@quonfig/cli 0.0.65 → 0.0.67

package/dist/migrate/sources/launch/translate.js

@@ -1,4 +1,5 @@
 import { zodToJsonSchema } from './zod-to-json-schema.js';
+import { resolveKey } from '../../key-rewriter.js';
 /**
  * Thrown by transformConfig when the source config is structurally invalid
  * (e.g. variant/valueType mismatch) and the migrator cannot produce a valid
@@ -24,13 +25,29 @@ export function normalizeLogLevelKey(key) {
     return key.startsWith('log-level.') ? key : `log-level.${key}`;
 }
 /**
- * qfg-qhk1: Quonfig keys cannot contain `/` — keys are stored as flat dotted
- * filenames, and a `/` in a source key would create a nested directory tree
- * (data-loss-on-tombstone, cross-key collisions). Normalize `/` to `.` so the
- * destination is always flat.
+ * qfg-qhk1 + qfg-6na9.3: resolve keys through the per-run key rewriter so the
+ * destination is always flat AND 100% Policy-A conformant (charset + FS-floor,
+ * with collision disambiguation). Launch keys are dotted identifiers, so this is
+ * a no-op in the common case; an odd key still gets made safe, and the matching
+ * IN_SEG reference (resolveSegmentRef, below) resolves the same source string so
+ * a rewritten segment key never dangles its rules.
  */
 export function normalizeKey(key) {
-    return key.replaceAll('/', '.');
+    return resolveKey(key);
+}
+/**
+ * qfg-6na9.3: an IN_SEG/NOT_IN_SEG criterion's `valueToMatch` holds a referenced
+ * segment KEY (not an arbitrary value) — resolve it through the same rewriter as
+ * the segment's own key definition so the two stay in sync.
+ */
+function resolveSegmentRef(valueToMatch) {
+    if (!valueToMatch || typeof valueToMatch !== 'object')
+        return;
+    const v = valueToMatch;
+    if (typeof v.value === 'string')
+        v.value = resolveKey(v.value);
+    else if (Array.isArray(v.value))
+        v.value = v.value.map((x) => (typeof x === 'string' ? resolveKey(x) : x));
 }
 /**
  * qfg-l18w / qfg-0q1f: Operators Quonfig accepts in rule criteria. Mirrors
@@ -202,6 +219,9 @@ function normalizeRules(rules, configKey, path) {
                 const c = crit;
                 if (c.valueToMatch) {
                     normalizeLaunchValue(c.valueToMatch, configKey, `${path}[${i}].criteria[${j}].valueToMatch`);
+                    if (c.operator === 'IN_SEG' || c.operator === 'NOT_IN_SEG') {
+                        resolveSegmentRef(c.valueToMatch);
+                    }
                 }
             }
         }

package/dist/migrate/sources/launchdarkly/translate.js

@@ -8,16 +8,19 @@
  * variants, per-environment state → `environments[]`, the gap dispositions of
  * plan §5.4.
  */
+import { resolveKey } from '../../key-rewriter.js';
 import { clauseToCriterion, collapseEnvironment, } from '../../quonfig-target/ruleset.js';
 import { inferFlagValueType, toQuonfigValue } from '../../quonfig-target/values.js';
 const ALWAYS_TRUE = { operator: 'ALWAYS_TRUE' };
 /**
- * LaunchDarkly keys are already flat and URL-safe, but normalize `/` → `.`
- * defensively so a key can never create a nested directory tree (matches the
- * flat-path contract `local-write.ts` enforces).
+ * qfg-6na9.3: resolve keys through the per-run key rewriter for Policy A
+ * conformance. LD keys are already `[A-Za-z0-9._-]`, so this is a strict no-op
+ * in practice — wired for uniformity + future-proofing (an odd imported key
+ * would still be made safe, and stay in sync with any IN_SEG reference to it,
+ * which resolves through `ruleset.ts`).
  */
 function normalizeKey(key) {
-    return key.replaceAll('/', '.');
+    return resolveKey(key);
 }
 /** Environment keys are LD slugs already; lowercase + hyphenate to be safe. */
 function slugifyEnvKey(key) {

package/dist/util/policy-a-key.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Policy A key rule, HARD-enforced at `qfg create` time client-side (qfg-6na9.2)
+ * so a bad key fails fast before the network round-trip. This is a deliberate,
+ * hand-kept mirror of app-quonfig `src/lib/domain/config-schemas.ts`
+ * `PolicyAKeySchema` — the two MUST move together (see
+ * project/plans/26-06-tighter-naming.md, "Decision: Policy A"):
+ *
+ *   - charset `^[A-Za-z0-9._-]+$` (uppercase IS allowed; case-insensitive
+ *     collision is a separate verify/create-handler check, not here),
+ *   - 1..200 chars (ASCII-only, so char length == byte length),
+ *   - not the reserved key `"new"`,
+ *   - no leading dot (a `.beta.json` config is silently skipped by the loader
+ *     and `qfg verify`).
+ *
+ * NOTE the layering: this is the create boundary (hard). The general charset is
+ * a *warning* in `qfg verify` (`src/verify/validate.ts`, qfg-6na9.5) during the
+ * warn->error soak, and the FS-safety floor there is already hard (qfg-6na9.4).
+ * Keep the messages aligned with app-quonfig's for a consistent UX.
+ */
+export declare const POLICY_A_KEY_RE: RegExp;
+/**
+ * Returns a human-readable error message for a key that violates Policy A, or
+ * `null` if the key is valid. First failing rule wins (matches the order Zod
+ * evaluates the refinements in app-quonfig).
+ */
+export declare function policyAKeyError(key: string): string | null;

package/dist/util/policy-a-key.js

@@ -0,0 +1,42 @@
+/**
+ * Policy A key rule, HARD-enforced at `qfg create` time client-side (qfg-6na9.2)
+ * so a bad key fails fast before the network round-trip. This is a deliberate,
+ * hand-kept mirror of app-quonfig `src/lib/domain/config-schemas.ts`
+ * `PolicyAKeySchema` — the two MUST move together (see
+ * project/plans/26-06-tighter-naming.md, "Decision: Policy A"):
+ *
+ *   - charset `^[A-Za-z0-9._-]+$` (uppercase IS allowed; case-insensitive
+ *     collision is a separate verify/create-handler check, not here),
+ *   - 1..200 chars (ASCII-only, so char length == byte length),
+ *   - not the reserved key `"new"`,
+ *   - no leading dot (a `.beta.json` config is silently skipped by the loader
+ *     and `qfg verify`).
+ *
+ * NOTE the layering: this is the create boundary (hard). The general charset is
+ * a *warning* in `qfg verify` (`src/verify/validate.ts`, qfg-6na9.5) during the
+ * warn->error soak, and the FS-safety floor there is already hard (qfg-6na9.4).
+ * Keep the messages aligned with app-quonfig's for a consistent UX.
+ */
+// Kept as the explicit char class (not the `[\w.-]` the linter suggests) so it
+// is a byte-for-byte mirror of app-quonfig's PolicyAKeySchema and greppable
+// across both sources of truth — see the module doc above.
+// eslint-disable-next-line unicorn/better-regex
+export const POLICY_A_KEY_RE = /^[A-Za-z0-9._-]+$/;
+/**
+ * Returns a human-readable error message for a key that violates Policy A, or
+ * `null` if the key is valid. First failing rule wins (matches the order Zod
+ * evaluates the refinements in app-quonfig).
+ */
+export function policyAKeyError(key) {
+    if (key.length === 0)
+        return 'Key is required';
+    if (key.length > 200)
+        return 'Key must be 200 characters or fewer';
+    if (key === 'new')
+        return 'Key cannot be "new"';
+    if (!POLICY_A_KEY_RE.test(key))
+        return 'Key can only contain letters, numbers, dots, dashes, and underscores';
+    if (key.startsWith('.'))
+        return 'Key cannot start with a dot';
+    return null;
+}

package/dist/verify/standalone.d.ts

@@ -10,4 +10,16 @@
  *   0  All checks pass
  *   1  Validation errors found
  */
-export {};
+/**
+ * Read all JSON config files from a git commit using `git show`.
+ * Works in bare repos (no working tree needed).
+ *
+ * qfg-6na9.6: uses execFileSync (never a shell) and `ls-tree -z` (NUL-delimited,
+ * disables git's C-quoting of "unusual" paths). The old string-interpolated
+ * execSync + default ls-tree output silently SKIPPED any filename containing a
+ * space or non-ASCII char — exactly the Policy-A-violating keys the hook
+ * exists to catch (verified live on staging: a `configs/bad charset key.json`
+ * push was accepted unvalidated). A listed-but-unreadable file is now a hard
+ * failure (fail closed), not a silent skip.
+ */
+export declare function readFilesFromCommit(commitOid: string, cwd?: string): Map<string, string>;

package/dist/verify/standalone.js

@@ -10,7 +10,7 @@
  *   0  All checks pass
  *   1  Validation errors found
  */
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import * as readline from 'node:readline';
 import { formatResult, validateFileMap, validateWorkspace } from './validate.js';
 async function main() {
@@ -91,42 +91,50 @@ async function runGitHook() {
 /**
  * Read all JSON config files from a git commit using `git show`.
  * Works in bare repos (no working tree needed).
+ *
+ * qfg-6na9.6: uses execFileSync (never a shell) and `ls-tree -z` (NUL-delimited,
+ * disables git's C-quoting of "unusual" paths). The old string-interpolated
+ * execSync + default ls-tree output silently SKIPPED any filename containing a
+ * space or non-ASCII char — exactly the Policy-A-violating keys the hook
+ * exists to catch (verified live on staging: a `configs/bad charset key.json`
+ * push was accepted unvalidated). A listed-but-unreadable file is now a hard
+ * failure (fail closed), not a silent skip.
  */
-function readFilesFromCommit(commitOid) {
+export function readFilesFromCommit(commitOid, cwd) {
     const files = new Map();
     const dirs = ['configs', 'feature-flags', 'segments', 'log-levels', 'schemas', 'schemas-protected'];
     for (const dir of dirs) {
-        // List files in this directory at the given commit
-        let listing;
-        try {
-            listing = execSync(`git ls-tree --name-only ${commitOid} ${dir}/`, {
-                encoding: 'utf8',
-                stdio: ['pipe', 'pipe', 'pipe'],
-            });
-        }
-        catch {
-            // Directory doesn't exist in this commit
-            continue;
-        }
-        const filenames = listing.trim().split('\n').filter(Boolean);
+        // List files in this directory at the given commit. A directory that
+        // doesn't exist yields an empty listing (exit 0); a bad/unreadable OID
+        // throws — fail closed, the hook rejects the push.
+        const listing = execFileSync('git', ['ls-tree', '-z', '--name-only', commitOid, `${dir}/`], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const filenames = listing.split('\0').filter(Boolean);
         for (const filePath of filenames) {
             if (!filePath.endsWith('.json') || filePath.includes('/.'))
                 continue;
-            try {
-                const content = execSync(`git show ${commitOid}:${filePath}`, {
-                    encoding: 'utf8',
-                    stdio: ['pipe', 'pipe', 'pipe'],
-                });
-                files.set(filePath, content);
-            }
-            catch {
-                // File can't be read, skip
-            }
+            // Fail closed: if a listed file can't be read, the push must not be
+            // accepted with that file unvalidated — let the error propagate to the
+            // hook's per-ref handler, which rejects the push.
+            const content = execFileSync('git', ['show', `${commitOid}:${filePath}`], {
+                cwd,
+                encoding: 'utf8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            files.set(filePath, content);
         }
     }
     return files;
 }
-main().catch((error) => {
-    console.error(`qfg-verify: fatal: ${error.message}`);
-    process.exit(1);
-});
+// Only run as a program when compiled/executed as the entry point (Bun sets
+// import.meta.main; under node test imports it is undefined) — this lets tests
+// import readFilesFromCommit without triggering the CLI.
+if (import.meta.main) {
+    main().catch((error) => {
+        console.error(`qfg-verify: fatal: ${error.message}`);
+        process.exit(1);
+    });
+}

package/dist/verify/validate.js

@@ -808,8 +808,9 @@ function validateEnvironmentIds(environments, file, issues) {
 // IMPORTANT: this floor must stay conceptually in lockstep with app-quonfig's
 // src/lib/domain/config-schemas.ts (the charset precedent there is
 // `SchemaKeySchema`; Policy A is `PolicyAKeySchema`). The general charset check
-// (`^[A-Za-z0-9._-]+$`) is deliberately NOT here — it ships separately as a
-// warning (bead qfg-6na9.5). This module is the FS-floor + dedup only.
+// (`^[A-Za-z0-9._-]+$`) is deliberately NOT here — it lives in `validateKey`
+// below (warning per qfg-6na9.5, hard error since qfg-6na9.6). This list is the
+// FS-floor only.
 //
 // Structured as a table so severity is trivially adjustable later.
 const FS_SAFETY_FLOOR_CHECKS = [
@@ -827,6 +828,7 @@ const FS_SAFETY_FLOOR_CHECKS = [
 // pre-filtered by the directory walk before they'd reach the file-map path) can
 // be unit-tested directly.
 export function validateKey(key, file, issues) {
+    const errorsBefore = issues.length;
     if (key.length === 0) {
         issues.push({ file, message: `Key is empty`, severity: 'error' });
     }
@@ -847,6 +849,23 @@ export function validateKey(key, file, issues) {
             issues.push({ file, message: check.message, severity: 'error' });
         }
     }
+    // qfg-6na9.6: the general Policy A charset as a HARD ERROR. Shipped as a
+    // warning first (qfg-6na9.5), flipped after a full-corpus enumeration of all
+    // prod workspaces verified zero non-conforming keys (2026-07-03; see the bead
+    // and project/plans/26-06-tighter-naming.md). The charset `^[A-Za-z0-9._-]+$`
+    // is kept in sync with app-quonfig's PolicyAKeySchema (hard at create).
+    // Skipped when this key already earned an error above (e.g. a
+    // Windows-reserved char is both a floor error AND a charset miss) so we
+    // don't double-report the same key.
+    // eslint-disable-next-line unicorn/better-regex -- keep the explicit charset in sync with app-quonfig
+    if (issues.length === errorsBefore && !/^[A-Za-z0-9._-]+$/.test(key)) {
+        issues.push({
+            file,
+            message: `Key "${key}" has characters outside the allowed set (letters, numbers, ".", "-", "_").`,
+            severity: 'error',
+            suggestion: `Rename to use only letters, numbers, ".", "-", and "_"`,
+        });
+    }
 }
 // Case-insensitive duplicate-key detection (qfg-6na9.4,
 // project/plans/26-06-tighter-naming.md "Case-insensitive uniqueness").

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.65";
+declare const _default: "0.0.67";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.65';
+export default '0.0.67';

package/oclif.manifest.json

@@ -1491,6 +1491,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "strict-keys": {
+          "description": "Refuse to migrate if any source key would need rewriting to satisfy Quonfig key rules (Policy A), instead of rewriting it. Use when you require byte-identical keys.",
+          "name": "strict-keys",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "workspace": {
           "description": "Quonfig cloud workspace slug to push to. Requires `qfg login` and is typically combined with --push.",
           "name": "workspace",
@@ -4126,5 +4132,5 @@
       ]
     }
   },
-  "version": "0.0.65"
+  "version": "0.0.67"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.65",
+  "version": "0.0.67",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },
@@ -21,6 +21,7 @@
     "@oclif/core": "^3.18.2",
     "@oclif/plugin-help": "^6",
     "@oclif/plugin-plugins": "^4",
+    "@oclif/plugin-warn-if-update-available": "3.0.16",
     "@quonfig/node": "^1.0.0",
     "acorn": "^8.10.0",
     "acorn-walk": "^8.3.5",
@@ -77,7 +78,12 @@
     "bin": "qfg",
     "dirname": "qfg",
     "commands": "./dist/commands",
-    "plugins": [],
+    "plugins": [
+      "@oclif/plugin-warn-if-update-available"
+    ],
+    "warn-if-update-available": {
+      "message": "<%= config.name %> update available from <%= chalk.greenBright(config.version) %> to <%= chalk.greenBright(latest) %>.\nRun <%= chalk.cyan('npm i -g ' + config.name) %> to upgrade."
+    },
     "topicSeparator": " ",
     "helpClass": "./dist/help",
     "stacktrace": false,