@quonfig/cli 0.0.65 → 0.0.67

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.65 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.67 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -201,7 +201,7 @@ EXAMPLES
   $ qfg activity restore my.flag --yes
 ```
 
-_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity.ts)_
+_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/activity.ts)_
 
 ## `qfg activity deleted`
 
@@ -230,7 +230,7 @@ EXAMPLES
   $ qfg activity deleted --json
 ```
 
-_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/deleted.ts)_
+_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/activity/deleted.ts)_
 
 ## `qfg activity feed`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ qfg activity feed --json
 ```
 
-_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/feed.ts)_
+_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/activity/feed.ts)_
 
 ## `qfg activity history [NAME]`
 
@@ -299,7 +299,7 @@ EXAMPLES
   $ qfg activity history request.timeout --json
 ```
 
-_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/history.ts)_
+_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/activity/history.ts)_
 
 ## `qfg activity restore [NAME]`
 
@@ -338,7 +338,7 @@ EXAMPLES
   $ qfg activity restore request.timeout --type config --yes
 ```
 
-_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/activity/restore.ts)_
+_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/activity/restore.ts)_
 
 ## `qfg audit-log [NAME]`
 
@@ -366,7 +366,7 @@ EXAMPLES
   $ qfg audit-log my.flag
 ```
 
-_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/audit-log.ts)_
+_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/audit-log.ts)_
 
 ## `qfg cleanup`
 
@@ -407,7 +407,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key
 ```
 
-_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup.ts)_
+_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/cleanup.ts)_
 
 ## `qfg cleanup list`
 
@@ -453,7 +453,7 @@ EXAMPLES
   $ qfg cleanup list --json
 ```
 
-_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/list.ts)_
+_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/cleanup/list.ts)_
 
 ## `qfg cleanup remove [NAME]`
 
@@ -498,7 +498,7 @@ EXAMPLES
   $ qfg cleanup remove my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/remove.ts)_
+_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/cleanup/remove.ts)_
 
 ## `qfg cleanup status [NAME]`
 
@@ -538,7 +538,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/status.ts)_
+_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/cleanup/status.ts)_
 
 ## `qfg cleanup verify [NAME]`
 
@@ -584,7 +584,7 @@ EXAMPLES
   $ qfg cleanup verify my.flag.key && qfg delete my.flag.key
 ```
 
-_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/cleanup/verify.ts)_
+_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/cleanup/verify.ts)_
 
 ## `qfg config-schema`
 
@@ -613,7 +613,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -700,7 +700,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -746,7 +746,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -950,7 +950,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -973,7 +973,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/get.ts)_
 
 ## `qfg history NAME`
 
@@ -1031,7 +1031,7 @@ EXAMPLES
   $ qfg history my.flag
 ```
 
-_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/history.ts)_
+_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/history.ts)_
 
 ## `qfg info [NAME]`
 
@@ -1079,7 +1079,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -1119,7 +1119,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -1149,7 +1149,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -1189,7 +1189,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/list.ts)_
 
 ## `qfg log`
 
@@ -1214,7 +1214,7 @@ EXAMPLES
   $ qfg log --limit 5
 ```
 
-_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/log.ts)_
+_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/log.ts)_
 
 ## `qfg log-level NAME`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -1304,7 +1304,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -1327,7 +1327,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -1337,7 +1337,7 @@ Migrate flags and configs from a legacy feature-flag system into a Quonfig works
 USAGE
   $ qfg migrate --from launch|launchdarkly|flagsmith [--json] [--interactive] [--no-color] [--verbose]
     [--api-key <value>] [--dir <value>] [--dry-run] [--full-summary] [--project <value>] [--push] [--recent <value>]
-    [--reset] [--since <value>] [--source-api-key <value>] [--staging] [--workspace <value>]
+    [--reset] [--since <value>] [--source-api-key <value>] [--staging] [--strict-keys] [--workspace <value>]
 
 FLAGS
   --api-key=<value>         Deprecated alias for --source-api-key, kept for the `launch` source (or set LAUNCH_API_KEY).
@@ -1360,6 +1360,8 @@ FLAGS
   --source-api-key=<value>  API key for the legacy source. Set this, QUONFIG_MIGRATE_API_KEY, or the per-provider env
                             var (LAUNCHDARKLY_API_KEY, LAUNCH_API_KEY, FLAGSMITH_API_KEY).
   --staging                 Hit the staging API for the source (dev-only)
+  --strict-keys             Refuse to migrate if any source key would need rewriting to satisfy Quonfig key rules
+                            (Policy A), instead of rewriting it. Use when you require byte-identical keys.
   --workspace=<value>       Quonfig cloud workspace slug to push to. Requires `qfg login` and is typically combined with
                             --push.
 
@@ -1390,7 +1392,7 @@ EXAMPLES
   $ qfg migrate --from launch --source-api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -1428,7 +1430,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -1460,7 +1462,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -1491,7 +1493,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -1546,7 +1548,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1594,7 +1596,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1643,7 +1645,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/push.ts)_
 
 ## `qfg run [COMMAND]`
 
@@ -1694,7 +1696,7 @@ EXAMPLES
   $ qfg run --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test
 ```
 
-_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/run.ts)_
+_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/run.ts)_
 
 ## `qfg schema NAME`
 
@@ -1732,7 +1734,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1759,7 +1761,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1791,7 +1793,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1820,7 +1822,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1847,7 +1849,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg serve`
 
@@ -1904,7 +1906,7 @@ EXAMPLES
   $ qfg serve --port 6581 --frontend-sdk-key PUBLIC_KEY
 ```
 
-_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/serve.ts)_
+_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/serve.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1975,7 +1977,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -2052,7 +2054,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -2084,7 +2086,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -2186,7 +2188,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -2209,7 +2211,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -2232,7 +2234,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -2265,7 +2267,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -2299,7 +2301,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -2327,7 +2329,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.65/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.67/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/commands/create.js

@@ -8,6 +8,7 @@ import { mapConfigValueToDto, mapValueTypeToString } from '../util/config-value-
 import { makeConfidentialValue } from '../util/encryption.js';
 import { writeStoredConfigToWorkspace } from '../util/local-config-writer.js';
 import { LOG_LEVELS, LOG_LEVEL_KEY_PREFIX, isLogLevel } from '../util/log-levels.js';
+import { policyAKeyError } from '../util/policy-a-key.js';
 import secretFlags, { parsedSecretFlags } from '../util/secret-flags.js';
 export default class Create extends APICommand {
     static args = {
@@ -68,6 +69,14 @@ When this flag has done its job, mark readyForCleanup: true in the UI and run \`
     };
     async run() {
         const { args, flags } = await this.parse(Create);
+        // qfg-6na9.2: hard-enforce Policy A client-side before any network/prompt,
+        // so a bad key fails fast here instead of a 4xx from the server (which
+        // hard-enforces the same rule at create via PolicyAKeySchema, qfg-6na9.1).
+        // Covers all three creation paths below (config / boolean-flag / log-level).
+        const keyError = policyAKeyError(args.name);
+        if (keyError) {
+            return this.err(`Invalid key "${args.name}": ${keyError}`, { key: args.name, phase: 'validation' });
+        }
         if (flags.type === 'boolean-flag') {
             return this.createBooleanFlag(args, flags.value);
         }

package/dist/commands/migrate.d.ts

@@ -16,6 +16,7 @@ export default class Migrate extends BaseCommand {
         since: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'source-api-key': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         staging: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'strict-keys': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         workspace: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
     };
     run(): Promise<JsonObj | void>;

package/dist/commands/migrate.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { BaseCommand } from '../index.js';
 import { CrossSourceError, assertSourceMatches, readImportState } from '../migrate/import-state.js';
+import { StrictKeysError } from '../migrate/key-rewriter.js';
 import { applyLocalMigration, MigratorKeyCollisionError } from '../migrate/local-write.js';
 import { buildPushConflictSuggestion } from '../migrate/migrate-suggestion.js';
 import { migrationReportPath } from '../migrate/migration-report.js';
@@ -89,6 +90,11 @@ export default class Migrate extends BaseCommand {
             default: false,
             description: 'Hit the staging API for the source (dev-only)',
         }),
+        'strict-keys': Flags.boolean({
+            default: false,
+            description: 'Refuse to migrate if any source key would need rewriting to satisfy Quonfig key rules ' +
+                '(Policy A), instead of rewriting it. Use when you require byte-identical keys.',
+        }),
         workspace: Flags.string({
             description: 'Quonfig cloud workspace slug to push to. Requires `qfg login` and is typically combined with --push.',
         }),
@@ -265,6 +271,7 @@ export default class Migrate extends BaseCommand {
                         remoteUrl: repoUrl,
                         reportData: buildReportData(flags.from),
                         source,
+                        strictKeys: flags['strict-keys'],
                     });
                     duplicateResolutionsForWarn = result.duplicateResolutions;
                     this.log(result.committed
@@ -313,6 +320,7 @@ export default class Migrate extends BaseCommand {
                 localDir: dir,
                 reportData: buildReportData(flags.from),
                 source,
+                strictKeys: flags['strict-keys'],
             });
             duplicateResolutionsForWarn = localResult.duplicateResolutions;
             this.log(localResult.committed
@@ -334,6 +342,8 @@ export default class Migrate extends BaseCommand {
                 return this.err(error.message);
             if (error instanceof MigratorKeyCollisionError)
                 return this.err(error.message);
+            if (error instanceof StrictKeysError)
+                return this.err(error.message);
             throw error;
         }
         finally {

package/dist/migrate/import-state.d.ts

@@ -10,5 +10,8 @@ export declare class CrossSourceError extends Error {
 }
 export declare function writeImportState(outputDir: string, state: ImportState): void;
 export declare function readImportState(outputDir: string): ImportState | null;
+export declare function writeKeyPlan(outputDir: string, keys: Record<string, string>): void;
+/** The persisted plan, or null when absent/unreadable (treat as first run). */
+export declare function readKeyPlan(outputDir: string): null | Record<string, string>;
 export declare function assertSourceMatches(outputDir: string, requestedSource: string): void;
 export declare function removeQfFromGitignore(outputDir: string): void;

package/dist/migrate/import-state.js

@@ -35,6 +35,38 @@ export function readImportState(outputDir) {
         return null;
     return parsed;
 }
+function keyPlanPath(outputDir) {
+    return path.join(outputDir, '.qf', 'key-plan.json');
+}
+export function writeKeyPlan(outputDir, keys) {
+    const filePath = keyPlanPath(outputDir);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const sorted = {};
+    for (const source of Object.keys(keys).sort())
+        sorted[source] = keys[source];
+    const serialized = { keys: sorted, version: 1 };
+    fs.writeFileSync(filePath, JSON.stringify(serialized, null, 2) + '\n', 'utf8');
+}
+/** The persisted plan, or null when absent/unreadable (treat as first run). */
+export function readKeyPlan(outputDir) {
+    const filePath = keyPlanPath(outputDir);
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        if (typeof parsed?.keys !== 'object' || parsed.keys === null || Array.isArray(parsed.keys))
+            return null;
+        const out = {};
+        for (const [source, final] of Object.entries(parsed.keys)) {
+            if (typeof final === 'string')
+                out[source] = final;
+        }
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
 export function assertSourceMatches(outputDir, requestedSource) {
     const state = readImportState(outputDir);
     if (!state)

package/dist/migrate/key-rewriter.d.ts

@@ -0,0 +1,82 @@
+export interface KeyRewrite {
+    /** The Policy-A-valid, workspace-unique key it was rewritten to. */
+    final: string;
+    /** Why it changed (sanitize reasons + a disambiguation note when applicable). */
+    reasons: string[];
+    /** The original source-system key. */
+    source: string;
+}
+export declare function resetKeyRewriter(): void;
+/**
+ * Seed the rewriter with the complete source->final map persisted by previous
+ * runs. Every persisted final is immediately marked taken (case-insensitively)
+ * so keys planned later this run can never claim one. Call after
+ * `resetKeyRewriter()` and before `planKeyRewrites()` — `planKeyRewritesForChanges`
+ * does this ordering for you.
+ */
+export declare function seedPersistedKeyPlan(keys: Readonly<Record<string, string>>): void;
+/**
+ * Pre-pass: compute the final key for every source key. Three passes, each
+ * sorted so every assignment is deterministic and independent of the order
+ * changes were fetched in:
+ *
+ *   0. Keys mapped by a PREVIOUS run keep their persisted final verbatim (see
+ *      `seedPersistedKeyPlan`) — full and delta runs must resolve identically.
+ *   1. Keys that are ALREADY fully valid (sanitize is an identity: they pass
+ *      Policy A and the FS-floor) claim their own names FIRST and are never
+ *      renamed to make room for sanitized junk — customer code calling
+ *      get("my-flag") must keep resolving to the same flag even when a source
+ *      key like "my flag" sanitizes to the same name. If two VALID keys
+ *      collide case-insensitively ("Foo"/"foo" — a genuine source conflict the
+ *      FS-floor hard-rejects), the lexicographically-first one keeps its name
+ *      and the other is suffixed.
+ *   2. Keys that needed sanitizing then disambiguate AROUND the valid ones
+ *      (-2, -3, ...).
+ */
+export declare function planKeyRewrites(sourceKeys: Iterable<string>): void;
+/**
+ * The final key for `sourceKey`. Uses the planned map when present, then the
+ * PERSISTED map (a delta run's flag can reference a segment that was migrated
+ * in the full run but is absent from the delta's change set), else a pure
+ * sanitize (no disambiguation, no mutation) as a safe fallback.
+ */
+export declare function resolveKey(sourceKey: string): string;
+/** Every key that was actually rewritten (conforming keys are omitted). */
+export declare function getKeyRewrites(): KeyRewrite[];
+/**
+ * The COMPLETE source->final map to persist to `.qf/key-plan.json`: every key
+ * planned this run (unchanged ones included) merged over everything persisted
+ * by previous runs, sorted by source key for stable on-disk diffs.
+ */
+export declare function getFullKeyPlan(): Record<string, string>;
+/**
+ * Run-level pre-pass: reset the rewriter, seed the persisted plan from any
+ * previous run, and plan every source key BEFORE any change is translated, so
+ * both key-definition and by-key reference sites resolve against the same
+ * fully-disambiguated map. Structurally typed on `{key?}` to stay decoupled
+ * from LegacyChange.
+ */
+export declare function planKeyRewritesForChanges(changes: ReadonlyArray<{
+    key?: string;
+}>, persistedKeys?: Readonly<Record<string, string>>): void;
+/**
+ * `--strict-keys` escape hatch: refuse to migrate if any source key would need
+ * rewriting, so a customer who requires byte-identical keys can clean up the
+ * source first instead of accepting the (reported) rewrites.
+ */
+export declare class StrictKeysError extends Error {
+    readonly rewrites: KeyRewrite[];
+    constructor(rewrites: KeyRewrite[]);
+}
+/**
+ * Plan the rewrites for a run and, when `strict`, throw `StrictKeysError` if any
+ * key would be rewritten. Call once at the top of each migrate orchestrator
+ * before translating. `persistedKeys` (from `readKeyPlan`) makes previously
+ * mapped keys resolve exactly as they did on the run that mapped them.
+ */
+export declare function preflightKeyRewrites(changes: ReadonlyArray<{
+    key?: string;
+}>, opts?: {
+    persistedKeys?: Readonly<Record<string, string>>;
+    strict?: boolean;
+}): void;