@contrail/cli 3.5.5-alpha.ae6a66f → 3.5.5-alpha.bd66bf6

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @contrail/cli
 $ contrail COMMAND
 running command...
 $ contrail (--version)
-@contrail/cli/3.5.5-alpha.ae6a66f linux-x64 node-v24.20.0
+@contrail/cli/3.5.5-alpha.bd66bf6 linux-x64 node-v24.22.1
 $ contrail --help [COMMAND]
 USAGE
   $ contrail COMMAND

package/dist/auth/login.js

@@ -9,10 +9,10 @@ const config_1 = require("../helpers/config/config");
 const logger_1 = tslib_1.__importDefault(require("../logger"));
 const path_1 = tslib_1.__importDefault(require("path"));
 const fs_1 = tslib_1.__importDefault(require("fs"));
-const CONFIGURATION = {
-    userPoolId: 'us-east-1_qIaNZdUfm',
-    clientId: process.env.CONTRAIL_COGNITO_CLIENT_ID || '7knkt34gfacbgd0ghnuspefdfg',
-    apiGateway: 'https://api.vibeiq.com/prod/api',
+const DEFAULT_API_GATEWAY = config_1.ENVIRONMENTS.prod;
+const COGNITO_CONFIGS = {
+    dev: { userPoolId: 'us-east-1_e2cA0nJWu', clientId: '209s9c62o165cqab0fu5ihjtu9' },
+    prod: { userPoolId: 'us-east-1_qIaNZdUfm', clientId: '7knkt34gfacbgd0ghnuspefdfg' },
 };
 async function authUser() {
     logger_1.default.debug('authorizing user...');
@@ -66,7 +66,7 @@ async function getOrgSlug(config) {
     return orgSlug;
 }
 async function authenticateWithApiKey(config, apiKey, orgSlug) {
-    const apiGateway = config?.apiGateway ?? CONFIGURATION.apiGateway;
+    const apiGateway = config?.apiGateway ?? DEFAULT_API_GATEWAY;
     sdk_1.Auth.config = {
         apiUserToken: apiKey,
         apiRefreshToken: null,
@@ -78,6 +78,10 @@ async function authenticateWithApiKey(config, apiKey, orgSlug) {
     return returnAndStoreConfig(sdk_1.Auth.config);
 }
 async function authenticateWithUsernamePassword(config) {
+    const apiGateway = config?.apiGateway ?? DEFAULT_API_GATEWAY;
+    const cognitoConfig = getCognitoConfig(apiGateway);
+    const environment = describeEnvironment(apiGateway);
+    logger_1.default.info(`Signing in to ${environment} — use your ${environment} VibeIQ credentials.`);
     const questions = [];
     if (!process.env.CONTRAIL_CLI_EMAIL) {
         questions.push({
@@ -100,14 +104,14 @@ async function authenticateWithUsernamePassword(config) {
         email: process.env.CONTRAIL_CLI_EMAIL || answers.email,
         password: process.env.CONTRAIL_CLI_PASSWORD || answers.password,
         orgSlug: await getOrgSlug(config),
-        ...(config?.apiGateway && { apiGateway: config.apiGateway }),
+        apiGateway,
     };
     if (!params.email || !params.password) {
         throw new Error('Email and Password required');
     }
     const poolData = {
-        UserPoolId: CONFIGURATION.userPoolId,
-        ClientId: CONFIGURATION.clientId,
+        UserPoolId: cognitoConfig.userPoolId,
+        ClientId: cognitoConfig.clientId,
     };
     const userPool = new amazon_cognito_identity_js_1.CognitoUserPool(poolData);
     const authData = {
@@ -123,9 +127,12 @@ async function authenticateWithUsernamePassword(config) {
     return new Promise((resolve, reject) => {
         cognitoUser.authenticateUser(authDetails, {
             onSuccess: async (result) => {
-                const user = result;
-                const config = await setAuthContext(user, params);
-                resolve(config);
+                try {
+                    resolve(await setAuthContext(result, params));
+                }
+                catch (e) {
+                    reject(e);
+                }
             },
             onFailure: (err) => {
                 reject(err);
@@ -134,7 +141,7 @@ async function authenticateWithUsernamePassword(config) {
     });
 }
 async function setAuthContext(user, params) {
-    const apiGateway = params?.apiGateway ?? CONFIGURATION.apiGateway;
+    const apiGateway = params.apiGateway;
     const { vibeAccessToken, vibeRefreshToken } = await getVibeAccessTokenFromCognitoAccessToken(user.idToken.jwtToken, apiGateway);
     // Set Auth Config
     sdk_1.Auth.config = {
@@ -171,6 +178,19 @@ async function refreshCurrentUserOrg() {
     // await checkTelemetry(current_Version);
     return returnAndStoreConfig(sdk_1.Auth.config);
 }
+function getCognitoConfig(apiGateway) {
+    const environment = findEnvironmentName(apiGateway);
+    if (!environment) {
+        throw new Error(`No Cognito user pool is known for ${new URL(apiGateway).host}. Email and password sign-in works for ${Object.keys(COGNITO_CONFIGS).join(' and ')}; use CONTRAIL_CLI_API_KEY for other environments.`);
+    }
+    return COGNITO_CONFIGS[environment];
+}
+function findEnvironmentName(apiGateway) {
+    return Object.keys(config_1.ENVIRONMENTS).find((name) => config_1.ENVIRONMENTS[name] === apiGateway);
+}
+function describeEnvironment(apiGateway) {
+    return findEnvironmentName(apiGateway) ?? new URL(apiGateway).host;
+}
 async function getVibeAccessTokenFromCognitoAccessToken(cognitoAccessToken, apiGateway) {
     const url = `${apiGateway}/auth/cognito/`;
     const response = await fetch(url, {
@@ -181,9 +201,11 @@ async function getVibeAccessTokenFromCognitoAccessToken(cognitoAccessToken, apiG
         },
         body: JSON.stringify({ accessToken: cognitoAccessToken }),
     });
-    return await response.json().then((data) => {
-        return { vibeAccessToken: data.accessToken, vibeRefreshToken: data.refreshToken };
-    });
+    if (!response.ok) {
+        throw new Error(`${describeEnvironment(apiGateway)} rejected the sign-in (${response.status}).`);
+    }
+    const data = await response.json();
+    return { vibeAccessToken: data.accessToken, vibeRefreshToken: data.refreshToken };
 }
 async function requestRefreshedAccessToken(vibeRefreshToken, apiGateway) {
     const url = `${apiGateway}/auth/jwt_refresh/`;

package/dist/auth/login.spec.js

@@ -1,6 +1,93 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const amazon_cognito_identity_js_1 = require("amazon-cognito-identity-js");
+const sdk_1 = require("@contrail/sdk");
+const config_1 = require("../helpers/config/config");
 const login_1 = require("./login");
+jest.mock('amazon-cognito-identity-js', () => ({
+    CognitoUserPool: jest.fn(),
+    AuthenticationDetails: jest.fn(),
+    CognitoUser: jest.fn().mockImplementation(() => ({
+        authenticateUser: (_details, callbacks) => callbacks.onSuccess({ idToken: { jwtToken: 'cognito-id-token' } }),
+    })),
+}));
+jest.mock('@contrail/sdk', () => ({
+    Auth: { config: {} },
+    getCurrentUser: jest.fn(),
+    setConfig: jest.fn(),
+}));
+jest.mock('../helpers/config/config', () => ({
+    ...jest.requireActual('../helpers/config/config'),
+    getConfig: jest.fn(),
+    storeConfig: jest.fn(),
+}));
+jest.mock('../logger', () => ({
+    __esModule: true,
+    default: { debug: jest.fn(), info: jest.fn() },
+}));
+const DEV_GATEWAY = 'https://api.dev.vibeiq.com/dev/api';
+function jsonResponse(status, body = {}) {
+    return new Response(JSON.stringify(body), { status });
+}
+describe('authUser with email and password', () => {
+    const originalFetch = global.fetch;
+    const originalEmail = process.env.CONTRAIL_CLI_EMAIL;
+    const originalPassword = process.env.CONTRAIL_CLI_PASSWORD;
+    let fetchMock;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        process.env.CONTRAIL_CLI_EMAIL = 'dev@vibeiq.com';
+        process.env.CONTRAIL_CLI_PASSWORD = 'secret';
+        config_1.getConfig.mockResolvedValue({ apiGateway: DEV_GATEWAY, orgSlug: 'adam-zone-1' });
+        sdk_1.getCurrentUser.mockResolvedValue({ id: 'user-1' });
+        fetchMock = jest.fn();
+        global.fetch = fetchMock;
+    });
+    afterEach(() => {
+        global.fetch = originalFetch;
+        process.env.CONTRAIL_CLI_EMAIL = originalEmail;
+        process.env.CONTRAIL_CLI_PASSWORD = originalPassword;
+    });
+    it('should sign in through the dev pool when the config points at dev', async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { accessToken: 'vibe-access', refreshToken: 'vibe-refresh' }));
+        const context = await (0, login_1.authUser)();
+        expect(amazon_cognito_identity_js_1.CognitoUserPool).toHaveBeenCalledWith({
+            UserPoolId: 'us-east-1_e2cA0nJWu',
+            ClientId: '209s9c62o165cqab0fu5ihjtu9',
+        });
+        expect(context).toEqual({
+            apiUserToken: 'vibe-access',
+            apiRefreshToken: 'vibe-refresh',
+            apiGateway: DEV_GATEWAY,
+            orgSlug: 'adam-zone-1',
+        });
+    });
+    it('should sign in through the prod pool when the config points at prod', async () => {
+        config_1.getConfig.mockResolvedValue({
+            apiGateway: 'https://api.vibeiq.com/prod/api',
+            orgSlug: 'adam-zone-1',
+        });
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { accessToken: 'vibe-access', refreshToken: 'vibe-refresh' }));
+        await (0, login_1.authUser)();
+        expect(amazon_cognito_identity_js_1.CognitoUserPool).toHaveBeenCalledWith({
+            UserPoolId: 'us-east-1_qIaNZdUfm',
+            ClientId: '7knkt34gfacbgd0ghnuspefdfg',
+        });
+    });
+    it('should fail without saving tokens when no pool is known for the environment', async () => {
+        config_1.getConfig.mockResolvedValue({
+            apiGateway: 'http://localhost:3000/api',
+            orgSlug: 'adam-zone-1',
+        });
+        await expect((0, login_1.authUser)()).rejects.toThrow('No Cognito user pool is known for localhost:3000.');
+        expect(config_1.storeConfig).not.toHaveBeenCalled();
+    });
+    it('should fail without saving tokens when the environment rejects the sign-in', async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(401, { message: 'Unauthorized' }));
+        await expect((0, login_1.authUser)()).rejects.toThrow('dev rejected the sign-in (401).');
+        expect(config_1.storeConfig).not.toHaveBeenCalled();
+    });
+});
 describe('getVersionFromPackageJson', () => {
     it('should return the version value from package.json', () => {
         const version = (0, login_1.getVersionFromPackageJson)();

package/dist/commands/feature-flags/export.js

@@ -8,6 +8,7 @@ const fs_1 = tslib_1.__importDefault(require("fs"));
 const login_1 = require("../../auth/login");
 const core_1 = require("@oclif/core");
 const file_helpers_1 = require("../../helpers/file-helpers");
+const error_helpers_1 = require("../../helpers/error-helpers");
 const feature_flags_1 = require("../../api/feature-flags");
 const basecommand_1 = require("../../basecommand");
 exports.FEATURE_FLAGS_FILE = 'feature-flags.yml';
@@ -41,7 +42,8 @@ class ExportFeatureFlags extends basecommand_1.BaseCommand {
             this.log(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Exported`);
         }
         catch (e) {
-            this.log(`${chalk_1.default.red.bold('FAIL')} Feature Flags Export Failed. ${e}`);
+            this.log(`${chalk_1.default.red.bold('FAIL')} Feature Flags Export Failed. ${(0, error_helpers_1.describeError)(e)}`);
+            process.exitCode = 1;
             return;
         }
         this.log(`${chalk_1.default.green.bold('COMPLETE')} Feature Flags Export Complete.`);

package/dist/commands/feature-flags/export.spec.js

@@ -2,11 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 const fs_1 = tslib_1.__importDefault(require("fs"));
-const export_1 = require("./export");
+const export_1 = tslib_1.__importStar(require("./export"));
 const file_helpers_1 = require("../../helpers/file-helpers");
 const feature_flags_1 = require("../../api/feature-flags");
+const login_1 = require("../../auth/login");
 jest.mock('../../helpers/file-helpers');
 jest.mock('../../api/feature-flags');
+jest.mock('../../auth/login');
 const mocked = (fn) => fn;
 describe('exportFeatureFlags', () => {
     let mkdirSyncSpy;
@@ -32,3 +34,76 @@ describe('exportFeatureFlags', () => {
         expect(mocked(file_helpers_1.saveData)).toHaveBeenCalledWith([], 'out-dir/feature-flags.yml', false);
     });
 });
+describe('ExportFeatureFlags command', () => {
+    let mkdirSyncSpy;
+    let logs;
+    // oclif's init() parses argv and reads the on-disk config, so drive run() with flags set directly
+    const runCommand = async () => {
+        const command = new export_1.default([], {});
+        command.flags = { outDir: 'out-dir', overwrite: true };
+        jest.spyOn(command, 'log').mockImplementation((message) => logs.push(String(message)));
+        await command.run();
+    };
+    beforeEach(() => {
+        jest.clearAllMocks();
+        logs = [];
+        process.exitCode = undefined;
+        mkdirSyncSpy = jest.spyOn(fs_1.default, 'mkdirSync').mockReturnValue(undefined);
+        mocked(login_1.authUser).mockResolvedValue({});
+        mocked(file_helpers_1.saveData).mockResolvedValue(undefined);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([]);
+    });
+    afterEach(() => {
+        mkdirSyncSpy.mockRestore();
+        process.exitCode = undefined;
+    });
+    it('leaves the exit code alone on success', async () => {
+        await runCommand();
+        expect(process.exitCode).toBeUndefined();
+        expect(logs.join('\n')).toContain('Feature Flags Export Complete');
+    });
+    const failures = [
+        [
+            'authentication fails',
+            () => {
+                mocked(login_1.authUser).mockRejectedValue(new Error('boom'));
+            },
+        ],
+        [
+            'the API read fails',
+            () => {
+                mocked(feature_flags_1.getFeatureFlags).mockRejectedValue(new Error('boom'));
+            },
+        ],
+        [
+            'the directory cannot be created',
+            () => {
+                mkdirSyncSpy.mockImplementation(() => {
+                    throw new Error('boom');
+                });
+            },
+        ],
+        [
+            'the file write fails',
+            () => {
+                mocked(file_helpers_1.saveData).mockRejectedValue(new Error('boom'));
+            },
+        ],
+    ];
+    it.each(failures)('exits non-zero when %s, so automation does not read it as a success', async (_, fail) => {
+        fail();
+        await runCommand();
+        expect(process.exitCode).toBe(1);
+        const output = logs.join('\n');
+        expect(output).toContain('Feature Flags Export Failed');
+        expect(output).not.toContain('Feature Flags Export Complete');
+    });
+    it('reports the API message rather than a bare "Error"', async () => {
+        // the SDK's ApiError has an undefined message and keeps the body in details
+        mocked(feature_flags_1.getFeatureFlags).mockRejectedValue({
+            details: '{"message":"Forbidden resource","statusCode":403}',
+        });
+        await runCommand();
+        expect(logs.join('\n')).toContain('Forbidden resource');
+    });
+});

package/dist/commands/feature-flags/import.d.ts

@@ -16,6 +16,16 @@ export default class ImportFeatureFlags extends BaseCommand {
  * the command before it half-applies the file.
  */
 export declare function assertCanManageFeatureFlags(): Promise<void>;
+/**
+ * The `instance import` variant: feature flags are one step of a much larger config copy that
+ * org admins without a platform role are expected to run, so a missing role (or roles we could
+ * not read) logs and skips instead of failing the whole import. Errors from the flag upload
+ * itself still propagate — only the permission check is soft here.
+ *
+ * `contrail feature-flags import` deliberately does the opposite and fails, because there the
+ * flags are the entire point of the command.
+ */
+export declare function uploadFeatureFlagsIfPermitted(dir: string): Promise<void>;
 /**
  * Makes the target org's enabled feature flags match $dir/feature-flags.yml: enables every
  * flag in the file and disables any flag the target has that the file does not, the same
@@ -24,5 +34,9 @@ export declare function assertCanManageFeatureFlags(): Promise<void>;
  *
  * Failures are collected and rethrown so an import never reports success while the org is
  * missing flags.
+ *
+ * A file that lists no flags at all is skipped rather than applied: reconciling against an
+ * empty list would disable every flag in the target org, which is almost never what a copy
+ * is meant to do. Flags that should be off in the target have to be disabled by hand.
  */
 export declare function uploadFeatureFlags(dir: string): Promise<void>;

package/dist/commands/feature-flags/import.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.uploadFeatureFlags = exports.assertCanManageFeatureFlags = exports.REQUIRED_PLATFORM_ROLES = void 0;
+exports.uploadFeatureFlags = exports.uploadFeatureFlagsIfPermitted = exports.assertCanManageFeatureFlags = exports.REQUIRED_PLATFORM_ROLES = void 0;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const chalk_1 = tslib_1.__importDefault(require("chalk"));
@@ -48,26 +48,57 @@ class ImportFeatureFlags extends basecommand_1.BaseCommand {
     }
 }
 exports.default = ImportFeatureFlags;
+async function getPlatformRoles() {
+    try {
+        const currentUser = await (0, users_1.getCurrentUserWithPlatformRoles)();
+        return normalizePlatformRoles(currentUser?.platformRoles);
+    }
+    catch (e) {
+        throw new Error(`Could not read your platform roles. ${(0, error_helpers_1.describeError)(e)}`);
+    }
+}
 /**
  * The feature flags API only lets a platform admin/manager create or delete flags, and a
  * missing role surfaces as a generic 403 partway through the run. Checking up front stops
  * the command before it half-applies the file.
  */
 async function assertCanManageFeatureFlags() {
+    const platformRoles = await getPlatformRoles();
+    if (!platformRoles.some((role) => exports.REQUIRED_PLATFORM_ROLES.includes(role))) {
+        throw new Error(`Importing feature flags requires the ${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role. ` +
+            `Your roles: ${platformRoles.length ? platformRoles.join(', ') : 'none'}.`);
+    }
+}
+exports.assertCanManageFeatureFlags = assertCanManageFeatureFlags;
+/**
+ * The `instance import` variant: feature flags are one step of a much larger config copy that
+ * org admins without a platform role are expected to run, so a missing role (or roles we could
+ * not read) logs and skips instead of failing the whole import. Errors from the flag upload
+ * itself still propagate — only the permission check is soft here.
+ *
+ * `contrail feature-flags import` deliberately does the opposite and fails, because there the
+ * flags are the entire point of the command.
+ */
+async function uploadFeatureFlagsIfPermitted(dir) {
     let platformRoles;
     try {
-        const currentUser = await (0, users_1.getCurrentUserWithPlatformRoles)();
-        platformRoles = normalizePlatformRoles(currentUser?.platformRoles);
+        platformRoles = await getPlatformRoles();
     }
     catch (e) {
-        throw new Error(`Could not read your platform roles. ${(0, error_helpers_1.describeError)(e)}`);
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Skipping feature flags: ${(0, error_helpers_1.describeError)(e)} ` +
+            `Ask a platform admin to run 'contrail feature-flags import -d ${dir}'.`);
+        return;
     }
     if (!platformRoles.some((role) => exports.REQUIRED_PLATFORM_ROLES.includes(role))) {
-        throw new Error(`Importing feature flags requires the ${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role. ` +
-            `Your roles: ${platformRoles.length ? platformRoles.join(', ') : 'none'}.`);
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Skipping feature flags: this requires the ` +
+            `${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role and you have ` +
+            `${platformRoles.length ? platformRoles.join(', ') : 'none'}. ` +
+            `Ask a platform admin to run 'contrail feature-flags import -d ${dir}'.`);
+        return;
     }
+    await uploadFeatureFlags(dir);
 }
-exports.assertCanManageFeatureFlags = assertCanManageFeatureFlags;
+exports.uploadFeatureFlagsIfPermitted = uploadFeatureFlagsIfPermitted;
 /**
  * Makes the target org's enabled feature flags match $dir/feature-flags.yml: enables every
  * flag in the file and disables any flag the target has that the file does not, the same
@@ -76,6 +107,10 @@ exports.assertCanManageFeatureFlags = assertCanManageFeatureFlags;
  *
  * Failures are collected and rethrown so an import never reports success while the org is
  * missing flags.
+ *
+ * A file that lists no flags at all is skipped rather than applied: reconciling against an
+ * empty list would disable every flag in the target org, which is almost never what a copy
+ * is meant to do. Flags that should be off in the target have to be disabled by hand.
  */
 async function uploadFeatureFlags(dir) {
     const filePath = path.join(dir, export_1.FEATURE_FLAGS_FILE);
@@ -83,11 +118,16 @@ async function uploadFeatureFlags(dir) {
         logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} No feature flags found in ${dir}. Skipping.`);
         return;
     }
-    const data = (0, file_helpers_1.loadData)(filePath);
+    const data = (0, file_helpers_1.loadData)(filePath) ?? [];
     if (!Array.isArray(data)) {
         throw new Error(`${filePath} must contain a YAML list of feature flags`);
     }
     const featureNamesToEnable = new Set(data.map(toFeatureName).filter(Boolean));
+    if (featureNamesToEnable.size === 0) {
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} ${filePath} lists no feature flags. Skipping, so ` +
+            'the flags currently enabled in this org are left as they are.');
+        return;
+    }
     const existingFlags = (await (0, feature_flags_1.getFeatureFlags)()) ?? [];
     const enabledFeatureNames = new Set(existingFlags.map((flag) => flag?.featureName));
     const toCreate = [...featureNamesToEnable].filter((name) => !enabledFeatureNames.has(name));

package/dist/commands/feature-flags/import.spec.js

@@ -58,6 +58,26 @@ describe('uploadFeatureFlags', () => {
         expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
         expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
     });
+    it('skips an export that lists no flags instead of disabling everything in the target org', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([
+            { id: '1', featureName: 'SHOWROOM' },
+            { id: '2', featureName: 'DEV_TABS' },
+        ]);
+        const infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('lists no feature flags'));
+        infoSpy.mockRestore();
+    });
+    it('treats a blank feature-flags.yml the same as an empty list', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue(undefined);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+    });
     it('enables every flag from the export that the target org is missing', async () => {
         mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }, { featureName: 'PROMOTE' }]);
         mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
@@ -123,3 +143,52 @@ describe('uploadFeatureFlags', () => {
         expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('PROMOTE');
     });
 });
+describe('uploadFeatureFlagsIfPermitted', () => {
+    let existsSyncSpy;
+    let infoSpy;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        existsSyncSpy = jest.spyOn(fs_1.default, 'existsSync').mockReturnValue(true);
+        infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.createFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.deleteFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([]);
+    });
+    afterEach(() => {
+        existsSyncSpy.mockRestore();
+        infoSpy.mockRestore();
+    });
+    const messages = () => infoSpy.mock.calls.map(([message]) => String(message)).join('\n');
+    it('applies the flags when the user has a platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_MANAGER'],
+        });
+        await (0, import_1.uploadFeatureFlagsIfPermitted)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('SHOWROOM');
+    });
+    it('skips with a log instead of failing when the user has no platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [] });
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('PLATFORM_ADMIN or PLATFORM_MANAGER');
+        expect(messages()).toContain('contrail feature-flags import -d export-dir');
+    });
+    it('skips with a log when the platform roles cannot be read', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockRejectedValue(new Error('Forbidden resource'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('Forbidden resource');
+    });
+    it('still propagates a failure from the upload itself', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_ADMIN'],
+        });
+        mocked(feature_flags_1.createFeatureFlag).mockRejectedValue(new Error('boom'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).rejects.toThrow('could not enable SHOWROOM: boom');
+    });
+});

package/dist/commands/instance/export.d.ts

@@ -10,3 +10,12 @@ export default class ExportInstance extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+export declare function exportInstance(outDir: string, overwrite: boolean): Promise<void>;

package/dist/commands/instance/export.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportInstance = void 0;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const core_1 = require("@oclif/core");
 const getAll_1 = require("../types/getAll");
 const export_1 = require("../users/export");
 const export_2 = require("../groups/export");
+const export_3 = require("../feature-flags/export");
 const basecommand_1 = require("../../basecommand");
 class ExportInstance extends basecommand_1.BaseCommand {
     static description = 'Exports an data of an instance including types and users';
@@ -29,9 +31,22 @@ class ExportInstance extends basecommand_1.BaseCommand {
         }),
     };
     async run() {
-        await (0, getAll_1.getAll)(this.flags.outDir, this.flags.overwrite);
-        await (0, export_1.exportUsers)(path.join(this.flags.outDir, 'users.yml'), this.flags.overwrite);
-        await (0, export_2.exportGroups)(path.join(this.flags.outDir, 'groups.yml'), this.flags.overwrite);
+        await exportInstance(this.flags.outDir, this.flags.overwrite);
     }
 }
 exports.default = ExportInstance;
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+async function exportInstance(outDir, overwrite) {
+    await (0, getAll_1.getAll)(outDir, overwrite);
+    await (0, export_1.exportUsers)(path.join(outDir, 'users.yml'), overwrite);
+    await (0, export_2.exportGroups)(path.join(outDir, 'groups.yml'), overwrite);
+    await (0, export_3.exportFeatureFlags)(outDir, overwrite);
+}
+exports.exportInstance = exportInstance;

package/dist/commands/instance/export.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/instance/export.spec.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const export_1 = require("./export");
+const getAll_1 = require("../types/getAll");
+const export_2 = require("../users/export");
+const export_3 = require("../groups/export");
+const export_4 = require("../feature-flags/export");
+jest.mock('../types/getAll');
+jest.mock('../users/export');
+jest.mock('../groups/export');
+jest.mock('../feature-flags/export');
+const mocked = (fn) => fn;
+const STEPS = [getAll_1.getAll, export_2.exportUsers, export_3.exportGroups, export_4.exportFeatureFlags];
+describe('exportInstance', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        for (const fn of STEPS) {
+            mocked(fn).mockResolvedValue(undefined);
+        }
+    });
+    it('exports everything the import loads back, including feature flags', async () => {
+        await (0, export_1.exportInstance)('out-dir', true);
+        expect(mocked(getAll_1.getAll)).toHaveBeenCalledWith('out-dir', true);
+        expect(mocked(export_2.exportUsers)).toHaveBeenCalledWith('out-dir/users.yml', true);
+        expect(mocked(export_3.exportGroups)).toHaveBeenCalledWith('out-dir/groups.yml', true);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', true);
+    });
+    it('passes the overwrite flag through to the feature flags export', async () => {
+        await (0, export_1.exportInstance)('out-dir', false);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', false);
+    });
+});

package/dist/commands/instance/import.d.ts

@@ -17,6 +17,9 @@ export default class ImportInstance extends BaseCommand {
  *   4. type overrides — after policies, because they reference policies, rule sets and option
  *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
  *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
  *
  * Fails (rejects) if the type overrides could not be applied, so the import does not
  * report success while the org is missing customizations carried by overrides

package/dist/commands/instance/import.js

@@ -11,6 +11,7 @@ const uploadTypePropertyPolicies_1 = require("../types/uploadTypePropertyPolicie
 const uploadTypePolicies_1 = require("../types/uploadTypePolicies");
 const uploadTypeOverrides_1 = require("../types/uploadTypeOverrides");
 const import_3 = require("../org-config/import");
+const import_4 = require("../feature-flags/import");
 const basecommand_1 = require("../../basecommand");
 class ImportInstance extends basecommand_1.BaseCommand {
     static description = 'Import the data to an instance, including types and users';
@@ -40,6 +41,9 @@ exports.default = ImportInstance;
  *   4. type overrides — after policies, because they reference policies, rule sets and option
  *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
  *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
  *
  * Fails (rejects) if the type overrides could not be applied, so the import does not
  * report success while the org is missing customizations carried by overrides
@@ -53,5 +57,6 @@ async function importInstance(dir) {
     await (0, uploadTypePolicies_1.uploadTypePolicies)(dir);
     await (0, uploadTypeOverrides_1.uploadTypeOverrides)(dir);
     await (0, import_3.uploadOrgConfig)(dir);
+    await (0, import_4.uploadFeatureFlagsIfPermitted)(dir);
 }
 exports.importInstance = importInstance;

package/dist/commands/instance/import.spec.js

@@ -8,6 +8,7 @@ const uploadTypePropertyPolicies_1 = require("../types/uploadTypePropertyPolicie
 const uploadTypePolicies_1 = require("../types/uploadTypePolicies");
 const uploadTypeOverrides_1 = require("../types/uploadTypeOverrides");
 const import_4 = require("../org-config/import");
+const import_5 = require("../feature-flags/import");
 jest.mock('../types/loadAll');
 jest.mock('../users/import');
 jest.mock('../groups/import');
@@ -15,6 +16,7 @@ jest.mock('../types/uploadTypePropertyPolicies');
 jest.mock('../types/uploadTypePolicies');
 jest.mock('../types/uploadTypeOverrides');
 jest.mock('../org-config/import');
+jest.mock('../feature-flags/import');
 const mocked = (fn) => fn;
 const STEPS = [
     loadAll_1.loadAll,
@@ -24,6 +26,7 @@ const STEPS = [
     uploadTypePolicies_1.uploadTypePolicies,
     uploadTypeOverrides_1.uploadTypeOverrides,
     import_4.uploadOrgConfig,
+    import_5.uploadFeatureFlagsIfPermitted,
 ];
 describe('importInstance', () => {
     beforeEach(() => {
@@ -37,6 +40,7 @@ describe('importInstance', () => {
         expect(mocked(loadAll_1.loadAll)).toHaveBeenCalledWith('export-dir', true, false);
         expect(mocked(uploadTypeOverrides_1.uploadTypeOverrides)).toHaveBeenCalledWith('export-dir');
         expect(mocked(import_4.uploadOrgConfig)).toHaveBeenCalledWith('export-dir');
+        expect(mocked(import_5.uploadFeatureFlagsIfPermitted)).toHaveBeenCalledWith('export-dir');
         const order = STEPS.map((fn) => mocked(fn).mock.invocationCallOrder[0]);
         // strictly increasing => called in exactly this order
         for (let i = 1; i < order.length; i++) {

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.5.5-alpha.ae6a66f",
+  "version": "3.5.5-alpha.bd66bf6",
   "commands": {
     "app:create": {
       "id": "app:create",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/cli",
-  "version": "3.5.5-alpha.ae6a66f",
+  "version": "3.5.5-alpha.bd66bf6",
   "description": "VibeIQ's Contrail Platform CLI.",
   "bin": {
     "contrail-cli": "./bin/run",