@quonfig/cli 0.0.71 → 0.0.73

package/dist/commands/get.js

@@ -72,7 +72,9 @@ export default class Get extends APICommand {
         const providedByDep = config.dependencies?.find((dep) => dep.dependencyType === 'providedBy');
         if (providedByDep) {
             const envVarName = providedByDep.source;
-            this.log(`This config is provided by env var '${envVarName}'`);
+            // qfg-zvef: diagnostics go to stderr so stdout stays a bare value —
+            // `qfg get` is commonly used in `$(...)` substitutions.
+            this.logToStderr(`This config is provided by env var '${envVarName}'`);
             const envValue = process.env[envVarName];
             if (envValue === undefined) {
                 return this.err(`Environment variable '${envVarName}' is not set. Cannot resolve config '${key}'.`, {
@@ -82,7 +84,7 @@ export default class Get extends APICommand {
                 });
             }
             value = envValue;
-            this.log(`Successfully resolved config '${key}' from env var`);
+            this.logToStderr(`Successfully resolved config '${key}' from env var`);
         }
         const decryptWithDep = config.dependencies?.find((dep) => dep.dependencyType === 'decryptWith');
         if (decryptWithDep && decryptWithDep.config) {
@@ -90,7 +92,7 @@ export default class Get extends APICommand {
             const keyProvidedByDep = encryptionKeyConfig.dependencies?.find((dep) => dep.dependencyType === 'providedBy');
             if (keyProvidedByDep) {
                 const envVarName = keyProvidedByDep.source;
-                this.log(`This config is encrypted by key '${encryptionKeyConfig.key}' that should be found in env var '${envVarName}'`);
+                this.logToStderr(`This config is encrypted by key '${encryptionKeyConfig.key}' that should be found in env var '${envVarName}'`);
                 const encryptionKey = process.env[envVarName];
                 if (encryptionKey === undefined) {
                     return this.err(`Environment variable '${envVarName}' is not set. Cannot decrypt config '${key}'.`, {
@@ -107,7 +109,7 @@ export default class Get extends APICommand {
                 }
                 try {
                     value = decrypt(value, encryptionKey);
-                    this.log(`Successfully decrypted config '${key}'`);
+                    this.logToStderr(`Successfully decrypted config '${key}'`);
                 }
                 catch (error) {
                     const errorMessage = error instanceof Error ? error.message : String(error);

package/dist/commands/info.js

@@ -5,6 +5,7 @@ import autocomplete from '../util/autocomplete.js';
 import { getAppUrl } from '../util/domain-urls.js';
 import isInteractive from '../util/is-interactive.js';
 import nameArg from '../util/name-arg.js';
+import { isCatchAllRule } from '../util/rules.js';
 export default class Info extends APICommand {
     static aliases = ['flag:show', 'flag:info'];
     static args = { ...nameArg };
@@ -335,14 +336,11 @@ Related commands:
         }
         return this.extractSimpleValue(value);
     }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    // Anything that is not a catch-all targets someone. Both live catch-all
+    // spellings (`criteria: []` and all-ALWAYS_TRUE) are unconditional — one
+    // shared predicate, qfg-9kr8.
     hasNonTrivialCriteria(rule) {
-        if (!rule.criteria || rule.criteria.length === 0)
-            return false;
-        // ALWAYS_TRUE is not a real criteria - treat it as unconditional
-        if (rule.criteria.length === 1 && rule.criteria[0].operator === 'ALWAYS_TRUE')
-            return false;
-        return true;
+        return !isCatchAllRule(rule);
     }
     // A rule value is a "simple scalar" if it carries a literal value that can be
     // rendered inline next to "[override]". Rollouts ({type: 'weighted_values',
@@ -404,10 +402,8 @@ Related commands:
             }
             else if (envConfig.name === 'Default') {
                 // For Default environment, show the unconditional fallback value
-                // Find the ALWAYS_TRUE rule (usually the last rule)
-                const fallbackRule = envConfig.rules.find(
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                (r) => r.criteria?.length === 1 && r.criteria[0].operator === 'ALWAYS_TRUE');
+                // Find the unconditional rule (usually the last rule)
+                const fallbackRule = envConfig.rules.find((r) => isCatchAllRule(r));
                 displayValue = fallbackRule
                     ? this.formatValue(fallbackRule.value, false)
                     : this.formatValue(envConfig.rules[0].value, false);
@@ -430,7 +426,7 @@ Related commands:
                     }
                 }
                 else {
-                    // Only has unconditional rules (ALWAYS_TRUE) - show [see rules] to indicate env has custom config
+                    // Only has unconditional rules - show [see rules] to indicate env has custom config
                     displayValue = '[see rules]';
                 }
             }
@@ -443,9 +439,7 @@ Related commands:
             if (envConfig.rules && envConfig.rules.length > 0) {
                 if (envConfig.name === 'Default') {
                     // For Default, show the unconditional fallback value
-                    const fallbackRule = envConfig.rules.find(
-                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                    (r) => r.criteria?.length === 1 && r.criteria[0].operator === 'ALWAYS_TRUE');
+                    const fallbackRule = envConfig.rules.find((r) => isCatchAllRule(r));
                     const valueToShow = fallbackRule ? fallbackRule.value.value : envConfig.rules[0].value.value;
                     json[envConfig.name].value = valueToShow;
                 }

package/dist/commands/log-level.js

@@ -2,6 +2,7 @@ import { Args, Flags } from '@oclif/core';
 import { APICommand } from '../index.js';
 import { checkmark } from '../util/color.js';
 import { LOG_LEVELS, LOG_LEVEL_KEY_PREFIX, isLogLevel } from '../util/log-levels.js';
+import { seedScopeRules, upsertEnvRules } from '../util/rules.js';
 const SDK_LOGGER_CONTEXT = 'quonfig-sdk-logging.key';
 /**
  * Convenience command for log-level configs.
@@ -122,10 +123,14 @@ For more complex rules (regex, multi-criterion, exact match) edit the JSON:
         // Merge semantics: if an existing rule has the same exact targeting
         // criterion (same propertyName, same valueToMatch set), replace its value.
         // Otherwise insert the new rule before the catch-all so it takes priority.
-        const existingRules = environment ? findEnvRules(current, environment) : (current.default?.rules ?? []);
+        // An environment with no block of its own INHERITS default.rules at
+        // evaluation time, so the merge starts from a clone of those rules rather
+        // than from an empty list — otherwise writing one logger's level silently
+        // dropped every inherited rule for that environment (qfg-qjdm).
+        const { rules: existingRules } = seedScopeRules(current, environment);
         const mergedRules = mergeTargetingRule(existingRules, newRule);
         const logLevelPatch = environment
-            ? { environments: replaceEnvRules(current.environments ?? [], environment, mergedRules) }
+            ? { environments: upsertEnvRules(current.environments ?? [], environment, mergedRules) }
             : { default: { rules: mergedRules } };
         const updateRequest = await this.apiClient.post('/api/v1/logLevels/update', {
             workspaceId: this.workspaceId,
@@ -146,14 +151,6 @@ For more complex rules (regex, multi-criterion, exact match) edit the JSON:
         });
     }
 }
-function findEnvRules(config, environment) {
-    const env = (config.environments ?? []).find((e) => e.id === environment);
-    return env?.rules ?? [];
-}
-function replaceEnvRules(envs, environment, rules) {
-    const hasEnv = envs.some((e) => e.id === environment);
-    return hasEnv ? envs.map((e) => (e.id === environment ? { ...e, rules } : e)) : [...envs, { id: environment, rules }];
-}
 function mergeTargetingRule(existing, incoming) {
     const incomingTargets = new Set(stringListTargets(incoming.criteria[0].valueToMatch));
     const incomingPropertyName = incoming.criteria[0].propertyName;

package/dist/commands/set-default.d.ts

@@ -14,6 +14,7 @@ export default class SetDefault extends APICommand {
         confidential: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         'env-var': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         environment: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        'replace-targeting': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         value: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
     };
     run(): Promise<JsonObj | void>;

package/dist/commands/set-default.js

@@ -10,19 +10,22 @@ import { mapConfigValueToDto } from '../util/config-value-dto.js';
 import { makeConfidentialValue } from '../util/encryption.js';
 import isInteractive from '../util/is-interactive.js';
 import nameArg from '../util/name-arg.js';
+import { catchAllRule, countTargetingRules, keptTargetingNote, replacedTargetingNote, seedScopeRules, seededFromDefaultNote, upsertEnvRules, upsertFallbackRule, } from '../util/rules.js';
 import secretFlags, { parsedSecretFlags } from '../util/secret-flags.js';
 export default class SetDefault extends APICommand {
     static aliases = ['toggle'];
     static args = { ...nameArg };
-    static description = `Set the unconditional fallback value for a flag or config in a specific environment.
+    static description = `Set the fallback value for a flag or config in one environment.
 
-This updates the catch-all rule — the value users receive when NO targeting rule matches.
-Any targeting rules or percentage rollouts you have configured are NOT affected; they
-continue to fire before this fallback is evaluated.
+The fallback is the unconditional rule at the end of the environment's rule
+list: what users receive when no targeting rule matches. Targeting rules and
+percentage rollouts above it are kept, and the command tells you how many.
+If the environment has no rules of its own yet, they are copied from the
+flag's default rules first, so inherited targeting is kept too.
 
-"Other rules still apply" means: if you have rules targeting specific users, segments,
-or properties, those rules still take priority. This command only changes what everyone
-else sees.
+To turn a flag on or off for EVERYONE, including users matched by targeting
+rules, add --replace-targeting. This deletes the environment's targeting
+rules (they stay in git history).
 
 To set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:
   qfg set-rollout my.flag --environment production --true-percent 20
@@ -32,7 +35,7 @@ To see all current values and rules for a flag:
     static examples = [
         '<%= config.bin %> <%= command.id %> my.flag.name                                          # prompts for value and env',
         '<%= config.bin %> <%= command.id %> my.flag.name --value=true --environment=staging',
-        '<%= config.bin %> <%= command.id %> my.flag.name --value=false --environment=production   # kill-switch: turn off for everyone',
+        '<%= config.bin %> <%= command.id %> my.flag.name --value=false --environment=production --replace-targeting   # kill-switch: off for everyone',
         '<%= config.bin %> <%= command.id %> my.flag.name --value=true --secret',
         '<%= config.bin %> <%= command.id %> my.config.name --env-var=MY_ENV_VAR_NAME --environment=production',
         '# For a percentage rollout, use set-rollout instead:',
@@ -44,6 +47,10 @@ To see all current values and rules for a flag:
         confidential: Flags.boolean({ default: false, description: 'mark the value as confidential' }),
         'env-var': Flags.string({ description: 'environment variable to use as default value' }),
         environment: Flags.string({ description: 'environment to change' }),
+        'replace-targeting': Flags.boolean({
+            default: false,
+            description: "set the value for EVERYONE: delete this environment's targeting rules instead of keeping them (they stay in git history)",
+        }),
         value: Flags.string({ description: 'new default value' }),
         ...confirmFlag,
         ...secretFlags('encrypt the value of this item'),
@@ -95,28 +102,28 @@ To see all current values and rules for a flag:
             return this.err(`Could not find config named ${key}`);
         }
         this.verboseLog('Selected config:', config);
+        // Fetch the stored document ONCE. It drives encryption auto-detection,
+        // the targeting-rule count in the confirmation prompt, the rules the write
+        // is applied to, and the commitSha for optimistic concurrency.
+        const detailRequest = await this.apiClient.post('/api/v1/metadata/getByKey', {
+            workspaceId: this.workspaceId,
+            key,
+        });
+        if (!detailRequest.ok) {
+            return this.err(`Failed to fetch config details: ${detailRequest.status}`);
+        }
+        const currentConfig = detailRequest.json;
+        this.verboseLog('Config details:', currentConfig);
         // Check if existing config has encrypted values
-        if (!secret.selected) {
-            const configDetailsRequest = await this.apiClient.post('/api/v1/metadata/getByKey', {
-                workspaceId: this.workspaceId,
-                key,
-            });
-            if (configDetailsRequest.ok) {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const configDetails = configDetailsRequest.json;
-                this.verboseLog('Config details:', configDetails);
-                // Check if any existing rules have encrypted values
-                if (configDetails.default?.rules) {
-                    for (const rule of configDetails.default.rules) {
-                        if (rule.value?.decryptWith) {
-                            this.verboseLog('Auto-detected encryption from existing config');
-                            secret = {
-                                keyName: secret.keyName,
-                                selected: true,
-                            };
-                            break;
-                        }
-                    }
+        if (!secret.selected && currentConfig.default?.rules) {
+            for (const rule of currentConfig.default.rules) {
+                if (rule.value?.decryptWith) {
+                    this.verboseLog('Auto-detected encryption from existing config');
+                    secret = {
+                        keyName: secret.keyName,
+                        selected: true,
+                    };
+                    break;
                 }
             }
         }
@@ -131,22 +138,40 @@ To see all current values and rules for a flag:
         if (!environment) {
             return;
         }
+        // The scope this write targets: one environment's rule list, or the
+        // document's `default` block when the user picked [Default].
+        // environment.name is the slug stored in git files (e.g. "production");
+        // environment.id is the DB UUID and is never written to git files.
+        const envName = environment.id === '' ? undefined : environment.name;
+        const replaceTargeting = flags['replace-targeting'];
+        const scope = seedScopeRules(currentConfig, envName);
+        // A --replace-targeting write does NOT seed from default: there is nothing
+        // in that environment to replace, and the default rules it inherits are
+        // not being deleted, so reporting them as "replaced" would be a lie.
+        const targetingRuleCount = replaceTargeting && scope.seeded ? 0 : countTargetingRules(scope.rules);
+        const keptPhrase = targetingRuleCount > 0 ? ` (${targetingRuleCount} targeting rule${targetingRuleCount === 1 ? '' : 's'} kept)` : '';
+        const deletePhrase = targetingRuleCount > 0 ? `, deleting ${targetingRuleCount} targeting rule(s)` : '';
+        const confirmMessage = (valuePhrase) => replaceTargeting
+            ? `Confirm: set ${key} in ${environment.name} to ${valuePhrase} for EVERYONE${deletePhrase}? yes/no`
+            : `Confirm: set the fallback for ${key} in ${environment.name} to ${valuePhrase}?${keptPhrase} yes/no`;
         const { confidential } = flags;
         // Get the value
         if (flags['env-var']) {
-            if (!(await getConfirmation({
-                flags,
-                message: `Confirm: change the default for ${key} in ${environment.name} to be provided by \`${flags['env-var']}\`? yes/no`,
-            }))) {
+            if (!(await getConfirmation({ flags, message: confirmMessage(`be provided by \`${flags['env-var']}\``) }))) {
                 return;
             }
             return this.submitChange({
                 confidential,
                 config,
+                currentConfig,
+                envName,
                 envVar: flags['env-var'],
                 environment,
                 key,
+                replaceTargeting,
+                scope,
                 secret,
+                targetingRuleCount,
             });
         }
         let value = flags.value;
@@ -160,20 +185,24 @@ To see all current values and rules for a flag:
             return this.err('Value is required');
         }
         const secretMaybe = secret.selected ? ' (encrypted)' : '';
-        const message = `Confirm: change the default for ${key} in ${environment.name} to \`${value}\`${secretMaybe}? yes/no`;
-        if (!(await getConfirmation({ flags, message }))) {
+        if (!(await getConfirmation({ flags, message: confirmMessage(`\`${value}\`${secretMaybe}`) }))) {
             return;
         }
         return this.submitChange({
             confidential,
             config,
+            currentConfig,
+            envName,
             environment,
             key,
+            replaceTargeting,
+            scope,
             secret,
+            targetingRuleCount,
             value,
         });
     }
-    async submitChange({ confidential, config, envVar, environment, key, secret, value, }) {
+    async submitChange({ confidential, config, currentConfig, envName, envVar, environment, key, replaceTargeting, scope, secret, targetingRuleCount, value, }) {
         const typeMapping = {
             bool: 'bool',
             string: 'string',
@@ -187,9 +216,12 @@ To see all current values and rules for a flag:
         };
         const type = typeMapping[config.valueType.toLowerCase()] || config.valueType;
         let configValue;
-        let successMessage;
+        // How the new value is named in the prompt and the report — `\`true\``, or
+        // "be provided by `MY_ENV_VAR`" — plus any (encrypted)/(confidential) note.
+        let valuePhrase;
+        let modifiers = '';
         if (envVar === undefined) {
-            successMessage = `Successfully changed default to \`${value}\``;
+            valuePhrase = `\`${value}\``;
             if (secret.selected) {
                 // Handle encrypted values using shared utility
                 const encryptedValueResult = await makeConfidentialValue(this, value, secret, environment.name);
@@ -197,7 +229,7 @@ To see all current values and rules for a flag:
                     return this.err(encryptedValueResult.message || 'Failed to encrypt value');
                 }
                 configValue = mapConfigValueToDto(encryptedValueResult.value, ConfigValueType.String);
-                successMessage += ' (encrypted)';
+                modifiers += ' (encrypted)';
             }
             else {
                 // Parse the value based on type and build value object
@@ -253,41 +285,22 @@ To see all current values and rules for a flag:
             // ValueSchema discriminates on `type`; provided values are
             // {type: 'provided', value: {source, lookup}}. See qfg-84df.
             configValue = mapConfigValueToDto({ provided: { lookup: envVar, source: ProvidedSource.EnvVar } }, ConfigValueType.String);
-            successMessage = `Successfully changed default to be provided by \`${envVar}\``;
+            valuePhrase = `be provided by \`${envVar}\``;
         }
         if (confidential && !secret.selected) {
             configValue.confidential = true;
-            successMessage += ' (confidential)';
-        }
-        // Fetch the current full config to get the existing environments array and commitSha.
-        const detailRequest = await this.apiClient.post('/api/v1/metadata/getByKey', {
-            workspaceId: this.workspaceId,
-            key,
-        });
-        if (!detailRequest.ok) {
-            return this.err(`Failed to fetch config details: ${detailRequest.status}`);
-        }
-        const currentConfig = detailRequest.json;
-        // Build a single catch-all rule (empty criteria = matches everything).
-        const newRule = { criteria: [], value: configValue };
-        // For [Default] (environment.id === ''), update default.rules.
-        // For a specific environment, update the environments array.
-        let updateFields;
-        if (environment.id === '') {
-            // [Default] — no environment-specific block, update the catch-all default rules.
-            updateFields = { default: { rules: [newRule] } };
-        }
-        else {
-            // environment.name is the slug stored in git files (e.g. "production").
-            // environment.id is the DB UUID — never written to git files.
-            const envKey = environment.name;
-            const existingEnvs = currentConfig.environments ?? [];
-            const hasEnv = existingEnvs.some((e) => e.id === envKey);
-            const updatedEnvironments = hasEnv
-                ? existingEnvs.map((e) => (e.id === envKey ? { ...e, rules: [newRule] } : e))
-                : [...existingEnvs, { id: envKey, rules: [newRule] }];
-            updateFields = { environments: updatedEnvironments };
+            modifiers += ' (confidential)';
         }
+        // Surgical by default (qfg-qjdm): the fallback rule's value is replaced
+        // in place and every targeting rule around it is kept. --replace-targeting
+        // is the explicit opt-in to collapsing the scope to a single unconditional
+        // rule — the behavior this command used to have without saying so.
+        const newRules = replaceTargeting ? [catchAllRule(configValue)] : upsertFallbackRule(scope.rules, configValue);
+        // For [Default] (envName undefined), update default.rules.
+        // For a specific environment, upsert the environments array.
+        const updateFields = envName
+            ? { environments: upsertEnvRules(currentConfig.environments ?? [], envName, newRules) }
+            : { default: { rules: newRules } };
         this.verboseLog('Update fields:', JSON.stringify(updateFields, null, 2));
         // Route to the correct update endpoint based on config type.
         let request;
@@ -316,7 +329,28 @@ To see all current values and rules for a flag:
             });
         }
         if (request.ok) {
-            this.log(`${checkmark} ${successMessage}`);
+            // Always say what happened to the targeting rules — the whole point of
+            // qfg-97z9 was that this command changed them silently.
+            const scopeLabel = envName ?? 'the default';
+            const sentences = replaceTargeting
+                ? [
+                    `Set ${scopeLabel} to ${valuePhrase}${modifiers} for everyone.`,
+                    replacedTargetingNote(targetingRuleCount, currentConfig.commitSha),
+                ]
+                : [
+                    `Set ${scopeLabel} fallback to ${valuePhrase}${modifiers}.`,
+                    scope.seeded && envName ? seededFromDefaultNote(envName) : '',
+                    keptTargetingNote(targetingRuleCount),
+                ];
+            this.log(`${checkmark} ${sentences.filter(Boolean).join(' ')}`);
+            const counts = replaceTargeting
+                ? {
+                    previousCommitSha: currentConfig.commitSha,
+                    ...(targetingRuleCount > 0 ? { replacedTargetingRuleCount: targetingRuleCount } : {}),
+                }
+                : targetingRuleCount > 0
+                    ? { keptTargetingRuleCount: targetingRuleCount }
+                    : {};
             return {
                 environment: {
                     id: environment.id,
@@ -325,6 +359,7 @@ To see all current values and rules for a flag:
                 key,
                 success: true,
                 value,
+                ...counts,
             };
         }
         this.verboseLog(request.error);

package/dist/commands/set-rollout.d.ts

@@ -10,6 +10,7 @@ export default class SetRollout extends APICommand {
         environment: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'hash-by': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'true-percent': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        'replace-targeting': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         weights: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         confirm: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
     };

package/dist/commands/set-rollout.js

@@ -5,6 +5,7 @@ import getEnvironment from '../ui/get-environment.js';
 import { checkmark } from '../util/color.js';
 import isInteractive from '../util/is-interactive.js';
 import nameArg from '../util/name-arg.js';
+import { catchAllRule, countTargetingRules, keptTargetingNote, replacedTargetingNote, seedScopeRules, seededFromDefaultNote, upsertEnvRules, upsertFallbackRule, } from '../util/rules.js';
 const WEIGHT_TOTAL = 100_000;
 export default class SetRollout extends APICommand {
     static args = { ...nameArg };
@@ -27,6 +28,16 @@ Hashing: users are bucketed by the value of hashByPropertyName (default: "user.k
 Use --hash-by to change which property drives the bucket assignment:
   qfg set-rollout my.flag --environment production --true-percent 10 --hash-by user.id
 
+The rollout becomes the environment's fallback: the unconditional rule at the end
+of its rule list, what users receive when no targeting rule matches. Targeting
+rules above it are kept, and the command tells you how many. If the environment
+has no rules of its own yet, they are copied from the flag's default rules first,
+so inherited targeting is kept too.
+
+To roll out to EVERYONE, including users matched by targeting rules, add
+--replace-targeting. This deletes the environment's targeting rules (they stay in
+git history).
+
 For scripted / agent use, add --confirm to skip the interactive confirmation prompt.
 
 To combine a rollout with segment targeting (e.g. beta ON, holdout OFF, everyone else 50/50),
@@ -35,7 +46,7 @@ you need to edit the JSON config file directly:
   qfg pull --dir ./config     # clone workspace to edit
 
 To revert to a single value for everyone, use:
-  qfg set-default my.flag --environment production --value false
+  qfg set-default my.flag --environment production --value false --replace-targeting
 
 To inspect the current rollout:
   qfg info my.flag`;
@@ -43,7 +54,8 @@ To inspect the current rollout:
         '<%= config.bin %> <%= command.id %> my.feature.flag --environment production --true-percent 20',
         '<%= config.bin %> <%= command.id %> my.feature.flag --environment staging --true-percent 50',
         '<%= config.bin %> <%= command.id %> my.feature.flag --environment production --true-percent 100  # full rollout',
-        '<%= config.bin %> <%= command.id %> my.feature.flag --environment production --true-percent 0    # kill switch (all false)',
+        '# For a kill switch — false for EVERYONE, including targeted users — use set-default:',
+        '<%= config.bin %> set-default my.feature.flag --value=false --environment=production --replace-targeting',
         '<%= config.bin %> <%= command.id %> my.variant.flag --environment production --weights "control:50,treatment:50"',
         '<%= config.bin %> <%= command.id %> my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id',
     ];
@@ -58,6 +70,10 @@ To inspect the current rollout:
             max: 100,
             min: 0,
         }),
+        'replace-targeting': Flags.boolean({
+            default: false,
+            description: "roll out to EVERYONE: delete this environment's targeting rules instead of keeping them (they stay in git history)",
+        }),
         weights: Flags.string({
             description: 'comma-separated "value:percent" pairs that must sum to 100 (e.g. "true:20,false:80" or "red:33,green:33,blue:34")',
         }),
@@ -145,11 +161,8 @@ To inspect the current rollout:
         const rolloutDescription = weightedValues
             .map((wv) => `${wv.weight / 1000}% → ${JSON.stringify(wv.value.value)}`)
             .join(', ');
-        const message = `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}]? yes/no`;
-        if (!(await getConfirmation({ flags, message }))) {
-            return;
-        }
-        // Fetch the current full config to get commitSha and existing environments
+        // Fetch the current full config BEFORE confirming: the prompt has to say
+        // how many targeting rules the write keeps (or deletes).
         const detailRequest = await this.apiClient.post('/api/v1/metadata/getByKey', {
             workspaceId: this.workspaceId,
             key,
@@ -158,20 +171,34 @@ To inspect the current rollout:
             return this.err(`Failed to fetch config details: ${detailRequest.status}`);
         }
         const currentConfig = detailRequest.json;
-        const newRule = { criteria: [], value: rolloutValue };
-        const envKey = environment.name;
-        const existingEnvs = currentConfig.environments ?? [];
-        const hasEnv = existingEnvs.some((e) => e.id === envKey);
-        const updatedEnvironments = hasEnv
-            ? existingEnvs.map((e) => (e.id === envKey ? { ...e, rules: [newRule] } : e))
-            : [...existingEnvs, { id: envKey, rules: [newRule] }];
+        // The scope this write targets: one environment's rule list, or the
+        // document's `default` block when the user picked [Default].
+        const envName = environment.id === '' ? undefined : environment.name;
+        const replaceTargeting = flags['replace-targeting'];
+        const scope = seedScopeRules(currentConfig, envName);
+        // A --replace-targeting write does NOT seed from default: there is nothing
+        // in that environment to replace.
+        const targetingRuleCount = replaceTargeting && scope.seeded ? 0 : countTargetingRules(scope.rules);
+        const keptPhrase = targetingRuleCount > 0 ? ` (${targetingRuleCount} targeting rule${targetingRuleCount === 1 ? '' : 's'} kept)` : '';
+        const deletePhrase = targetingRuleCount > 0 ? `, deleting ${targetingRuleCount} targeting rule(s)` : '';
+        const message = replaceTargeting
+            ? `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}] for EVERYONE${deletePhrase}? yes/no`
+            : `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}]?${keptPhrase} yes/no`;
+        if (!(await getConfirmation({ flags, message }))) {
+            return;
+        }
+        // Surgical by default (qfg-qjdm): the rollout replaces the FALLBACK rule's
+        // value and every targeting rule around it is kept. A newly appended
+        // catch-all uses the ALWAYS_TRUE spelling (qfg-gv54); an existing fallback
+        // keeps whichever spelling it already had.
+        const newRules = replaceTargeting ? [catchAllRule(rolloutValue)] : upsertFallbackRule(scope.rules, rolloutValue);
         // Auto-create variants when the config has none. The UI cannot render a
         // rollout without named variants, and the server/gitea verify now rejects
         // it. Bool configs are exempt — the UI supplies implicit true/false variants.
         const existingVariants = currentConfig.variants ?? [];
-        const updateFields = {
-            environments: updatedEnvironments,
-        };
+        const updateFields = envName
+            ? { environments: upsertEnvRules(currentConfig.environments ?? [], envName, newRules) }
+            : { default: { rules: newRules } };
         if (existingVariants.length === 0 && config.valueType !== 'bool') {
             const synthesized = synthesizeVariants(weightedValues);
             if (synthesized.length > 0) {
@@ -198,7 +225,26 @@ To inspect the current rollout:
             });
         }
         if (request.ok) {
-            this.log(`${checkmark} Rollout set: ${key} in ${environment.name} → [${rolloutDescription}]`);
+            const scopeLabel = envName ?? 'the default';
+            const sentences = replaceTargeting
+                ? [
+                    `Rollout set: ${key} in ${scopeLabel} → [${rolloutDescription}] for everyone.`,
+                    replacedTargetingNote(targetingRuleCount, currentConfig.commitSha),
+                ]
+                : [
+                    `Rollout set: ${key} in ${scopeLabel} → [${rolloutDescription}].`,
+                    scope.seeded && envName ? seededFromDefaultNote(envName) : '',
+                    keptTargetingNote(targetingRuleCount),
+                ];
+            this.log(`${checkmark} ${sentences.filter(Boolean).join(' ')}`);
+            const counts = replaceTargeting
+                ? {
+                    previousCommitSha: currentConfig.commitSha,
+                    ...(targetingRuleCount > 0 ? { replacedTargetingRuleCount: targetingRuleCount } : {}),
+                }
+                : targetingRuleCount > 0
+                    ? { keptTargetingRuleCount: targetingRuleCount }
+                    : {};
             return {
                 environment: { id: environment.id, name: environment.name },
                 hashByPropertyName: flags['hash-by'],
@@ -206,6 +252,7 @@ To inspect the current rollout:
                 rollout: rolloutDescription,
                 success: true,
                 weightedValues,
+                ...counts,
             };
         }
         this.verboseLog(request.error);

package/dist/commands/workspace.d.ts

@@ -13,9 +13,18 @@ export default class Workspace extends BaseCommand {
     private activePin;
     /**
      * Fan out across every cached org's token and merge the results. One org's
-     * stale token doesn't block the others — we verbose-log and continue.
+     * stale token doesn't block the others — that isolation is deliberate for
+     * multi-org accounts. What is NOT ok (qfg-t15h) is losing the fact that an
+     * org failed: each failure is returned so the caller can decide between a
+     * hard session-expired error (nothing listed) and a per-org warning
+     * alongside the orgs that did answer.
      */
     private fetchAllOrgsWorkspaces;
+    /**
+     * qfg-t15h: returns a tagged result rather than a bare array, so a 401 or a
+     * dead connection is distinguishable from an org that genuinely has no
+     * workspaces yet.
+     */
     private fetchWorkspaces;
     /**
      * Pin the default-profile workspaceId to org/ws form by looking it up in