@quonfig/cli 0.4.0 → 0.6.0

package/dist/verify/standalone.d.ts

@@ -35,7 +35,9 @@ export declare function hookVersion(env?: HookEnv): string;
  * old oid that is an ancestor of the new oid. A delete and a create are both
  * rejected (provisioning creates `main` with auto_init; no writer creates it by
  * push, and the zero-oid door is the only way to delete-then-recreate).
- * Other refs are untouched. See plan 2026-09-17-tree-derived-cache 5.6.
+ * Other refs are untouched. Enforced on every repo, unconditionally: the
+ * QUONFIG_HOOK_FF_ENFORCE rollout switch is gone (qfg-jxml.29), so no env var
+ * can turn the rule off. See plan 2026-09-17-tree-derived-cache 5.6.
  */
 export declare function checkAppendOnlyMain(refs: readonly RefUpdate[], env: HookEnv, cwd?: string): {
     bypassReason?: string;

package/dist/verify/standalone.js

@@ -127,11 +127,13 @@ const REWRITE_OPTION = 'quonfig-rewrite=';
  * old oid that is an ancestor of the new oid. A delete and a create are both
  * rejected (provisioning creates `main` with auto_init; no writer creates it by
  * push, and the zero-oid door is the only way to delete-then-recreate).
- * Other refs are untouched. See plan 2026-09-17-tree-derived-cache 5.6.
+ * Other refs are untouched. Enforced on every repo, unconditionally: the
+ * QUONFIG_HOOK_FF_ENFORCE rollout switch is gone (qfg-jxml.29), so no env var
+ * can turn the rule off. See plan 2026-09-17-tree-derived-cache 5.6.
  */
 export function checkAppendOnlyMain(refs, env, cwd) {
     const mainUpdates = refs.filter((ref) => ref.refName === MAIN_REF);
-    if (mainUpdates.length === 0 || !ffEnforcedForRepo(env))
+    if (mainUpdates.length === 0)
         return { errors: [] };
     const bypassReason = operatorBypassReason(env);
     if (bypassReason)
@@ -159,23 +161,6 @@ export function checkAppendOnlyMain(refs, env, cwd) {
     }
     return { errors };
 }
-/** Rollout switch: enforce only for repos named in the allowlist; `*` = all. */
-function ffEnforcedForRepo(env) {
-    const allowlist = (env.QUONFIG_HOOK_FF_ENFORCE ?? '')
-        .split(',')
-        .map((entry) => entry.trim().toLowerCase())
-        .filter(Boolean);
-    if (allowlist.length === 0)
-        return false;
-    if (allowlist.includes('*'))
-        return true;
-    // Gitea 1.25 hands the hook its repo via these (modules/repository/env.go).
-    const owner = (env.GITEA_REPO_USER_NAME ?? '').trim().toLowerCase();
-    const name = (env.GITEA_REPO_NAME ?? '').trim().toLowerCase();
-    if (!owner || !name)
-        return false;
-    return allowlist.includes(`${owner}/${name}`);
-}
 /**
  * Operator bypass, two keys, BOTH required: the pusher is the operator admin
  * account (the app pushes as admin too, so identity only excludes customers)

package/dist/verify/validate.js

@@ -28,6 +28,7 @@
 import { z } from 'zod';
 import { findMapKeyOrderWarnings, navigate, scanOrderedJson } from './map-key-order.js';
 import { compileSchema, validateAgainstSchema } from './schema-validator.js';
+import { checkRegexV1, REGEX_V1_DOCS_URL } from './regex-dialect.js';
 import { DURATION_FORMAT_HINT, INT_RANGE_FORMAT_HINT, isValidIntRange, isValidIsoDuration, isValidSemver, isValidTimestamp, parseDoubleValue, parseIntValue, SEMVER_FORMAT_HINT, TIMESTAMP_FORMAT_HINT, } from './value-grammar.js';
 // Inlined to keep this directory self-contained for the standalone bun-compile
 // build that runs as the qfg-verify pre-receive hook in app-gitea — that build
@@ -1341,6 +1342,25 @@ function criterionValueShapeIssue(criterion) {
                 return { hint: SEMVER_FORMAT_HINT, problem: `needs a version string; got ${vtm.type} ${shown}` };
             return undefined;
         }
+        case 'PROP_DOES_NOT_MATCH':
+        case 'PROP_MATCHES': {
+            // Quonfig regex v1 (qfg-ktkr.2): an out-of-dialect pattern compiles in
+            // some SDKs and not others (or runs in exponential time), so the rule
+            // silently diverges across SDKs. One check here covers qfg verify, the
+            // Git hook and both push engines.
+            if (vtm.type !== 'string' || typeof vtm.value !== 'string')
+                return {
+                    hint: `Store the pattern as {"type": "string", "value": "<pattern>"}. See ${REGEX_V1_DOCS_URL}`,
+                    problem: `needs a string pattern; got ${vtm.type} ${shown}`,
+                };
+            const violation = checkRegexV1(vtm.value);
+            if (violation)
+                return {
+                    hint: `${violation.hint} See ${REGEX_V1_DOCS_URL}`,
+                    problem: `pattern ${shown} is outside Quonfig regex v1 (${violation.reason})`,
+                };
+            return undefined;
+        }
         default: {
             return undefined;
         }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.4.0";
+declare const _default: "0.6.0";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.4.0';
+export default '0.6.0';