@quonfig/cli 0.4.0 → 0.5.0

package/dist/verify/regex-dialect.d.ts

@@ -0,0 +1,39 @@
+/**
+ * "Quonfig regex v1": the regex dialect of PROP_MATCHES and PROP_DOES_NOT_MATCH
+ * (qfg-ktkr.2). Spec: project/plans/2026-10-12-regex-write-time-check.md
+ * section 2, approved 2026-10-16 (qfg-goi1.10.10). Fixture of record:
+ * integration-test-data tests/regex/dialect.yaml (tag v2026.10.22.1; \_, \v
+ * and \x80-\xFF rejected per qfg-ktkr.7), which
+ * test/verify/regex-dialect.test.ts holds this file to, row by row.
+ *
+ * The dialect is the intersection of what every SDK's engine (go RE2, node
+ * RegExp, python re, ruby Onigmo, java.util.regex, .NET Regex) accepts and
+ * reads the same way, plus a ReDoS safety rule. SDKs do not validate; the
+ * writers (this check, app-quonfig's copy, and the Git hook built from this
+ * repo) are the only gate.
+ *
+ * No imports: src/verify/ is bundled into the standalone qfg-verify hook.
+ */
+export declare const REGEX_V1_LIMITS: {
+    readonly maxLength: 256;
+    readonly maxRepeat: 1000;
+    readonly maxUnboundedQuantifiers: 2;
+};
+/** The canonical docs section the error links to (qfg-ktkr.5 owns the page). */
+export declare const REGEX_V1_DOCS_URL = "https://docs.quonfig.com/docs/explanations/features/rules-and-segmentation#quonfig-regex-v1";
+export type RegexV1Reason = 'backref' | 'bad-repeat' | 'class-syntax' | 'group-extension' | 'inline-flag' | 'lookaround' | 'named-group' | 'nested-quantifier' | 'octal' | 'possessive' | 'syntax' | 'too-long' | 'too-many-unbounded' | 'unicode-shorthand' | 'unsupported-escape';
+/** Fix-it hints, verbatim from the fixture's `hints` map. */
+export declare const REGEX_V1_HINTS: Record<RegexV1Reason, string>;
+export interface RegexV1Violation {
+    hint: string;
+    reason: RegexV1Reason;
+}
+/**
+ * Check one pattern against Quonfig regex v1. Returns null when the pattern is
+ * in the dialect, or the reason and fix-it hint for the first violation.
+ *
+ * Precedence (fixture header): too-long first; then one left-to-right scan
+ * reports the first offending construct (an unclosed ( or [ is found at the
+ * end); then too-many-unbounded, which needs the whole pattern.
+ */
+export declare function checkRegexV1(pattern: string): null | RegexV1Violation;

package/dist/verify/regex-dialect.js

@@ -0,0 +1,278 @@
+/**
+ * "Quonfig regex v1": the regex dialect of PROP_MATCHES and PROP_DOES_NOT_MATCH
+ * (qfg-ktkr.2). Spec: project/plans/2026-10-12-regex-write-time-check.md
+ * section 2, approved 2026-10-16 (qfg-goi1.10.10). Fixture of record:
+ * integration-test-data tests/regex/dialect.yaml (tag v2026.10.22.1; \_, \v
+ * and \x80-\xFF rejected per qfg-ktkr.7), which
+ * test/verify/regex-dialect.test.ts holds this file to, row by row.
+ *
+ * The dialect is the intersection of what every SDK's engine (go RE2, node
+ * RegExp, python re, ruby Onigmo, java.util.regex, .NET Regex) accepts and
+ * reads the same way, plus a ReDoS safety rule. SDKs do not validate; the
+ * writers (this check, app-quonfig's copy, and the Git hook built from this
+ * repo) are the only gate.
+ *
+ * No imports: src/verify/ is bundled into the standalone qfg-verify hook.
+ */
+export const REGEX_V1_LIMITS = { maxLength: 256, maxRepeat: 1000, maxUnboundedQuantifiers: 2 };
+/** The canonical docs section the error links to (qfg-ktkr.5 owns the page). */
+export const REGEX_V1_DOCS_URL = 'https://docs.quonfig.com/docs/explanations/features/rules-and-segmentation#quonfig-regex-v1';
+/** Fix-it hints, verbatim from the fixture's `hints` map. */
+export const REGEX_V1_HINTS = {
+    'too-long': 'Regex patterns are limited to 256 characters.',
+    syntax: 'This is not a valid regular expression. Check for an unbalanced ( ) or [ ], a trailing \\, a reversed range such as [z-a], or a quantifier with nothing before it (a quantifier cannot follow ^, $, |, ( or another quantifier).',
+    lookaround: 'Lookahead and lookbehind ((?=, (?!, (?<=, (?<!) are not supported. Rewrite the pattern without them, or split the rule into two criteria.',
+    'named-group': "Named groups ((?<name>...), (?P<name>...), (?'name'...)) are not supported. Use a plain group ( ) or (?: ).",
+    'inline-flag': 'Inline flags such as (?i) are not supported. Spell out both cases with a class, for example [Hh]ello.',
+    'group-extension': 'Only ( ) and (?: ) groups are supported. Atomic groups (?>...), comments (?#...), conditionals and other (? forms are not.',
+    backref: 'Backreferences (\\1 to \\9, \\k<name>) are not supported. Repeat the text explicitly instead.',
+    octal: 'Octal escapes and \\0 are not supported. Write the character as \\xHH, for example \\x00.',
+    possessive: 'Possessive quantifiers (*+, ++, ?+, {n}+) are not supported. Use the plain form (a+) or the lazy form (a+?).',
+    'bad-repeat': 'Write repeat counts as {n}, {n,} or {n,m} with n <= m <= 1000. {,m} is not portable: write {0,m}. Escape a literal brace as \\{.',
+    'class-syntax': 'Inside [...] use only literals, ranges and escapes. POSIX classes such as [:digit:], a nested [, &&, --, ~~ and || are not supported. Escape a literal [ or ] as \\[ or \\], and do not start a class with ].',
+    'unicode-shorthand': '\\d, \\w, \\s, \\b and their negations match different characters in different SDKs. Use [0-9], [A-Za-z0-9_] or [ \\t\\r\\n\\f\\x0B].',
+    'unsupported-escape': 'This escape is not supported. The supported escapes are \\ followed by ASCII punctuation other than _, \\t \\n \\r \\f, and \\xHH with exactly two hex digits from \\x00 to \\x7F. Write _ unescaped instead of \\_, \\x0B instead of \\v, and a character above \\x7F as the character itself.',
+    'nested-quantifier': 'A quantifier cannot apply to a group that contains a quantifier or a |, as in (a+)+ or (a|b)*. Such patterns can take exponential time. Quantify the inner part only, or use a class: [ab]* instead of (a|b)*.',
+    'too-many-unbounded': 'A pattern can have at most 2 unbounded quantifiers (*, +, {n,}). Bound the extra ones with {n,m}, or split the rule into two criteria.',
+};
+// qfg-ktkr.7: no \_ (.NET throws), no \v (java reads a vertical-whitespace
+// class), and \xHH only up to \x7F (ruby rejects \x80-\xFF).
+const ASCII_PUNCT = '!"#$%&\'()*+,-./:;<=>?@[\\]^`{|}~';
+const SIMPLE_ESCAPES = { f: 0x0c, n: 0x0a, r: 0x0d, t: 0x09 };
+const MAX_HEX_ESCAPE = 0x7f;
+const SHORTHANDS = 'dDwWsSbB';
+const HEX = /^[\dA-Fa-f]{2}$/;
+class Violation {
+    reason;
+    constructor(reason) {
+        this.reason = reason;
+    }
+}
+const fail = (reason) => {
+    throw new Violation(reason);
+};
+/**
+ * Check one pattern against Quonfig regex v1. Returns null when the pattern is
+ * in the dialect, or the reason and fix-it hint for the first violation.
+ *
+ * Precedence (fixture header): too-long first; then one left-to-right scan
+ * reports the first offending construct (an unclosed ( or [ is found at the
+ * end); then too-many-unbounded, which needs the whole pattern.
+ */
+export function checkRegexV1(pattern) {
+    const cps = [...pattern];
+    try {
+        if (cps.length > REGEX_V1_LIMITS.maxLength)
+            fail('too-long');
+        const unbounded = scan(cps);
+        if (unbounded > REGEX_V1_LIMITS.maxUnboundedQuantifiers)
+            fail('too-many-unbounded');
+        return null;
+    }
+    catch (error) {
+        if (error instanceof Violation)
+            return { hint: REGEX_V1_HINTS[error.reason], reason: error.reason };
+        throw error;
+    }
+}
+/** Scan the pattern; returns the unbounded-quantifier count or throws a Violation. */
+function scan(p) {
+    // One frame per open group: does it (transitively) contain a quantifier or |?
+    const groups = [];
+    let last = 'none';
+    let lastGroupRisky = false;
+    let unbounded = 0;
+    let i = 0;
+    const markRisky = () => {
+        if (groups.length > 0)
+            groups[groups.length - 1] = true;
+    };
+    /** At p[i] === '{': parse a repeat. Returns [end index, unbounded] or throws. */
+    const parseRepeat = () => {
+        let j = i + 1;
+        let n = '';
+        while (j < p.length && p[j] >= '0' && p[j] <= '9')
+            n += p[j++];
+        let m;
+        let comma = false;
+        if (p[j] === ',') {
+            comma = true;
+            j++;
+            m = '';
+            while (j < p.length && p[j] >= '0' && p[j] <= '9')
+                m += p[j++];
+        }
+        if (p[j] !== '}' || n === '')
+            fail('bad-repeat'); // {,m}, a bare {, x{foo}
+        const lo = Number(n);
+        const hi = comma && m !== '' ? Number(m) : undefined;
+        if (lo > REGEX_V1_LIMITS.maxRepeat || (hi !== undefined && (hi > REGEX_V1_LIMITS.maxRepeat || hi < lo)))
+            fail('bad-repeat');
+        return [j, comma && m === ''];
+    };
+    /** At p[i] === '\\': validate one escape, return its code point (or -1 for a non-literal). */
+    const parseEscape = () => {
+        const c = p[i + 1];
+        if (c === undefined)
+            fail('syntax');
+        if (c >= '1' && c <= '9')
+            fail('backref');
+        if (c === 'k')
+            fail('backref');
+        if (c === '0')
+            fail('octal');
+        if (SHORTHANDS.includes(c))
+            fail('unicode-shorthand');
+        if (c in SIMPLE_ESCAPES) {
+            i += 2;
+            return SIMPLE_ESCAPES[c];
+        }
+        if (c === 'x') {
+            const hex = (p[i + 2] ?? '') + (p[i + 3] ?? '');
+            if (!HEX.test(hex))
+                fail('unsupported-escape');
+            const cp = Number.parseInt(hex, 16);
+            if (cp > MAX_HEX_ESCAPE)
+                fail('unsupported-escape');
+            i += 4;
+            return cp;
+        }
+        if (c.length === 1 && ASCII_PUNCT.includes(c)) {
+            i += 2;
+            return c.codePointAt(0);
+        }
+        return fail('unsupported-escape');
+    };
+    const parseClass = () => {
+        // p[i] === '['
+        i++;
+        if (p[i] === '^')
+            i++;
+        if (p[i] === ']')
+            fail('class-syntax'); // []a] / [^]a] read differently in node
+        const start = i;
+        let prev; // code point of the previous single literal, for ranges
+        for (;;) {
+            const c = p[i];
+            if (c === undefined)
+                fail('syntax'); // unclosed [
+            if (c === ']') {
+                const body = p.slice(start, i);
+                if (body.length >= 2 && body[0] === ':' && body.at(-1) === ':')
+                    fail('class-syntax'); // [:alpha:]
+                i++;
+                return;
+            }
+            if (c === '[')
+                fail('class-syntax'); // nested [ and [[:x:]]
+            if ('&-~|'.includes(c) && p[i + 1] === c)
+                fail('class-syntax'); // && -- ~~ ||
+            if (c === '-' && prev !== undefined && p[i + 1] !== ']' && p[i + 1] !== undefined) {
+                i++;
+                if (p[i] === '[')
+                    fail('class-syntax');
+                const hi = p[i] === '\\' ? parseEscape() : p[i++].codePointAt(0);
+                if (hi < prev)
+                    fail('syntax'); // [z-a]
+                prev = undefined;
+                continue;
+            }
+            prev = c === '\\' ? parseEscape() : p[i++].codePointAt(0);
+        }
+    };
+    while (i < p.length) {
+        const c = p[i];
+        switch (c) {
+            case '\\': {
+                parseEscape();
+                last = 'atom';
+                continue;
+            }
+            case '[': {
+                parseClass();
+                last = 'atom';
+                continue;
+            }
+            case '(': {
+                if (p[i + 1] === '?') {
+                    const a = p[i + 2];
+                    const b = p[i + 3];
+                    if (a === ':') {
+                        i += 3;
+                    }
+                    else if (a === '=' || a === '!' || (a === '<' && (b === '=' || b === '!'))) {
+                        fail('lookaround');
+                    }
+                    else if (a === '<' || a === 'P' || a === "'") {
+                        fail('named-group');
+                    }
+                    else if (a !== undefined && /[A-Za-z-]/.test(a)) {
+                        fail('inline-flag');
+                    }
+                    else if (a === undefined) {
+                        fail('syntax');
+                    }
+                    else {
+                        fail('group-extension');
+                    }
+                }
+                else {
+                    i++;
+                }
+                groups.push(false);
+                last = 'none';
+                continue;
+            }
+            case ')': {
+                if (groups.length === 0)
+                    fail('syntax');
+                lastGroupRisky = groups.pop();
+                if (lastGroupRisky)
+                    markRisky(); // "contains" is transitive
+                last = 'group';
+                i++;
+                continue;
+            }
+            case '|': {
+                markRisky();
+                last = 'none';
+                break;
+            }
+            case '^':
+            case '$': {
+                last = 'none';
+                break;
+            }
+            case '*':
+            case '+':
+            case '?':
+            case '{': {
+                let end = i;
+                let isUnbounded = c === '*' || c === '+';
+                if (c === '{')
+                    [end, isUnbounded] = parseRepeat();
+                if (last === 'none' || last === 'quantifier')
+                    fail('syntax');
+                if (last === 'group' && lastGroupRisky)
+                    fail('nested-quantifier');
+                markRisky();
+                if (isUnbounded)
+                    unbounded++;
+                i = end + 1;
+                if (p[i] === '?')
+                    i++; // lazy
+                else if (p[i] === '+')
+                    fail('possessive');
+                last = 'quantifier';
+                continue;
+            }
+            default: {
+                last = 'atom';
+            }
+        }
+        i++;
+    }
+    if (groups.length > 0)
+        fail('syntax'); // unclosed (
+    return unbounded;
+}

package/dist/verify/standalone.d.ts

@@ -35,7 +35,9 @@ export declare function hookVersion(env?: HookEnv): string;
  * old oid that is an ancestor of the new oid. A delete and a create are both
  * rejected (provisioning creates `main` with auto_init; no writer creates it by
  * push, and the zero-oid door is the only way to delete-then-recreate).
- * Other refs are untouched. See plan 2026-09-17-tree-derived-cache 5.6.
+ * Other refs are untouched. Enforced on every repo, unconditionally: the
+ * QUONFIG_HOOK_FF_ENFORCE rollout switch is gone (qfg-jxml.29), so no env var
+ * can turn the rule off. See plan 2026-09-17-tree-derived-cache 5.6.
  */
 export declare function checkAppendOnlyMain(refs: readonly RefUpdate[], env: HookEnv, cwd?: string): {
     bypassReason?: string;

package/dist/verify/standalone.js

@@ -127,11 +127,13 @@ const REWRITE_OPTION = 'quonfig-rewrite=';
  * old oid that is an ancestor of the new oid. A delete and a create are both
  * rejected (provisioning creates `main` with auto_init; no writer creates it by
  * push, and the zero-oid door is the only way to delete-then-recreate).
- * Other refs are untouched. See plan 2026-09-17-tree-derived-cache 5.6.
+ * Other refs are untouched. Enforced on every repo, unconditionally: the
+ * QUONFIG_HOOK_FF_ENFORCE rollout switch is gone (qfg-jxml.29), so no env var
+ * can turn the rule off. See plan 2026-09-17-tree-derived-cache 5.6.
  */
 export function checkAppendOnlyMain(refs, env, cwd) {
     const mainUpdates = refs.filter((ref) => ref.refName === MAIN_REF);
-    if (mainUpdates.length === 0 || !ffEnforcedForRepo(env))
+    if (mainUpdates.length === 0)
         return { errors: [] };
     const bypassReason = operatorBypassReason(env);
     if (bypassReason)
@@ -159,23 +161,6 @@ export function checkAppendOnlyMain(refs, env, cwd) {
     }
     return { errors };
 }
-/** Rollout switch: enforce only for repos named in the allowlist; `*` = all. */
-function ffEnforcedForRepo(env) {
-    const allowlist = (env.QUONFIG_HOOK_FF_ENFORCE ?? '')
-        .split(',')
-        .map((entry) => entry.trim().toLowerCase())
-        .filter(Boolean);
-    if (allowlist.length === 0)
-        return false;
-    if (allowlist.includes('*'))
-        return true;
-    // Gitea 1.25 hands the hook its repo via these (modules/repository/env.go).
-    const owner = (env.GITEA_REPO_USER_NAME ?? '').trim().toLowerCase();
-    const name = (env.GITEA_REPO_NAME ?? '').trim().toLowerCase();
-    if (!owner || !name)
-        return false;
-    return allowlist.includes(`${owner}/${name}`);
-}
 /**
  * Operator bypass, two keys, BOTH required: the pusher is the operator admin
  * account (the app pushes as admin too, so identity only excludes customers)

package/dist/verify/validate.js

@@ -28,6 +28,7 @@
 import { z } from 'zod';
 import { findMapKeyOrderWarnings, navigate, scanOrderedJson } from './map-key-order.js';
 import { compileSchema, validateAgainstSchema } from './schema-validator.js';
+import { checkRegexV1, REGEX_V1_DOCS_URL } from './regex-dialect.js';
 import { DURATION_FORMAT_HINT, INT_RANGE_FORMAT_HINT, isValidIntRange, isValidIsoDuration, isValidSemver, isValidTimestamp, parseDoubleValue, parseIntValue, SEMVER_FORMAT_HINT, TIMESTAMP_FORMAT_HINT, } from './value-grammar.js';
 // Inlined to keep this directory self-contained for the standalone bun-compile
 // build that runs as the qfg-verify pre-receive hook in app-gitea — that build
@@ -1341,6 +1342,25 @@ function criterionValueShapeIssue(criterion) {
                 return { hint: SEMVER_FORMAT_HINT, problem: `needs a version string; got ${vtm.type} ${shown}` };
             return undefined;
         }
+        case 'PROP_DOES_NOT_MATCH':
+        case 'PROP_MATCHES': {
+            // Quonfig regex v1 (qfg-ktkr.2): an out-of-dialect pattern compiles in
+            // some SDKs and not others (or runs in exponential time), so the rule
+            // silently diverges across SDKs. One check here covers qfg verify, the
+            // Git hook and both push engines.
+            if (vtm.type !== 'string' || typeof vtm.value !== 'string')
+                return {
+                    hint: `Store the pattern as {"type": "string", "value": "<pattern>"}. See ${REGEX_V1_DOCS_URL}`,
+                    problem: `needs a string pattern; got ${vtm.type} ${shown}`,
+                };
+            const violation = checkRegexV1(vtm.value);
+            if (violation)
+                return {
+                    hint: `${violation.hint} See ${REGEX_V1_DOCS_URL}`,
+                    problem: `pattern ${shown} is outside Quonfig regex v1 (${violation.reason})`,
+                };
+            return undefined;
+        }
         default: {
             return undefined;
         }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.4.0";
+declare const _default: "0.5.0";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.4.0';
+export default '0.5.0';