@quonfig/cli 0.4.0 → 0.6.0

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.4.0 linux-x64 node-v24.4.1
+@quonfig/cli/0.6.0 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -137,6 +137,8 @@ script doesn't need to know which env it's running in.
 * [`qfg contexts search CONTEXTTYPE QUERY`](#qfg-contexts-search-contexttype-query)
 * [`qfg create NAME`](#qfg-create-name)
 * [`qfg delete NAME`](#qfg-delete-name)
+* [`qfg environments`](#qfg-environments)
+* [`qfg envs`](#qfg-envs)
 * [`qfg flag info [NAME]`](#qfg-flag-info-name)
 * [`qfg flag list`](#qfg-flag-list)
 * [`qfg flag show [NAME]`](#qfg-flag-show-name)
@@ -204,7 +206,7 @@ EXAMPLES
   $ qfg activity restore my.flag --yes
 ```
 
-_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/activity.ts)_
+_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/activity.ts)_
 
 ## `qfg activity deleted`
 
@@ -233,7 +235,7 @@ EXAMPLES
   $ qfg activity deleted --json
 ```
 
-_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/activity/deleted.ts)_
+_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/activity/deleted.ts)_
 
 ## `qfg activity feed`
 
@@ -268,7 +270,7 @@ EXAMPLES
   $ qfg activity feed --json
 ```
 
-_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/activity/feed.ts)_
+_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/activity/feed.ts)_
 
 ## `qfg activity history [NAME]`
 
@@ -302,7 +304,7 @@ EXAMPLES
   $ qfg activity history request.timeout --json
 ```
 
-_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/activity/history.ts)_
+_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/activity/history.ts)_
 
 ## `qfg activity restore [NAME]`
 
@@ -341,7 +343,7 @@ EXAMPLES
   $ qfg activity restore request.timeout --type config --yes
 ```
 
-_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/activity/restore.ts)_
+_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/activity/restore.ts)_
 
 ## `qfg agent install-skill`
 
@@ -386,7 +388,7 @@ EXAMPLES
   $ qfg agent install-skill --force
 ```
 
-_See code: [src/commands/agent/install-skill.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/agent/install-skill.ts)_
+_See code: [src/commands/agent/install-skill.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/agent/install-skill.ts)_
 
 ## `qfg audit-log [NAME]`
 
@@ -414,7 +416,7 @@ EXAMPLES
   $ qfg audit-log my.flag
 ```
 
-_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/audit-log.ts)_
+_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/audit-log.ts)_
 
 ## `qfg cleanup`
 
@@ -456,7 +458,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key
 ```
 
-_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/cleanup.ts)_
+_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/cleanup.ts)_
 
 ## `qfg cleanup list`
 
@@ -503,7 +505,7 @@ EXAMPLES
   $ qfg cleanup list --json
 ```
 
-_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/cleanup/list.ts)_
+_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/cleanup/list.ts)_
 
 ## `qfg cleanup remove [NAME]`
 
@@ -550,7 +552,7 @@ EXAMPLES
   $ qfg cleanup remove my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/cleanup/remove.ts)_
+_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/cleanup/remove.ts)_
 
 ## `qfg cleanup status [NAME]`
 
@@ -590,7 +592,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/cleanup/status.ts)_
+_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/cleanup/status.ts)_
 
 ## `qfg cleanup verify [NAME]`
 
@@ -636,7 +638,7 @@ EXAMPLES
   $ qfg cleanup verify my.flag.key && qfg delete my.flag.key
 ```
 
-_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/cleanup/verify.ts)_
+_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/cleanup/verify.ts)_
 
 ## `qfg config-schema`
 
@@ -665,7 +667,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/config-schema.ts)_
 
 ## `qfg contexts`
 
@@ -688,7 +690,7 @@ EXAMPLES
   $ qfg contexts search organization formhealth
 ```
 
-_See code: [src/commands/contexts.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/contexts.ts)_
+_See code: [src/commands/contexts.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/contexts.ts)_
 
 ## `qfg contexts search CONTEXTTYPE QUERY`
 
@@ -740,7 +742,7 @@ EXAMPLES
   $ qfg contexts search organization formhealth --json
 ```
 
-_See code: [src/commands/contexts/search.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/contexts/search.ts)_
+_See code: [src/commands/contexts/search.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/contexts/search.ts)_
 
 ## `qfg create NAME`
 
@@ -748,22 +750,26 @@ Create a new feature flag, config value, or other item.
 
 ```
 USAGE
-  $ qfg create NAME --type boolean-flag|boolean|string|double|int|string-list|json|duration|log_level
-    [--json] [--interactive] [--no-color] [--verbose] [-w <value>] [--confidential] [--env-var <value>] [--value
-    <value>] [--secret] [--secret-key-name <value>]
+  $ qfg create NAME [--json] [--interactive] [--no-color] [--verbose] [-w <value>] [--confidential]
+    [--env-var <value>] [--type boolean-flag|boolean|string|double|int|string-list|json|duration|log_level] [--value
+    <value>] [--value-from-env VAR] [--value-stdin] [--secret] [--secret-key-name <value>]
 
 ARGUMENTS
   NAME  name for your new item (e.g. my.new.flag)
 
 FLAGS
   --confidential             mark the value as confidential
-  --env-var=<value>          environment variable to get value from
-  --secret                   encrypt the value of this item
+  --env-var=<value>          store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local
+                             env var NOW, use --value-from-env
+  --secret                   encrypt the value of this item (string-only; the CLI never prints the plaintext)
   --secret-key-name=<value>  [default: quonfig.secrets.encryption.key] name of the secret key to use for
                              encryption/decryption
-  --type=<option>            (required)
+  --type=<option>            kind of item to create (required, except with --secret, which implies string)
                              <options: boolean-flag|boolean|string|double|int|string-list|json|duration|log_level>
-  --value=<value>            default value for your new item
+  --value=<value>            default value for your new item (for secrets prefer --value-stdin / --value-from-env)
+  --value-from-env=VAR       read the value to store from this LOCAL env var now (keeps it out of argv/shell history).
+                             Not the same as --env-var
+  --value-stdin              read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv
 
 GLOBAL FLAGS
   -w, --workspace=<value>  Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)
@@ -786,6 +792,17 @@ DESCRIPTION
   duration      An ISO 8601 duration string, e.g. PT30S, PT5M, PT1H30M (SDK returns milliseconds)
   log_level     A dynamic log level (value must be one of TRACE/DEBUG/INFO/WARN/ERROR/FATAL)
 
+  Secrets (--secret) are encrypted client-side and are STRING-ONLY: --secret
+  implies --type string, so you can leave --type off. To store a JSON secret, store the JSON as a string secret and
+  JSON.parse it in your app. The CLI never prints a secret's plaintext: it shows
+  a redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].
+
+  Keep the value out of argv / shell history / agent transcripts with:
+  --value-stdin             read the value from stdin
+  --value-from-env=VAR      read the value from a local env var, now
+  These are different from --env-var, which stores NO value: it tells the SDK to
+  read the value from that env var at runtime.
+
   This sets the global default value. Override per-environment with:
   qfg set-default my.flag --environment production --value true
 
@@ -812,7 +829,15 @@ EXAMPLES
 
   $ qfg create my.new.string --type string --value="hello world"
 
-  $ qfg create my.new.string --type string --value="hello world" --secret
+  # Create a secret without the value ever appearing in argv (--secret implies --type string):
+
+  pbpaste | qfg create stripe.api-key --secret --value-stdin
+
+  $ qfg create stripe.api-key --secret --value-from-env STRIPE_API_KEY
+
+  # A JSON secret is a string secret holding JSON (JSON.parse it in your app):
+
+  $ qfg create gcp.service-account --secret --value-stdin < sa.json
 
   $ qfg create my.new.string --type string --env-var=MY_ENV_VAR_NAME
 
@@ -827,7 +852,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -873,7 +898,73 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/delete.ts)_
+
+## `qfg environments`
+
+List the environments in your workspace.
+
+```
+USAGE
+  $ qfg environments [--json] [--interactive] [--no-color] [--verbose] [-w <value>]
+
+GLOBAL FLAGS
+  -w, --workspace=<value>  Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)
+      --[no-]interactive   Force interactive mode
+      --json               Format output as json.
+      --no-color           Do not colorize output
+      --verbose            Verbose output
+
+DESCRIPTION
+  List the environments in your workspace.
+
+  Use these names with --environment (set-default, set-rollout, get, run, ...).
+  "[Default]" is not an environment: it names the default rules that every
+  environment without rules of its own inherits. Protected environments may
+  require extra permissions to change.
+
+ALIASES
+  $ qfg envs
+
+EXAMPLES
+  $ qfg environments
+
+  $ qfg environments --json
+```
+
+_See code: [src/commands/environments.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/environments.ts)_
+
+## `qfg envs`
+
+List the environments in your workspace.
+
+```
+USAGE
+  $ qfg envs [--json] [--interactive] [--no-color] [--verbose] [-w <value>]
+
+GLOBAL FLAGS
+  -w, --workspace=<value>  Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)
+      --[no-]interactive   Force interactive mode
+      --json               Format output as json.
+      --no-color           Do not colorize output
+      --verbose            Verbose output
+
+DESCRIPTION
+  List the environments in your workspace.
+
+  Use these names with --environment (set-default, set-rollout, get, run, ...).
+  "[Default]" is not an environment: it names the default rules that every
+  environment without rules of its own inherits. Protected environments may
+  require extra permissions to change.
+
+ALIASES
+  $ qfg envs
+
+EXAMPLES
+  $ qfg envs
+
+  $ qfg envs --json
+```
 
 ## `qfg flag info [NAME]`
 
@@ -1077,7 +1168,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -1100,7 +1191,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -1109,12 +1200,14 @@ Get the value of a config/feature-flag/etc.
 ```
 USAGE
   $ qfg get [NAME] [--json] [--interactive] [--no-color] [--verbose] [-w <value>] [--environment <value>]
+    [--reveal]
 
 ARGUMENTS
   NAME  config/feature-flag/etc. name
 
 FLAGS
   --environment=<value>  environment to evaluate in
+  --reveal               print the plaintext of a secret/confidential value (it is redacted by default)
 
 GLOBAL FLAGS
   -w, --workspace=<value>  Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)
@@ -1126,13 +1219,24 @@ GLOBAL FLAGS
 DESCRIPTION
   Get the value of a config/feature-flag/etc.
 
+  Secrets (encrypted) and confidential values print REDACTED by default, as a
+  fingerprint plus length (and the last 4 characters for values of 12+ chars):
+  [encrypted *****3fa9c, 51 chars, ends …a1b2]
+  The fingerprint is the same one SDK telemetry and the Quonfig UI show, so you
+  can confirm a rotation landed without printing the secret. Pass --reveal to
+  print the plaintext. To inject secrets into a process, prefer `qfg run`.
+
 EXAMPLES
   $ qfg get my.config.name
 
   $ qfg get my.config.name --environment=production
+
+  $ qfg get stripe.api-key --environment=production            # redacted fingerprint
+
+  $ qfg get stripe.api-key --environment=production --reveal   # plaintext
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/get.ts)_
 
 ## `qfg history NAME`
 
@@ -1158,7 +1262,7 @@ EXAMPLES
   $ qfg history my.flag
 ```
 
-_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/history.ts)_
+_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/history.ts)_
 
 ## `qfg info [NAME]`
 
@@ -1206,7 +1310,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -1246,7 +1350,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -1276,7 +1380,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -1316,7 +1420,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/list.ts)_
 
 ## `qfg log`
 
@@ -1341,7 +1445,7 @@ EXAMPLES
   $ qfg log --limit 5
 ```
 
-_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/log.ts)_
+_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/log.ts)_
 
 ## `qfg log-level NAME`
 
@@ -1406,7 +1510,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -1431,7 +1535,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -1454,7 +1558,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -1519,7 +1623,7 @@ EXAMPLES
   $ qfg migrate --from launch --source-api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -1557,7 +1661,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -1589,7 +1693,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -1620,7 +1724,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -1675,7 +1779,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1722,7 +1826,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1771,7 +1875,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/push.ts)_
 
 ## `qfg run [COMMAND]`
 
@@ -1822,7 +1926,7 @@ EXAMPLES
   $ qfg run --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test
 ```
 
-_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/run.ts)_
+_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/run.ts)_
 
 ## `qfg schema NAME`
 
@@ -1860,7 +1964,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1887,7 +1991,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1919,7 +2023,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1948,7 +2052,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1975,7 +2079,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg serve`
 
@@ -2033,7 +2137,7 @@ EXAMPLES
   $ qfg serve --port 6581 --frontend-sdk-key PUBLIC_KEY
 ```
 
-_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/serve.ts)_
+_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/serve.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -2042,23 +2146,29 @@ Set the fallback value for a flag or config in one environment.
 ```
 USAGE
   $ qfg set-default [NAME] [--json] [--interactive] [--no-color] [--verbose] [-w <value>] [--confidential]
-    [--env-var <value>] [--environment <value>] [--replace-targeting] [--value <value>] [--confirm] [--secret]
-    [--secret-key-name <value>]
+    [--env-var <value>] [--environment <value>] [--replace-targeting] [--value <value>] [--value-from-env VAR]
+    [--value-stdin] [--confirm] [--secret] [--secret-key-name <value>]
 
 ARGUMENTS
   NAME  config/feature-flag/etc. name
 
 FLAGS
-  --confidential             mark the value as confidential
+  --[no-]confidential        mark the value as confidential. Auto-detected when the key already holds a confidential
+                             value; pass --no-confidential to store it in the clear
   --confirm                  confirm without prompt
-  --env-var=<value>          environment variable to use as default value
-  --environment=<value>      environment to change
+  --env-var=<value>          store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local
+                             env var NOW, use --value-from-env
+  --environment=<value>      environment to change, e.g. production. Use "[Default]" for the default rules that every
+                             environment without its own rules inherits
   --replace-targeting        set the value for EVERYONE: delete this environment's targeting rules instead of keeping
                              them (they stay in git history)
-  --secret                   encrypt the value of this item
+  --secret                   encrypt the value of this item (string-only; the CLI never prints the plaintext)
   --secret-key-name=<value>  [default: quonfig.secrets.encryption.key] name of the secret key to use for
                              encryption/decryption
-  --value=<value>            new default value
+  --value=<value>            new default value (for secrets prefer --value-stdin / --value-from-env)
+  --value-from-env=VAR       read the value to store from this LOCAL env var now (keeps it out of argv/shell history).
+                             Not the same as --env-var
+  --value-stdin              read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv
 
 GLOBAL FLAGS
   -w, --workspace=<value>  Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)
@@ -2083,6 +2193,16 @@ DESCRIPTION
   To set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:
   qfg set-rollout my.flag --environment production --true-percent 20
 
+  Secrets (--secret, or any config whose value is already encrypted) are
+  STRING-ONLY. To store a JSON secret, make it a string secret holding the JSON
+  and JSON.parse it in your app. The CLI never prints a secret's plaintext; it
+  shows a redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].
+  Rotate a secret without the value entering argv / shell history:
+  pbpaste | qfg set-default stripe.api-key --environment production --secret --value-stdin --confirm
+  qfg set-default stripe.api-key --environment production --secret --value-from-env STRIPE_API_KEY --confirm
+  (--env-var is different: it stores NO value and tells the SDK to read one from
+  that env var at runtime.)
+
   To see all current values and rules for a flag:
   qfg info my.flag
 
@@ -2100,7 +2220,15 @@ EXAMPLES
 
   $ qfg set-default my.flag.name --value=false --environment=production --replace-targeting   # kill-switch: off for everyone
 
-  $ qfg set-default my.flag.name --value=true --secret
+  # Rotate a secret without the value entering argv:
+
+  pbpaste | qfg set-default my.secret --environment=production --secret --value-stdin --confirm
+
+  $ qfg set-default my.secret --environment=production --secret --value-from-env=MY_SECRET --confirm
+
+  # Write the [Default] rules (inherited by every environment without its own):
+
+  $ qfg set-default my.secret --environment="[Default]" --secret --value-from-env=MY_SECRET --confirm
 
   $ qfg set-default my.config.name --env-var=MY_ENV_VAR_NAME --environment=production
 
@@ -2113,7 +2241,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -2204,7 +2332,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -2236,7 +2364,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -2245,23 +2373,29 @@ Set the fallback value for a flag or config in one environment.
 ```
 USAGE
   $ qfg toggle [NAME] [--json] [--interactive] [--no-color] [--verbose] [-w <value>] [--confidential]
-    [--env-var <value>] [--environment <value>] [--replace-targeting] [--value <value>] [--confirm] [--secret]
-    [--secret-key-name <value>]
+    [--env-var <value>] [--environment <value>] [--replace-targeting] [--value <value>] [--value-from-env VAR]
+    [--value-stdin] [--confirm] [--secret] [--secret-key-name <value>]
 
 ARGUMENTS
   NAME  config/feature-flag/etc. name
 
 FLAGS
-  --confidential             mark the value as confidential
+  --[no-]confidential        mark the value as confidential. Auto-detected when the key already holds a confidential
+                             value; pass --no-confidential to store it in the clear
   --confirm                  confirm without prompt
-  --env-var=<value>          environment variable to use as default value
-  --environment=<value>      environment to change
+  --env-var=<value>          store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local
+                             env var NOW, use --value-from-env
+  --environment=<value>      environment to change, e.g. production. Use "[Default]" for the default rules that every
+                             environment without its own rules inherits
   --replace-targeting        set the value for EVERYONE: delete this environment's targeting rules instead of keeping
                              them (they stay in git history)
-  --secret                   encrypt the value of this item
+  --secret                   encrypt the value of this item (string-only; the CLI never prints the plaintext)
   --secret-key-name=<value>  [default: quonfig.secrets.encryption.key] name of the secret key to use for
                              encryption/decryption
-  --value=<value>            new default value
+  --value=<value>            new default value (for secrets prefer --value-stdin / --value-from-env)
+  --value-from-env=VAR       read the value to store from this LOCAL env var now (keeps it out of argv/shell history).
+                             Not the same as --env-var
+  --value-stdin              read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv
 
 GLOBAL FLAGS
   -w, --workspace=<value>  Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)
@@ -2286,6 +2420,16 @@ DESCRIPTION
   To set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:
   qfg set-rollout my.flag --environment production --true-percent 20
 
+  Secrets (--secret, or any config whose value is already encrypted) are
+  STRING-ONLY. To store a JSON secret, make it a string secret holding the JSON
+  and JSON.parse it in your app. The CLI never prints a secret's plaintext; it
+  shows a redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].
+  Rotate a secret without the value entering argv / shell history:
+  pbpaste | qfg set-default stripe.api-key --environment production --secret --value-stdin --confirm
+  qfg set-default stripe.api-key --environment production --secret --value-from-env STRIPE_API_KEY --confirm
+  (--env-var is different: it stores NO value and tells the SDK to read one from
+  that env var at runtime.)
+
   To see all current values and rules for a flag:
   qfg info my.flag
 
@@ -2303,7 +2447,15 @@ EXAMPLES
 
   $ qfg toggle my.flag.name --value=false --environment=production --replace-targeting   # kill-switch: off for everyone
 
-  $ qfg toggle my.flag.name --value=true --secret
+  # Rotate a secret without the value entering argv:
+
+  pbpaste | qfg toggle my.secret --environment=production --secret --value-stdin --confirm
+
+  $ qfg toggle my.secret --environment=production --secret --value-from-env=MY_SECRET --confirm
+
+  # Write the [Default] rules (inherited by every environment without its own):
+
+  $ qfg toggle my.secret --environment="[Default]" --secret --value-from-env=MY_SECRET --confirm
 
   $ qfg toggle my.config.name --env-var=MY_ENV_VAR_NAME --environment=production
 
@@ -2347,7 +2499,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -2370,7 +2522,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -2393,7 +2545,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -2426,7 +2578,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -2460,7 +2612,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -2488,7 +2640,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.4.0/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.6.0/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development