@wairon/cli 5.1.1-dev.73 → 5.1.1-dev.74

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.73";
+    WAIRON_VERSION = "5.1.1-dev.74";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -36722,7 +36722,7 @@ function createProjectRecord(dataDir, id) {
   save2(dataDir, records);
   return record2;
 }
-function registerLocalDevProject(dataDir, id, rootPath) {
+function registerProjectRecord(dataDir, id, rootPath) {
   if (!isValidProjectId(id)) {
     throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
   }
@@ -37433,6 +37433,12 @@ function destroyProject(cfg, credential, id) {
   }
   removeProjectRecord(cfg.dataDir, id);
 }
+function registerLocalDevProject(cfg, id, rootPath) {
+  if (!cfg.devMode) {
+    throw new Error("Registering a project at a working directory is reserved for the local development server.");
+  }
+  return registerProjectRecord(cfg.dataDir, id, rootPath);
+}
 function listProjects(cfg, credential) {
   requireAdmin(credential);
   return listProjectRecords(cfg.dataDir);
@@ -39963,6 +39969,62 @@ async function handleIdentityRequest(cfg, credential, req, res, body, url) {
   }
 }
 
+// src/server/identity-provider-bootstrap.ts
+var DEFAULT_PROVIDER_ID = "default";
+var DEFAULT_PROVIDER_SECRET_REF = "oidc-default";
+function envTrim(name) {
+  const value = process.env[name]?.trim();
+  return value ? value : void 0;
+}
+function envCsv(name) {
+  return (process.env[name] ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function seedDefaultProvider(cfg) {
+  const issuer = envTrim("WAIRON_OIDC_ISSUER");
+  if (!issuer) return null;
+  let clientSecretRef = envTrim("WAIRON_OIDC_CLIENT_SECRET_REF");
+  const rawSecret = process.env["WAIRON_OIDC_CLIENT_SECRET"];
+  if (rawSecret) {
+    setSecret(DEFAULT_PROVIDER_SECRET_REF, rawSecret);
+    clientSecretRef = DEFAULT_PROVIDER_SECRET_REF;
+  }
+  const config = defaultProviderFromEnv(issuer, clientSecretRef);
+  return upsertIdentityProviderRecord(cfg.dataDir, config);
+}
+function defaultProviderFromEnv(issuer, clientSecretRef) {
+  const config = {
+    id: DEFAULT_PROVIDER_ID,
+    providerType: envTrim("WAIRON_OIDC_PROVIDER_TYPE") ?? "oidc",
+    issuerUrl: issuer,
+    enabled: true,
+    updatedAt: ""
+    // stamped server-side by the policy registry
+  };
+  const displayName = envTrim("WAIRON_OIDC_DISPLAY_NAME");
+  if (displayName) config.displayName = displayName;
+  const clientId = envTrim("WAIRON_OIDC_CLIENT_ID");
+  if (clientId) config.clientId = clientId;
+  if (clientSecretRef) config.clientSecretRef = clientSecretRef;
+  const adminGroups = envCsv("WAIRON_OIDC_ADMIN_GROUPS");
+  if (adminGroups.length) config.adminGroupClaims = adminGroups;
+  const redirectUris = envCsv("WAIRON_OIDC_ALLOWED_REDIRECT_URIS");
+  if (redirectUris.length) config.allowedRedirectUris = redirectUris;
+  const domains = envCsv("WAIRON_OIDC_ALLOWED_DOMAINS");
+  if (domains.length) config.allowedDomains = domains;
+  applyEndpointOverrides(config);
+  return config;
+}
+function applyEndpointOverrides(config) {
+  const authorizationEndpoint = envTrim("WAIRON_OIDC_AUTHORIZATION_ENDPOINT");
+  if (authorizationEndpoint) config.authorizationEndpoint = authorizationEndpoint;
+  const tokenEndpoint = envTrim("WAIRON_OIDC_TOKEN_ENDPOINT");
+  if (tokenEndpoint) config.tokenEndpoint = tokenEndpoint;
+  const jwksUri = envTrim("WAIRON_OIDC_JWKS_URI");
+  if (jwksUri) config.jwksUri = jwksUri;
+  const userinfoEndpoint = envTrim("WAIRON_OIDC_USERINFO_ENDPOINT");
+  if (userinfoEndpoint) config.userinfoEndpoint = userinfoEndpoint;
+}
+
 // src/server/landscape.ts
 init_fs();
 init_yaml();
@@ -48069,55 +48131,11 @@ ${lines}`);
   }
   return new WaironError(e instanceof Error ? e.message : String(e));
 }
-function envTrim(name) {
-  const value = process.env[name]?.trim();
-  return value ? value : void 0;
-}
-function envCsv(name) {
-  return (process.env[name] ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
-}
 function seedIdentityProviderFromEnv(cfg) {
-  const issuer = envTrim("WAIRON_OIDC_ISSUER");
-  if (!issuer) return;
-  if (!process.env["WAIRON_DATA_DIR"]) {
+  if (process.env["WAIRON_OIDC_ISSUER"]?.trim() && !process.env["WAIRON_DATA_DIR"]) {
     process.env["WAIRON_DATA_DIR"] = cfg.dataDir;
   }
-  let clientSecretRef = envTrim("WAIRON_OIDC_CLIENT_SECRET_REF");
-  const rawSecret = process.env["WAIRON_OIDC_CLIENT_SECRET"];
-  if (rawSecret) {
-    setSecret("oidc-default", rawSecret);
-    clientSecretRef = "oidc-default";
-  }
-  const config = {
-    id: "default",
-    // matches the sign-in screen's default provider id
-    providerType: envTrim("WAIRON_OIDC_PROVIDER_TYPE") ?? "oidc",
-    issuerUrl: issuer,
-    enabled: true,
-    updatedAt: ""
-    // stamped server-side by the policy registry
-  };
-  const displayName = envTrim("WAIRON_OIDC_DISPLAY_NAME");
-  if (displayName) config.displayName = displayName;
-  const clientId = envTrim("WAIRON_OIDC_CLIENT_ID");
-  if (clientId) config.clientId = clientId;
-  if (clientSecretRef) config.clientSecretRef = clientSecretRef;
-  const adminGroups = envCsv("WAIRON_OIDC_ADMIN_GROUPS");
-  if (adminGroups.length) config.adminGroupClaims = adminGroups;
-  const redirectUris = envCsv("WAIRON_OIDC_ALLOWED_REDIRECT_URIS");
-  if (redirectUris.length) config.allowedRedirectUris = redirectUris;
-  const domains = envCsv("WAIRON_OIDC_ALLOWED_DOMAINS");
-  if (domains.length) config.allowedDomains = domains;
-  const authorizationEndpoint = envTrim("WAIRON_OIDC_AUTHORIZATION_ENDPOINT");
-  if (authorizationEndpoint) config.authorizationEndpoint = authorizationEndpoint;
-  const tokenEndpoint = envTrim("WAIRON_OIDC_TOKEN_ENDPOINT");
-  if (tokenEndpoint) config.tokenEndpoint = tokenEndpoint;
-  const jwksUri = envTrim("WAIRON_OIDC_JWKS_URI");
-  if (jwksUri) config.jwksUri = jwksUri;
-  const userinfoEndpoint = envTrim("WAIRON_OIDC_USERINFO_ENDPOINT");
-  if (userinfoEndpoint) config.userinfoEndpoint = userinfoEndpoint;
-  upsertIdentityProviderRecord(cfg.dataDir, config);
-  logger.info("seeded identity provider 'default' from env");
+  if (seedDefaultProvider(cfg)) logger.info("seeded identity provider 'default' from env");
 }
 async function runServe(options = {}) {
   const cfg = resolveHostConfig(options);
@@ -48172,7 +48190,6 @@ async function runDev(options = {}) {
   const hash = crypto23.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
   const dataDir = path68.join(os11.tmpdir(), "wairon-dev", hash);
   fs55.mkdirSync(dataDir, { recursive: true });
-  registerLocalDevProject(dataDir, "local", cwd);
   const port = options.port ? Number(options.port) : 8080;
   const exposurePolicy = {
     adminApiMode: "local_only",
@@ -48195,6 +48212,7 @@ async function runDev(options = {}) {
     devMode: true,
     exposurePolicy
   };
+  registerLocalDevProject(cfg, "local", cwd);
   let handle;
   try {
     handle = startHostServer(cfg);