@fluixi/cli 0.1.0-alpha.82 → 0.1.0-alpha.83

package/dist/scaffold/prompt.js

@@ -0,0 +1,95 @@
+/**
+ * The interactive prompts create-fluixi and `fluixi add` share: a text answer and an
+ * arrow-key choice, drawn in the clack-style gutter. Zero dependencies, hand-rolled ANSI.
+ */
+import { createInterface } from 'node:readline/promises';
+import { emitKeypressEvents } from 'node:readline';
+import { stdin as input, stdout as output, exit, env } from 'node:process';
+const COLOR = env.NO_COLOR || env.FORCE_COLOR === '0'
+    ? false
+    : (!!output.isTTY || !!env.FORCE_COLOR) && env.TERM !== 'dumb';
+const sgr = (o, x) => (s) => (COLOR ? `\x1b[${o}m${s}\x1b[${x}m` : `${s}`);
+const c = { bold: sgr(1, 22), green: sgr(32, 39), cyan: sgr(36, 39), gray: sgr(90, 39) };
+export const BAR = c.gray('│');
+export async function askText(label, fallback) {
+    output.write(`${c.green('◇')}  ${c.bold(label)} ${c.gray(`(${fallback})`)}\n`);
+    const rl = createInterface({ input, output });
+    const answer = (await rl.question(`${BAR}  `)).trim();
+    rl.close();
+    output.write(`${BAR}\n`);
+    return answer || fallback;
+}
+export function askSelect(label, choices) {
+    return new Promise((done) => {
+        let idx = 0;
+        output.write(`${c.green('◆')}  ${c.bold(label)}\n`);
+        const draw = (first) => {
+            if (!first)
+                output.write(`\x1b[${choices.length}A`);
+            for (let i = 0; i < choices.length; i++) {
+                const on = i === idx;
+                const dot = on ? c.green('●') : c.gray('○');
+                const name = on ? c.cyan(c.bold(choices[i].label)) : choices[i].label;
+                output.write(`\x1b[2K${BAR}  ${dot} ${name}  ${c.gray(choices[i].hint)}\n`);
+            }
+        };
+        draw(true);
+        emitKeypressEvents(input);
+        if (input.isTTY)
+            input.setRawMode(true);
+        const onKey = (_s, k) => {
+            if (k.name === 'up' || k.name === 'k') {
+                idx = (idx - 1 + choices.length) % choices.length;
+                draw(false);
+            }
+            else if (k.name === 'down' || k.name === 'j') {
+                idx = (idx + 1) % choices.length;
+                draw(false);
+            }
+            // Both names. A terminal sends `\r` and readline calls that `return`; a pty or a
+            // piped answer sends `\n`, which it calls `enter`. Accepting only the first left
+            // the prompt waiting for a key that never came.
+            else if (k.name === 'return' || k.name === 'enter') {
+                finish();
+                done(choices[idx].value);
+            }
+            else if (k.name === 'c' && k.ctrl) {
+                finish();
+                output.write('\n');
+                exit(1);
+            }
+        };
+        // Enter on a closed stream still means "take what is highlighted". Without this a
+        // piped answer (`printf 'app\n\n\n' | create-fluixi`) drew the list and stopped.
+        const onEnd = () => { finish(); done(choices[idx].value); };
+        const finish = () => {
+            input.off('keypress', onKey);
+            input.off('end', onEnd);
+            input.off('close', onEnd);
+            if (input.isTTY)
+                input.setRawMode(false);
+            // Pause it again or the live stdin handle keeps the event loop alive and the CLI
+            // never exits.
+            input.pause();
+            output.write(`${BAR}\n`);
+        };
+        // Already at EOF, so no event is coming: a fully buffered answer
+        // (`printf 'app\n\n\n' | create-fluixi`) is consumed by the name prompt and the
+        // stream ends before this one is set up. Take the highlighted value now.
+        if (input.readableEnded) {
+            finish();
+            done(choices[idx].value);
+            return;
+        }
+        input.on('keypress', onKey);
+        input.on('end', onEnd);
+        input.on('close', onEnd);
+        // The reason this prompt used to go nowhere. `askText` closes its readline
+        // interface, which leaves stdin paused, and `emitKeypressEvents` only wires the
+        // stream up the first time it is called. Attaching a listener to a paused stream
+        // reads nothing, so no key ever arrived: the list drew with the first option
+        // highlighted, the event loop drained, and the process exited 0 having created
+        // nothing.
+        input.resume();
+    });
+}

package/dist/scaffold/prompt.mjs

@@ -0,0 +1,81 @@
+// src/scaffold/prompt.ts
+import { createInterface } from "node:readline/promises";
+import { emitKeypressEvents } from "node:readline";
+import { stdin as input, stdout as output, exit, env } from "node:process";
+var COLOR = env.NO_COLOR || env.FORCE_COLOR === "0" ? false : (!!output.isTTY || !!env.FORCE_COLOR) && env.TERM !== "dumb";
+var sgr = (o, x) => (s) => COLOR ? `\x1B[${o}m${s}\x1B[${x}m` : `${s}`;
+var c = { bold: sgr(1, 22), green: sgr(32, 39), cyan: sgr(36, 39), gray: sgr(90, 39) };
+var BAR = c.gray("│");
+async function askText(label, fallback) {
+  output.write(`${c.green("◇")}  ${c.bold(label)} ${c.gray(`(${fallback})`)}
+`);
+  const rl = createInterface({ input, output });
+  const answer = (await rl.question(`${BAR}  `)).trim();
+  rl.close();
+  output.write(`${BAR}
+`);
+  return answer || fallback;
+}
+function askSelect(label, choices) {
+  return new Promise((done) => {
+    let idx = 0;
+    output.write(`${c.green("◆")}  ${c.bold(label)}
+`);
+    const draw = (first) => {
+      if (!first) output.write(`\x1B[${choices.length}A`);
+      for (let i = 0; i < choices.length; i++) {
+        const on = i === idx;
+        const dot = on ? c.green("●") : c.gray("○");
+        const name = on ? c.cyan(c.bold(choices[i].label)) : choices[i].label;
+        output.write(`\x1B[2K${BAR}  ${dot} ${name}  ${c.gray(choices[i].hint)}
+`);
+      }
+    };
+    draw(true);
+    emitKeypressEvents(input);
+    if (input.isTTY) input.setRawMode(true);
+    const onKey = (_s, k) => {
+      if (k.name === "up" || k.name === "k") {
+        idx = (idx - 1 + choices.length) % choices.length;
+        draw(false);
+      } else if (k.name === "down" || k.name === "j") {
+        idx = (idx + 1) % choices.length;
+        draw(false);
+      } else if (k.name === "return" || k.name === "enter") {
+        finish();
+        done(choices[idx].value);
+      } else if (k.name === "c" && k.ctrl) {
+        finish();
+        output.write("\n");
+        exit(1);
+      }
+    };
+    const onEnd = () => {
+      finish();
+      done(choices[idx].value);
+    };
+    const finish = () => {
+      input.off("keypress", onKey);
+      input.off("end", onEnd);
+      input.off("close", onEnd);
+      if (input.isTTY) input.setRawMode(false);
+      input.pause();
+      output.write(`${BAR}
+`);
+    };
+    if (input.readableEnded) {
+      finish();
+      done(choices[idx].value);
+      return;
+    }
+    input.on("keypress", onKey);
+    input.on("end", onEnd);
+    input.on("close", onEnd);
+    input.resume();
+  });
+}
+export {
+  BAR,
+  askSelect,
+  askText
+};

package/dist/scaffold/templates.cjs

@@ -0,0 +1,274 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/scaffold/templates.ts
+var templates_exports = {};
+__export(templates_exports, {
+  AUTH_READER: () => AUTH_READER,
+  PROVIDERS: () => PROVIDERS,
+  PROVIDER_VARS: () => PROVIDER_VARS,
+  SERVER_ONLY: () => SERVER_ONLY,
+  apiRoute: () => apiRoute,
+  authEnvConfig: () => authEnvConfig,
+  authServerFile: () => authServerFile,
+  authServiceFile: () => authServiceFile,
+  betterAuthClient: () => betterAuthClient,
+  betterAuthConfig: () => betterAuthConfig,
+  betterAuthMiddleware: () => betterAuthMiddleware,
+  betterAuthRoute: () => betterAuthRoute,
+  callbackRoute: () => callbackRoute,
+  camel: () => camel,
+  envConfig: () => envConfig,
+  guardedApiRoute: () => guardedApiRoute,
+  loginRoute: () => loginRoute,
+  moduleFile: () => moduleFile,
+  serverFn: () => serverFn,
+  serviceFile: () => serviceFile,
+  verifyServer: () => verifyServer
+});
+module.exports = __toCommonJS(templates_exports);
+var camel = (name) => name.toLowerCase().replace(/_+([a-z0-9])/g, (_, ch) => ch.toUpperCase());
+var envConfig = (names) => {
+  const fields = names.length ? names.map((n) => `  ${camel(n)}: '${n}',`).join("\n") : `  // apiUrl: 'API_URL',`;
+  return `import { pickEnv } from '@fluixi/start/env';
+
+// Every missing variable is reported at once, when this module loads. A field that may be
+// unset takes { key, optional: true } or { key, default }; parse: asNumber and friends convert.
+export const config = pickEnv({
+${fields}
+});
+`;
+};
+var moduleFile = (Name, name) => `import { defineModule } from '@fluixi/start/app';
+
+export const ${Name}Module = defineModule({
+  name: '${name}',
+  imports: [],
+  providers: [],
+});
+`;
+var serviceFile = (Name, name, server) => `${server ? `// Server only: the browser build refuses a page that imports this file.
+` : ""}import { injectionToken } from '@fluixi/start/di';
+import { defineModule } from '@fluixi/start/app';
+
+export class ${Name}Service {}
+
+export const ${Name}Token = injectionToken<${Name}Service>('${Name}');
+
+export const ${Name}Module = defineModule({
+  name: '${name}',
+  providers: [{ provide: ${Name}Token, useFactory: () => new ${Name}Service() }],
+});
+`;
+var apiRoute = () => `export function GET(request: Request) {
+  return Response.json({ path: new URL(request.url).pathname });
+}
+`;
+var guardedApiRoute = (guardImport, role) => `import { guard } from '${guardImport}';
+
+export const GET = guard(
+  async (request, claims) => {
+    return Response.json({ sub: claims.sub });
+  },
+  { role: '${role}' },
+);
+`;
+var verifyServer = () => `import { createTokenVerifier, createApiGuard } from '@fluixi/oauth2/verify';
+import { auth } from '../config/env.js';
+
+// Checks a bearer token's signature, issuer, audience and expiry against the provider.
+export const verify = createTokenVerifier(auth.provider.verifier(auth.clientId));
+
+// Answers 401 without a valid token and 403 without the role.
+export const guard = createApiGuard({ verify, roles: auth.provider.roles });
+`;
+var serverFn = (name) => `export async function ${name}(input: { id: string }) {
+  'use server';
+  // Runs on the server only. The browser calls it over RPC, so input and result are plain data.
+  return { id: input.id };
+}
+`;
+var PROVIDERS = ["oidc", "keycloak", "auth0", "okta", "google", "dex", "oauth2"];
+var SERVER_ONLY = {
+  google: "Google answers a token request without a client secret with `client_secret is missing`",
+  dex: "Dex sends no CORS headers on discovery or the token endpoint"
+};
+var PROVIDER_VARS = {
+  oidc: { AUTH_ISSUER: "https://id.example.com" },
+  keycloak: { AUTH_BASE_URL: "http://localhost:8080", AUTH_REALM: "master" },
+  auth0: { AUTH_DOMAIN: "example.eu.auth0.com", AUTH_AUDIENCE: "https://api.example.com" },
+  okta: { AUTH_DOMAIN: "example.okta.com" },
+  google: {},
+  dex: { AUTH_BASE_URL: "http://localhost:5556/dex" },
+  oauth2: {
+    AUTH_ISSUER: "https://id.example.com",
+    AUTH_AUTHORIZATION_ENDPOINT: "https://id.example.com/authorize",
+    AUTH_TOKEN_ENDPOINT: "https://id.example.com/token"
+  }
+};
+var AUTH_READER = `// Provider, issuer, client and token mode from the AUTH_* variables in env.public. Moving to
+// another provider is a change to .env.
+export const auth = authFromEnv(publicEnv(), { clientPrefix: '' });
+`;
+var authEnvConfig = () => `import { publicEnv } from '@fluixi/start/env';
+import { authFromEnv } from '@fluixi/oauth2/env';
+
+${AUTH_READER}`;
+var authServiceFile = (tokens) => `import { createAuthService, authModule } from '@fluixi/oauth2';
+import { env } from '@fluixi/start/env';
+${tokens === "browser" ? `import { auth as authEnv } from '../config/env.js';
+` : ""}
+export interface User {
+  sub: string;
+  email?: string;
+  name?: string;
+}
+
+const appUrl = env('APP_URL') ?? 'http://localhost:3000';
+
+export const auth = createAuthService<User>({
+${tokens === "browser" ? `  config: {
+    ...authEnv.client,
+    tokens: 'browser',
+    redirectUri: \`\${appUrl}/callback\`,
+    postLogoutRedirectUri: \`\${appUrl}/login\`,
+  },` : `  // The tokens stay on the server behind an httpOnly cookie. The browser calls the routes
+  // auth.server.ts mounts under basePath and never sees a token.
+  config: {
+    tokens: 'server',
+    redirectUri: \`\${appUrl}/auth/callback\`,
+    postLogoutRedirectUri: \`\${appUrl}/login\`,
+    basePath: '/auth',
+  },`}
+});
+
+export const AuthModule = authModule(auth);
+export const { protectedRoute, Protect, Can, useUser } = auth;
+`;
+var authServerFile = () => `import { authServerModule } from '@fluixi/oauth2/server';
+import { publicEnv, serverEnv } from '@fluixi/start/env';
+import { auth } from '../config/env.js';
+
+// A function: serverEnv with required throws when a secret is unset, and it is only read
+// when app.config.server.ts registers this.
+export function authServer() {
+  const appUrl = publicEnv().APP_URL ?? 'http://localhost:3000';
+  return authServerModule({
+    ...auth.client,
+    clientSecret: serverEnv('OIDC_CLIENT_SECRET', { required: true }),
+    cookieSecret: serverEnv('SESSION_SECRET', { required: true }),
+    redirectUri: \`\${appUrl}/auth/callback\`,
+    defaultReturnTo: '/',
+    secureCookie: appUrl.startsWith('https://'),
+  });
+}
+`;
+var callbackRoute = (html) => html ? `import { html } from '@fluixi/core';
+import { OAuthCallback } from '@fluixi/oauth2/callback';
+
+export default OAuthCallback({
+  pending: () => html\`<p>Signing you in</p>\`,
+  failed: (reason) => html\`<p>\${reason}</p><a href="/login">Try again</a>\`,
+});
+` : `import { OAuthCallback } from '@fluixi/oauth2/callback';
+
+export default OAuthCallback({
+  pending: () => <p>Signing you in</p>,
+  failed: (reason) => (
+    <>
+      <p>{reason}</p>
+      <a href="/login">Try again</a>
+    </>
+  ),
+});
+`;
+var loginRoute = (html) => html ? `import { html } from '@fluixi/core';
+import { auth } from '../services/auth.js';
+
+export default function Login() {
+  return html\`<button @click=\${() => auth.signIn({ returnTo: '/' })}>Sign in</button>\`;
+}
+` : `import { auth } from '../services/auth.js';
+
+export default function Login() {
+  return <button onClick={() => auth.signIn({ returnTo: '/' })}>Sign in</button>;
+}
+`;
+var betterAuthConfig = () => `import { betterAuth } from 'better-auth';
+import { defineAuth } from '@fluixi/auth/server';
+
+export type AppUser = { id: string; email: string; name?: string; role?: string };
+
+// Better Auth owns the audited primitives; defineAuth registers it with @fluixi/auth.
+export const auth = defineAuth<AppUser>(
+  betterAuth({
+    // database: <your adapter>,
+    emailAndPassword: { enabled: true },
+    // socialProviders: { google: { … }, github: { … } },
+  } as Parameters<typeof betterAuth>[0]),
+);
+`;
+var betterAuthClient = () => `import { createAuthClient } from 'better-auth/client';
+import { createAuthHooks } from '@fluixi/auth/client';
+import type { AppUser } from './auth.config.js';
+
+const client = createAuthClient({ baseURL: '/api/auth' });
+
+// Or, to reuse an existing reactive session: createAuthHooks({ session: yourSessionStore }).
+export const { useUser, useSession, useAuth, useSignIn, useSignOut, protectedRoute } =
+  createAuthHooks<AppUser>({ client, loginPath: '/login' });
+`;
+var betterAuthMiddleware = () => `import { defineMiddleware } from '@fluixi/start';
+import { authMiddleware } from '@fluixi/auth/server';
+import './auth.config.js';
+
+export default defineMiddleware([authMiddleware()]);
+`;
+var betterAuthRoute = () => `import { mountAuthRoutes } from '@fluixi/auth/server';
+import '../../auth.config.js';
+
+const handler = mountAuthRoutes();
+export const GET = handler;
+export const POST = handler;
+export default handler;
+`;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUTH_READER,
+  PROVIDERS,
+  PROVIDER_VARS,
+  SERVER_ONLY,
+  apiRoute,
+  authEnvConfig,
+  authServerFile,
+  authServiceFile,
+  betterAuthClient,
+  betterAuthConfig,
+  betterAuthMiddleware,
+  betterAuthRoute,
+  callbackRoute,
+  camel,
+  envConfig,
+  guardedApiRoute,
+  loginRoute,
+  moduleFile,
+  serverFn,
+  serviceFile,
+  verifyServer
+});

package/dist/scaffold/templates.d.ts

@@ -0,0 +1,26 @@
+/** What the env, module, service, api, server-fn and oauth2 generators write. */
+export declare const camel: (name: string) => string;
+export declare const envConfig: (names: string[]) => string;
+export declare const moduleFile: (Name: string, name: string) => string;
+export declare const serviceFile: (Name: string, name: string, server: boolean) => string;
+export declare const apiRoute: () => string;
+export declare const guardedApiRoute: (guardImport: string, role: string) => string;
+export declare const verifyServer: () => string;
+export declare const serverFn: (name: string) => string;
+export declare const PROVIDERS: readonly ["oidc", "keycloak", "auth0", "okta", "google", "dex", "oauth2"];
+export type ProviderName = (typeof PROVIDERS)[number];
+/** Providers that refuse a public client, so tokens must stay on the server. */
+export declare const SERVER_ONLY: Partial<Record<ProviderName, string>>;
+/** The variables each preset needs beyond the common ones, with a placeholder. */
+export declare const PROVIDER_VARS: Record<ProviderName, Record<string, string>>;
+export declare const AUTH_READER = "// Provider, issuer, client and token mode from the AUTH_* variables in env.public. Moving to\n// another provider is a change to .env.\nexport const auth = authFromEnv(publicEnv(), { clientPrefix: '' });\n";
+export declare const authEnvConfig: () => string;
+export declare const authServiceFile: (tokens: "browser" | "server") => string;
+export declare const authServerFile: () => string;
+export declare const callbackRoute: (html: boolean) => "import { html } from '@fluixi/core';\nimport { OAuthCallback } from '@fluixi/oauth2/callback';\n\nexport default OAuthCallback({\n  pending: () => html`<p>Signing you in</p>`,\n  failed: (reason) => html`<p>${reason}</p><a href=\"/login\">Try again</a>`,\n});\n" | "import { OAuthCallback } from '@fluixi/oauth2/callback';\n\nexport default OAuthCallback({\n  pending: () => <p>Signing you in</p>,\n  failed: (reason) => (\n    <>\n      <p>{reason}</p>\n      <a href=\"/login\">Try again</a>\n    </>\n  ),\n});\n";
+export declare const loginRoute: (html: boolean) => "import { html } from '@fluixi/core';\nimport { auth } from '../services/auth.js';\n\nexport default function Login() {\n  return html`<button @click=${() => auth.signIn({ returnTo: '/' })}>Sign in</button>`;\n}\n" | "import { auth } from '../services/auth.js';\n\nexport default function Login() {\n  return <button onClick={() => auth.signIn({ returnTo: '/' })}>Sign in</button>;\n}\n";
+export declare const betterAuthConfig: () => string;
+export declare const betterAuthClient: () => string;
+export declare const betterAuthMiddleware: () => string;
+export declare const betterAuthRoute: () => string;
+//# sourceMappingURL=templates.d.ts.map

package/dist/scaffold/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,WACgD,CAAC;AAEnF,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,EAAE,WAYxC,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,WAOpD,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,EAAE,QAAQ,OAAO,WAatE,CAAC;AAEF,eAAO,MAAM,QAAQ,cAGpB,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,aAAa,MAAM,EAAE,MAAM,MAAM,WAQhE,CAAC;AAEF,eAAO,MAAM,YAAY,cAQxB,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,WAKpC,CAAC;AAIF,eAAO,MAAM,SAAS,2EAA4E,CAAC;AACnG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtD,gFAAgF;AAChF,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAG7D,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYtE,CAAC;AAEF,eAAO,MAAM,WAAW,mNAGvB,CAAC;AAEF,eAAO,MAAM,aAAa,cAGX,CAAC;AAEhB,eAAO,MAAM,eAAe,GAAI,QAAQ,SAAS,GAAG,QAAQ,WAiC3D,CAAC;AAEF,eAAO,MAAM,cAAc,cAiB1B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,MAAM,OAAO,0gBAqB1C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,MAAM,OAAO,wYAcvC,CAAC;AAIF,eAAO,MAAM,gBAAgB,cAc5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,cAU5B,CAAC;AAEF,eAAO,MAAM,oBAAoB,cAMhC,CAAC;AAEF,eAAO,MAAM,eAAe,cAQ3B,CAAC"}