@hs-x/cli 0.3.0 → 0.3.7

package/dist/commands/flags.js

@@ -9,6 +9,7 @@ import { activeSession } from '../account-store.js';
 import { CliError, exitWith } from '../cli-error.js';
 import { accountIdOption, controlPlaneUrlOption, jsonOption, runHandler, yesOption, } from '../cli/kit.js';
 import { DEFAULT_CONTROL_PLANE_URL } from '../config.js';
+import { requestMutationConsent } from '../mutation-consent.js';
 import { isMachineOutput } from '../output-context.js';
 import { canDiscoverHubSpotAppIdFromTenantBindings, readLocalProjectContext, resolveHubSpotAppId, resolveHubSpotAppIdFromTenantBindings, resolveProjectId, resolveRuntimeOrigin, } from '../project-context.js';
 import { ProjectPickerCancelled, createControlPlaneFlagAuthoringClient, discoverProjectRuntimeBindings, discoverProjects, resolveAccountId, resolveProjectSelection, resolveRuntimeBinding, } from '../project-picker.js';
@@ -30,21 +31,56 @@ function resolveFlag(argv, flag) {
     }
     return undefined;
 }
-function fail(reporter, json, message) {
-    if (json) {
-        reporter.raw(`${JSON.stringify({ ok: false, error: message })}\n`);
+function isMachineReporter(reporter) {
+    return reporter.mode === 'json' || reporter.mode === 'ndjson';
+}
+function fail(reporter, _json, message, code = 'HSX_E_INPUT_INVALID') {
+    if (isMachineReporter(reporter)) {
+        reporter.error(code, message);
+        reporter.done(undefined, 1);
     }
     else {
         reporter.rawErr(`Error: ${message}\n`);
     }
     return { exitCode: 1 };
 }
+function succeed(reporter, data, human) {
+    if (isMachineReporter(reporter)) {
+        reporter.data(data);
+        reporter.done();
+        return;
+    }
+    human();
+}
+function flagTransportErrorCode(error) {
+    if (!(error instanceof RuntimeFlagAuthoringError))
+        return 'HSX_E_INTERNAL';
+    if (error.status === 401 || error.status === 403)
+        return 'HSX_E_API_UNAUTHORIZED';
+    if (error.status >= 500)
+        return 'HSX_E_API_SERVER';
+    return 'HSX_E_API_BAD_REQUEST';
+}
 const liveFlagsPrompts = {
     isInteractive,
     select: promptSelect,
     text: promptText,
     confirm: promptConfirm,
 };
+const liveFlagConsentPrompts = {
+    isInteractive,
+    confirm: promptConfirm,
+};
+const FLAG_DEFINITION_CONSENT_ERROR = 'Creating or updating a flag requires explicit consent in machine or non-interactive mode. Re-run with --yes.';
+function flagStateConsentError(state) {
+    return `Changing a flag to ${state} requires explicit consent in machine or non-interactive mode. Re-run with --yes.`;
+}
+function hasExplicitYes(argv) {
+    return argv.some((arg) => arg === '--yes' || arg === '-y');
+}
+function flagDefinitionPlan(definition, options) {
+    return `\nFlag definition plan\n${JSON.stringify(definition, null, 2)}\n\n${options.wizard ? 'Percentage rollouts are available through --file only.\n\n' : ''}`;
+}
 class FlagsPromptCancelled extends Error {
     constructor() {
         super('Cancelled.');
@@ -237,10 +273,45 @@ export async function flagsCommand(input) {
     const { argv, json } = input;
     const root = input.root ?? process.cwd();
     const subcommand = argv[1];
-    const reporter = createReporter({ command: 'flags', argv });
+    const reporter = createReporter({
+        command: 'flags',
+        argv: json && !argv.includes('--json') ? [...argv, '--json'] : argv,
+    });
     if (!subcommand || !SUBCOMMANDS.has(subcommand)) {
         return fail(reporter, json, `Usage: hs-x flags <${[...SUBCOMMANDS].join('|')}> [options]`);
     }
+    const machineOutput = json || isMachineOutput();
+    const interactive = isInteractive();
+    const yes = hasExplicitYes(argv);
+    if ((subcommand === 'create' || subcommand === 'define') && !resolveFlag(argv, '--file')) {
+        if (machineOutput || !interactive) {
+            return fail(reporter, json, 'Require --file <flag-definition.json> for `flags create` outside an interactive terminal.');
+        }
+    }
+    if ((subcommand === 'enable' || subcommand === 'disable' || subcommand === 'archive') &&
+        !resolveFlag(argv, '--key') &&
+        (machineOutput || !interactive)) {
+        const state = subcommand === 'enable' ? 'enabled' : subcommand === 'disable' ? 'disabled' : 'archived';
+        return fail(reporter, json, `Require --key <flagKey> to ${state} a flag.`);
+    }
+    if (subcommand !== 'list' && (machineOutput || !interactive)) {
+        const consent = await requestMutationConsent({
+            yes,
+            machineOutput,
+            interactive,
+            message: 'Apply this flag mutation?',
+            confirm: promptConfirm,
+        });
+        if (consent === 'require-yes') {
+            return fail(reporter, json, subcommand === 'create' || subcommand === 'define'
+                ? FLAG_DEFINITION_CONSENT_ERROR
+                : flagStateConsentError(subcommand === 'enable'
+                    ? 'enabled'
+                    : subcommand === 'disable'
+                        ? 'disabled'
+                        : 'archived'));
+        }
+    }
     const local = await readLocalProjectContext(root);
     const projectId = resolveProjectId({
         explicit: resolveFlag(argv, '--project-id'),
@@ -312,7 +383,7 @@ export async function flagsCommand(input) {
                 return await runList({ argv, json, client, reporter });
             case 'create':
             case 'define':
-                return await runCreate({ argv, json, client, scope, reporter });
+                return await runCreate({ argv, json, client, scope, reporter, yes });
             case 'enable':
                 return await runSetState({ argv, json, client, state: 'enabled', reporter });
             case 'disable':
@@ -325,29 +396,31 @@ export async function flagsCommand(input) {
     }
     catch (error) {
         if (error instanceof RuntimeFlagAuthoringError) {
-            return fail(reporter, json, `Tenant Worker rejected the request (${error.status}): ${error.message}`);
+            return fail(reporter, json, `Tenant Worker rejected the request (${error.status}): ${error.message}`, flagTransportErrorCode(error));
         }
-        return fail(reporter, json, error instanceof Error ? error.message : String(error));
+        return fail(reporter, json, error instanceof Error ? error.message : String(error), flagTransportErrorCode(error));
     }
 }
 async function runList(input) {
     const limitRaw = resolveFlag(input.argv, '--limit');
     const flags = await input.client.listFlags(limitRaw !== undefined ? { limit: Number(limitRaw) } : undefined);
-    if (input.json) {
-        input.reporter.raw(`${JSON.stringify({ ok: true, flags }, null, 2)}\n`);
-    }
-    else if (flags.length === 0) {
-        input.reporter.raw('No flags defined.\n');
-    }
-    else {
+    succeed(input.reporter, { flags }, () => {
+        if (flags.length === 0) {
+            input.reporter.raw('No flags defined.\n');
+            return;
+        }
         for (const flag of flags) {
             const label = flag.label ? ` — ${flag.label}` : '';
             input.reporter.raw(`${flag.key}  [${flag.type}, ${flag.state}, v${flag.version}]${label}\n`);
         }
-    }
+    });
     return { exitCode: 0 };
 }
 export async function runCreate(input) {
+    const prompts = input.prompts ?? liveFlagConsentPrompts;
+    const yes = input.yes ?? hasExplicitYes(input.argv);
+    const machineOutput = input.json || isMachineOutput();
+    const interactive = prompts.isInteractive();
     const file = resolveFlag(input.argv, '--file');
     if (!file)
         return fail(input.reporter, input.json, 'Require --file <flag-definition.json> for `flags create`.');
@@ -377,13 +450,25 @@ export async function runCreate(input) {
     if (decoded._tag === 'Left') {
         return fail(input.reporter, input.json, `Invalid flag definition: ${String(decoded.left)}`);
     }
-    const result = await input.client.defineFlag(decoded.right);
-    if (input.json) {
-        input.reporter.raw(`${JSON.stringify({ ok: true, flag: result.flag, syncedSnapshots: result.syncedSnapshots }, null, 2)}\n`);
+    if (!machineOutput && interactive) {
+        input.reporter.raw(flagDefinitionPlan(decoded.right, { wizard: false }));
     }
-    else {
-        input.reporter.raw(`Defined "${result.flag.key}" [${result.flag.type}, ${result.flag.state}, v${result.flag.version}] — synced ${result.syncedSnapshots} snapshot(s).\n`);
+    const consent = await requestMutationConsent({
+        yes,
+        machineOutput,
+        interactive,
+        message: `Create or update flag "${decoded.right.key}"?`,
+        confirm: prompts.confirm,
+    });
+    if (consent === 'require-yes') {
+        return fail(input.reporter, input.json, FLAG_DEFINITION_CONSENT_ERROR);
     }
+    if (consent === 'cancelled')
+        return cancelled(input.reporter);
+    const result = await input.client.defineFlag(decoded.right);
+    succeed(input.reporter, { flag: result.flag, syncedSnapshots: result.syncedSnapshots }, () => {
+        input.reporter.raw(`Defined "${result.flag.key}" [${result.flag.type}, ${result.flag.state}, v${result.flag.version}] — synced ${result.syncedSnapshots} snapshot(s).\n`);
+    });
     return { exitCode: 0 };
 }
 /** Dependency-injected action seam used by the bare `hs-x flags` TTY flow. */
@@ -815,22 +900,28 @@ export async function runCreateWizard(input) {
         const referenceError = validateWizardReferences(decoded.right);
         if (referenceError)
             return fail(input.reporter, false, referenceError);
-        input.reporter.raw(`\nFlag definition preview\n${JSON.stringify(decoded.right, null, 2)}\n\nPercentage rollouts are available through --file only.\n\n`);
-        if (input.yes) {
-            definition = decoded.right;
-            break;
-        }
-        const confirmed = await prompts.confirm({
+        input.reporter.raw(flagDefinitionPlan(decoded.right, { wizard: true }));
+        let requestedBack = false;
+        const consent = await requestMutationConsent({
+            yes: input.yes ?? false,
+            machineOutput: false,
+            interactive: true,
             message: `Create or update flag "${decoded.right.key}"?`,
-            default: false,
-            allowBack: true,
+            confirm: async (options) => {
+                const answer = await prompts.confirm({ ...options, allowBack: true });
+                if (answer === BACK) {
+                    requestedBack = true;
+                    return undefined;
+                }
+                return answer;
+            },
         });
-        if (confirmed === undefined || confirmed === false)
-            return cancelled(input.reporter);
-        if (confirmed === true) {
+        if (consent === 'proceed') {
             definition = decoded.right;
             break;
         }
+        if (!requestedBack)
+            return cancelled(input.reporter);
         // Esc from the final confirmation returns to the immediately preceding
         // targeting-rule step without discarding the rest of the draft.
         const revisedRules = await buildRules(prompts, variations ?? []);
@@ -844,7 +935,13 @@ export async function runCreateWizard(input) {
     return { exitCode: 0 };
 }
 function cancelled(reporter) {
-    reporter.rawErr('Cancelled.\n');
+    if (isMachineReporter(reporter)) {
+        reporter.error('HSX_E_INPUT_INVALID', 'Cancelled.');
+        reporter.done(undefined, 130);
+    }
+    else {
+        reporter.rawErr('Cancelled.\n');
+    }
     return { exitCode: 130 };
 }
 const liveFlagMutationPrompts = {
@@ -854,13 +951,21 @@ const liveFlagMutationPrompts = {
 };
 export async function runSetState(input) {
     const prompts = input.prompts ?? liveFlagMutationPrompts;
+    const yes = input.yes ?? hasExplicitYes(input.argv);
+    const machineOutput = input.json || isMachineOutput();
+    const interactive = prompts.isInteractive();
     let key = resolveFlag(input.argv, '--key');
-    const canPrompt = !input.json && !isMachineOutput() && prompts.isInteractive();
+    const canPrompt = !machineOutput && interactive;
     // Deterministic machine/non-interactive validation must not touch the tenant
     // transport merely to discover that a required mutation key is absent.
     if (!key && !canPrompt) {
         return fail(input.reporter, input.json, `Require --key <flagKey> to ${input.state} a flag.`);
     }
+    // Machine and non-interactive mutations require consent before even the
+    // read-only flag lookup, so a missing --yes can never reach tenant transport.
+    if (key && !yes && (machineOutput || !interactive)) {
+        return fail(input.reporter, input.json, flagStateConsentError(input.state));
+    }
     const flags = await input.client.listFlags();
     const candidates = flags.filter((flag) => flag.state !== 'archived' && flag.state !== input.state);
     if (!key && canPrompt) {
@@ -892,19 +997,21 @@ export async function runSetState(input) {
     if (existing.state === input.state) {
         return fail(input.reporter, input.json, `Flag "${key}" is already ${input.state}.`);
     }
-    if (input.state === 'archived' &&
-        !input.json &&
-        !input.yes &&
-        !isMachineOutput() &&
-        prompts.isInteractive()) {
-        const confirmed = await prompts.confirm({
-            message: `Archive flag "${key}"?`,
-            default: false,
-        });
-        if (confirmed !== true) {
-            input.reporter.rawErr('Cancelled.\n');
-            return { exitCode: 130 };
-        }
+    if (!machineOutput && interactive) {
+        input.reporter.raw(`\nFlag state-change plan\nKey: ${key}\nCurrent state: ${existing.state}\nCurrent version: ${existing.version}\nNew state: ${input.state}\nNew version: ${existing.version + 1}\n\n`);
+    }
+    const consent = await requestMutationConsent({
+        yes,
+        machineOutput,
+        interactive,
+        message: `Set flag "${key}" to ${input.state}?`,
+        confirm: prompts.confirm,
+    });
+    if (consent === 'require-yes') {
+        return fail(input.reporter, input.json, flagStateConsentError(input.state));
+    }
+    if (consent === 'cancelled') {
+        return cancelled(input.reporter);
     }
     const updated = {
         ...existing,
@@ -913,12 +1020,9 @@ export async function runSetState(input) {
         updatedAt: new Date().toISOString(),
     };
     const result = await input.client.defineFlag(updated);
-    if (input.json) {
-        input.reporter.raw(`${JSON.stringify({ ok: true, key, state: input.state, flag: result.flag }, null, 2)}\n`);
-    }
-    else {
+    succeed(input.reporter, { key, state: input.state, flag: result.flag }, () => {
         input.reporter.raw(`Flag "${key}" is now ${input.state} (v${result.flag.version}).\n`);
-    }
+    });
     return { exitCode: 0 };
 }
 // ─── Native @effect/cli command (Phase 4) ───────────────────────────────────
@@ -929,15 +1033,9 @@ export async function runSetState(input) {
 // `runList`/`runCreate`/`runSetState` bodies and the `createFlagAuthoringClient`
 // transport are reused verbatim from the legacy path.
 //
-// JSON-shape MISMATCH (flagged, NOT changed): every flags output is a bespoke
-// shape — `{ ok, flags }`, `{ ok, flag, syncedSnapshots }`, `{ ok:false, error }`,
-// all pretty-printed (2-space) — and NOT the `JsonReporter`
-// `{schema_version, command, ok, data}` envelope. Errors in human mode print
-// `Error: <msg>` to stderr. To preserve the exact bytes the subprocess tests
-// assert, the bodies emit through the legacy `fail()` / `reporter.raw` writers
-// and the handler fails with a silent `exitWith(1)` so `runHandler` does not
-// re-render. TODO(phase-5): reconcile these payloads with the standard envelope
-// once the dispatch swap lets the fixtures move in lockstep.
+// Machine output uses the shared reporter contract: JSON emits one
+// `{schema_version, command, ok, data|error}` envelope and JSON-stream emits
+// start/data-or-error/done events. Human output retains the established text.
 const projectIdOption = Options.text('project-id').pipe(Options.withAlias('project'), Options.optional);
 const appIdOption = Options.integer('app-id').pipe(Options.optional);
 const environmentOption = Options.text('environment').pipe(Options.optional);
@@ -958,12 +1056,13 @@ const identityOptions = {
     runtimeOrigin: runtimeOriginOption,
     cloudflareApiToken: cloudflareApiTokenOption,
 };
-/** Effect twin of `fail()` for the native path: emit the bespoke output, then fail silently. */
-function failEff(json, message) {
+/** Effect twin of `fail()` for the native path, rendered once before a silent exit. */
+function failEff(_json, message, code = 'HSX_E_INPUT_INVALID') {
     return Effect.gen(function* () {
         const reporter = yield* Reporter;
-        if (json) {
-            yield* reporter.raw(`${JSON.stringify({ ok: false, error: message })}\n`);
+        if (reporter.mode === 'json' || reporter.mode === 'ndjson') {
+            yield* reporter.error(code, message);
+            yield* reporter.done(undefined, 1);
         }
         else {
             yield* reporter.rawErr(`Error: ${message}\n`);
@@ -974,16 +1073,20 @@ function failEff(json, message) {
 function cancelEff() {
     return Effect.gen(function* () {
         const reporter = yield* Reporter;
-        yield* reporter.rawErr('Cancelled.\n');
+        if (reporter.mode === 'json' || reporter.mode === 'ndjson') {
+            yield* reporter.error('HSX_E_INPUT_INVALID', 'Cancelled.');
+            yield* reporter.done(undefined, 130);
+        }
+        else {
+            yield* reporter.rawErr('Cancelled.\n');
+        }
         return yield* Effect.fail(exitWith(130));
     });
 }
 /**
  * Synchronous reporter sink for the shared `runList`/`runCreate`/`runSetState`
- * bodies on the native path. These helpers emit verbatim bytes (the bespoke
- * `--json`/human shapes) and so route through `reporter.raw`/`rawErr`, the
- * sanctioned I/O edge, instead of `process.std*`. Mode is derived solely from
- * `--json` so the produced bytes match the legacy path exactly.
+ * bodies on the native path. Machine modes use data/error/done; human mode
+ * retains the established raw text through the sanctioned reporter edge.
  */
 const syncReporter = Effect.gen(function* () {
     const reporter = yield* Reporter;
@@ -1191,16 +1294,15 @@ function resolveClient(opts, config = {}) {
     });
 }
 /**
- * Map a thrown `RuntimeFlagAuthoringError`/`Error` to the legacy bespoke
- * failure. A `CliError` (an already-rendered `failEff`) is re-raised untouched;
- * anything else is rendered like the legacy `try/catch` around the dispatch.
+ * Map a thrown `RuntimeFlagAuthoringError`/`Error` to the standard machine
+ * failure contract while preserving the legacy human message.
  */
 function withClientErrors(json, body) {
     return body.pipe(Effect.catchAll((error) => error instanceof CliError
         ? Effect.fail(error)
         : error instanceof RuntimeFlagAuthoringError
-            ? failEff(json, `Tenant Worker rejected the request (${error.status}): ${error.message}`)
-            : failEff(json, error instanceof Error ? error.message : String(error))));
+            ? failEff(json, `Tenant Worker rejected the request (${error.status}): ${error.message}`, flagTransportErrorCode(error))
+            : failEff(json, error instanceof Error ? error.message : String(error), flagTransportErrorCode(error))));
 }
 const flagsListCmd = Command.make('list', { ...identityOptions, limit: limitOption }, (opts) => runHandler('flags', { json: opts.json }, Effect.gen(function* () {
     const { client } = yield* resolveClient(opts);
@@ -1225,6 +1327,11 @@ function makeCreateCmd(name) {
         if (!file && !wizardAllowed) {
             return yield* failEff(opts.json, 'Require --file <flag-definition.json> for `flags create` outside an interactive terminal.');
         }
+        const machineOutput = opts.json || isMachineOutput();
+        const interactive = isInteractive();
+        if (file && !opts.yes && (machineOutput || !interactive)) {
+            return yield* failEff(opts.json, FLAG_DEFINITION_CONSENT_ERROR);
+        }
         // A definition file is authoritative and never opens context/wizard
         // pickers. If its scope is ambiguous, report the required identity flag.
         const { client, scope } = yield* resolveClient(opts, { allowPrompt: !file });
@@ -1250,6 +1357,7 @@ function makeCreateCmd(name) {
             client,
             scope,
             reporter,
+            yes: opts.yes,
         }));
     })));
 }
@@ -1258,9 +1366,14 @@ const flagsDefineCmd = makeCreateCmd('define');
 function makeSetStateCmd(name, state) {
     return Command.make(name, { ...identityOptions, key: keyOption, yes: yesOption }, (opts) => runHandler('flags', { json: opts.json }, Effect.gen(function* () {
         const key = Option.getOrUndefined(opts.key);
-        if (key === undefined && (isMachineOutput() || !isInteractive())) {
+        if (key === undefined && (opts.json || isMachineOutput() || !isInteractive())) {
             return yield* failEff(opts.json, `Require --key <flagKey> to ${state} a flag.`);
         }
+        if (key !== undefined &&
+            !opts.yes &&
+            (opts.json || isMachineOutput() || !isInteractive())) {
+            return yield* failEff(opts.json, flagStateConsentError(state));
+        }
         const { client } = yield* resolveClient(opts);
         const reporter = yield* syncReporter;
         yield* withClientErrors(opts.json, Effect.tryPromise({
@@ -1321,6 +1434,9 @@ export const flagsCmd = bareFlagsCmd.pipe(Command.withSubcommands([
  */
 function runCreateFromSource(input) {
     return Effect.gen(function* () {
+        const prompts = input.prompts ?? liveFlagConsentPrompts;
+        const machineOutput = input.json || isMachineOutput();
+        const interactive = prompts.isInteractive();
         let parsed;
         try {
             parsed = JSON.parse(input.source);
@@ -1344,16 +1460,28 @@ function runCreateFromSource(input) {
         if (decoded._tag === 'Left') {
             return yield* failEff(input.json, `Invalid flag definition: ${String(decoded.left)}`);
         }
+        if (!machineOutput && interactive) {
+            input.reporter.raw(flagDefinitionPlan(decoded.right, { wizard: false }));
+        }
+        const consent = yield* Effect.promise(() => requestMutationConsent({
+            yes: input.yes,
+            machineOutput,
+            interactive,
+            message: `Create or update flag "${decoded.right.key}"?`,
+            confirm: prompts.confirm,
+        }));
+        if (consent === 'require-yes') {
+            return yield* failEff(input.json, FLAG_DEFINITION_CONSENT_ERROR);
+        }
+        if (consent === 'cancelled')
+            return yield* cancelEff();
         const result = yield* Effect.tryPromise({
             try: () => input.client.defineFlag(decoded.right),
             catch: (cause) => cause,
         });
-        if (input.json) {
-            input.reporter.raw(`${JSON.stringify({ ok: true, flag: result.flag, syncedSnapshots: result.syncedSnapshots }, null, 2)}\n`);
-        }
-        else {
+        succeed(input.reporter, { flag: result.flag, syncedSnapshots: result.syncedSnapshots }, () => {
             input.reporter.raw(`Defined "${result.flag.key}" [${result.flag.type}, ${result.flag.state}, v${result.flag.version}] — synced ${result.syncedSnapshots} snapshot(s).\n`);
-        }
+        });
     });
 }
 //# sourceMappingURL=flags.js.map