@quonfig/cli 0.2.0 → 0.2.1

package/dist/verify/validate.js

@@ -16,8 +16,9 @@
  *  - Log level constraints (valueType=log_level)
  *  - Referential integrity (IN_SEG/NOT_IN_SEG reference existing segments)
  *  - schemaKey references existing schemas
- *  - Schema-bound JSON values match their schema (Ajv, opt-in via
- *    `validateValues`; see validateBoundJsonValues)
+ *  - Schema-bound JSON values match their schema, and every schema compiles
+ *    (Ajv, opt-in via `validateValues`, which the CLI and the pre-receive
+ *    hook both set; see validateBoundJsonValues)
  *  - Rule structure (criteria + value present)
  *  - Value type consistency
  *  - Weighted values non-empty and consistent
@@ -574,6 +575,7 @@ export function validateWorkspace(workspaceDir, options = {}) {
     }
     // Second pass: referential integrity. Keep the plain skip-filter here —
     // ghost entries were already reported (once) by the first pass.
+    const cycleNodes = [];
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
@@ -603,6 +605,7 @@ export function validateWorkspace(workspaceDir, options = {}) {
             if (!result.success)
                 continue;
             const config = result.data;
+            cycleNodes.push({ config, raw: parsed, relPath });
             // Check segment references in criteria
             const segRefs = collectSegmentReferences(config);
             for (const ref of segRefs) {
@@ -646,6 +649,7 @@ export function validateWorkspace(workspaceDir, options = {}) {
             }
         }
     }
+    detectReferenceCycles(cycleNodes, issues);
     // Check for duplicate keys across directories (case-insensitive — see
     // detectDuplicateKeys).
     const uniqueConfigKeys = detectDuplicateKeys(allConfigs, 'key', issues);
@@ -878,6 +882,7 @@ export function validateFileMap(files, options = {}) {
             }
         }
     }
+    detectReferenceCycles(parsedConfigs, issues);
     // Duplicate keys (case-insensitive — see detectDuplicateKeys).
     detectDuplicateKeys(allConfigs, 'key', issues);
     detectDuplicateKeys(allSchemaFiles, 'schema key', issues);
@@ -936,8 +941,8 @@ function validateBoundJsonValues(raw, config, schemaDocuments, file, issues) {
 }
 /**
  * A schema that does not compile is an error on the schema file, bound or not.
- * Gated on `validateValues` with the value checks, so the pre-receive hook
- * leaves it off until phase 1b.
+ * Gated on `validateValues` with the value checks; the CLI and the pre-receive
+ * hook both turn it on.
  */
 function validateSchemaCompiles(schemaKey, schema, file, issues) {
     const compiled = compileSchema(schema);
@@ -1223,6 +1228,97 @@ function collectSegmentReferences(config) {
     }
     return refs;
 }
+/**
+ * Reject reference cycles that SDKs recurse through at eval time (qfg-9dxb.11):
+ * - segment -> segment via IN_SEG / NOT_IN_SEG criteria;
+ * - config -> config via `decryptWith` on a confidential value (the SDKs
+ *   resolve the key config's value to decrypt, and follow its decryptWith).
+ * An unguarded SDK recurses until the stack overflows (sdk-net: an
+ * uncatchable StackOverflowException), so a cycle is a hard error at write
+ * time. Edges to keys that do not exist are skipped — a missing segment is
+ * the reference error above. Each cycle is reported once, on the file of its
+ * lexicographically first key, with the path starting there.
+ */
+function detectReferenceCycles(nodes, issues) {
+    const segments = nodes.filter((n) => n.config.type === 'segment');
+    const segmentKeys = new Set(segments.map((n) => n.config.key));
+    reportCycles(segments.map((n) => ({
+        key: n.config.key,
+        relPath: n.relPath,
+        targets: collectSegmentReferences(n.config).filter((ref) => segmentKeys.has(ref)),
+    })), 'Segment reference cycle', 'Remove one of the IN_SEG / NOT_IN_SEG references in the cycle', issues);
+    const configKeys = new Set(nodes.map((n) => n.config.key));
+    reportCycles(nodes.map((n) => ({
+        key: n.config.key,
+        relPath: n.relPath,
+        targets: collectDecryptWithReferences(n.raw).filter((ref) => configKeys.has(ref)),
+    })), 'decryptWith cycle', 'A decryption key config must not itself be decrypted with a config in the cycle', issues);
+}
+function reportCycles(graph, label, suggestion, issues) {
+    const byKey = new Map(graph.map((n) => [n.key, n]));
+    const state = new Map();
+    const stack = [];
+    const seen = new Set();
+    function visit(key) {
+        state.set(key, 'visiting');
+        stack.push(key);
+        for (const target of [...new Set(byKey.get(key).targets)].sort()) {
+            const s = state.get(target);
+            if (s === 'visiting') {
+                const cycle = stack.slice(stack.indexOf(target));
+                const first = cycle.indexOf([...cycle].sort()[0]);
+                const rotated = [...cycle.slice(first), ...cycle.slice(0, first)];
+                const id = rotated.join('\0');
+                if (!seen.has(id)) {
+                    seen.add(id);
+                    issues.push({
+                        file: byKey.get(rotated[0]).relPath,
+                        message: `${label}: ${[...rotated, rotated[0]].join(' -> ')}`,
+                        severity: 'error',
+                        suggestion,
+                    });
+                }
+            }
+            else if (s === undefined) {
+                visit(target);
+            }
+        }
+        stack.pop();
+        state.set(key, 'done');
+    }
+    for (const key of [...byKey.keys()].sort()) {
+        if (!state.has(key))
+            visit(key);
+    }
+}
+/** decryptWith targets of every confidential value in a config's rules and variants. */
+function collectDecryptWithReferences(raw) {
+    const refs = [];
+    const doc = (raw ?? {});
+    function scanValue(value) {
+        if (!value || typeof value !== 'object')
+            return;
+        const v = value;
+        if (v.type === 'weighted_values') {
+            const wv = v.value;
+            for (const entry of wv?.weightedValues ?? [])
+                scanValue(entry?.value);
+            return;
+        }
+        if (v.confidential === true && typeof v.decryptWith === 'string')
+            refs.push(v.decryptWith);
+    }
+    function scanRules(rules) {
+        for (const rule of rules ?? [])
+            scanValue(rule?.value);
+    }
+    scanRules(doc.default?.rules);
+    for (const env of doc.environments ?? [])
+        scanRules(env?.rules);
+    for (const variant of doc.variants ?? [])
+        scanValue(variant?.value);
+    return refs;
+}
 function typeToDir(type) {
     for (const [dir, t] of Object.entries(DIR_TO_TYPE)) {
         if (t === type)

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.2.0";
+declare const _default: "0.2.1";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.2.0';
+export default '0.2.1';