@quonfig/cli 0.0.74 → 0.2.0

package/dist/verify/validate.js

@@ -16,11 +16,14 @@
  *  - Log level constraints (valueType=log_level)
  *  - Referential integrity (IN_SEG/NOT_IN_SEG reference existing segments)
  *  - schemaKey references existing schemas
+ *  - Schema-bound JSON values match their schema (Ajv, opt-in via
+ *    `validateValues`; see validateBoundJsonValues)
  *  - Rule structure (criteria + value present)
  *  - Value type consistency
  *  - Weighted values non-empty and consistent
  */
 import { z } from 'zod';
+import { compileSchema, validateAgainstSchema } from './schema-validator.js';
 // Inlined to keep this directory self-contained for the standalone bun-compile
 // build that runs as the qfg-verify pre-receive hook in app-gitea — that build
 // only copies cli/src/verify/, so any out-of-tree imports break it. Source of
@@ -157,9 +160,11 @@ const DIR_TO_TYPE = {
     segments: 'segment',
     'log-levels': 'log_level',
 };
+/** The directories a config document can live in. Source of truth. */
 const CONFIG_DIRS = new Set(Object.keys(DIR_TO_TYPE));
 const SCHEMA_DIRS = new Set(['schemas', 'schemas-protected']);
-const KNOWN_DIRS = new Set([...CONFIG_DIRS, ...SCHEMA_DIRS]);
+/** Every directory this validator owns: config documents plus schemas. */
+export const KNOWN_DIRS = new Set([...CONFIG_DIRS, ...SCHEMA_DIRS]);
 // ── Ghost-file prevention (qfg-hbuy.4) ──────────────────────────────────
 // Within the validated content dirs (KNOWN_DIRS), every entry must be a
 // top-level, non-dot, lowercase-`.json` file. Anything else used to be
@@ -295,7 +300,7 @@ import * as path from 'node:path';
 /**
  * Validate an entire workspace directory on disk.
  */
-export function validateWorkspace(workspaceDir) {
+export function validateWorkspace(workspaceDir, options = {}) {
     const issues = [];
     let filesChecked = 0;
     const stats = {
@@ -316,6 +321,7 @@ export function validateWorkspace(workspaceDir) {
     const allSchemaFiles = [];
     const segmentKeys = new Set();
     const schemaKeys = new Set();
+    const schemaDocuments = new Map();
     const declaredEnvIds = new Set();
     // Check for unexpected top-level entries
     let entries;
@@ -444,6 +450,9 @@ export function validateWorkspace(workspaceDir) {
                 }
                 const schemaKey = file.replace(/\.json$/, '');
                 schemaKeys.add(schemaKey);
+                schemaDocuments.set(schemaKey, result.data);
+                if (options.validateValues)
+                    validateSchemaCompiles(schemaKey, result.data, relPath, issues);
                 validateKey(schemaKey, relPath, issues);
                 allSchemaFiles.push({ key: schemaKey, file: relPath });
                 stats.schemas++;
@@ -619,6 +628,8 @@ export function validateWorkspace(workspaceDir) {
                     });
                 }
             }
+            if (options.validateValues)
+                validateBoundJsonValues(parsed, config, schemaDocuments, relPath, issues);
             // Check environment IDs referenced in config exist in quonfig.json
             if (declaredEnvIds.size > 0) {
                 for (const env of config.environments) {
@@ -664,13 +675,14 @@ function emptyStats() {
  * Validate configs provided as a map of { "dir/file.json": jsonString }.
  * Used by the pre-receive hook which reads files from git objects.
  */
-export function validateFileMap(files) {
+export function validateFileMap(files, options = {}) {
     const issues = [];
     let filesChecked = 0;
     const segmentKeys = new Set();
     const schemaKeys = new Set();
     const allSchemaFiles = [];
     const allConfigs = [];
+    const schemaDocuments = new Map();
     const parsedConfigs = [];
     const declaredEnvIds = new Set();
     // Validate quonfig.json if it's included in the file map (it may not be in every commit)
@@ -743,6 +755,9 @@ export function validateFileMap(files) {
             }
             const schemaKey = file.replace(/\.json$/, '');
             schemaKeys.add(schemaKey);
+            schemaDocuments.set(schemaKey, result.data);
+            if (options.validateValues)
+                validateSchemaCompiles(schemaKey, result.data, relPath, issues);
             validateKey(schemaKey, relPath, issues);
             allSchemaFiles.push({ key: schemaKey, file: relPath });
             continue;
@@ -824,10 +839,10 @@ export function validateFileMap(files) {
             validateRules(env.rules, relPath, `environments[${env.id}]`, config.valueType, issues, config.variants);
         }
         allConfigs.push({ key: config.key, file: relPath });
-        parsedConfigs.push({ relPath, config, dir });
+        parsedConfigs.push({ config, dir, raw: parsed, relPath });
     }
     // Referential integrity
-    for (const { relPath, config } of parsedConfigs) {
+    for (const { config, raw, relPath } of parsedConfigs) {
         const segRefs = collectSegmentReferences(config);
         for (const ref of segRefs) {
             if (!segmentKeys.has(ref)) {
@@ -847,6 +862,8 @@ export function validateFileMap(files) {
                 suggestion: `Create schemas/${config.schemaKey}.json or schemas-protected/${config.schemaKey}.json, or remove schemaKey`,
             });
         }
+        if (options.validateValues)
+            validateBoundJsonValues(raw, config, schemaDocuments, relPath, issues);
         // Check environment IDs referenced in config exist in quonfig.json
         if (declaredEnvIds.size > 0) {
             for (const env of config.environments) {
@@ -868,6 +885,79 @@ export function validateFileMap(files) {
     return { issues, filesChecked, valid: !hasErrors, stats: emptyStats() };
 }
 // ── Helpers ─────────────────────────────────────────────────────────────
+/**
+ * Validate a config's schema-bound JSON values (qfg-phcv). Scope matches the
+ * app's save gate (app-quonfig config-crud-handlers.ts findJsonBoundViolations)
+ * exactly:
+ * - only `type === "config"` with `valueType === "json"` and a `schemaKey`
+ *   whose schema exists (a missing schema is the reference error above);
+ * - every `{type: "json", value}` node anywhere in the RAW document: default
+ *   and environment rules, weighted-value entries, top-level variants.
+ *   `provided` values are not json nodes, so they are skipped;
+ * - one issue per violation, worded `Value does not match schema "<key>":
+ *   <document path>.<path in value>: <message>`;
+ * - a schema that does not compile is reported once, on the schema file
+ *   (validateSchemaCompiles), whether or not anything is bound to it. Values
+ *   bound to it are not reported again.
+ */
+function validateBoundJsonValues(raw, config, schemaDocuments, file, issues) {
+    if (config.type !== 'config' || config.valueType !== 'json' || !config.schemaKey)
+        return;
+    const schemaKey = config.schemaKey;
+    const schema = schemaDocuments.get(schemaKey);
+    if (!schema)
+        return;
+    const isPlainObject = (node) => typeof node === 'object' && node !== null && !Array.isArray(node);
+    // Returns true to stop the walk.
+    const walk = (node, docPath) => {
+        if (Array.isArray(node))
+            return node.some((child, index) => walk(child, `${docPath}[${index}]`));
+        if (!isPlainObject(node))
+            return false;
+        if (node.type === 'json' && 'value' in node) {
+            const valuePath = docPath || 'value';
+            const result = validateAgainstSchema(schema, node.value);
+            if (result.ok)
+                return false;
+            if (result.kind === 'invalid-schema')
+                return true;
+            for (const violation of result.violations) {
+                issues.push({
+                    file,
+                    message: `Value does not match schema "${schemaKey}": ${joinSchemaPath(valuePath, violation.path)}: ${violation.message}`,
+                    severity: 'error',
+                });
+            }
+            return false;
+        }
+        return Object.entries(node).some(([key, child]) => walk(child, docPath ? `${docPath}.${key}` : key));
+    };
+    walk(raw, '');
+}
+/**
+ * A schema that does not compile is an error on the schema file, bound or not.
+ * Gated on `validateValues` with the value checks, so the pre-receive hook
+ * leaves it off until phase 1b.
+ */
+function validateSchemaCompiles(schemaKey, schema, file, issues) {
+    const compiled = compileSchema(schema);
+    if (compiled.ok)
+        return;
+    issues.push({
+        file,
+        message: `schema ${schemaKey} is invalid: ${compiled.reason}`,
+        severity: 'error',
+        suggestion: `Fix the schema "${schemaKey}" so it compiles as JSON Schema draft 2020-12 or draft-07`,
+    });
+}
+/** Same as app-quonfig schema-json.ts joinSchemaPath: `[n]` attaches without a dot. */
+function joinSchemaPath(prefix, valuePath) {
+    if (!valuePath)
+        return prefix;
+    if (!prefix)
+        return valuePath;
+    return valuePath.startsWith('[') ? `${prefix}${valuePath}` : `${prefix}.${valuePath}`;
+}
 function validateEnvironmentIds(environments, file, issues) {
     for (const env of environments) {
         if (UUID_RE.test(env.id)) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.74";
+declare const _default: "0.2.0";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.74';
+export default '0.2.0';

package/oclif.manifest.json

@@ -3982,7 +3982,7 @@
           "type": "option"
         },
         "force": {
-          "description": "Force push even if remote already has commits",
+          "description": "Accepted and ignored (no-op). Bootstrap never rewrites the workspace history.",
           "name": "force",
           "allowNo": false,
           "type": "boolean"
@@ -4150,5 +4150,5 @@
       ]
     }
   },
-  "version": "0.0.74"
+  "version": "0.2.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.74",
+  "version": "0.2.0",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },
@@ -25,6 +25,8 @@
     "@quonfig/node": "^1.0.0",
     "acorn": "^8.10.0",
     "acorn-walk": "^8.3.5",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "chalk": "^5.6.2",
     "common-tags": "^1.8.2",
     "fuzzy": "^0.1.3",