@quonfig/cli 0.4.0 → 0.5.0

package/dist/commands/set-default.js

@@ -12,7 +12,9 @@ import { makeConfidentialValue } from '../util/encryption.js';
 import isInteractive from '../util/is-interactive.js';
 import nameArg from '../util/name-arg.js';
 import { catchAllRule, countTargetingRules, keptTargetingNote, replacedTargetingNote, seedScopeRules, seededFromDefaultNote, upsertEnvRules, upsertFallbackRule, } from '../util/rules.js';
+import { redactedDisplay, redactedSummary } from '../util/redact.js';
 import secretFlags, { parsedSecretFlags } from '../util/secret-flags.js';
+import { resolveValueSource, valueSourceFlags } from '../util/value-source.js';
 export default class SetDefault extends APICommand {
     static aliases = ['toggle'];
     static args = { ...nameArg };
@@ -31,6 +33,16 @@ rules (they stay in git history).
 To set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:
   qfg set-rollout my.flag --environment production --true-percent 20
 
+Secrets (--secret, or any config whose value is already encrypted) are
+STRING-ONLY. To store a JSON secret, make it a string secret holding the JSON
+and JSON.parse it in your app. The CLI never prints a secret's plaintext; it
+shows a redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].
+Rotate a secret without the value entering argv / shell history:
+  pbpaste | qfg set-default stripe.api-key --environment production --secret --value-stdin --confirm
+  qfg set-default stripe.api-key --environment production --secret --value-from-env STRIPE_API_KEY --confirm
+(--env-var is different: it stores NO value and tells the SDK to read one from
+that env var at runtime.)
+
 To see all current values and rules for a flag:
   qfg info my.flag
 
@@ -41,7 +53,11 @@ To target specific organizations or users, write rules on their KEY
         '<%= config.bin %> <%= command.id %> my.flag.name                                          # prompts for value and env',
         '<%= config.bin %> <%= command.id %> my.flag.name --value=true --environment=staging',
         '<%= config.bin %> <%= command.id %> my.flag.name --value=false --environment=production --replace-targeting   # kill-switch: off for everyone',
-        '<%= config.bin %> <%= command.id %> my.flag.name --value=true --secret',
+        '# Rotate a secret without the value entering argv:',
+        'pbpaste | <%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-stdin --confirm',
+        '<%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-from-env=MY_SECRET --confirm',
+        '# Write the [Default] rules (inherited by every environment without its own):',
+        '<%= config.bin %> <%= command.id %> my.secret --environment="[Default]" --secret --value-from-env=MY_SECRET --confirm',
         '<%= config.bin %> <%= command.id %> my.config.name --env-var=MY_ENV_VAR_NAME --environment=production',
         '# For a percentage rollout, use set-rollout instead:',
         '<%= config.bin %> set-rollout my.flag.name --environment production --true-percent 20',
@@ -50,15 +66,20 @@ To target specific organizations or users, write rules on their KEY
     ];
     static flags = {
         confidential: Flags.boolean({ default: false, description: 'mark the value as confidential' }),
-        'env-var': Flags.string({ description: 'environment variable to use as default value' }),
-        environment: Flags.string({ description: 'environment to change' }),
+        'env-var': Flags.string({
+            description: 'store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local env var NOW, use --value-from-env',
+        }),
+        environment: Flags.string({
+            description: 'environment to change, e.g. production. Use "[Default]" for the default rules that every environment without its own rules inherits',
+        }),
         'replace-targeting': Flags.boolean({
             default: false,
             description: "set the value for EVERYONE: delete this environment's targeting rules instead of keeping them (they stay in git history)",
         }),
-        value: Flags.string({ description: 'new default value' }),
+        value: Flags.string({ description: 'new default value (for secrets prefer --value-stdin / --value-from-env)' }),
+        ...valueSourceFlags,
         ...confirmFlag,
-        ...secretFlags('encrypt the value of this item'),
+        ...secretFlags('encrypt the value of this item (string-only; the CLI never prints the plaintext)'),
     };
     async run() {
         const { args, flags } = await this.parse(SetDefault);
@@ -69,6 +90,11 @@ To target specific organizations or users, write rules on their KEY
         if (flags['env-var'] && secret.selected) {
             return this.err('cannot specify both --env-var and --secret');
         }
+        // qfg-38lp: --value / --value-stdin / --value-from-env all resolve here.
+        const valueSource = await resolveValueSource(flags);
+        if (!valueSource.ok) {
+            return this.err(valueSource.error ? valueSource.message : 'Value is required');
+        }
         if (flags.confidential && secret.selected) {
             console.warn("Note: --confidential is implied when using --secret, so you don't need to specify both.");
         }
@@ -107,6 +133,13 @@ To target specific organizations or users, write rules on their KEY
             return this.err(`Could not find config named ${key}`);
         }
         this.verboseLog('Selected config:', config);
+        // qfg-38lp: secrets are string-only end to end. Say so here instead of
+        // letting the server answer with a bare 422.
+        if (secret.selected && config.valueType.toLowerCase() !== 'string') {
+            return this.err(`secrets are string-only; ${key} is type ${config.valueType}. ` +
+                'Store JSON (or any structured value) as a string secret instead — e.g. ' +
+                '`qfg create <new-key> --type string --secret --value-stdin < value.json` — and JSON.parse it in your app.', { key, phase: 'validation', valueType: config.valueType });
+        }
         // Fetch the stored document ONCE. It drives encryption auto-detection,
         // the targeting-rule count in the confirmation prompt, the rules the write
         // is applied to, and the commitSha for optimistic concurrency.
@@ -179,18 +212,23 @@ To target specific organizations or users, write rules on their KEY
                 targetingRuleCount,
             });
         }
-        let value = flags.value;
+        let value = valueSource.value;
+        // A secret / confidential value is masked while typed and never shown.
+        const hideValue = secret.selected || confidential;
         if (!value && isInteractive(flags)) {
             value = await getString({
                 allowBlank: true,
-                message: 'Default value',
+                mask: hideValue,
+                message: hideValue ? 'Secret value (input is masked)' : 'Default value',
             });
         }
         if (value === undefined) {
             return this.err('Value is required');
         }
-        const secretMaybe = secret.selected ? ' (encrypted)' : '';
-        if (!(await getConfirmation({ flags, message: confirmMessage(`\`${value}\`${secretMaybe}`) }))) {
+        const promptPhrase = hideValue
+            ? redactedDisplay(redactedSummary({ encrypted: secret.selected, plaintext: value }))
+            : `\`${value}\``;
+        if (!(await getConfirmation({ flags, message: confirmMessage(promptPhrase) }))) {
             return;
         }
         return this.submitChange({
@@ -225,8 +263,17 @@ To target specific organizations or users, write rules on their KEY
         // "be provided by `MY_ENV_VAR`" — plus any (encrypted)/(confidential) note.
         let valuePhrase;
         let modifiers = '';
+        // Set whenever the value must not be printed (secret or confidential), qfg-38lp.
+        let redacted;
+        // How the value may appear in an error message.
+        let shownValue = value;
         if (envVar === undefined) {
             valuePhrase = `\`${value}\``;
+            if (confidential && !secret.selected) {
+                redacted = redactedSummary({ plaintext: value });
+                valuePhrase = redactedDisplay(redacted);
+                shownValue = valuePhrase;
+            }
             if (secret.selected) {
                 // Handle encrypted values using shared utility
                 const encryptedValueResult = await makeConfidentialValue(this, value, secret, environment.name);
@@ -234,7 +281,9 @@ To target specific organizations or users, write rules on their KEY
                     return this.err(encryptedValueResult.message || 'Failed to encrypt value');
                 }
                 configValue = mapConfigValueToDto(encryptedValueResult.value, ConfigValueType.String);
-                modifiers += ' (encrypted)';
+                redacted = redactedSummary({ ciphertext: String(encryptedValueResult.value.value), plaintext: value });
+                valuePhrase = redactedDisplay(redacted);
+                shownValue = valuePhrase;
             }
             else {
                 // Parse the value based on type and build value object
@@ -249,7 +298,7 @@ To target specific organizations or users, write rules on their KEY
                     case 'bool': {
                         const lowerValue = value.toLowerCase();
                         if (lowerValue !== 'true' && lowerValue !== 'false') {
-                            return this.err(`'${value}' is not a valid value for ${key}`);
+                            return this.err(`'${shownValue}' is not a valid value for ${key}`);
                         }
                         variantValue = lowerValue === 'true';
                         break;
@@ -258,14 +307,14 @@ To target specific organizations or users, write rules on their KEY
                         // Shared strict grammar with qfg create (qfg-2agi.23).
                         variantValue = parseIntValue(value);
                         if (variantValue === undefined) {
-                            return this.err(`Invalid default value for int: ${value}`);
+                            return this.err(`Invalid default value for int: ${shownValue}`);
                         }
                         break;
                     }
                     case 'double': {
                         variantValue = parseDoubleValue(value);
                         if (variantValue === undefined) {
-                            return this.err(`Invalid default value for double: ${value}`);
+                            return this.err(`Invalid default value for double: ${shownValue}`);
                         }
                         break;
                     }
@@ -274,7 +323,7 @@ To target specific organizations or users, write rules on their KEY
                             variantValue = JSON.parse(value);
                         }
                         catch {
-                            return this.err(`Invalid JSON value: ${value}`);
+                            return this.err(`Invalid JSON value: ${shownValue}`);
                         }
                         break;
                     }
@@ -285,7 +334,7 @@ To target specific organizations or users, write rules on their KEY
                     case 'duration': {
                         // Stored verbatim as the ISO 8601 string; no conversions (qfg-2agi.3).
                         if (!isValidIsoDuration(value)) {
-                            return this.err(`Invalid value for duration: ${value}. ${DURATION_FORMAT_HINT}`);
+                            return this.err(`Invalid value for duration: ${shownValue}. ${DURATION_FORMAT_HINT}`);
                         }
                         break;
                     }
@@ -305,7 +354,9 @@ To target specific organizations or users, write rules on their KEY
         }
         if (confidential && !secret.selected) {
             configValue.confidential = true;
-            modifiers += ' (confidential)';
+            // the redacted display already says "confidential"
+            if (!redacted)
+                modifiers += ' (confidential)';
         }
         // Surgical by default (qfg-qjdm): the fallback rule's value is replaced
         // in place and every targeting rule around it is kept. --replace-targeting
@@ -374,13 +425,14 @@ To target specific organizations or users, write rules on their KEY
                 },
                 key,
                 success: true,
-                value,
+                // qfg-38lp: a secret/confidential value is reported redacted, never verbatim.
+                value: redacted ?? value,
                 ...counts,
             };
         }
         this.verboseLog(request.error);
         const errMsg = request.status === 400
-            ? `Failed to change default: ${request.status} -- is ${value || envVar} a valid value?`
+            ? `Failed to change default: ${request.status} -- is ${shownValue || envVar} a valid value?`
             : `Failed to change default: ${request.status}`;
         return this.err(errMsg, { key, serverError: request.error });
     }

package/dist/index.d.ts

@@ -50,6 +50,12 @@ export declare abstract class BaseCommand extends Command {
     protected toErrorJson(err: unknown): {
         error: JsonObj;
     };
+    /**
+     * qfg-38lp: a value typed as a stray positional (`qfg set-default KEY <secret>`)
+     * comes back from oclif as `Unexpected argument: <secret>`. On commands that
+     * take a value, hide the offending tokens instead of echoing them.
+     */
+    private redactValueParseError;
 }
 export declare abstract class APICommand extends BaseCommand {
     static baseFlags: {

package/dist/index.js

@@ -1,6 +1,7 @@
 export { run } from '@oclif/core';
 import { Command, Errors, Flags } from '@oclif/core';
 import rawGetClient, { unwrapRequest } from './util/get-client.js';
+import { scrubForLog } from './util/redact.js';
 const globalFlags = {
     interactive: Flags.boolean({
         allowNo: true,
@@ -109,11 +110,15 @@ export class BaseCommand extends Command {
     verboseLog = (category, message) => {
         if (!this.isVerbose)
             return;
+        // qfg-38lp: verbose output (request bodies, API responses, stored config
+        // documents) must never carry a confidential plaintext.
         if (message) {
-            this.logToStderr(`[${category}] ${typeof message === 'string' ? message : JSON.stringify(message)}`);
+            const scrubbed = scrubForLog(message);
+            this.logToStderr(`[${category}] ${typeof scrubbed === 'string' ? scrubbed : JSON.stringify(scrubbed)}`);
         }
         else {
-            this.logToStderr(typeof category === 'string' ? category : JSON.stringify(category));
+            const scrubbed = scrubForLog(category);
+            this.logToStderr(typeof scrubbed === 'string' ? scrubbed : JSON.stringify(scrubbed));
         }
     };
     async catch(err) {
@@ -127,6 +132,7 @@ export class BaseCommand extends Command {
         if (err instanceof Errors.ExitError || err.code === 'EEXIT') {
             throw err;
         }
+        this.redactValueParseError(err);
         // qfg-hzmb: `this.log()` is a documented no-op whenever jsonEnabled(), so
         // this override used to print NOTHING for a failing `--json` run — empty
         // stdout was indistinguishable from an empty success. Emit the structured
@@ -162,9 +168,12 @@ export class BaseCommand extends Command {
         // An Error's own *enumerable* properties are the structured payload handed
         // to `err()` — keep those. `oclif` is internal bookkeeping (surfaced as
         // `exitCode`), and `stack` is dropped on purpose (oclif.stacktrace=false).
+        // `parse` is oclif's parse-error context: hundreds of KB of config dump
+        // that includes the raw argv, so a `--value=<secret>` landed on stdout
+        // (qfg-38lp). The message already names the bad flag; drop the dump.
         const payload = {};
         for (const [key, value] of Object.entries(err)) {
-            if (key !== 'oclif' && key !== 'stack')
+            if (key !== 'oclif' && key !== 'stack' && key !== 'parse')
                 payload[key] = value;
         }
         const { code } = err;
@@ -177,6 +186,29 @@ export class BaseCommand extends Command {
             },
         };
     }
+    /**
+     * qfg-38lp: a value typed as a stray positional (`qfg set-default KEY <secret>`)
+     * comes back from oclif as `Unexpected argument: <secret>`. On commands that
+     * take a value, hide the offending tokens instead of echoing them.
+     */
+    redactValueParseError(err) {
+        const flags = this.ctor.flags ?? {};
+        if (!('value' in flags))
+            return;
+        if (err.message.startsWith('Unexpected argument')) {
+            const count = Array.isArray(err.args) ? err.args.length : 1;
+            err.message =
+                `Unexpected argument${count === 1 ? '' : 's'} (${count} hidden, in case ${count === 1 ? 'it is' : 'they are'} a value). ` +
+                    'Pass a value with --value, --value-stdin or --value-from-env=VAR, not as a positional argument.';
+            delete err.args;
+            return;
+        }
+        if (err.message.startsWith('Nonexistent flag')) {
+            err.message = err.message.replaceAll(/=\S+/g, '=<hidden>');
+            if (Array.isArray(err.flags))
+                err.flags = err.flags.map((f) => String(f).replace(/=.*$/, '=<hidden>'));
+        }
+    }
 }
 export class APICommand extends BaseCommand {
     static baseFlags = {

package/dist/interactive-prompt.d.ts

@@ -1,2 +1,20 @@
 import { Config } from '@oclif/core/lib/interfaces/index.js';
+import Create from './commands/create.js';
+import GenerateNewHexKey from './commands/generate-new-hex-key.js';
+import Get from './commands/get.js';
+import Info from './commands/info.js';
+import List from './commands/list.js';
+import Override from './commands/override.js';
+import SetDefault from './commands/set-default.js';
+type SuggestedCommand = {
+    command: typeof Create | typeof GenerateNewHexKey | typeof Get | typeof Info | typeof List | typeof Override | typeof SetDefault;
+    description: string;
+    displayCommandName: string;
+    id: string;
+    implicitFlags: string[];
+};
+declare const commands: SuggestedCommand[];
+type AvailableCommand = (typeof commands)[number];
+export declare const getFlags: (flags: AvailableCommand["command"]["flags"], commandId: string, implicitFlags: string[], command: SuggestedCommand["command"]) => Promise<string[]>;
 export declare const interactivePrompt: (config: Config) => Promise<void>;
+export {};

package/dist/interactive-prompt.js

@@ -94,14 +94,23 @@ const getArgs = async (args, commandId, command) => {
     // Filter out undefined values (OAuth commands handle their own name prompting)
     return values.filter((v) => v !== undefined);
 };
-const getFlags = async (flags, commandId, implicitFlags, command) => {
+export const getFlags = async (flags, commandId, implicitFlags, command) => {
     if (!flags && implicitFlags.length === 0) {
         return [];
     }
     const inputs = [];
     const promiseInputs = [];
+    // qfg-38lp: secrets are string-only, so "create --secret" never asks for a type.
+    const forceStringType = commandId === 'create' && implicitFlags.includes('secret');
     for (const [key, arg] of Object.entries(flags)) {
-        if (arg.required || implicitFlags.includes(key)) {
+        if (forceStringType && key === 'type') {
+            inputs.push('--type=string');
+            continue;
+        }
+        // `create --type` is optional on the command line (--secret implies string)
+        // but the interactive create still asks for it.
+        const promptForType = commandId === 'create' && key === 'type';
+        if (arg.required || promptForType || implicitFlags.includes(key)) {
             if (arg.type === 'boolean') {
                 inputs.push(`--${key}`);
             }

package/dist/migrate/quonfig-target/operators.js

@@ -9,8 +9,10 @@
  * provider extends the table rather than reinventing the dispatch.
  */
 /**
- * Operators that have a direct negated form in Quonfig. `negate: true` simply
- * selects the negated operator — semantics-preserving, always converted.
+ * Operators that have a direct negated form in Quonfig. `negate: true` selects
+ * the negated operator and always converts. LD never matches a context missing
+ * the attribute, so `clauseToCriteria` (ruleset.ts) ANDs an IS_PRESENT guard in
+ * front of each negated property operator to keep that (qfg-goi1.5.10).
  */
 const NEGATABLE = {
     contains: { negated: 'PROP_DOES_NOT_CONTAIN_ONE_OF', plain: 'PROP_CONTAINS_ONE_OF' },

package/dist/migrate/quonfig-target/ruleset.d.ts

@@ -91,6 +91,27 @@ export interface RulesetContext {
  * becomes a dotted path (`address.city`).
  */
 export declare function normalizeAttribute(contextKind: string | undefined, attribute: string): string;
+/**
+ * Join several regex patterns into one alternation `(?:a)|(?:b)` (qfg-ktkr.6).
+ * Each alternative is wrapped in a non-capturing group so anchors and inner
+ * `|` stay scoped to their own pattern. The join adds no quantified group, so
+ * it stays inside the v1 safety rule as long as every pattern is in v1 and
+ * the length and unbounded-quantifier caps hold; returns `null` otherwise
+ * (qfg-ktkr.2: the full checkRegexV1, not just the caps).
+ */
+export declare function joinRegexAlternation(patterns: string[]): null | string;
+/**
+ * Expand a provider rule's clauses into the OR-alternatives of clause lists
+ * that preserve LaunchDarkly semantics (qfg-ktkr.6). LD ORs a clause's values;
+ * Quonfig has no within-rule OR, so a multi-value `matches` clause whose
+ * patterns cannot be joined within the v1 caps is:
+ *  - negated (matches none): split into single-pattern negated clauses ANDed
+ *    in the same rule;
+ *  - positive (matches any): fanned out into one alternative per pattern.
+ * Alternatives serve the same value, so first-match-wins over them is the OR.
+ * Returns `null` (rule dropped + reported) past MAX_SPLIT_RULES alternatives.
+ */
+export declare function expandClauses(clauses: SourceClause[], ctx: RulesetContext): null | SourceClause[][];
 /**
  * Map one provider clause to a Quonfig criterion, or `null` when the clause's
  * operator has no v1 mapping (D3 — negated comparisons, applicationVersion…).
@@ -98,12 +119,39 @@ export declare function normalizeAttribute(contextKind: string | undefined, attr
  * partial AND would silently broaden targeting.
  */
 export declare function clauseToCriterion(clause: SourceClause, ctx: RulesetContext): QuonfigCriterion | null;
+/**
+ * Map one provider clause to the Quonfig criteria it ANDs into a rule, or
+ * `null` when the clause cannot be mapped (see `clauseToCriterion`).
+ *
+ * A negated property clause (`in`, `contains`, `startsWith`, `endsWith`,
+ * `matches` with `negate: true`) gets an `IS_PRESENT` guard on the same
+ * property ANDed in front of it (qfg-goi1.5.10, operator-semantics Q6b).
+ * LaunchDarkly never matches a context that lacks the clause attribute, negated
+ * or not; Quonfig's negated operators do match a missing attribute (Q6a, kept),
+ * so without the guard a migrated rule would broaden to every context missing
+ * the attribute. Negated `segmentMatch` (NOT_IN_SEG) has no property and is not
+ * guarded. This only shapes NEW migrations; already-migrated workspaces are
+ * never rewritten.
+ */
+export declare function clauseToCriteria(clause: SourceClause, ctx: RulesetContext): QuonfigCriterion[] | null;
 /**
  * Build a Quonfig rule from a provider rule's clauses (AND semantics) plus its
  * served value. Returns `null` when any clause cannot be mapped — the rule is
  * dropped wholesale and reported, rather than silently broadened.
  */
 export declare function buildRule(clauses: SourceClause[], value: QuonfigRuleValue, ctx: RulesetContext): QuonfigRule | null;
+/**
+ * AND a clause list into criteria, or `null` when any clause is unmappable.
+ * An IS_PRESENT guard already in the list is not repeated (a split negated
+ * multi-pattern clause guards its property once).
+ */
+export declare function clausesToCriteria(clauses: SourceClause[], ctx: RulesetContext): null | QuonfigCriterion[];
+/**
+ * Build the Quonfig rules for one provider rule: `buildRule` over each
+ * alternative from `expandClauses` (qfg-ktkr.6). Usually one rule; empty when
+ * the rule is dropped (and reported).
+ */
+export declare function buildRules(clauses: SourceClause[], value: QuonfigRuleValue, ctx: RulesetContext): QuonfigRule[];
 /**
  * Convert a provider rollout to a Quonfig `weighted_values`. The experiment
  * framing (`kind: "experiment"` + `seed`) is dropped + reported (plan §5.4),

package/dist/migrate/quonfig-target/ruleset.js

@@ -8,6 +8,7 @@
  * verbs do the LaunchDarkly collapse; a second provider with a different
  * topology composes them differently.
  */
+import { checkRegexV1 } from '../../verify/regex-dialect.js';
 import { resolveKey } from '../key-rewriter.js';
 import { mapLaunchDarklyOperator } from './operators.js';
 import { toQuonfigValue } from './values.js';
@@ -41,6 +42,57 @@ export function normalizeAttribute(contextKind, attribute) {
     const dotted = attribute.replace(/^\//, '').replaceAll('/', '.');
     return `${kind}.${dotted}`;
 }
+/** Upper bound on rules one LD rule may fan out into when patterns are split. */
+const MAX_SPLIT_RULES = 16;
+/**
+ * Join several regex patterns into one alternation `(?:a)|(?:b)` (qfg-ktkr.6).
+ * Each alternative is wrapped in a non-capturing group so anchors and inner
+ * `|` stay scoped to their own pattern. The join adds no quantified group, so
+ * it stays inside the v1 safety rule as long as every pattern is in v1 and
+ * the length and unbounded-quantifier caps hold; returns `null` otherwise
+ * (qfg-ktkr.2: the full checkRegexV1, not just the caps).
+ */
+export function joinRegexAlternation(patterns) {
+    const joined = patterns.map((p) => `(?:${p})`).join('|');
+    return checkRegexV1(joined) === null ? joined : null;
+}
+/** A multi-value `matches` clause whose patterns cannot be joined within v1. */
+function isUnjoinableMatches(clause) {
+    return clause.op === 'matches' && clause.values.length > 1 && joinRegexAlternation(clause.values.map(String)) === null;
+}
+/**
+ * Expand a provider rule's clauses into the OR-alternatives of clause lists
+ * that preserve LaunchDarkly semantics (qfg-ktkr.6). LD ORs a clause's values;
+ * Quonfig has no within-rule OR, so a multi-value `matches` clause whose
+ * patterns cannot be joined within the v1 caps is:
+ *  - negated (matches none): split into single-pattern negated clauses ANDed
+ *    in the same rule;
+ *  - positive (matches any): fanned out into one alternative per pattern.
+ * Alternatives serve the same value, so first-match-wins over them is the OR.
+ * Returns `null` (rule dropped + reported) past MAX_SPLIT_RULES alternatives.
+ */
+export function expandClauses(clauses, ctx) {
+    let alternatives = [[]];
+    for (const clause of clauses) {
+        if (!isUnjoinableMatches(clause)) {
+            for (const alt of alternatives)
+                alt.push(clause);
+            continue;
+        }
+        const singles = clause.values.map((v) => ({ ...clause, values: [v] }));
+        if (clause.negate) {
+            for (const alt of alternatives)
+                alt.push(...singles);
+            continue;
+        }
+        alternatives = alternatives.flatMap((alt) => singles.map((single) => [...alt, single]));
+        if (alternatives.length > MAX_SPLIT_RULES) {
+            ctx.report.add('skipped-rule', ctx.sourceKey, `rule dropped: its regex clauses expand to more than ${MAX_SPLIT_RULES} rules (patterns too long or too complex to join within Quonfig regex v1)`);
+            return null;
+        }
+    }
+    return alternatives;
+}
 /** Build a `valueToMatch` typed value for a non-presence, non-segment clause. */
 function valueToMatchFor(operator, clause, ctx) {
     if (STRING_LIST_OPERATORS.has(operator)) {
@@ -60,6 +112,11 @@ function valueToMatchFor(operator, clause, ctx) {
     }
     if (operator === 'PROP_MATCHES' || operator === 'PROP_DOES_NOT_MATCH') {
         if (clause.values.length > 1) {
+            // LD ORs the patterns (qfg-ktkr.6). `expandClauses` splits any set too
+            // big to join, so this only falls back for a direct caller.
+            const joined = joinRegexAlternation(clause.values.map(String));
+            if (joined !== null)
+                return { type: 'string', value: joined };
             ctx.report.add('skipped-rule', ctx.sourceKey, `regex clause listed ${clause.values.length} patterns; Quonfig PROP_MATCHES takes one — only the first kept`);
         }
         return { type: 'string', value: String(clause.values[0] ?? '') };
@@ -97,23 +154,92 @@ export function clauseToCriterion(clause, ctx) {
         ? { operator }
         : { operator, propertyName: normalizeAttribute(clause.contextKind, clause.attribute) };
     criterion.valueToMatch = valueToMatchFor(operator, clause, ctx);
+    // qfg-ktkr.2: a pattern outside Quonfig regex v1 would be refused by
+    // `qfg verify` and the Git hook, so drop the rule and report why instead of
+    // writing a file nobody can push.
+    if ((operator === 'PROP_MATCHES' || operator === 'PROP_DOES_NOT_MATCH') && criterion.valueToMatch) {
+        const pattern = String(criterion.valueToMatch.value);
+        const violation = checkRegexV1(pattern);
+        if (violation) {
+            ctx.report.add('skipped-rule', ctx.sourceKey, `regex clause on "${clause.attribute}" skipped: pattern "${pattern}" is outside Quonfig regex v1 (${violation.reason}). ${violation.hint}`);
+            return null;
+        }
+    }
     return criterion;
 }
+/**
+ * Map one provider clause to the Quonfig criteria it ANDs into a rule, or
+ * `null` when the clause cannot be mapped (see `clauseToCriterion`).
+ *
+ * A negated property clause (`in`, `contains`, `startsWith`, `endsWith`,
+ * `matches` with `negate: true`) gets an `IS_PRESENT` guard on the same
+ * property ANDed in front of it (qfg-goi1.5.10, operator-semantics Q6b).
+ * LaunchDarkly never matches a context that lacks the clause attribute, negated
+ * or not; Quonfig's negated operators do match a missing attribute (Q6a, kept),
+ * so without the guard a migrated rule would broaden to every context missing
+ * the attribute. Negated `segmentMatch` (NOT_IN_SEG) has no property and is not
+ * guarded. This only shapes NEW migrations; already-migrated workspaces are
+ * never rewritten.
+ */
+export function clauseToCriteria(clause, ctx) {
+    const criterion = clauseToCriterion(clause, ctx);
+    if (criterion === null)
+        return null;
+    if (clause.negate && criterion.propertyName !== undefined) {
+        return [{ operator: 'IS_PRESENT', propertyName: criterion.propertyName }, criterion];
+    }
+    return [criterion];
+}
 /**
  * Build a Quonfig rule from a provider rule's clauses (AND semantics) plus its
  * served value. Returns `null` when any clause cannot be mapped — the rule is
  * dropped wholesale and reported, rather than silently broadened.
  */
 export function buildRule(clauses, value, ctx) {
+    const criteria = clausesToCriteria(clauses, ctx);
+    if (criteria === null)
+        return null;
+    // A rule with no clauses matches everyone — represent that as ALWAYS_TRUE.
+    return { criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value };
+}
+/**
+ * AND a clause list into criteria, or `null` when any clause is unmappable.
+ * An IS_PRESENT guard already in the list is not repeated (a split negated
+ * multi-pattern clause guards its property once).
+ */
+export function clausesToCriteria(clauses, ctx) {
     const criteria = [];
     for (const clause of clauses) {
-        const criterion = clauseToCriterion(clause, ctx);
-        if (criterion === null)
+        const mapped = clauseToCriteria(clause, ctx);
+        if (mapped === null)
             return null;
-        criteria.push(criterion);
+        for (const c of mapped) {
+            const duplicateGuard = c.operator === 'IS_PRESENT' &&
+                criteria.some((e) => e.operator === 'IS_PRESENT' && e.propertyName === c.propertyName);
+            if (!duplicateGuard)
+                criteria.push(c);
+        }
     }
-    // A rule with no clauses matches everyone — represent that as ALWAYS_TRUE.
-    return { criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value };
+    return criteria;
+}
+/**
+ * Build the Quonfig rules for one provider rule: `buildRule` over each
+ * alternative from `expandClauses` (qfg-ktkr.6). Usually one rule; empty when
+ * the rule is dropped (and reported).
+ */
+export function buildRules(clauses, value, ctx) {
+    const alternatives = expandClauses(clauses, ctx);
+    if (alternatives === null)
+        return [];
+    const rules = [];
+    for (const alt of alternatives) {
+        const rule = buildRule(alt, value, ctx);
+        // An unmappable clause fails every alternative alike — report it once.
+        if (rule === null)
+            return [];
+        rules.push(rule);
+    }
+    return rules;
 }
 /** Resolve a variation index to its typed Quonfig value. */
 function variationValue(index, ctx) {
@@ -202,9 +328,7 @@ export function collapseEnvironment(env, ctx) {
     }
     for (const rule of env.rules ?? []) {
         const value = rule.rollout === undefined ? variationValue(rule.variation ?? 0, ctx) : rolloutToWeightedValues(rule.rollout, ctx);
-        const built = buildRule(rule.clauses, value, ctx);
-        if (built !== null)
-            rules.push(built);
+        rules.push(...buildRules(rule.clauses, value, ctx));
     }
     if (env.fallthrough) {
         rules.push({ criteria: [ALWAYS_TRUE], value: servedValue(env.fallthrough, ctx) });

package/dist/migrate/sources/flagsmith/translate.js

@@ -15,6 +15,7 @@
  * mutable state. Report accumulation flows through the `ConversionReport`
  * argument supplied by the caller (the `flagsmith.ts` source).
  */
+import { checkRegexV1 } from '../../../verify/regex-dialect.js';
 import { resolveKey } from '../../key-rewriter.js';
 import { inferValueType, toQuonfigValue } from '../../quonfig-target/values.js';
 import { normalizeImportedWeights } from '../../quonfig-target/weights.js';
@@ -270,6 +271,16 @@ export function mapCondition(condition) {
             };
         }
         case 'REGEX': {
+            // qfg-ktkr.2: a pattern outside Quonfig regex v1 would be refused by
+            // `qfg verify` and the Git hook; drop the rule with the reason instead.
+            const pattern = String(value ?? '');
+            const violation = checkRegexV1(pattern);
+            if (violation) {
+                return {
+                    drop: true,
+                    reason: `pattern "${pattern}" is outside Quonfig regex v1 (${violation.reason}). ${violation.hint}`,
+                };
+            }
             return {
                 criterion: {
                     operator: 'PROP_MATCHES',