@quonfig/cli 0.0.64 → 0.0.66

package/dist/verify/validate.js

@@ -9,7 +9,8 @@
  *  - Valid JSON
  *  - Schema compliance (StoredConfigSchema from Zod)
  *  - Key matches filename
- *  - Key constraints (1-512 chars, no slashes, not "new")
+ *  - Key constraints (1-200 chars, no slashes, not "new", FS-safety floor)
+ *  - Case-insensitive key uniqueness (no Foo/foo collisions)
  *  - Config type matches directory
  *  - Segment constraints (valueType=bool, sendToClientSdk=false)
  *  - Log level constraints (valueType=log_level)
@@ -552,40 +553,11 @@ export function validateWorkspace(workspaceDir) {
             }
         }
     }
-    // Check for duplicate keys across directories
-    const keyToFiles = new Map();
-    for (const c of allConfigs) {
-        const existing = keyToFiles.get(c.key) || [];
-        existing.push(c.file);
-        keyToFiles.set(c.key, existing);
-    }
-    for (const [key, files] of keyToFiles) {
-        if (files.length > 1) {
-            issues.push({
-                file: files.join(', '),
-                message: `Duplicate key "${key}" found in multiple files`,
-                severity: 'error',
-                suggestion: `Each key must be unique across the workspace`,
-            });
-        }
-    }
-    const schemaKeyToFiles = new Map();
-    for (const schemaFile of allSchemaFiles) {
-        const existing = schemaKeyToFiles.get(schemaFile.key) || [];
-        existing.push(schemaFile.file);
-        schemaKeyToFiles.set(schemaFile.key, existing);
-    }
-    for (const [key, files] of schemaKeyToFiles) {
-        if (files.length > 1) {
-            issues.push({
-                file: files.join(', '),
-                message: `Duplicate schema key "${key}" found in multiple files`,
-                severity: 'error',
-                suggestion: `Each schema key must be unique across schema directories`,
-            });
-        }
-    }
-    stats.uniqueKeysVerified = keyToFiles.size + schemaKeyToFiles.size;
+    // Check for duplicate keys across directories (case-insensitive — see
+    // detectDuplicateKeys).
+    const uniqueConfigKeys = detectDuplicateKeys(allConfigs, 'key', issues);
+    const uniqueSchemaKeys = detectDuplicateKeys(allSchemaFiles, 'schema key', issues);
+    stats.uniqueKeysVerified = uniqueConfigKeys + uniqueSchemaKeys;
     const hasErrors = issues.some((i) => i.severity === 'error');
     return { issues, filesChecked, valid: !hasErrors, stats };
 }
@@ -800,37 +772,9 @@ export function validateFileMap(files) {
             }
         }
     }
-    // Duplicate keys
-    const keyToFiles = new Map();
-    for (const c of allConfigs) {
-        const existing = keyToFiles.get(c.key) || [];
-        existing.push(c.file);
-        keyToFiles.set(c.key, existing);
-    }
-    for (const [key, fileList] of keyToFiles) {
-        if (fileList.length > 1) {
-            issues.push({
-                file: fileList.join(', '),
-                message: `Duplicate key "${key}" found in multiple files`,
-                severity: 'error',
-            });
-        }
-    }
-    const schemaKeyToFiles = new Map();
-    for (const schemaFile of allSchemaFiles) {
-        const existing = schemaKeyToFiles.get(schemaFile.key) || [];
-        existing.push(schemaFile.file);
-        schemaKeyToFiles.set(schemaFile.key, existing);
-    }
-    for (const [key, fileList] of schemaKeyToFiles) {
-        if (fileList.length > 1) {
-            issues.push({
-                file: fileList.join(', '),
-                message: `Duplicate schema key "${key}" found in multiple files`,
-                severity: 'error',
-            });
-        }
-    }
+    // Duplicate keys (case-insensitive — see detectDuplicateKeys).
+    detectDuplicateKeys(allConfigs, 'key', issues);
+    detectDuplicateKeys(allSchemaFiles, 'schema key', issues);
     const hasErrors = issues.some((i) => i.severity === 'error');
     return { issues, filesChecked, valid: !hasErrors, stats: emptyStats() };
 }
@@ -855,12 +799,43 @@ function validateEnvironmentIds(environments, file, issues) {
         }
     }
 }
-function validateKey(key, file, issues) {
+// FS-safety floor checks (qfg-6na9.4). These are the names that pass the loose
+// historical rule but produce a file that cannot be cloned/checked-out on a
+// customer machine (macOS/Windows). The audit (project/plans/26-06-tighter-naming.md,
+// "FS-safety floor") found ZERO existing violations, so every one is a hard
+// error from day one.
+//
+// IMPORTANT: this floor must stay conceptually in lockstep with app-quonfig's
+// src/lib/domain/config-schemas.ts (the charset precedent there is
+// `SchemaKeySchema`; Policy A is `PolicyAKeySchema`). The general charset check
+// (`^[A-Za-z0-9._-]+$`) is deliberately NOT here — it ships separately as a
+// warning (bead qfg-6na9.5). This module is the FS-floor + dedup only.
+//
+// Structured as a table so severity is trivially adjustable later.
+const FS_SAFETY_FLOOR_CHECKS = [
+    { test: (k) => k.startsWith('.'), message: `Key has a leading dot (files starting with "." are skipped by verify)` },
+    // eslint-disable-next-line no-control-regex -- matching control chars/NUL is the point
+    { test: (k) => /[\u0000-\u001F\u007F]/.test(k), message: `Key contains control chars or NUL` },
+    { test: (k) => /["*:<>?|]/.test(k), message: `Key contains Windows-reserved chars (: * ? " < > |)` },
+    {
+        test: (k) => /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(k.split('.')[0]),
+        message: `Key is a Windows reserved device name (con/prn/aux/nul/com1-9/lpt1-9)`,
+    },
+    { test: (k) => /[ .]$/.test(k), message: `Key has a trailing dot or space (silently stripped on Windows)` },
+];
+// Exported so the FS-safety floor (incl. the leading-dot rule, whose files are
+// pre-filtered by the directory walk before they'd reach the file-map path) can
+// be unit-tested directly.
+export function validateKey(key, file, issues) {
+    const errorsBefore = issues.length;
     if (key.length === 0) {
         issues.push({ file, message: `Key is empty`, severity: 'error' });
     }
-    if (key.length > 512) {
-        issues.push({ file, message: `Key exceeds 512 characters (${key.length})`, severity: 'error' });
+    // Length cap lowered 512 -> 200 (project/plans/26-06-tighter-naming.md,
+    // "Length cap: 200"): ASCII-only Policy A means 200 chars == 200 bytes, well
+    // under the 255-byte filesystem path-component limit even with `.json`.
+    if (key.length > 200) {
+        issues.push({ file, message: `Key exceeds 200 characters (${key.length})`, severity: 'error' });
     }
     if (key === 'new') {
         issues.push({ file, message: `Key cannot be "new" (reserved)`, severity: 'error' });
@@ -868,6 +843,71 @@ function validateKey(key, file, issues) {
     if (/[/\\]/.test(key)) {
         issues.push({ file, message: `Key contains slash or backslash`, severity: 'error' });
     }
+    for (const check of FS_SAFETY_FLOOR_CHECKS) {
+        if (check.test(key)) {
+            issues.push({ file, message: check.message, severity: 'error' });
+        }
+    }
+    // qfg-6na9.5: the general Policy A charset as a WARNING — the warn stage of the
+    // warn->error soak (project/plans/26-06-tighter-naming.md). A config that trips
+    // this must STILL push, so severity is 'warning' (does not set result.valid =
+    // false); qfg-6na9.6 will flip it to a hard error after a clean soak. The
+    // charset `^[A-Za-z0-9._-]+$` is kept in sync with app-quonfig's
+    // PolicyAKeySchema (hard at create). Skipped when this key already earned a
+    // hard error above (e.g. a Windows-reserved char is both a floor error AND a
+    // charset miss) so we don't double-report the same key.
+    // eslint-disable-next-line unicorn/better-regex -- keep the explicit charset in sync with app-quonfig
+    if (issues.length === errorsBefore && !/^[A-Za-z0-9._-]+$/.test(key)) {
+        issues.push({
+            file,
+            message: `Key "${key}" has characters outside the allowed set (letters, numbers, ".", "-", "_"). This will become a hard error in a future release — rename it to conform.`,
+            severity: 'warning',
+            suggestion: `Rename to use only letters, numbers, ".", "-", and "_"`,
+        });
+    }
+}
+// Case-insensitive duplicate-key detection (qfg-6na9.4,
+// project/plans/26-06-tighter-naming.md "Case-insensitive uniqueness").
+// `Foo` and `foo` are distinct keys server-side (case-sensitive Linux ext4) but
+// collide to one file on a case-insensitive macOS/Windows clone, silently
+// dropping a config. Group by the DOWNCASED key and branch the message:
+//   - all original keys byte-identical -> exact-duplicate message
+//   - they differ only by case        -> case-collision message
+// The audit found 0 such collisions today, so this is a hard error from day one.
+function detectDuplicateKeys(entries, label, issues) {
+    const byLowercase = new Map();
+    for (const e of entries) {
+        const lower = e.key.toLowerCase();
+        const existing = byLowercase.get(lower) || [];
+        existing.push(e);
+        byLowercase.set(lower, existing);
+    }
+    for (const group of byLowercase.values()) {
+        if (group.length <= 1)
+            continue;
+        const files = group.map((g) => g.file).join(', ');
+        const originalKeys = group.map((g) => g.key);
+        const allIdentical = originalKeys.every((k) => k === originalKeys[0]);
+        if (allIdentical) {
+            issues.push({
+                file: files,
+                message: `Duplicate ${label} "${originalKeys[0]}" found in multiple files`,
+                severity: 'error',
+                suggestion: label === 'schema key'
+                    ? `Each schema key must be unique across schema directories`
+                    : `Each key must be unique across the workspace`,
+            });
+        }
+        else {
+            issues.push({
+                file: files,
+                message: `Keys differ only by case (${originalKeys.join(', ')}); they collide to one file on case-insensitive filesystems (macOS/Windows)`,
+                severity: 'error',
+                suggestion: `Rename so the ${label}s are also unique when lowercased`,
+            });
+        }
+    }
+    return byLowercase.size;
 }
 function validateRules(rules, file, context, expectedValueType, issues, variants = []) {
     if (rules.length === 0) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.64";
+declare const _default: "0.0.66";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.64';
+export default '0.0.66';