@quonfig/cli 0.0.68 → 0.0.70

package/dist/migrate/migration-report.js

@@ -198,6 +198,7 @@ const CONVERSION_NOTE_HEADINGS = {
     'identity-override-as-rule': 'Identity overrides converted to leading rules',
     'identity-traits-referenced': 'Identity traits referenced by segment rules',
     'individual-target-as-rule': 'Individual targets converted to rules',
+    'normalized-rollout-weights': 'Normalized rollout weights',
     'skipped-rule': 'Skipped rules (unsupported operators)',
     'unexportable-segment-membership': 'Unexportable segment membership',
 };

package/dist/migrate/push-to-cloud.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { readKeyPlan, removeQfFromGitignore, writeImportState, writeKeyPlan } from './import-state.js';
-import { buildAuditFinalCommit, buildAuditPerChangeCommits, buildMigrationCommitMessage, buildMigrationCounts, writeQuonfigFiles, } from './local-write.js';
+import { buildAuditFinalCommit, buildAuditPerChangeCommits, buildMigrationCommitMessage, buildMigrationCounts, collectExistingWorkspaceKeys, writeQuonfigFiles, } from './local-write.js';
 import { getFullKeyPlan, getKeyRewrites, preflightKeyRewrites } from './key-rewriter.js';
 import { deriveFollowUpFromConversionNotes, writeMigrationReport } from './migration-report.js';
 import { cloneAndStackPush, } from '../util/clone-and-stack-push.js';
@@ -60,10 +60,14 @@ export const pushMigrationToCloud = async (opts) => {
     // not per-commit) so key-def and reference sites resolve identically, then
     // enforce --strict-keys before any clone/commit/push. Mappings persisted by a
     // previous run (.qf/key-plan.json in the reused clone) are authoritative so a
-    // delta run cannot replan a subset and land on different finals. (When the
-    // clone is fresh, the plan only comes down WITH the clone — the collapsed
-    // commit's apply() re-plans below once it can read the cloned .qf/.)
+    // delta run cannot replan a subset and land on different finals. qfg-hbuy.12:
+    // keys already in the workspace seed the rewriter so a case-variant collision
+    // (incoming `Foo`, existing `foo`) renames instead of aborting, while a
+    // byte-equal match keeps the silent-overwrite re-migration path. (When the
+    // clone is fresh, both the plan and the existing keys only come down WITH the
+    // clone — the post-clone re-plan below repeats this once it can read them.)
     preflightKeyRewrites(opts.changes, {
+        existingKeys: collectExistingWorkspaceKeys(opts.localDir),
         persistedKeys: readKeyPlan(opts.localDir) ?? undefined,
         strict: opts.strictKeys,
     });
@@ -79,8 +83,23 @@ export const pushMigrationToCloud = async (opts) => {
             mergeEnvironmentsIntoQuonfigJson(dir, opts.environments);
         }
     };
+    // Re-plan once the clone exists: a FRESH clone of a live workspace delivers
+    // .qf/key-plan.json AND the existing key files only at this point (the
+    // pre-clone preflight above couldn't see either), and both must win before
+    // any file is written. The collapsed path runs this at the top of its single
+    // commit; audit-log mode prepends it as a no-op commit spec (its apply()
+    // stages nothing, so stackCommits silently skips the commit) so it runs
+    // BEFORE the first per-change commit writes files (qfg-hbuy.12).
+    const replanAgainstClone = (dir) => {
+        preflightKeyRewrites(opts.changes, {
+            existingKeys: collectExistingWorkspaceKeys(dir),
+            persistedKeys: readKeyPlan(dir) ?? undefined,
+            strict: opts.strictKeys,
+        });
+    };
     const commits = opts.fullHistory
         ? [
+            { apply: replanAgainstClone, message: 'migrator: replan keys against the cloned workspace (no-op)' },
             ...buildAuditPerChangeCommits(opts.changes, opts.source),
             buildAuditFinalCommit({
                 changes: opts.changes,
@@ -97,14 +116,7 @@ export const pushMigrationToCloud = async (opts) => {
             {
                 message: () => computedCommitMessage,
                 async apply(dir) {
-                    // Re-plan now that the clone exists: a FRESH clone of a previously
-                    // migrated workspace delivers .qf/key-plan.json only at this point
-                    // (the pre-clone preflight above couldn't see it), and the
-                    // persisted mappings must win before any file is written.
-                    preflightKeyRewrites(opts.changes, {
-                        persistedKeys: readKeyPlan(dir) ?? undefined,
-                        strict: opts.strictKeys,
-                    });
+                    replanAgainstClone(dir);
                     mergeEnvsIfPresent(dir);
                     const { livePaths, resolutions: resolutionEntries } = writeQuonfigFiles(dir, opts.changes, opts.source);
                     removeQfFromGitignore(dir);

package/dist/migrate/quonfig-target/report.d.ts

@@ -60,7 +60,13 @@ export type ConversionNoteCategory =
  * (plan §5.5 / D-F6). Pure FYI — your SDK callers will need to send this attribute at
  * eval time. The `key` is the trait name; `detail` lists the segments referencing it.
  */
- | 'identity-traits-referenced';
+ | 'identity-traits-referenced'
+/**
+ * Imported rollout weights violated the weight predicate (neither an even
+ * split nor a percent-scale sum of 100000) and were normalized to sum
+ * 100000 — or, at zero total, replaced with an even split (qfg-wis6.11).
+ */
+ | 'normalized-rollout-weights';
 export interface ConversionNote {
     category: ConversionNoteCategory;
     /** Human-readable detail — names the exact thing lost and why. */

package/dist/migrate/quonfig-target/ruleset.js

@@ -11,6 +11,7 @@
 import { resolveKey } from '../key-rewriter.js';
 import { mapLaunchDarklyOperator } from './operators.js';
 import { toQuonfigValue } from './values.js';
+import { normalizeImportedWeights } from './weights.js';
 const ALWAYS_TRUE = { operator: 'ALWAYS_TRUE' };
 /** Operators whose `valueToMatch` is a `string_list` of every clause value. */
 const STRING_LIST_OPERATORS = new Set([
@@ -52,7 +53,10 @@ function valueToMatchFor(operator, clause, ctx) {
         // qfg-6na9.3: this value is a referenced segment KEY — resolve it through
         // the per-run rewriter so a sanitized/disambiguated segment key stays in
         // sync with the IN_SEG rules pointing at it (no dangling targeting).
-        return { type: 'string', value: resolveKey(String(clause.values[0] ?? '')) };
+        // qfg-hbuy.10: resolve in the SEGMENT namespace, so a segment renamed to
+        // dodge a same-keyed flag keeps its references (falls back to the default
+        // namespace for non-colliding segments).
+        return { type: 'string', value: resolveKey(String(clause.values[0] ?? ''), 'segment') };
     }
     if (operator === 'PROP_MATCHES' || operator === 'PROP_DOES_NOT_MATCH') {
         if (clause.values.length > 1) {
@@ -130,13 +134,21 @@ export function rolloutToWeightedValues(rollout, ctx) {
         ? normalizeAttribute(rollout.contextKind, rollout.bucketBy)
         : `${rollout.contextKind && rollout.contextKind.length > 0 ? rollout.contextKind : 'user'}.key`;
     ctx.report.add('rebucketed-rollout', ctx.sourceKey, `percentage rollout hashed on "${hashByPropertyName}" — LaunchDarkly and Quonfig bucket differently, so users will be re-bucketed`);
+    // LD weights natively sum to 100000, but guard the predicate anyway
+    // (qfg-wis6.11) — the hook now errors on non-conforming imports.
+    let weights = rollout.variations.map((wv) => wv.weight);
+    const normalized = normalizeImportedWeights(weights);
+    if (normalized) {
+        ctx.report.add('normalized-rollout-weights', ctx.sourceKey, normalized.detail);
+        weights = normalized.weights;
+    }
     return {
         type: 'weighted_values',
         value: {
             hashByPropertyName,
-            weightedValues: rollout.variations.map((wv) => ({
+            weightedValues: rollout.variations.map((wv, i) => ({
                 value: variationValue(wv.variation, ctx),
-                weight: wv.weight,
+                weight: weights[i],
             })),
         },
     };

package/dist/migrate/quonfig-target/weights.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Shared verb: imported rollout-weight normalization (qfg-wis6.11).
+ *
+ * Stored weighted values must satisfy the weight predicate qfg-verify
+ * enforces: either an even split (all weights equal and > 0) or percentages
+ * summing to MAX_WEIGHT. All-equal imports are the canonical even-split
+ * encoding and pass through verbatim (Launch's 1/1 rollouts are intended
+ * data, not a bug). Anything else is scaled to sum exactly MAX_WEIGHT via
+ * largest remainder — ties go to the earliest index — and reported. A zero
+ * (or negative) total becomes an even split.
+ */
+export declare const MAX_WEIGHT = 100000;
+export interface NormalizedWeights {
+    /** Human-readable report line naming the original ratio and the action. */
+    detail: string;
+    /** The predicate-satisfying replacement weights, same length as input. */
+    weights: number[];
+}
+/** Returns null when the weights already satisfy the predicate (import verbatim). */
+export declare function normalizeImportedWeights(weights: number[]): NormalizedWeights | null;

package/dist/migrate/quonfig-target/weights.js

@@ -0,0 +1,48 @@
+/**
+ * Shared verb: imported rollout-weight normalization (qfg-wis6.11).
+ *
+ * Stored weighted values must satisfy the weight predicate qfg-verify
+ * enforces: either an even split (all weights equal and > 0) or percentages
+ * summing to MAX_WEIGHT. All-equal imports are the canonical even-split
+ * encoding and pass through verbatim (Launch's 1/1 rollouts are intended
+ * data, not a bug). Anything else is scaled to sum exactly MAX_WEIGHT via
+ * largest remainder — ties go to the earliest index — and reported. A zero
+ * (or negative) total becomes an even split.
+ */
+export const MAX_WEIGHT = 100_000;
+/** Returns null when the weights already satisfy the predicate (import verbatim). */
+export function normalizeImportedWeights(weights) {
+    if (weights.length === 0)
+        return null;
+    const clamped = weights.map((w) => (Number.isFinite(w) && w > 0 ? w : 0));
+    const total = clamped.reduce((a, b) => a + b, 0);
+    const allEqualNonZero = clamped[0] > 0 && clamped.every((w) => w === clamped[0]);
+    if (allEqualNonZero && clamped.every((w, i) => w === weights[i]))
+        return null;
+    if (total <= 0) {
+        return {
+            weights: weights.map(() => 1),
+            detail: `rollout weights [${weights.join(', ')}] have zero total — imported as an even split (all ones)`,
+        };
+    }
+    if (total === MAX_WEIGHT && clamped.every((w, i) => w === weights[i] && Number.isInteger(w)))
+        return null;
+    // Largest remainder: floor each exact share, then hand the missing units
+    // to the largest fractional remainders, ties to the earliest index.
+    const exact = clamped.map((w) => (w / total) * MAX_WEIGHT);
+    const floors = exact.map((x) => Math.floor(x));
+    let missing = MAX_WEIGHT - floors.reduce((a, b) => a + b, 0);
+    const order = exact
+        .map((x, i) => ({ fraction: x - Math.floor(x), i }))
+        .sort((a, b) => b.fraction - a.fraction || a.i - b.i);
+    for (const { i } of order) {
+        if (missing <= 0)
+            break;
+        floors[i] += 1;
+        missing -= 1;
+    }
+    return {
+        weights: floors,
+        detail: `rollout weights [${weights.join(', ')}] (sum ${total}) normalized to [${floors.join(', ')}] to sum ${MAX_WEIGHT}`,
+    };
+}

package/dist/migrate/source.d.ts

@@ -2,6 +2,15 @@ import type { ConversionNote } from './quonfig-target/report.js';
 export interface LegacyChange {
     changedAt?: number;
     key?: string;
+    /**
+     * qfg-hbuy.10: source-side key namespace. LaunchDarkly flags and segments
+     * are SEPARATE key namespaces, so a flag and a segment can legitimately
+     * share one source key. Sources that model segments as their own namespace
+     * tag segment changes `'segment'` so the key rewriter can disambiguate the
+     * collision (the flag keeps the clean name; the segment gets a
+     * deterministic `-segment` suffix). Absent = the default namespace.
+     */
+    keyNamespace?: 'segment';
     raw: unknown;
     source: string;
 }

package/dist/migrate/sources/flagsmith/translate.js

@@ -17,6 +17,7 @@
  */
 import { resolveKey } from '../../key-rewriter.js';
 import { inferValueType, toQuonfigValue } from '../../quonfig-target/values.js';
+import { normalizeImportedWeights } from '../../quonfig-target/weights.js';
 const ALWAYS_TRUE = { operator: 'ALWAYS_TRUE' };
 /** Flagsmith identity-override rule keys context attributes under this propertyName. */
 const IDENTITY_PROPERTY_NAME = 'user.key';
@@ -465,6 +466,14 @@ function multivariateWeightedValue(mvOptions, perEnvWeights, ctx) {
             weight: Math.round(pct * 1000),
         };
     });
+    // Flagsmith allocations don't have to sum to 100 — enforce the weight
+    // predicate the qfg-verify hook now errors on (qfg-wis6.11).
+    const normalized = normalizeImportedWeights(weightedValues.map((wv) => wv.weight));
+    if (normalized) {
+        ctx.report.add('normalized-rollout-weights', ctx.feature.name, normalized.detail);
+        for (const [i, wv] of weightedValues.entries())
+            wv.weight = normalized.weights[i];
+    }
     return {
         type: 'weighted_values',
         value: {

package/dist/migrate/sources/launch/translate.d.ts

@@ -31,7 +31,7 @@ export declare function normalizeKey(key: string): string;
  * test in this file enforces parity.
  */
 export declare const QUONFIG_SUPPORTED_OPERATORS: Set<string>;
-export declare function transformConfig(config: LaunchConfig, envIdMap: Record<string, string>, onDroppedEnv?: (envId: string) => void, onCoercedSentinel?: (envId: string, valueType: string) => void): Record<string, unknown>;
+export declare function transformConfig(config: LaunchConfig, envIdMap: Record<string, string>, onDroppedEnv?: (envId: string) => void, onCoercedSentinel?: (envId: string, valueType: string) => void, onNormalizedWeights?: (detail: string) => void): Record<string, unknown>;
 export declare function getOutputPath(type: string, key: string): string;
 /**
  * Walks the set of written files looking for cross-type collisions (the same

package/dist/migrate/sources/launch/translate.js

@@ -1,5 +1,6 @@
+import { normalizeImportedWeights } from '../../quonfig-target/weights.js';
 import { zodToJsonSchema } from './zod-to-json-schema.js';
-import { resolveKey } from '../../key-rewriter.js';
+import { resolveKey, resolveMappedKey } from '../../key-rewriter.js';
 /**
  * Thrown by transformConfig when the source config is structurally invalid
  * (e.g. variant/valueType mismatch) and the migrator cannot produce a valid
@@ -49,6 +50,74 @@ function resolveSegmentRef(valueToMatch) {
     else if (Array.isArray(v.value))
         v.value = v.value.map((x) => (typeof x === 'string' ? resolveKey(x) : x));
 }
+/**
+ * qfg-hbuy.11: a value's `decryptWith` names the CONFIG KEY holding its
+ * AES-GCM key — a by-key reference, exactly like an IN_SEG segment ref. When
+ * the referenced config was renamed by the key rewriter the reference must
+ * follow, or the config can never decrypt. A key absent from the map points
+ * at a pre-existing workspace config the import does not own — left
+ * untouched. Recurses into weighted_values so encrypted variant splits are
+ * covered too.
+ */
+function rewriteValueKeyRefs(value) {
+    if (!value || typeof value !== 'object')
+        return;
+    const v = value;
+    if (typeof v.decryptWith === 'string') {
+        const mapped = resolveMappedKey(v.decryptWith);
+        if (mapped !== null)
+            v.decryptWith = mapped;
+    }
+    if (v.type === 'weighted_values') {
+        const inner = v.value;
+        let entries = [];
+        if (Array.isArray(inner)) {
+            entries = inner;
+        }
+        else if (inner && typeof inner === 'object') {
+            const wvs = inner.weightedValues;
+            if (Array.isArray(wvs))
+                entries = wvs;
+        }
+        for (const entry of entries) {
+            if (entry && typeof entry === 'object' && entry.value) {
+                rewriteValueKeyRefs(entry.value);
+            }
+        }
+    }
+}
+/**
+ * qfg-hbuy.11: walk every value position that can carry `decryptWith`
+ * (default rules, per-environment rules, variants) and rewrite the reference
+ * through the final key map. Mirrors normalizeJsonValuesInConfig's traversal.
+ */
+function rewriteKeyReferencesInConfig(out) {
+    const walkRules = (rules) => {
+        if (!Array.isArray(rules))
+            return;
+        for (const rule of rules) {
+            if (!rule || typeof rule !== 'object')
+                continue;
+            const r = rule;
+            if (r.value)
+                rewriteValueKeyRefs(r.value);
+        }
+    };
+    const defaultSection = out.default;
+    if (defaultSection)
+        walkRules(defaultSection.rules);
+    if (Array.isArray(out.environments)) {
+        for (const env of out.environments) {
+            walkRules(env.rules);
+        }
+    }
+    if (Array.isArray(out.variants)) {
+        for (const variant of out.variants) {
+            if (variant && variant.value)
+                rewriteValueKeyRefs(variant.value);
+        }
+    }
+}
 /**
  * qfg-l18w / qfg-0q1f: Operators Quonfig accepts in rule criteria. Mirrors
  * the `OperatorSchema` enum in cli/src/verify/validate.ts (and app-quonfig's
@@ -271,13 +340,71 @@ function normalizeJsonValuesInConfig(out) {
         }
     }
 }
-export function transformConfig(config, envIdMap, onDroppedEnv, onCoercedSentinel) {
+// qfg-wis6.11: Launch's relative weights import verbatim when all weights
+// are equal (the intended even-split encoding, e.g. 1/1). Any other ratio is
+// normalized to sum 100000, and a zero total becomes an even split, so
+// imported data always satisfies the weight predicate the qfg-verify hook
+// errors on. Every change is surfaced through the callback.
+function normalizeWeightsInRules(rules, path, onNormalized) {
+    if (!Array.isArray(rules))
+        return;
+    for (const [i, rule] of rules.entries()) {
+        if (!rule || typeof rule !== 'object')
+            continue;
+        const v = rule.value;
+        if (!v || typeof v !== 'object' || v.type !== 'weighted_values')
+            continue;
+        const inner = v.value;
+        let entries = null;
+        if (Array.isArray(inner)) {
+            entries = inner;
+        }
+        else if (inner && typeof inner === 'object') {
+            const wvs = inner.weightedValues;
+            if (Array.isArray(wvs))
+                entries = wvs;
+        }
+        if (!entries || entries.length === 0)
+            continue;
+        const weights = entries.map((e) => Number(e?.weight ?? 0));
+        const normalized = normalizeImportedWeights(weights);
+        if (!normalized)
+            continue;
+        for (const [j, entry] of entries.entries()) {
+            if (entry && typeof entry === 'object')
+                entry.weight = normalized.weights[j];
+        }
+        onNormalized?.(`${path}[${i}]: ${normalized.detail}`);
+    }
+}
+function normalizeWeightsInConfig(out, onNormalized) {
+    const defaultSection = out.default;
+    if (defaultSection) {
+        normalizeWeightsInRules(defaultSection.rules, 'default.rules', onNormalized);
+    }
+    if (Array.isArray(out.environments)) {
+        for (const [i, env] of out.environments.entries()) {
+            const envId = typeof env.id === 'string' ? env.id : String(i);
+            normalizeWeightsInRules(env.rules, `environments[${envId}].rules`, onNormalized);
+        }
+    }
+}
+export function transformConfig(config, envIdMap, onDroppedEnv, onCoercedSentinel, onNormalizedWeights) {
     const out = JSON.parse(JSON.stringify(config));
     // qfg-qhk1: normalize `/` to `.` in the key so the JSON `key` field matches
     // the flat dotted filename the migrator will write.
     if (typeof out.key === 'string') {
         out.key = normalizeKey(out.key);
     }
+    // qfg-hbuy.11: `schemaKey` references ANOTHER config's key (the schema this
+    // config validates against). If that schema was renamed by the key rewriter
+    // the reference must follow; a schemaKey absent from the map references a
+    // pre-existing workspace schema and is left untouched.
+    if (typeof out.schemaKey === 'string') {
+        const mapped = resolveMappedKey(out.schemaKey);
+        if (mapped !== null)
+            out.schemaKey = mapped;
+    }
     delete out.changedBy;
     delete out.modifiedAt;
     delete out.createdAt;
@@ -374,6 +501,10 @@ export function transformConfig(config, envIdMap, onDroppedEnv, onCoercedSentine
         }
     }
     normalizeJsonValuesInConfig(out);
+    // qfg-hbuy.11: rewrite `decryptWith` references AFTER json-normalization so
+    // the walker sees the final value shapes.
+    rewriteKeyReferencesInConfig(out);
+    normalizeWeightsInConfig(out, onNormalizedWeights);
     validateOperators(out);
     return out;
 }

package/dist/migrate/sources/launch.js

@@ -1,9 +1,11 @@
+import { ConversionReport } from '../quonfig-target/report.js';
 import { fetchAllChangeHistory, fetchEnvironments } from './launch/api.js';
 import { InvalidSourceConfigError, getOutputPath, isLegacyLogLevel, slugify, transformConfig, } from './launch/translate.js';
 const SOURCE_NAME = 'launch';
 const state = {
     apiKey: null,
     coercedSentinels: new Map(),
+    conversionReport: new ConversionReport(),
     droppedOverrides: new Map(),
     envIdMap: null,
     skippedConfigs: [],
@@ -71,6 +73,8 @@ function translateImpl(change) {
                 state.coercedSentinels.set(envId, perFlag);
             }
             perFlag.set(outputPath, (perFlag.get(outputPath) ?? 0) + 1);
+        }, (detail) => {
+            state.conversionReport.add('normalized-rollout-weights', raw.key, detail);
         });
     }
     catch (error) {
@@ -145,6 +149,10 @@ async function validateAuthImpl(apiKey) {
     state.droppedOverrides = new Map();
     state.skippedConfigs = [];
     state.coercedSentinels = new Map();
+    state.conversionReport.reset();
+}
+function getConversionNotesImpl() {
+    return state.conversionReport.isEmpty() ? null : state.conversionReport.all();
 }
 export const launchSource = {
     fetchChanges(sinceEpochMs, onProgress) {
@@ -152,6 +160,7 @@ export const launchSource = {
     },
     getCoercedSentinels: getCoercedSentinelsImpl,
     getCommitMeta: getCommitMetaImpl,
+    getConversionNotes: getConversionNotesImpl,
     getDroppedOverrides: getDroppedOverridesImpl,
     getSkippedConfigs: getSkippedConfigsImpl,
     listEnvironments: listEnvironmentsImpl,
@@ -165,4 +174,5 @@ export function __resetLaunchSourceForTests() {
     state.droppedOverrides = new Map();
     state.skippedConfigs = [];
     state.coercedSentinels = new Map();
+    state.conversionReport.reset();
 }

package/dist/migrate/sources/launchdarkly/translate.js

@@ -22,6 +22,16 @@ const ALWAYS_TRUE = { operator: 'ALWAYS_TRUE' };
 function normalizeKey(key) {
     return resolveKey(key);
 }
+/**
+ * qfg-hbuy.10: LD segments are their OWN key namespace — a project can carry a
+ * flag and a segment both keyed `checkout`. Segment key definitions (and the
+ * IN_SEG references in `ruleset.ts`) resolve through the segment namespace so
+ * the collision case gets the deterministic `-segment` suffix while the flag
+ * keeps the clean name. Non-colliding segments resolve exactly as before.
+ */
+function normalizeSegmentKey(key) {
+    return resolveKey(key, 'segment');
+}
 /** Environment keys are LD slugs already; lowercase + hyphenate to be safe. */
 function slugifyEnvKey(key) {
     return key
@@ -53,7 +63,7 @@ export function flagOutputPath(key) {
     return `feature-flags/${normalizeKey(key)}.json`;
 }
 export function segmentOutputPath(key) {
-    return `segments/${normalizeKey(key)}.json`;
+    return `segments/${normalizeSegmentKey(key)}.json`;
 }
 /**
  * Translate one LaunchDarkly flag into a Quonfig feature-flag file.
@@ -199,7 +209,7 @@ export function translateSegment(segment, report) {
     // Trailing catch-all: anyone not matched above is not in the segment.
     rules.push({ criteria: [ALWAYS_TRUE], value: { type: 'bool', value: false } });
     const out = {
-        key: normalizeKey(segment.key),
+        key: normalizeSegmentKey(segment.key),
         type: 'segment',
         valueType: 'bool',
         default: { rules },

package/dist/migrate/sources/launchdarkly.js

@@ -164,7 +164,14 @@ async function* fetchChangesImpl() {
         yield { key: flag.key, raw: { data: flag, kind: 'flag' }, source: SOURCE_NAME };
     }
     for (const segment of snapshot.segments) {
-        yield { key: segment.key, raw: { data: segment, kind: 'segment' }, source: SOURCE_NAME };
+        // qfg-hbuy.10: LD segments are their own key namespace — tag them so the
+        // key rewriter can disambiguate a flag and a segment sharing one key.
+        yield {
+            key: segment.key,
+            keyNamespace: 'segment',
+            raw: { data: segment, kind: 'segment' },
+            source: SOURCE_NAME,
+        };
     }
 }
 /** Path to this run's audit-walk resume cursor (always under os.tmpdir; see filename comment). */
@@ -235,7 +242,13 @@ async function* fetchAuditHistory(apiKey) {
         }
     }
     for (const segment of segmentsByKey.values()) {
-        yield { key: segment.key, raw: { data: segment, kind: 'segment' }, source: SOURCE_NAME };
+        // qfg-hbuy.10: see the matching tag in fetchChangesImpl.
+        yield {
+            key: segment.key,
+            keyNamespace: 'segment',
+            raw: { data: segment, kind: 'segment' },
+            source: SOURCE_NAME,
+        };
     }
 }
 function translateImpl(change) {

package/dist/util/policy-a-key.d.ts

@@ -10,7 +10,9 @@
  *   - 1..200 chars (ASCII-only, so char length == byte length),
  *   - not the reserved key `"new"`,
  *   - no leading dot (a `.beta.json` config is silently skipped by the loader
- *     and `qfg verify`).
+ *     and `qfg verify`),
+ *   - no trailing dot or space (silently stripped on Windows), and
+ *   - the first dot-segment is not a Windows reserved device name (qfg-hbuy.6).
  *
  * NOTE the layering: this is the create boundary (hard). The general charset is
  * a *warning* in `qfg verify` (`src/verify/validate.ts`, qfg-6na9.5) during the
@@ -18,6 +20,18 @@
  * Keep the messages aligned with app-quonfig's for a consistent UX.
  */
 export declare const POLICY_A_KEY_RE: RegExp;
+/**
+ * Windows reserved device names (qfg-hbuy.6). Byte-identical mirror of
+ * app-quonfig `src/lib/domain/config-schemas.ts` `WINDOWS_RESERVED_DEVICE_NAME_RE`
+ * and the qfg-verify hook's FS-safety floor (`src/verify/validate.ts`
+ * `FS_SAFETY_FLOOR_CHECKS`). Matched case-insensitively against the FIRST
+ * dot-segment of the key (`k.split('.')[0]`), because Windows treats
+ * `con.anything` as the `con` device. So `con`, `CON`, and `com3.foo` are
+ * rejected while `foo.con`, `com10`, and `console` are fine. The audit
+ * (project/plans/26-07-policy-a-audit-findings.md) specifically wants these
+ * checks byte-identical across enforcement points — keep the regex in sync.
+ */
+export declare const WINDOWS_RESERVED_DEVICE_NAME_RE: RegExp;
 /**
  * Returns a human-readable error message for a key that violates Policy A, or
  * `null` if the key is valid. First failing rule wins (matches the order Zod

package/dist/util/policy-a-key.js

@@ -10,7 +10,9 @@
  *   - 1..200 chars (ASCII-only, so char length == byte length),
  *   - not the reserved key `"new"`,
  *   - no leading dot (a `.beta.json` config is silently skipped by the loader
- *     and `qfg verify`).
+ *     and `qfg verify`),
+ *   - no trailing dot or space (silently stripped on Windows), and
+ *   - the first dot-segment is not a Windows reserved device name (qfg-hbuy.6).
  *
  * NOTE the layering: this is the create boundary (hard). The general charset is
  * a *warning* in `qfg verify` (`src/verify/validate.ts`, qfg-6na9.5) during the
@@ -22,6 +24,18 @@
 // across both sources of truth — see the module doc above.
 // eslint-disable-next-line unicorn/better-regex
 export const POLICY_A_KEY_RE = /^[A-Za-z0-9._-]+$/;
+/**
+ * Windows reserved device names (qfg-hbuy.6). Byte-identical mirror of
+ * app-quonfig `src/lib/domain/config-schemas.ts` `WINDOWS_RESERVED_DEVICE_NAME_RE`
+ * and the qfg-verify hook's FS-safety floor (`src/verify/validate.ts`
+ * `FS_SAFETY_FLOOR_CHECKS`). Matched case-insensitively against the FIRST
+ * dot-segment of the key (`k.split('.')[0]`), because Windows treats
+ * `con.anything` as the `con` device. So `con`, `CON`, and `com3.foo` are
+ * rejected while `foo.con`, `com10`, and `console` are fine. The audit
+ * (project/plans/26-07-policy-a-audit-findings.md) specifically wants these
+ * checks byte-identical across enforcement points — keep the regex in sync.
+ */
+export const WINDOWS_RESERVED_DEVICE_NAME_RE = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
 /**
  * Returns a human-readable error message for a key that violates Policy A, or
  * `null` if the key is valid. First failing rule wins (matches the order Zod
@@ -38,5 +52,15 @@ export function policyAKeyError(key) {
         return 'Key can only contain letters, numbers, dots, dashes, and underscores';
     if (key.startsWith('.'))
         return 'Key cannot start with a dot';
+    // ── FS-safety floor parity with app-quonfig PolicyAKeySchema (qfg-hbuy.6) ──
+    // The charset above already covers the hook's control-char and
+    // Windows-reserved-char floor items; these two are the only floor items the
+    // charset alone permits. Without them the UI/create boundary accepts the key
+    // and the user gets a confusing 422 at push time instead of a clean error.
+    if (/[ .]$/.test(key))
+        return 'Key cannot end with a dot or space';
+    if (WINDOWS_RESERVED_DEVICE_NAME_RE.test(key.split('.')[0])) {
+        return 'Key cannot use a Windows reserved device name (con, prn, aux, nul, com1-9, lpt1-9) before the first dot';
+    }
     return null;
 }

package/dist/verify/standalone.d.ts

@@ -21,5 +21,12 @@
  * exists to catch (verified live on staging: a `configs/bad charset key.json`
  * push was accepted unvalidated). A listed-but-unreadable file is now a hard
  * failure (fail closed), not a silent skip.
+ *
+ * qfg-hbuy.4: enumerates RECURSIVELY (`-r`) and with NO name filtering. The
+ * old non-recursive listing plus `endsWith('.json') && !includes('/.')` filter
+ * meant dotfiles, nested paths (configs/sub/x.json), and case-variant
+ * extensions (FOO.JSON) never reached validation at all — ghost files that
+ * push fine but no loader reads. The hook must see EVERYTHING under the
+ * validated dirs; validateFileMap is the layer that decides what is an error.
  */
 export declare function readFilesFromCommit(commitOid: string, cwd?: string): Map<string, string>;