@quonfig/cli 0.2.0 → 0.2.2

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.2.0 linux-x64 node-v24.4.1
+@quonfig/cli/0.2.2 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -201,7 +201,7 @@ EXAMPLES
   $ qfg activity restore my.flag --yes
 ```
 
-_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/activity.ts)_
+_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/activity.ts)_
 
 ## `qfg activity deleted`
 
@@ -230,7 +230,7 @@ EXAMPLES
   $ qfg activity deleted --json
 ```
 
-_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/activity/deleted.ts)_
+_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/activity/deleted.ts)_
 
 ## `qfg activity feed`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ qfg activity feed --json
 ```
 
-_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/activity/feed.ts)_
+_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/activity/feed.ts)_
 
 ## `qfg activity history [NAME]`
 
@@ -299,7 +299,7 @@ EXAMPLES
   $ qfg activity history request.timeout --json
 ```
 
-_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/activity/history.ts)_
+_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/activity/history.ts)_
 
 ## `qfg activity restore [NAME]`
 
@@ -338,7 +338,7 @@ EXAMPLES
   $ qfg activity restore request.timeout --type config --yes
 ```
 
-_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/activity/restore.ts)_
+_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/activity/restore.ts)_
 
 ## `qfg audit-log [NAME]`
 
@@ -366,7 +366,7 @@ EXAMPLES
   $ qfg audit-log my.flag
 ```
 
-_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/audit-log.ts)_
+_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/audit-log.ts)_
 
 ## `qfg cleanup`
 
@@ -407,7 +407,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key
 ```
 
-_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/cleanup.ts)_
+_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/cleanup.ts)_
 
 ## `qfg cleanup list`
 
@@ -453,7 +453,7 @@ EXAMPLES
   $ qfg cleanup list --json
 ```
 
-_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/cleanup/list.ts)_
+_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/cleanup/list.ts)_
 
 ## `qfg cleanup remove [NAME]`
 
@@ -498,7 +498,7 @@ EXAMPLES
   $ qfg cleanup remove my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/cleanup/remove.ts)_
+_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/cleanup/remove.ts)_
 
 ## `qfg cleanup status [NAME]`
 
@@ -538,7 +538,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/cleanup/status.ts)_
+_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/cleanup/status.ts)_
 
 ## `qfg cleanup verify [NAME]`
 
@@ -584,7 +584,7 @@ EXAMPLES
   $ qfg cleanup verify my.flag.key && qfg delete my.flag.key
 ```
 
-_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/cleanup/verify.ts)_
+_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/cleanup/verify.ts)_
 
 ## `qfg config-schema`
 
@@ -613,7 +613,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -700,7 +700,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -746,7 +746,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -950,7 +950,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -973,7 +973,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/get.ts)_
 
 ## `qfg history NAME`
 
@@ -1031,7 +1031,7 @@ EXAMPLES
   $ qfg history my.flag
 ```
 
-_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/history.ts)_
+_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/history.ts)_
 
 ## `qfg info [NAME]`
 
@@ -1079,7 +1079,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -1119,7 +1119,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -1149,7 +1149,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -1189,7 +1189,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/list.ts)_
 
 ## `qfg log`
 
@@ -1214,7 +1214,7 @@ EXAMPLES
   $ qfg log --limit 5
 ```
 
-_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/log.ts)_
+_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/log.ts)_
 
 ## `qfg log-level NAME`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -1304,7 +1304,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -1327,7 +1327,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -1392,7 +1392,7 @@ EXAMPLES
   $ qfg migrate --from launch --source-api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -1430,7 +1430,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -1462,7 +1462,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -1493,7 +1493,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -1548,7 +1548,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1595,7 +1595,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1644,7 +1644,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/push.ts)_
 
 ## `qfg run [COMMAND]`
 
@@ -1695,7 +1695,7 @@ EXAMPLES
   $ qfg run --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test
 ```
 
-_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/run.ts)_
+_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/run.ts)_
 
 ## `qfg schema NAME`
 
@@ -1733,7 +1733,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1760,7 +1760,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1792,7 +1792,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1821,7 +1821,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1848,7 +1848,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg serve`
 
@@ -1906,7 +1906,7 @@ EXAMPLES
   $ qfg serve --port 6581 --frontend-sdk-key PUBLIC_KEY
 ```
 
-_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/serve.ts)_
+_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/serve.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1982,7 +1982,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -2073,7 +2073,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -2105,7 +2105,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -2212,7 +2212,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -2235,7 +2235,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -2258,7 +2258,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -2291,7 +2291,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -2325,7 +2325,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -2353,7 +2353,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.2.0/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.2.2/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/verify/map-key-order.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Integer map key order warning (qfg-e87r.21).
+ *
+ * JavaScript objects always put integer keys first, ascending, then every
+ * other key in insertion order. The app editor reads a value with JSON.parse
+ * and saves it with JSON.stringify, so a hand-written map
+ * `{"b": 2, "a": 1, "5": 0}` comes back from an app save as
+ * `{"5": 0, "b": 2, "a": 1}`. Nothing is lost, but git gets a one-time
+ * key-order diff. This check warns about it up front.
+ *
+ * Scope: maps only, meaning objects under an `additionalProperties` schema
+ * (keys the author chooses). Objects with only schema-fixed `properties` are
+ * skipped. A map is checked only if it has at least one integer key, and the
+ * file text is scanned for the real key order (JSON.parse already reorders)
+ * only if some map has one.
+ *
+ * Lives inside cli/src/verify/ because the app-gitea hook build only copies
+ * this directory (see validate.ts). No dependencies on purpose.
+ */
+type Segment = number | string;
+type Schema = Record<string, unknown>;
+export interface KeyOrderWarning {
+    integerKeys: string[];
+    path: string;
+}
+/** True for keys JavaScript moves to the front: "0", "5", "1001"; not "007", "-1", "1.5". */
+export declare function isIntegerKey(key: string): boolean;
+/**
+ * Find maps in `value` (walked with `schema`) whose key order in the file
+ * would change on an app save. `readOrderedValue` returns `value` as written
+ * in the file (see scanOrderedJson); it is only called when some map has an
+ * integer key, so maps without one cost nothing extra.
+ */
+export declare function findMapKeyOrderWarnings(schema: Schema, value: unknown, readOrderedValue: () => OrderedNode | undefined, basePath: string): KeyOrderWarning[];
+export type OrderedNode = {
+    entries: Map<string, OrderedNode>;
+    keys: string[];
+    kind: 'object';
+} | {
+    items: OrderedNode[];
+    kind: 'array';
+} | {
+    kind: 'scalar';
+};
+export declare function navigate(node: OrderedNode, segments: Segment[]): OrderedNode | undefined;
+/**
+ * Parse JSON text keeping each object's keys in file order. Duplicate keys
+ * keep their first position, as JavaScript does. Returns undefined on text
+ * that is not JSON (JSON.parse has already reported it).
+ */
+export declare function scanOrderedJson(text: string): OrderedNode | undefined;
+export {};

package/dist/verify/map-key-order.js

@@ -0,0 +1,246 @@
+/**
+ * Integer map key order warning (qfg-e87r.21).
+ *
+ * JavaScript objects always put integer keys first, ascending, then every
+ * other key in insertion order. The app editor reads a value with JSON.parse
+ * and saves it with JSON.stringify, so a hand-written map
+ * `{"b": 2, "a": 1, "5": 0}` comes back from an app save as
+ * `{"5": 0, "b": 2, "a": 1}`. Nothing is lost, but git gets a one-time
+ * key-order diff. This check warns about it up front.
+ *
+ * Scope: maps only, meaning objects under an `additionalProperties` schema
+ * (keys the author chooses). Objects with only schema-fixed `properties` are
+ * skipped. A map is checked only if it has at least one integer key, and the
+ * file text is scanned for the real key order (JSON.parse already reorders)
+ * only if some map has one.
+ *
+ * Lives inside cli/src/verify/ because the app-gitea hook build only copies
+ * this directory (see validate.ts). No dependencies on purpose.
+ */
+/** Largest array index in JavaScript: 2^32 - 2. */
+const MAX_INTEGER_KEY = 4_294_967_294;
+/** True for keys JavaScript moves to the front: "0", "5", "1001"; not "007", "-1", "1.5". */
+export function isIntegerKey(key) {
+    return /^(?:0|[1-9]\d*)$/.test(key) && Number(key) <= MAX_INTEGER_KEY;
+}
+const isPlainObject = (node) => typeof node === 'object' && node !== null && !Array.isArray(node);
+/**
+ * Find maps in `value` (walked with `schema`) whose key order in the file
+ * would change on an app save. `readOrderedValue` returns `value` as written
+ * in the file (see scanOrderedJson); it is only called when some map has an
+ * integer key, so maps without one cost nothing extra.
+ */
+export function findMapKeyOrderWarnings(schema, value, readOrderedValue, basePath) {
+    const candidates = new Map();
+    const walk = (node, nodeSchema, segments, depth) => {
+        if (depth > 64)
+            return;
+        const schemas = expandSchema(schema, nodeSchema);
+        if (schemas.length === 0)
+            return;
+        if (Array.isArray(node)) {
+            for (const [index, child] of node.entries()) {
+                for (const s of schemas)
+                    walk(child, itemSchema(s, index), [...segments, index], depth + 1);
+            }
+            return;
+        }
+        if (!isPlainObject(node))
+            return;
+        const keys = Object.keys(node);
+        if (schemas.some((s) => isMapSchema(s)) && keys.some((k) => isIntegerKey(k))) {
+            candidates.set(formatPath(basePath, segments), segments);
+        }
+        for (const key of keys) {
+            for (const s of schemas) {
+                const child = propertySchema(s, key);
+                if (child !== undefined)
+                    walk(node[key], child, [...segments, key], depth + 1);
+            }
+        }
+    };
+    walk(value, schema, [], 0);
+    if (candidates.size === 0)
+        return [];
+    const ordered = readOrderedValue();
+    if (!ordered)
+        return [];
+    const warnings = [];
+    for (const [path, segments] of candidates) {
+        const node = navigate(ordered, segments);
+        if (node?.kind !== 'object')
+            continue;
+        const keys = node.keys;
+        const integerKeys = keys.filter((k) => isIntegerKey(k));
+        const saved = [...integerKeys].sort((a, b) => Number(a) - Number(b));
+        saved.push(...keys.filter((k) => !isIntegerKey(k)));
+        if (saved.every((k, i) => k === keys[i]))
+            continue;
+        warnings.push({ integerKeys, path });
+    }
+    return warnings.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+// ── Schema navigation ───────────────────────────────────────────────────
+function isMapSchema(schema) {
+    return schema.additionalProperties === true || isPlainObject(schema.additionalProperties);
+}
+/** Resolve local `$ref`s and flatten allOf/anyOf/oneOf into the schemas that apply. */
+function expandSchema(root, schema, seen = new Set()) {
+    if (!isPlainObject(schema) || seen.has(schema))
+        return [];
+    seen.add(schema);
+    const out = [schema];
+    if (typeof schema.$ref === 'string')
+        out.push(...expandSchema(root, resolveRef(root, schema.$ref), seen));
+    for (const keyword of ['allOf', 'anyOf', 'oneOf']) {
+        const branches = schema[keyword];
+        if (Array.isArray(branches))
+            for (const branch of branches)
+                out.push(...expandSchema(root, branch, seen));
+    }
+    return out;
+}
+function resolveRef(root, ref) {
+    if (!ref.startsWith('#'))
+        return undefined;
+    let node = root;
+    for (const raw of ref.slice(1).split('/').filter(Boolean)) {
+        const part = decodeURIComponent(raw).replaceAll('~1', '/').replaceAll('~0', '~');
+        if (!isPlainObject(node))
+            return undefined;
+        node = node[part];
+    }
+    return node;
+}
+function propertySchema(schema, key) {
+    const properties = schema.properties;
+    if (isPlainObject(properties) && key in properties)
+        return properties[key];
+    return isMapSchema(schema) ? schema.additionalProperties : undefined;
+}
+function itemSchema(schema, index) {
+    if (Array.isArray(schema.prefixItems) && index < schema.prefixItems.length)
+        return schema.prefixItems[index];
+    // draft-07 tuple form
+    if (Array.isArray(schema.items))
+        return index < schema.items.length ? schema.items[index] : schema.additionalItems;
+    return schema.items;
+}
+function formatPath(base, segments) {
+    let out = base;
+    for (const segment of segments)
+        out += typeof segment === 'number' ? `[${segment}]` : `.${segment}`;
+    return out;
+}
+export function navigate(node, segments) {
+    let current = node;
+    for (const segment of segments) {
+        if (current?.kind === 'object' && typeof segment === 'string')
+            current = current.entries.get(segment);
+        else if (current?.kind === 'array' && typeof segment === 'number')
+            current = current.items[segment];
+        else
+            return undefined;
+    }
+    return current;
+}
+/**
+ * Parse JSON text keeping each object's keys in file order. Duplicate keys
+ * keep their first position, as JavaScript does. Returns undefined on text
+ * that is not JSON (JSON.parse has already reported it).
+ */
+export function scanOrderedJson(text) {
+    let pos = 0;
+    const skipWhitespace = () => {
+        while (pos < text.length && ' \t\n\r'.includes(text[pos]))
+            pos++;
+    };
+    const readString = () => {
+        const start = pos;
+        pos++; // opening quote
+        while (pos < text.length && text[pos] !== '"')
+            pos += text[pos] === '\\' ? 2 : 1;
+        if (pos >= text.length)
+            throw new Error('unterminated string');
+        pos++; // closing quote
+        return JSON.parse(text.slice(start, pos));
+    };
+    const readValue = () => {
+        skipWhitespace();
+        const ch = text[pos];
+        if (ch === '{') {
+            pos++;
+            const keys = [];
+            const entries = new Map();
+            skipWhitespace();
+            if (text[pos] === '}') {
+                pos++;
+                return { entries, keys, kind: 'object' };
+            }
+            for (;;) {
+                skipWhitespace();
+                if (text[pos] !== '"')
+                    throw new Error('expected key');
+                const key = readString();
+                skipWhitespace();
+                if (text[pos] !== ':')
+                    throw new Error('expected colon');
+                pos++;
+                const child = readValue();
+                if (!entries.has(key))
+                    keys.push(key);
+                entries.set(key, child);
+                skipWhitespace();
+                if (text[pos] === ',') {
+                    pos++;
+                    continue;
+                }
+                if (text[pos] === '}') {
+                    pos++;
+                    return { entries, keys, kind: 'object' };
+                }
+                throw new Error('expected , or }');
+            }
+        }
+        if (ch === '[') {
+            pos++;
+            const items = [];
+            skipWhitespace();
+            if (text[pos] === ']') {
+                pos++;
+                return { items, kind: 'array' };
+            }
+            for (;;) {
+                items.push(readValue());
+                skipWhitespace();
+                if (text[pos] === ',') {
+                    pos++;
+                    continue;
+                }
+                if (text[pos] === ']') {
+                    pos++;
+                    return { items, kind: 'array' };
+                }
+                throw new Error('expected , or ]');
+            }
+        }
+        if (ch === '"') {
+            readString();
+            return { kind: 'scalar' };
+        }
+        const start = pos;
+        while (pos < text.length && !',}] \t\n\r'.includes(text[pos]))
+            pos++;
+        if (pos === start)
+            throw new Error('expected value');
+        return { kind: 'scalar' };
+    };
+    try {
+        const node = readValue();
+        skipWhitespace();
+        return pos === text.length ? node : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/verify/schema-validator.js

@@ -15,9 +15,9 @@
  *   collide in the shared Ajv instance.
  *
  * Lives inside cli/src/verify/ because the app-gitea hook build only copies
- * this directory (see validate.ts). The hook does not run value validation
- * yet (phase 1b), but it compiles this file, so app-gitea/Dockerfile must
- * install `ajv` and `ajv-formats`.
+ * this directory (see validate.ts). The hook runs value validation
+ * (qfg-q5f6.10), so app-gitea/Dockerfile must install `ajv` and
+ * `ajv-formats`.
  *
  * Imports: the CLI is ESM with nodenext resolution and Ajv ships CommonJS, so
  * the default import may be the class or the module object depending on the

package/dist/verify/standalone.js

@@ -97,7 +97,10 @@ export function runHookChecks(refs, opts) {
         log(`qfg-verify: validating ${ref.refName} (${ref.newOid.slice(0, 8)})`);
         try {
             const files = readFilesFromCommit(ref.newOid, cwd);
-            const result = validateFileMap(files);
+            // validateValues: schema-bound JSON values must match their schema and
+            // every schema must compile, same as the CLI and the app (qfg-q5f6.10,
+            // plan 2026-09-25-advanced-schema-for-jev.md W1b Decision 10).
+            const result = validateFileMap(files, { validateValues: true });
             log(formatResult(result));
             if (!result.valid) {
                 hasErrors = true;
@@ -255,28 +258,57 @@ main is append-only: every push must fast-forward from the current tip. What to
 export function readFilesFromCommit(commitOid, cwd) {
     const files = new Map();
     const dirs = ['configs', 'feature-flags', 'segments', 'log-levels', 'schemas', 'schemas-protected'];
-    for (const dir of dirs) {
-        // List every leaf entry under this directory at the given commit. A
-        // directory that doesn't exist yields an empty listing (exit 0); a
-        // bad/unreadable OID throws — fail closed, the hook rejects the push.
-        const listing = execFileSync('git', ['ls-tree', '-z', '-r', '--name-only', commitOid, `${dir}/`], {
-            cwd,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        const filenames = listing.split('\0').filter(Boolean);
-        for (const filePath of filenames) {
-            // Fail closed: if a listed entry can't be read (bad object, submodule
-            // gitlink, ...), the push must not be accepted with that entry
-            // unvalidated — let the error propagate to the hook's per-ref handler,
-            // which rejects the push.
-            const content = execFileSync('git', ['show', `${commitOid}:${filePath}`], {
-                cwd,
-                encoding: 'utf8',
-                stdio: ['pipe', 'pipe', 'pipe'],
-            });
-            files.set(filePath, content);
+    // qfg-3nyi: exactly two git processes per call, whatever the tree size. One
+    // `git show` per file cost ~10s on a 620-file workspace, all of it spawns.
+    //
+    // List every leaf entry under the validated dirs at the given commit. A dir
+    // that doesn't exist yields nothing (exit 0); a bad/unreadable OID throws —
+    // fail closed, the hook rejects the push.
+    const listing = execFileSync('git', ['ls-tree', '-z', '-r', commitOid, '--', ...dirs.map((dir) => `${dir}/`)], {
+        cwd,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    // Each entry is `<mode> SP <type> SP <oid> TAB <path>`.
+    const entries = listing
+        .split('\0')
+        .filter(Boolean)
+        .map((entry) => {
+        const tab = entry.indexOf('\t');
+        const [, type, oid] = entry.slice(0, tab).split(' ');
+        return { filePath: entry.slice(tab + 1), oid, type };
+    });
+    // Fail closed: an entry that isn't a readable blob (submodule gitlink, bad
+    // object, ...) must not be accepted unvalidated. Throwing reaches the
+    // hook's per-ref handler, which rejects the push.
+    for (const { filePath, type } of entries) {
+        if (type !== 'blob')
+            throw new Error(`cannot read ${filePath}: tree entry is a ${type}, not a file`);
+    }
+    if (entries.length === 0)
+        return files;
+    const output = execFileSync('git', ['cat-file', '--batch'], {
+        cwd,
+        input: entries.map(({ oid }) => oid).join('\n') + '\n',
+        // The whole tree comes back in one buffer; execFileSync's 1MB default
+        // would fail a large workspace.
+        maxBuffer: 1024 ** 3,
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    // Replies come in request order: `<oid> SP blob SP <size> LF <bytes> LF`, or
+    // `<oid> SP missing LF`. Sizes are bytes, so slice the Buffer before decoding.
+    let offset = 0;
+    for (const { filePath, oid } of entries) {
+        const headerEnd = output.indexOf(0x0a, offset);
+        const header = headerEnd === -1 ? '' : output.subarray(offset, headerEnd).toString('utf8');
+        const [replyOid, replyType, size] = header.split(' ');
+        if (replyOid !== oid || replyType !== 'blob') {
+            throw new Error(`cannot read ${filePath}: git cat-file replied "${header}"`);
         }
+        const start = headerEnd + 1;
+        const end = start + Number(size);
+        files.set(filePath, output.subarray(start, end).toString('utf8'));
+        offset = end + 1;
     }
     return files;
 }

package/dist/verify/validate.d.ts

@@ -16,8 +16,11 @@
  *  - Log level constraints (valueType=log_level)
  *  - Referential integrity (IN_SEG/NOT_IN_SEG reference existing segments)
  *  - schemaKey references existing schemas
- *  - Schema-bound JSON values match their schema (Ajv, opt-in via
- *    `validateValues`; see validateBoundJsonValues)
+ *  - Schema-bound JSON values match their schema, and every schema compiles
+ *    (Ajv, opt-in via `validateValues`, which the CLI and the pre-receive
+ *    hook both set; see validateBoundJsonValues)
+ *  - Warning: a schema map whose integer keys an app save would move to the
+ *    front (same gate; see warnMapKeyOrder)
  *  - Rule structure (criteria + value present)
  *  - Value type consistency
  *  - Weighted values non-empty and consistent
@@ -46,10 +49,10 @@ export interface ValidationStats {
 export interface ValidateOptions {
     /**
      * Validate every schema-bound JSON value against its schema with Ajv
-     * (qfg-phcv). The CLI callers (`qfg verify`, `qfg push`, `qfg workspace
-     * bootstrap`, `qfg migrate --push`) turn it on. The pre-receive hook
-     * (standalone.ts) leaves it OFF until phase 1b (plan
-     * 2026-09-25-advanced-schema-for-jev.md W1b).
+     * (qfg-phcv), and check that every schema compiles. The CLI callers (`qfg
+     * verify`, `qfg push`, `qfg workspace bootstrap`, `qfg migrate --push`) and
+     * the pre-receive hook (standalone.ts, since qfg-q5f6.10 / plan
+     * 2026-09-25-advanced-schema-for-jev.md W1b) all turn it on.
      */
     validateValues?: boolean;
 }

package/dist/verify/validate.js

@@ -16,13 +16,17 @@
  *  - Log level constraints (valueType=log_level)
  *  - Referential integrity (IN_SEG/NOT_IN_SEG reference existing segments)
  *  - schemaKey references existing schemas
- *  - Schema-bound JSON values match their schema (Ajv, opt-in via
- *    `validateValues`; see validateBoundJsonValues)
+ *  - Schema-bound JSON values match their schema, and every schema compiles
+ *    (Ajv, opt-in via `validateValues`, which the CLI and the pre-receive
+ *    hook both set; see validateBoundJsonValues)
+ *  - Warning: a schema map whose integer keys an app save would move to the
+ *    front (same gate; see warnMapKeyOrder)
  *  - Rule structure (criteria + value present)
  *  - Value type consistency
  *  - Weighted values non-empty and consistent
  */
 import { z } from 'zod';
+import { findMapKeyOrderWarnings, navigate, scanOrderedJson } from './map-key-order.js';
 import { compileSchema, validateAgainstSchema } from './schema-validator.js';
 // Inlined to keep this directory self-contained for the standalone bun-compile
 // build that runs as the qfg-verify pre-receive hook in app-gitea — that build
@@ -574,6 +578,7 @@ export function validateWorkspace(workspaceDir, options = {}) {
     }
     // Second pass: referential integrity. Keep the plain skip-filter here —
     // ghost entries were already reported (once) by the first pass.
+    const cycleNodes = [];
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
@@ -603,6 +608,7 @@ export function validateWorkspace(workspaceDir, options = {}) {
             if (!result.success)
                 continue;
             const config = result.data;
+            cycleNodes.push({ config, raw: parsed, relPath });
             // Check segment references in criteria
             const segRefs = collectSegmentReferences(config);
             for (const ref of segRefs) {
@@ -628,8 +634,10 @@ export function validateWorkspace(workspaceDir, options = {}) {
                     });
                 }
             }
-            if (options.validateValues)
+            if (options.validateValues) {
                 validateBoundJsonValues(parsed, config, schemaDocuments, relPath, issues);
+                warnMapKeyOrder(raw, parsed, config, schemaDocuments, relPath, issues);
+            }
             // Check environment IDs referenced in config exist in quonfig.json
             if (declaredEnvIds.size > 0) {
                 for (const env of config.environments) {
@@ -646,6 +654,7 @@ export function validateWorkspace(workspaceDir, options = {}) {
             }
         }
     }
+    detectReferenceCycles(cycleNodes, issues);
     // Check for duplicate keys across directories (case-insensitive — see
     // detectDuplicateKeys).
     const uniqueConfigKeys = detectDuplicateKeys(allConfigs, 'key', issues);
@@ -862,8 +871,10 @@ export function validateFileMap(files, options = {}) {
                 suggestion: `Create schemas/${config.schemaKey}.json or schemas-protected/${config.schemaKey}.json, or remove schemaKey`,
             });
         }
-        if (options.validateValues)
+        if (options.validateValues) {
             validateBoundJsonValues(raw, config, schemaDocuments, relPath, issues);
+            warnMapKeyOrder(files.get(relPath) ?? '', raw, config, schemaDocuments, relPath, issues);
+        }
         // Check environment IDs referenced in config exist in quonfig.json
         if (declaredEnvIds.size > 0) {
             for (const env of config.environments) {
@@ -878,6 +889,7 @@ export function validateFileMap(files, options = {}) {
             }
         }
     }
+    detectReferenceCycles(parsedConfigs, issues);
     // Duplicate keys (case-insensitive — see detectDuplicateKeys).
     detectDuplicateKeys(allConfigs, 'key', issues);
     detectDuplicateKeys(allSchemaFiles, 'schema key', issues);
@@ -934,10 +946,61 @@ function validateBoundJsonValues(raw, config, schemaDocuments, file, issues) {
     };
     walk(raw, '');
 }
+/**
+ * Warn when a schema map (an object under `additionalProperties`) has integer
+ * keys that are not first, ascending (qfg-e87r.21). The app saves with
+ * JSON.stringify, which moves them there, so a hand-written file gets a
+ * one-time key-order diff. Same scope as validateBoundJsonValues. Always a
+ * warning: it never fails verify or rejects a push.
+ */
+function warnMapKeyOrder(text, raw, config, schemaDocuments, file, issues) {
+    if (config.type !== 'config' || config.valueType !== 'json' || !config.schemaKey)
+        return;
+    const schema = schemaDocuments.get(config.schemaKey);
+    if (!schema)
+        return;
+    // The file is scanned for its real key order at most once, and only if a
+    // map with an integer key exists.
+    let ordered = null;
+    const orderedDocument = () => {
+        if (ordered === null)
+            ordered = scanOrderedJson(text);
+        return ordered;
+    };
+    const walk = (node, segments, docPath) => {
+        if (Array.isArray(node)) {
+            for (const [index, child] of node.entries())
+                walk(child, [...segments, index], `${docPath}[${index}]`);
+            return;
+        }
+        if (typeof node !== 'object' || node === null)
+            return;
+        const record = node;
+        if (record.type === 'json' && 'value' in record) {
+            const valueSegments = [...segments, 'value'];
+            const warnings = findMapKeyOrderWarnings(schema, record.value, () => {
+                const doc = orderedDocument();
+                return doc && navigate(doc, valueSegments);
+            }, docPath || 'value');
+            for (const warning of warnings) {
+                const keys = warning.integerKeys.map((k) => `"${k}"`).join(', ');
+                issues.push({
+                    file,
+                    message: `map at ${warning.path} has integer keys (${keys}) that aren't first, in ascending order. Saving from the app moves them to the front. Reorder them here to avoid a one-time diff.`,
+                    severity: 'warning',
+                });
+            }
+            return;
+        }
+        for (const [key, child] of Object.entries(record))
+            walk(child, [...segments, key], docPath ? `${docPath}.${key}` : key);
+    };
+    walk(raw, [], '');
+}
 /**
  * A schema that does not compile is an error on the schema file, bound or not.
- * Gated on `validateValues` with the value checks, so the pre-receive hook
- * leaves it off until phase 1b.
+ * Gated on `validateValues` with the value checks; the CLI and the pre-receive
+ * hook both turn it on.
  */
 function validateSchemaCompiles(schemaKey, schema, file, issues) {
     const compiled = compileSchema(schema);
@@ -1223,6 +1286,97 @@ function collectSegmentReferences(config) {
     }
     return refs;
 }
+/**
+ * Reject reference cycles that SDKs recurse through at eval time (qfg-9dxb.11):
+ * - segment -> segment via IN_SEG / NOT_IN_SEG criteria;
+ * - config -> config via `decryptWith` on a confidential value (the SDKs
+ *   resolve the key config's value to decrypt, and follow its decryptWith).
+ * An unguarded SDK recurses until the stack overflows (sdk-net: an
+ * uncatchable StackOverflowException), so a cycle is a hard error at write
+ * time. Edges to keys that do not exist are skipped — a missing segment is
+ * the reference error above. Each cycle is reported once, on the file of its
+ * lexicographically first key, with the path starting there.
+ */
+function detectReferenceCycles(nodes, issues) {
+    const segments = nodes.filter((n) => n.config.type === 'segment');
+    const segmentKeys = new Set(segments.map((n) => n.config.key));
+    reportCycles(segments.map((n) => ({
+        key: n.config.key,
+        relPath: n.relPath,
+        targets: collectSegmentReferences(n.config).filter((ref) => segmentKeys.has(ref)),
+    })), 'Segment reference cycle', 'Remove one of the IN_SEG / NOT_IN_SEG references in the cycle', issues);
+    const configKeys = new Set(nodes.map((n) => n.config.key));
+    reportCycles(nodes.map((n) => ({
+        key: n.config.key,
+        relPath: n.relPath,
+        targets: collectDecryptWithReferences(n.raw).filter((ref) => configKeys.has(ref)),
+    })), 'decryptWith cycle', 'A decryption key config must not itself be decrypted with a config in the cycle', issues);
+}
+function reportCycles(graph, label, suggestion, issues) {
+    const byKey = new Map(graph.map((n) => [n.key, n]));
+    const state = new Map();
+    const stack = [];
+    const seen = new Set();
+    function visit(key) {
+        state.set(key, 'visiting');
+        stack.push(key);
+        for (const target of [...new Set(byKey.get(key).targets)].sort()) {
+            const s = state.get(target);
+            if (s === 'visiting') {
+                const cycle = stack.slice(stack.indexOf(target));
+                const first = cycle.indexOf([...cycle].sort()[0]);
+                const rotated = [...cycle.slice(first), ...cycle.slice(0, first)];
+                const id = rotated.join('\0');
+                if (!seen.has(id)) {
+                    seen.add(id);
+                    issues.push({
+                        file: byKey.get(rotated[0]).relPath,
+                        message: `${label}: ${[...rotated, rotated[0]].join(' -> ')}`,
+                        severity: 'error',
+                        suggestion,
+                    });
+                }
+            }
+            else if (s === undefined) {
+                visit(target);
+            }
+        }
+        stack.pop();
+        state.set(key, 'done');
+    }
+    for (const key of [...byKey.keys()].sort()) {
+        if (!state.has(key))
+            visit(key);
+    }
+}
+/** decryptWith targets of every confidential value in a config's rules and variants. */
+function collectDecryptWithReferences(raw) {
+    const refs = [];
+    const doc = (raw ?? {});
+    function scanValue(value) {
+        if (!value || typeof value !== 'object')
+            return;
+        const v = value;
+        if (v.type === 'weighted_values') {
+            const wv = v.value;
+            for (const entry of wv?.weightedValues ?? [])
+                scanValue(entry?.value);
+            return;
+        }
+        if (v.confidential === true && typeof v.decryptWith === 'string')
+            refs.push(v.decryptWith);
+    }
+    function scanRules(rules) {
+        for (const rule of rules ?? [])
+            scanValue(rule?.value);
+    }
+    scanRules(doc.default?.rules);
+    for (const env of doc.environments ?? [])
+        scanRules(env?.rules);
+    for (const variant of doc.variants ?? [])
+        scanValue(variant?.value);
+    return refs;
+}
 function typeToDir(type) {
     for (const [dir, t] of Object.entries(DIR_TO_TYPE)) {
         if (t === type)

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.2.0";
+declare const _default: "0.2.2";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.2.0';
+export default '0.2.2';

package/oclif.manifest.json

@@ -4150,5 +4150,5 @@
       ]
     }
   },
-  "version": "0.2.0"
+  "version": "0.2.2"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },