually in lockstep with app-quonfig's
+// src/lib/domain/config-schemas.ts (the charset precedent there is
+// `SchemaKeySchema`; Policy A is `PolicyAKeySchema`). The general charset check
+// (`^[A-Za-z0-9._-]+$`) is deliberately NOT here — it ships separately as a
+// warning (bead qfg-6na9.5). This module is the FS-floor + dedup only.
+//
+// Structured as a table so severity is trivially adjustable later.
+const FS_SAFETY_FLOOR_CHECKS = [
+    { test: (k) => k.startsWith('.'), message: `Key has a leading dot (files starting with "." are skipped by verify)` },
+    // eslint-disable-next-line no-control-regex -- matching control chars/NUL is the point
+    { test: (k) => /[\u0000-\u001F\u007F]/.test(k), message: `Key contains control chars or NUL` },
+    { test: (k) => /["*:<>?|]/.test(k), message: `Key contains Windows-reserved chars (: * ? " < > |)` },
+    {
+        test: (k) => /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(k.split('.')[0]),
+        message: `Key is a Windows reserved device name (con/prn/aux/nul/com1-9/lpt1-9)`,
+    },
+    { test: (k) => /[ .]$/.test(k), message: `Key has a trailing dot or space (silently stripped on Windows)` },
+];
+// Exported so the FS-safety floor (incl. the leading-dot rule, whose files are
+// pre-filtered by the directory walk before they'd reach the file-map path) can
+// be unit-tested directly.
+export function validateKey(key, file, issues) {
     if (key.length === 0) {
         issues.push({ file, message: `Key is empty`, severity: 'error' });
     }
-    if (key.length > 512) {
-        issues.push({ file, message: `Key exceeds 512 characters (${key.length})`, severity: 'error' });
+    // Length cap lowered 512 -> 200 (project/plans/26-06-tighter-naming.md,
+    // "Length cap: 200"): ASCII-only Policy A means 200 chars == 200 bytes, well
+    // under the 255-byte filesystem path-component limit even with `.json`.
+    if (key.length > 200) {
+        issues.push({ file, message: `Key exceeds 200 characters (${key.length})`, severity: 'error' });
     }
     if (key === 'new') {
         issues.push({ file, message: `Key cannot be "new" (reserved)`, severity: 'error' });
@@ -868,6 +842,54 @@ function validateKey(key, file, issues) {
     if (/[/\\]/.test(key)) {
         issues.push({ file, message: `Key contains slash or backslash`, severity: 'error' });
     }
+    for (const check of FS_SAFETY_FLOOR_CHECKS) {
+        if (check.test(key)) {
+            issues.push({ file, message: check.message, severity: 'error' });
+        }
+    }
+}
+// Case-insensitive duplicate-key detection (qfg-6na9.4,
+// project/plans/26-06-tighter-naming.md "Case-insensitive uniqueness").
+// `Foo` and `foo` are distinct keys server-side (case-sensitive Linux ext4) but
+// collide to one file on a case-insensitive macOS/Windows clone, silently
+// dropping a config. Group by the DOWNCASED key and branch the message:
+//   - all original keys byte-identical -> exact-duplicate message
+//   - they differ only by case        -> case-collision message
+// The audit found 0 such collisions today, so this is a hard error from day one.
+function detectDuplicateKeys(entries, label, issues) {
+    const byLowercase = new Map();
+    for (const e of entries) {
+        const lower = e.key.toLowerCase();
+        const existing = byLowercase.get(lower) || [];
+        existing.push(e);
+        byLowercase.set(lower, existing);
+    }
+    for (const group of byLowercase.values()) {
+        if (group.length <= 1)
+            continue;
+        const files = group.map((g) => g.file).join(', ');
+        const originalKeys = group.map((g) => g.key);
+        const allIdentical = originalKeys.every((k) => k === originalKeys[0]);
+        if (allIdentical) {
+            issues.push({
+                file: files,
+                message: `Duplicate ${label} "${originalKeys[0]}" found in multiple files`,
+                severity: 'error',
+                suggestion: label === 'schema key'
+                    ? `Each schema key must be unique across schema directories`
+                    : `Each key must be unique across the workspace`,
+            });
+        }
+        else {
+            issues.push({
+                file: files,
+                message: `Keys differ only by case (${originalKeys.join(', ')}); they collide to one file on case-insensitive filesystems (macOS/Windows)`,
+                severity: 'error',
+                suggestion: `Rename so the ${label}s are also unique when lowercased`,
+            });
+        }
+    }
+    return byLowercase.size;
 }
 function validateRules(rules, file, context, expectedValueType, issues, variants = []) {
     if (rules.length === 0) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.63";
+declare const _default: "0.0.65";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.63';
+export default '0.0.65';

package/oclif.manifest.json

@@ -4126,5 +4126,5 @@
       ]
     }
   },
-  "version": "0.0.63"
+  "version": "0.0.65"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.63",
+  "version": "0.0.65",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },