@quonfig/cli 0.0.65 → 0.0.66

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.65 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.66 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -201,7 +201,7 @@ EXAMPLES
   $ qfg activity restore my.flag --yes
 ```
 
-_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity.ts)_
+_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/activity.ts)_
 
 ## `qfg activity deleted`
 
@@ -230,7 +230,7 @@ EXAMPLES
   $ qfg activity deleted --json
 ```
 
-_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/deleted.ts)_
+_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/activity/deleted.ts)_
 
 ## `qfg activity feed`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ qfg activity feed --json
 ```
 
-_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/feed.ts)_
+_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/activity/feed.ts)_
 
 ## `qfg activity history [NAME]`
 
@@ -299,7 +299,7 @@ EXAMPLES
   $ qfg activity history request.timeout --json
 ```
 
-_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/history.ts)_
+_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/activity/history.ts)_
 
 ## `qfg activity restore [NAME]`
 
@@ -338,7 +338,7 @@ EXAMPLES
   $ qfg activity restore request.timeout --type config --yes
 ```
 
-_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/restore.ts)_
+_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/activity/restore.ts)_
 
 ## `qfg audit-log [NAME]`
 
@@ -366,7 +366,7 @@ EXAMPLES
   $ qfg audit-log my.flag
 ```
 
-_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/audit-log.ts)_
+_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/audit-log.ts)_
 
 ## `qfg cleanup`
 
@@ -407,7 +407,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key
 ```
 
-_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup.ts)_
+_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/cleanup.ts)_
 
 ## `qfg cleanup list`
 
@@ -453,7 +453,7 @@ EXAMPLES
   $ qfg cleanup list --json
 ```
 
-_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/list.ts)_
+_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/cleanup/list.ts)_
 
 ## `qfg cleanup remove [NAME]`
 
@@ -498,7 +498,7 @@ EXAMPLES
   $ qfg cleanup remove my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/remove.ts)_
+_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/cleanup/remove.ts)_
 
 ## `qfg cleanup status [NAME]`
 
@@ -538,7 +538,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/status.ts)_
+_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/cleanup/status.ts)_
 
 ## `qfg cleanup verify [NAME]`
 
@@ -584,7 +584,7 @@ EXAMPLES
   $ qfg cleanup verify my.flag.key && qfg delete my.flag.key
 ```
 
-_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/verify.ts)_
+_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/cleanup/verify.ts)_
 
 ## `qfg config-schema`
 
@@ -613,7 +613,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -700,7 +700,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -746,7 +746,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -950,7 +950,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -973,7 +973,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/get.ts)_
 
 ## `qfg history NAME`
 
@@ -1031,7 +1031,7 @@ EXAMPLES
   $ qfg history my.flag
 ```
 
-_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/history.ts)_
+_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/history.ts)_
 
 ## `qfg info [NAME]`
 
@@ -1079,7 +1079,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -1119,7 +1119,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -1149,7 +1149,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -1189,7 +1189,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/list.ts)_
 
 ## `qfg log`
 
@@ -1214,7 +1214,7 @@ EXAMPLES
   $ qfg log --limit 5
 ```
 
-_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/log.ts)_
+_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/log.ts)_
 
 ## `qfg log-level NAME`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -1304,7 +1304,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -1327,7 +1327,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -1337,7 +1337,7 @@ Migrate flags and configs from a legacy feature-flag system into a Quonfig works
 USAGE
   $ qfg migrate --from launch|launchdarkly|flagsmith [--json] [--interactive] [--no-color] [--verbose]
     [--api-key <value>] [--dir <value>] [--dry-run] [--full-summary] [--project <value>] [--push] [--recent <value>]
-    [--reset] [--since <value>] [--source-api-key <value>] [--staging] [--workspace <value>]
+    [--reset] [--since <value>] [--source-api-key <value>] [--staging] [--strict-keys] [--workspace <value>]
 
 FLAGS
   --api-key=<value>         Deprecated alias for --source-api-key, kept for the `launch` source (or set LAUNCH_API_KEY).
@@ -1360,6 +1360,8 @@ FLAGS
   --source-api-key=<value>  API key for the legacy source. Set this, QUONFIG_MIGRATE_API_KEY, or the per-provider env
                             var (LAUNCHDARKLY_API_KEY, LAUNCH_API_KEY, FLAGSMITH_API_KEY).
   --staging                 Hit the staging API for the source (dev-only)
+  --strict-keys             Refuse to migrate if any source key would need rewriting to satisfy Quonfig key rules
+                            (Policy A), instead of rewriting it. Use when you require byte-identical keys.
   --workspace=<value>       Quonfig cloud workspace slug to push to. Requires `qfg login` and is typically combined with
                             --push.
 
@@ -1390,7 +1392,7 @@ EXAMPLES
   $ qfg migrate --from launch --source-api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -1428,7 +1430,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -1460,7 +1462,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -1491,7 +1493,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -1546,7 +1548,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1594,7 +1596,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1643,7 +1645,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/push.ts)_
 
 ## `qfg run [COMMAND]`
 
@@ -1694,7 +1696,7 @@ EXAMPLES
   $ qfg run --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test
 ```
 
-_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/run.ts)_
+_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/run.ts)_
 
 ## `qfg schema NAME`
 
@@ -1732,7 +1734,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1759,7 +1761,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1791,7 +1793,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1820,7 +1822,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1847,7 +1849,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg serve`
 
@@ -1904,7 +1906,7 @@ EXAMPLES
   $ qfg serve --port 6581 --frontend-sdk-key PUBLIC_KEY
 ```
 
-_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/serve.ts)_
+_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/serve.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1975,7 +1977,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -2052,7 +2054,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -2084,7 +2086,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -2186,7 +2188,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -2209,7 +2211,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -2232,7 +2234,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -2265,7 +2267,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -2299,7 +2301,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -2327,7 +2329,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.66/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/commands/create.js

@@ -8,6 +8,7 @@ import { mapConfigValueToDto, mapValueTypeToString } from '../util/config-value-
 import { makeConfidentialValue } from '../util/encryption.js';
 import { writeStoredConfigToWorkspace } from '../util/local-config-writer.js';
 import { LOG_LEVELS, LOG_LEVEL_KEY_PREFIX, isLogLevel } from '../util/log-levels.js';
+import { policyAKeyError } from '../util/policy-a-key.js';
 import secretFlags, { parsedSecretFlags } from '../util/secret-flags.js';
 export default class Create extends APICommand {
     static args = {
@@ -68,6 +69,14 @@ When this flag has done its job, mark readyForCleanup: true in the UI and run \`
     };
     async run() {
         const { args, flags } = await this.parse(Create);
+        // qfg-6na9.2: hard-enforce Policy A client-side before any network/prompt,
+        // so a bad key fails fast here instead of a 4xx from the server (which
+        // hard-enforces the same rule at create via PolicyAKeySchema, qfg-6na9.1).
+        // Covers all three creation paths below (config / boolean-flag / log-level).
+        const keyError = policyAKeyError(args.name);
+        if (keyError) {
+            return this.err(`Invalid key "${args.name}": ${keyError}`, { key: args.name, phase: 'validation' });
+        }
         if (flags.type === 'boolean-flag') {
             return this.createBooleanFlag(args, flags.value);
         }

package/dist/commands/migrate.d.ts

@@ -16,6 +16,7 @@ export default class Migrate extends BaseCommand {
         since: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'source-api-key': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         staging: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'strict-keys': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         workspace: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
     };
     run(): Promise<JsonObj | void>;

package/dist/commands/migrate.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { BaseCommand } from '../index.js';
 import { CrossSourceError, assertSourceMatches, readImportState } from '../migrate/import-state.js';
+import { StrictKeysError } from '../migrate/key-rewriter.js';
 import { applyLocalMigration, MigratorKeyCollisionError } from '../migrate/local-write.js';
 import { buildPushConflictSuggestion } from '../migrate/migrate-suggestion.js';
 import { migrationReportPath } from '../migrate/migration-report.js';
@@ -89,6 +90,11 @@ export default class Migrate extends BaseCommand {
             default: false,
             description: 'Hit the staging API for the source (dev-only)',
         }),
+        'strict-keys': Flags.boolean({
+            default: false,
+            description: 'Refuse to migrate if any source key would need rewriting to satisfy Quonfig key rules ' +
+                '(Policy A), instead of rewriting it. Use when you require byte-identical keys.',
+        }),
         workspace: Flags.string({
             description: 'Quonfig cloud workspace slug to push to. Requires `qfg login` and is typically combined with --push.',
         }),
@@ -265,6 +271,7 @@ export default class Migrate extends BaseCommand {
                         remoteUrl: repoUrl,
                         reportData: buildReportData(flags.from),
                         source,
+                        strictKeys: flags['strict-keys'],
                     });
                     duplicateResolutionsForWarn = result.duplicateResolutions;
                     this.log(result.committed
@@ -313,6 +320,7 @@ export default class Migrate extends BaseCommand {
                 localDir: dir,
                 reportData: buildReportData(flags.from),
                 source,
+                strictKeys: flags['strict-keys'],
             });
             duplicateResolutionsForWarn = localResult.duplicateResolutions;
             this.log(localResult.committed
@@ -334,6 +342,8 @@ export default class Migrate extends BaseCommand {
                 return this.err(error.message);
             if (error instanceof MigratorKeyCollisionError)
                 return this.err(error.message);
+            if (error instanceof StrictKeysError)
+                return this.err(error.message);
             throw error;
         }
         finally {

package/dist/migrate/key-rewriter.d.ts

@@ -0,0 +1,50 @@
+export interface KeyRewrite {
+    /** The Policy-A-valid, workspace-unique key it was rewritten to. */
+    final: string;
+    /** Why it changed (sanitize reasons + a disambiguation note when applicable). */
+    reasons: string[];
+    /** The original source-system key. */
+    source: string;
+}
+export declare function resetKeyRewriter(): void;
+/**
+ * Pre-pass: compute the final key for every source key. Sorted first so the
+ * assignment of the un-suffixed base name on a collision is deterministic and
+ * independent of the order changes were fetched in.
+ */
+export declare function planKeyRewrites(sourceKeys: Iterable<string>): void;
+/**
+ * The final key for `sourceKey`. Uses the planned map when present, else a pure
+ * sanitize (no disambiguation, no mutation) as a safe fallback.
+ */
+export declare function resolveKey(sourceKey: string): string;
+/** Every key that was actually rewritten (conforming keys are omitted). */
+export declare function getKeyRewrites(): KeyRewrite[];
+/**
+ * Run-level pre-pass: reset the rewriter and plan every source key BEFORE any
+ * change is translated, so both key-definition and by-key reference sites
+ * resolve against the same fully-disambiguated map. Structurally typed on
+ * `{key?}` to stay decoupled from LegacyChange.
+ */
+export declare function planKeyRewritesForChanges(changes: ReadonlyArray<{
+    key?: string;
+}>): void;
+/**
+ * `--strict-keys` escape hatch: refuse to migrate if any source key would need
+ * rewriting, so a customer who requires byte-identical keys can clean up the
+ * source first instead of accepting the (reported) rewrites.
+ */
+export declare class StrictKeysError extends Error {
+    readonly rewrites: KeyRewrite[];
+    constructor(rewrites: KeyRewrite[]);
+}
+/**
+ * Plan the rewrites for a run and, when `strict`, throw `StrictKeysError` if any
+ * key would be rewritten. Call once at the top of each migrate orchestrator
+ * before translating.
+ */
+export declare function preflightKeyRewrites(changes: ReadonlyArray<{
+    key?: string;
+}>, opts?: {
+    strict?: boolean;
+}): void;