flaghoist 0.3.0 → 0.4.0

package/README.md

@@ -19,7 +19,8 @@ into `wrangler.toml`.
 ## Managing flags
 
 Point the CLI at your server with `--url` and `--token`, or set `FLAGS_URL` and
-`FLAGS_ADMIN_TOKEN`.
+`FLAGS_ADMIN_TOKEN`. On a server with user accounts, `flaghoist login --url <server>` signs you in
+once and saves a personal access token instead.
 
 ```bash
 flaghoist flag list
@@ -31,6 +32,18 @@ flaghoist flag rollout new-checkout 25
 Rollouts are sticky. A user who lands inside 25 percent stays inside it as you go to 50, so nobody
 flickers in and out between deploys.
 
+## Managing members
+
+On a server with user accounts turned on, admins invite and manage people from the command line
+too. Invite and reset commands print a link to send yourself, and the server emails it as well when it has an email sender set up.
+
+```bash
+flaghoist users invite ada@example.com --role editor
+flaghoist users list
+flaghoist users role ada@example.com admin
+flaghoist users reset ada@example.com
+```
+
 ## Owning the code
 
 ```bash

package/dist/{chunk-HOSNPNBP.js → chunk-HSDDPXCM.js}

@@ -11,6 +11,7 @@ var STORAGE_KINDS = [
   "cloudflare-kv",
   "redis",
   "postgres",
+  "sqlite",
   "memory"
 ];
 var PLATFORM_KINDS = ["cloudflare", "container"];

package/dist/index.js

@@ -7,97 +7,34 @@ import {
   containerStorageDefault,
   parseConfig,
   serializeConfig
-} from "./chunk-HOSNPNBP.js";
+} from "./chunk-HSDDPXCM.js";
 
 // src/index.ts
 import { spawnSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
-import { createInterface } from "readline/promises";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { hostname } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { createInterface as createInterface2 } from "readline/promises";
 import { parseArgs } from "util";
 
 // src/admin.ts
-function createAdminClient(options) {
-  const doFetch = options.fetch ?? ((input, init) => fetch(input, init));
-  const api = `${options.url.replace(/\/+$/, "")}/api/v1`;
-  const headers = {
-    authorization: `Bearer ${options.token}`,
-    "content-type": "application/json"
-  };
-  const path = (key) => `${api}/flags/${encodeURIComponent(key)}`;
-  return {
-    async list() {
-      const res = await doFetch(`${api}/flags`, { headers });
-      if (!res.ok) throw new Error(`Failed to list flags (${res.status})`);
-      return (await res.json()).flags;
-    },
-    async get(key) {
-      const res = await doFetch(path(key), { headers });
-      if (res.status === 404) return null;
-      if (!res.ok) throw new Error(`Failed to read flag "${key}" (${res.status})`);
-      return await res.json();
-    },
-    async put(key, input) {
-      const res = await doFetch(path(key), { method: "PUT", headers, body: JSON.stringify(input) });
-      if (!res.ok)
-        throw new Error(`Failed to save flag "${key}" (${res.status}): ${await res.text()}`);
-      return await res.json();
-    },
-    async delete(key) {
-      const res = await doFetch(path(key), { method: "DELETE", headers });
-      if (!res.ok && res.status !== 404)
-        throw new Error(`Failed to delete flag "${key}" (${res.status})`);
-    }
-  };
-}
-function requireFlag(flag, key) {
-  if (!flag) throw new Error(`Flag "${key}" not found`);
-  return flag;
-}
-function createFlag(client, key, opts) {
-  return client.put(key, {
-    enabled: opts.enabled ?? false,
-    rollout: { percentage: opts.percentage ?? 0 },
-    rules: [],
-    description: opts.description ?? ""
-  });
-}
-async function toggleFlag(client, key, to) {
-  const flag = requireFlag(await client.get(key), key);
-  const enabled = to === "flip" ? !flag.enabled : to;
-  return client.put(key, {
-    enabled,
-    rollout: flag.rollout,
-    rules: flag.rules,
-    description: flag.description
-  });
-}
-async function setRollout(client, key, percentage) {
-  const flag = requireFlag(await client.get(key), key);
-  return client.put(key, {
-    enabled: flag.enabled,
-    rollout: { percentage },
-    rules: flag.rules,
-    description: flag.description
-  });
-}
-async function setRules(client, key, rules) {
-  const flag = requireFlag(await client.get(key), key);
-  return client.put(key, {
-    enabled: flag.enabled,
-    rollout: flag.rollout,
-    rules,
-    description: flag.description
-  });
-}
+import {
+  createAdminClient,
+  createFlag,
+  setRollout,
+  setRules,
+  toggleFlag
+} from "@flaghoist/admin-client";
 
 // src/generate-container.ts
 var CONTAINER_DEPS = {
   "@flaghoist/adapter-memory": "^0.1.2",
   "@flaghoist/adapter-postgres": "^0.1.2",
   "@flaghoist/adapter-redis": "^0.1.2",
+  "@flaghoist/adapter-sqlite": "^0.1.0",
   "@flaghoist/server": "^0.3.0",
   "@hono/node-server": "^2.1.1",
+  "better-sqlite3": "^11.0.0",
   ioredis: "^5.4.0",
   pg: "^8.13.0"
 };
@@ -117,6 +54,7 @@ function generateNodeEntry(config) {
     `import { memoryAdapter } from '@flaghoist/adapter-memory'`,
     `import { initPostgres, postgresAdapter } from '@flaghoist/adapter-postgres'`,
     `import { redisAdapter } from '@flaghoist/adapter-redis'`,
+    `import { initSqlite, sqliteAdapter } from '@flaghoist/adapter-sqlite'`,
     `import { ${serverImports.join(", ")} } from '@flaghoist/server'`,
     ...config.dashboard ? [`import { dashboardHtml } from '@flaghoist/server/dashboard'`] : [],
     `import { serve } from '@hono/node-server'`
@@ -150,12 +88,19 @@ async function makeStorage() {
     return redisAdapter(new Redis(env.REDIS_URL), { hashKey: env.FLAGS_HASH_KEY ?? 'flaghoist:flags' })
   }
 
+  if (kind === 'sqlite') {
+    const { default: Database } = await import('better-sqlite3')
+    const db = new Database(env.DATABASE_PATH ?? '/data/flags.db')
+    initSqlite(db)
+    return sqliteAdapter(db)
+  }
+
   if (kind === 'memory') {
     console.warn('[flaghoist] FLAGS_STORAGE=memory: flags are in-process and are lost on restart.')
     return memoryAdapter()
   }
 
-  throw new Error(\`Unknown FLAGS_STORAGE "\${kind}". Use postgres, redis, or memory.\`)
+  throw new Error(\`Unknown FLAGS_STORAGE "\${kind}". Use postgres, redis, sqlite, or memory.\`)
 }
 
 const app = createFlagServer({
@@ -253,6 +198,10 @@ function storageSnippet(storage) {
         expr: "memoryAdapter()",
         pkg: "@flaghoist/adapter-memory"
       };
+    case "sqlite":
+      throw new Error(
+        'SQLite storage requires a Node or container deployment. Use `npx flaghoist deploy` and pick "Another platform".'
+      );
   }
 }
 function adminExpr2(admin) {
@@ -342,27 +291,402 @@ function generatePackageJson(config) {
 `;
 }
 
+// src/credentials.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function credentialsPath(env = process.env, platform = process.platform, home = homedir()) {
+  const dir = env.FLAGHOIST_CONFIG_DIR ?? (platform === "win32" && env.APPDATA ? join(env.APPDATA, "flaghoist") : join(env.XDG_CONFIG_HOME ?? join(home, ".config"), "flaghoist"));
+  return join(dir, "credentials.json");
+}
+function serverKey(url) {
+  return url.trim().replace(/\/+$/, "");
+}
+function read(path) {
+  if (!existsSync(path)) return { servers: {} };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return { servers: parsed.servers && typeof parsed.servers === "object" ? parsed.servers : {} };
+  } catch {
+    throw new Error(`Could not read ${path}. Fix or delete it, then sign in again.`);
+  }
+}
+function write(path, file) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function savedCredential(path, url) {
+  return read(path).servers[serverKey(url)] ?? null;
+}
+function savedServers(path) {
+  return Object.keys(read(path).servers);
+}
+function saveCredential(path, url, credential) {
+  const file = read(path);
+  file.servers[serverKey(url)] = credential;
+  write(path, file);
+}
+function removeCredential(path, url) {
+  const file = read(path);
+  const key = serverKey(url);
+  if (!file.servers[key]) return false;
+  delete file.servers[key];
+  write(path, file);
+  return true;
+}
+
+// src/prompt.ts
+import { createInterface } from "readline/promises";
+async function readPassword(options) {
+  const input = options.input ?? process.stdin;
+  const output = options.output ?? process.stdout;
+  if (options.fromStdin) {
+    const chunks = [];
+    for await (const chunk of input) chunks.push(Buffer.from(chunk));
+    const password = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+    if (!password) throw new Error("--password-stdin was set but nothing was piped in.");
+    return password;
+  }
+  if (!input.isTTY) {
+    throw new Error(
+      "No terminal to ask for a password in. Run this in a terminal, or pipe the password in with --password-stdin."
+    );
+  }
+  const rl = createInterface({ input, output, terminal: true });
+  output.write("Password: ");
+  rl._writeToOutput = () => {
+  };
+  try {
+    return await rl.question("");
+  } finally {
+    rl.close();
+    output.write("\n");
+  }
+}
+
+// src/tokens.ts
+import {
+  createAdminClient as createAdminClient2,
+  createAuthClient,
+  isTwoFactorChallenge
+} from "@flaghoist/admin-client";
+var ROLES = ["viewer", "editor", "admin", "owner"];
+var TOKENS_USAGE = `  tokens list
+  tokens create <name> [--role <role>] [--expires-days N|never]
+  tokens revoke <id or name>`;
+function when(iso) {
+  return iso ? iso.slice(0, 10) : "never";
+}
+function parseExpiry(value) {
+  if (value === void 0) return void 0;
+  if (value === "never") return null;
+  const days = Number(value);
+  if (!Number.isInteger(days) || days < 1 || days > 3650) {
+    throw new Error('--expires-days must be a whole number from 1 to 3650, or "never".');
+  }
+  return days;
+}
+function findToken(tokens, ref) {
+  const byId = tokens.find((t) => t.id === ref);
+  if (byId) return byId;
+  const byName = tokens.filter((t) => t.name === ref);
+  if (byName.length === 1) return byName[0];
+  if (byName.length > 1) throw new Error(`More than one token is named "${ref}". Use its id.`);
+  throw new Error(`No token with the id or name "${ref}".`);
+}
+async function runTokens(client, positionals, options) {
+  const [sub, a] = positionals;
+  switch (sub) {
+    case "list": {
+      const tokens = await client.listTokens();
+      if (tokens.length === 0) return ["No access tokens."];
+      return tokens.map(
+        (t) => `${t.id}  ${t.name.padEnd(24)} ${t.role.padEnd(7)} ${t.prefix}...  expires ${when(
+          t.expiresAt
+        )}  last used ${when(t.lastUsedAt)}`
+      );
+    }
+    case "create": {
+      if (!a) throw new Error("Usage: flaghoist tokens create <name> [--role r] [--expires-days N]");
+      if (options.role && !ROLES.includes(options.role)) {
+        throw new Error(`Role must be one of ${ROLES.join(", ")}.`);
+      }
+      const { token, info } = await client.createToken({
+        name: a,
+        ...options.role ? { role: options.role } : {},
+        ...options.expiresDays !== void 0 ? { expiresInDays: parseExpiry(options.expiresDays) } : {}
+      });
+      return [
+        `Created "${info.name}" (${info.role}, expires ${when(info.expiresAt)}). Copy it now; it is not shown again:`,
+        token
+      ];
+    }
+    case "revoke": {
+      if (!a) throw new Error("Usage: flaghoist tokens revoke <id or name>");
+      const token = findToken(await client.listTokens(), a);
+      await client.revokeToken(token.id);
+      return [`Revoked "${token.name}".`];
+    }
+    default:
+      throw new Error(`Unknown tokens command: ${sub ?? "(none)"}. Try "flaghoist tokens list".`);
+  }
+}
+async function loginForToken(input) {
+  const auth = createAuthClient({ url: input.url, fetch: input.fetch });
+  const config = await auth.config();
+  if (!config.accounts) {
+    throw new Error(
+      "This server has no user accounts. Use its admin token with --token or FLAGS_ADMIN_TOKEN."
+    );
+  }
+  const first = await auth.signIn(input.email, input.password);
+  let signedIn;
+  if (isTwoFactorChallenge(first)) {
+    if (!input.twoFactorCode) {
+      throw new Error("This account uses two-factor codes. Pass the current one with --code.");
+    }
+    signedIn = await auth.completeTwoFactor(first.challenge, await input.twoFactorCode());
+  } else {
+    signedIn = first;
+  }
+  const session = createAdminClient2({ url: input.url, token: signedIn.token, fetch: input.fetch });
+  try {
+    const { token, info } = await session.createToken({ name: input.tokenName });
+    return {
+      token,
+      tokenId: info.id,
+      email: signedIn.user.email,
+      role: info.role,
+      expiresAt: info.expiresAt
+    };
+  } finally {
+    await session.logout().catch(() => {
+    });
+  }
+}
+
+// src/users.ts
+import { inviteLink } from "@flaghoist/admin-client";
+var ROLES2 = ["viewer", "editor", "admin", "owner"];
+var USERS_USAGE = `  users list
+  users invite <email> [--role viewer|editor|admin|owner]
+  users role <email> <role> [--env E]   With --env, the role in one environment; "default" clears it
+  users disable <email>
+  users enable <email>
+  users remove <email>
+  users reset <email>        Print a link that sets a new password (valid 24 hours)
+  users revoke <email>       Cancel an open invite`;
+async function memberByEmail(client, email) {
+  const wanted = email.trim().toLowerCase();
+  const member = (await client.listMembers()).find((m) => m.email === wanted);
+  if (!member) throw new Error(`No member with the email ${wanted}.`);
+  return member;
+}
+function requireRole(role) {
+  if (!role || !ROLES2.includes(role)) throw new Error(`Role must be one of ${ROLES2.join(", ")}.`);
+  return role;
+}
+function when2(iso) {
+  return iso ? iso.slice(0, 16).replace("T", " ") : "never";
+}
+async function runUsers(client, serverUrl, positionals, options) {
+  const [sub, a, b] = positionals;
+  const dashboard = `${serverUrl.replace(/\/+$/, "")}/admin/`;
+  switch (sub) {
+    case "list": {
+      const [members, invites] = await Promise.all([client.listMembers(), client.listInvites()]);
+      const lines = members.map(
+        (m) => `${m.email.padEnd(32)} ${m.role.padEnd(8)} ${m.status.padEnd(9)} last active ${when2(m.lastActiveAt)}`
+      );
+      for (const i of invites) {
+        lines.push(
+          `${i.email.padEnd(32)} ${i.role.padEnd(8)} invited   expires ${when2(i.expiresAt)}`
+        );
+      }
+      return lines.length > 0 ? lines : ["No members yet."];
+    }
+    case "invite": {
+      if (!a) throw new Error("Usage: flaghoist users invite <email> [--role viewer]");
+      const role = requireRole(options.role ?? "viewer");
+      const { token, invite, emailed } = await client.createInvite({
+        email: a,
+        role,
+        dashboardUrl: dashboard
+      });
+      return [
+        emailed ? `Invited ${invite.email} as ${invite.role} and emailed them the link (valid until ${when2(invite.expiresAt)}):` : `Invited ${invite.email} as ${invite.role}. Send them this link (valid until ${when2(invite.expiresAt)}):`,
+        inviteLink(dashboard, token)
+      ];
+    }
+    case "role": {
+      if (!a || !b) throw new Error("Usage: flaghoist users role <email> <role> [--env E]");
+      const member = await memberByEmail(client, a);
+      if (options.env) {
+        const clear = b === "default";
+        if (!clear && (!ROLES2.includes(b) || b === "owner")) {
+          throw new Error('An environment role must be viewer, editor or admin, or "default".');
+        }
+        const updated2 = await client.updateMember(member.id, {
+          environmentRoles: { ...member.environmentRoles, [options.env]: clear ? null : b }
+        });
+        const now = updated2.environmentRoles?.[options.env];
+        return [
+          now ? `${updated2.email} is ${now} in ${options.env}.` : `${updated2.email} has their main role (${updated2.role}) in ${options.env}.`
+        ];
+      }
+      const updated = await client.updateMember(member.id, { role: requireRole(b) });
+      return [`${updated.email} is now ${updated.role}.`];
+    }
+    case "disable":
+    case "enable": {
+      if (!a) throw new Error(`Usage: flaghoist users ${sub} <email>`);
+      const member = await memberByEmail(client, a);
+      const status = sub === "disable" ? "disabled" : "active";
+      await client.updateMember(member.id, { status });
+      return [`${member.email} is ${sub === "disable" ? "disabled and signed out" : "enabled"}.`];
+    }
+    case "remove": {
+      if (!a) throw new Error("Usage: flaghoist users remove <email>");
+      const member = await memberByEmail(client, a);
+      await client.removeMember(member.id);
+      return [`Removed ${member.email}.`];
+    }
+    case "reset": {
+      if (!a) throw new Error("Usage: flaghoist users reset <email>");
+      const member = await memberByEmail(client, a);
+      const { token, invite, emailed } = await client.createResetLink(member.id, {
+        dashboardUrl: dashboard
+      });
+      return [
+        emailed ? `Emailed ${member.email} a link to set a new password (valid until ${when2(invite.expiresAt)}):` : `Send ${member.email} this link to set a new password (valid until ${when2(invite.expiresAt)}):`,
+        inviteLink(dashboard, token)
+      ];
+    }
+    case "revoke": {
+      if (!a) throw new Error("Usage: flaghoist users revoke <email>");
+      const wanted = a.trim().toLowerCase();
+      const invite = (await client.listInvites()).find((i) => i.email === wanted);
+      if (!invite) throw new Error(`No open invite for ${wanted}.`);
+      await client.revokeInvite(invite.id);
+      return [`Cancelled the invite for ${wanted}.`];
+    }
+    default:
+      throw new Error(`Unknown users command: ${sub ?? "(none)"}. Try "flaghoist users list".`);
+  }
+}
+
 // src/version.ts
 import { createRequire } from "module";
 var VERSION = createRequire(import.meta.url)("../package.json").version;
 
 // src/index.ts
 function writeFileSafe(path, content) {
-  mkdirSync(dirname(path) || ".", { recursive: true });
-  writeFileSync(path, content);
+  mkdirSync2(dirname2(path) || ".", { recursive: true });
+  writeFileSync2(path, content);
 }
 function loadConfig() {
-  if (!existsSync("flaghoist.toml")) {
+  if (!existsSync2("flaghoist.toml")) {
     throw new Error("No flaghoist.toml found in this directory. Run `flaghoist init` first.");
   }
-  return parseConfig(readFileSync("flaghoist.toml", "utf8"));
+  return parseConfig(readFileSync2("flaghoist.toml", "utf8"));
+}
+function serverFrom(values) {
+  const url = values.url ?? process.env.FLAGS_URL;
+  if (url) return url;
+  const saved = savedServers(credentialsPath());
+  if (saved.length === 1) return saved[0];
+  throw new Error("Missing server URL. Pass --url or set FLAGS_URL.");
 }
 function clientFrom(values) {
+  const url = serverFrom(values);
+  const token = values.token ?? process.env.FLAGS_ADMIN_TOKEN ?? savedCredential(credentialsPath(), url)?.token;
+  if (!token) {
+    throw new Error(
+      "Not signed in. Run `flaghoist login`, or pass --token or set FLAGS_ADMIN_TOKEN."
+    );
+  }
+  return createAdminClient({ url, token });
+}
+async function runLogin(args) {
+  const { values } = parseArgs({
+    args,
+    options: {
+      url: { type: "string" },
+      email: { type: "string" },
+      "password-stdin": { type: "boolean" },
+      code: { type: "string" }
+    }
+  });
   const url = values.url ?? process.env.FLAGS_URL;
-  const token = values.token ?? process.env.FLAGS_ADMIN_TOKEN;
   if (!url) throw new Error("Missing server URL. Pass --url or set FLAGS_URL.");
-  if (!token) throw new Error("Missing admin token. Pass --token or set FLAGS_ADMIN_TOKEN.");
-  return createAdminClient({ url, token });
+  let email = values.email;
+  if (!email) {
+    if (!process.stdin.isTTY) throw new Error("Pass your email with --email.");
+    const rl = createInterface2({ input: process.stdin, output: process.stdout });
+    email = (await rl.question("Email: ")).trim();
+    rl.close();
+  }
+  const password = await readPassword({ fromStdin: values["password-stdin"] === true });
+  console.log(`Signing in to ${url} as ${email}...`);
+  const result = await loginForToken({
+    url,
+    email,
+    password,
+    tokenName: `flaghoist CLI on ${hostname()}`,
+    twoFactorCode: async () => {
+      if (values.code) return values.code;
+      if (!process.stdin.isTTY) {
+        throw new Error("This account uses two-factor codes. Pass the current one with --code.");
+      }
+      const rl = createInterface2({ input: process.stdin, output: process.stdout });
+      try {
+        return (await rl.question("Two-factor code (or a recovery code): ")).trim();
+      } finally {
+        rl.close();
+      }
+    }
+  });
+  const path = credentialsPath();
+  saveCredential(path, url, {
+    token: result.token,
+    tokenId: result.tokenId,
+    email: result.email,
+    savedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  console.log(
+    `Signed in to ${url} as ${result.email} (${result.role}). The access token expires ${result.expiresAt?.slice(0, 10) ?? "never"} and is saved in ${path}.`
+  );
+}
+async function runLogout(args) {
+  const { values } = parseArgs({ args, options: { url: { type: "string" } } });
+  const url = serverFrom(values);
+  const path = credentialsPath();
+  const saved = savedCredential(path, url);
+  if (!saved) return console.log(`Not signed in to ${url}.`);
+  const revoked = await createAdminClient({ url, token: saved.token }).logout().then(() => true).catch(() => false);
+  removeCredential(path, url);
+  console.log(
+    revoked ? `Signed out of ${url}. The access token is revoked.` : `Removed the saved token for ${url}. The server could not be reached to revoke it; revoke it from the dashboard's Account page.`
+  );
+}
+async function runTokensCommand(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      url: { type: "string" },
+      token: { type: "string" },
+      role: { type: "string" },
+      "expires-days": { type: "string" }
+    }
+  });
+  const lines = await runTokens(clientFrom(values), positionals, {
+    role: values.role,
+    expiresDays: values["expires-days"]
+  });
+  for (const line of lines) console.log(line);
 }
 function flagState(flag) {
   if (!flag.enabled) return "disabled";
@@ -433,7 +757,7 @@ async function runFlag(args) {
       if (a !== "set" || !b)
         throw new Error("Usage: flaghoist flag rules set <key> --file rules.json");
       if (!values.file) throw new Error("Missing --file <rules.json>");
-      const rules = JSON.parse(readFileSync(values.file, "utf8"));
+      const rules = JSON.parse(readFileSync2(values.file, "utf8"));
       if (!Array.isArray(rules)) throw new Error("Rules file must contain a JSON array");
       const flag = await setRules(clientFrom(values), b, rules);
       console.log(`Updated rules for "${b}"`);
@@ -443,6 +767,24 @@ async function runFlag(args) {
       throw new Error(`Unknown flag command: ${sub ?? "(none)"}. Try "flaghoist flag list".`);
   }
 }
+async function runUsersCommand(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      url: { type: "string" },
+      token: { type: "string" },
+      role: { type: "string" },
+      env: { type: "string" }
+    }
+  });
+  const client = clientFrom(values);
+  const url = serverFrom(values);
+  const options = { role: values.role, env: values.env };
+  for (const line of await runUsers(client, url, positionals, options)) {
+    console.log(line);
+  }
+}
 function runInit(args) {
   const { values } = parseArgs({
     args,
@@ -453,7 +795,7 @@ function runInit(args) {
       platform: { type: "string" }
     }
   });
-  if (existsSync("flaghoist.toml")) throw new Error("flaghoist.toml already exists.");
+  if (existsSync2("flaghoist.toml")) throw new Error("flaghoist.toml already exists.");
   if (values.storage && !STORAGE_KINDS.includes(values.storage)) {
     throw new Error(`Unknown storage "${values.storage}". One of: ${STORAGE_KINDS.join(", ")}.`);
   }
@@ -466,7 +808,7 @@ function runInit(args) {
     storage: values.storage ?? DEFAULT_CONFIG.storage
   };
   const config = values.platform === "container" ? asContainer(base) : base;
-  writeFileSync("flaghoist.toml", serializeConfig(config));
+  writeFileSync2("flaghoist.toml", serializeConfig(config));
   console.log("Created flaghoist.toml");
   console.log("Next: `flaghoist deploy` to ship it, or `flaghoist eject` to own the code.");
 }
@@ -490,7 +832,7 @@ function projectFiles(config) {
 }
 function writeProject(config, dir) {
   const files = projectFiles(config);
-  const existing = files.map(([name]) => name).filter((name) => existsSync(join(dir, name)));
+  const existing = files.map(([name]) => name).filter((name) => existsSync2(join2(dir, name)));
   if (existing.length > 0) {
     throw new Error(
       `Refusing to overwrite ${existing.join(", ")} in this directory.
@@ -498,12 +840,12 @@ Flaghoist deploys as its own service, so give it a directory of its own:
   npm create flaghoist@latest team-flags`
     );
   }
-  for (const [name, contents] of files) writeFileSafe(join(dir, name), contents);
+  for (const [name, contents] of files) writeFileSafe(join2(dir, name), contents);
 }
 function runEject() {
   const config = loadConfig();
   const entry = entryFile(config.platform);
-  if (existsSync(entry)) throw new Error(`${entry} already exists. Already ejected?`);
+  if (existsSync2(entry)) throw new Error(`${entry} already exists. Already ejected?`);
   writeProject(config, ".");
   if (config.platform === "container") {
     console.log("Ejected to a code project you own: server.mjs, Dockerfile, package.json");
@@ -520,7 +862,7 @@ function runEject() {
 }
 function ensureKvNamespace(config) {
   if (config.storage !== "cloudflare-kv") return;
-  const toml = readFileSync("wrangler.toml", "utf8");
+  const toml = readFileSync2("wrangler.toml", "utf8");
   if (!needsKvNamespace(toml)) return;
   const title = `${config.name}-FLAGS`;
   console.log(`Creating the ${title} KV namespace...`);
@@ -541,11 +883,11 @@ function ensureKvNamespace(config) {
       "Created the namespace but could not read its id from wrangler output. Paste the id above into wrangler.toml, then run `flaghoist deploy` again."
     );
   }
-  writeFileSync("wrangler.toml", fillKvNamespaceId(toml, id));
+  writeFileSync2("wrangler.toml", fillKvNamespaceId(toml, id));
   console.log(`Bound FLAGS to namespace ${id} in wrangler.toml`);
 }
 function ensureDependencies() {
-  if (existsSync("node_modules")) return;
+  if (existsSync2("node_modules")) return;
   console.log("Installing dependencies...");
   const result = spawnSync("npm", ["install", "--no-audit", "--no-fund"], { stdio: "inherit" });
   if (result.status !== 0) {
@@ -563,7 +905,7 @@ async function promptDeployTarget() {
   console.log("Where do you want to deploy?");
   console.log("  1) Cloudflare Workers   recommended, deploys in one command");
   console.log("  2) Another platform     Render, a container, any Node host");
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const answer = (await rl.question("Choose [1]: ")).trim().toLowerCase();
     return answer === "2" || answer.startsWith("o") || answer.startsWith("r") ? "other" : "cloudflare";
@@ -574,9 +916,9 @@ async function promptDeployTarget() {
 function deployContainer(config) {
   const container = asContainer(config);
   if (config.platform !== container.platform || config.storage !== container.storage) {
-    writeFileSync("flaghoist.toml", serializeConfig(container));
+    writeFileSync2("flaghoist.toml", serializeConfig(container));
   }
-  if (!existsSync(entryFile("container"))) writeProject(container, ".");
+  if (!existsSync2(entryFile("container"))) writeProject(container, ".");
   console.log(`
 Scaffolded a container project: server.mjs, Dockerfile, package.json.
 
@@ -595,7 +937,7 @@ Or deploy it to a host:
 Missing a platform you need? Open an issue at https://github.com/flaghoist/flaghoist/issues.`);
 }
 async function deployCloudflare(config) {
-  if (!existsSync("src/index.ts")) writeProject(config, ".");
+  if (!existsSync2("src/index.ts")) writeProject(config, ".");
   ensureDependencies();
   ensureKvNamespace(config);
   console.log("Deploying with wrangler...");
@@ -622,20 +964,37 @@ Scaffolding
   eject                    Generate a code project you own (a Worker, or a container)
   deploy [--target T]      Deploy (prompts for the platform; T is cloudflare or other)
 
-Flag management (needs --url/--token or FLAGS_URL/FLAGS_ADMIN_TOKEN)
+Signing in, on a server with user accounts
+  login [--url U] [--email E] [--password-stdin] [--code C]
+                               Sign in and save a personal access token for this server
+  logout [--url U]             Revoke that token and forget it
+${TOKENS_USAGE}
+
+Flag management (needs --url/--token or FLAGS_URL/FLAGS_ADMIN_TOKEN, or \`flaghoist login\`)
   flag list
   flag get <key>
   flag create <key> [--on] [--rollout N] [--desc "..."]
   flag toggle <key> [--on|--off]
   flag rollout <key> <percentage>
   flag rules set <key> --file rules.json
-  flag delete <key>`);
+  flag delete <key>
+
+Members, on a server with accounts on (same --url/--token; needs the admin role)
+${USERS_USAGE}`);
 }
 async function main() {
   const [command, ...rest] = process.argv.slice(2);
   switch (command) {
     case "flag":
       return runFlag(rest);
+    case "users":
+      return runUsersCommand(rest);
+    case "login":
+      return runLogin(rest);
+    case "logout":
+      return runLogout(rest);
+    case "tokens":
+      return runTokensCommand(rest);
     case "init":
       return runInit(rest);
     case "eject":

package/dist/lib.d.ts

@@ -1,4 +1,4 @@
-type StorageKind = 'cloudflare-kv' | 'redis' | 'postgres' | 'memory';
+type StorageKind = 'cloudflare-kv' | 'redis' | 'postgres' | 'sqlite' | 'memory';
 type AdminAuthKind = 'bearer-token' | 'oidc';
 /**
  * The shape of project `flaghoist deploy`/`eject` scaffolds. `cloudflare` is a Worker plus a
@@ -26,7 +26,7 @@ declare const STORAGE_KINDS: readonly StorageKind[];
 /** Every deploy shape selectable by name in `flaghoist.toml`. */
 declare const PLATFORM_KINDS: readonly PlatformKind[];
 /** The stores a container can reach. Cloudflare KV is a Worker binding, so it is not one of them. */
-type ContainerStorage = 'postgres' | 'redis' | 'memory';
+type ContainerStorage = 'postgres' | 'redis' | 'sqlite' | 'memory';
 /**
  * The storage a container project uses. Cloudflare KV cannot be reached off Workers, so a config
  * that still names it (the scaffolding default) becomes postgres, the store every container deploy

package/dist/lib.js

@@ -6,7 +6,7 @@ import {
   containerStorageDefault,
   parseConfig,
   serializeConfig
-} from "./chunk-HOSNPNBP.js";
+} from "./chunk-HSDDPXCM.js";
 export {
   DEFAULT_CONFIG,
   PLATFORM_KINDS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flaghoist",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Scaffold, deploy, and manage your Flaghoist feature-flag service from the terminal.",
   "license": "Apache-2.0",
   "type": "module",
@@ -23,12 +23,13 @@
     "node": ">=20"
   },
   "dependencies": {
-    "smol-toml": "^1.8.0"
+    "smol-toml": "^1.8.0",
+    "@flaghoist/admin-client": "0.3.0"
   },
   "devDependencies": {
-    "@flaghoist/adapter-memory": "0.1.2",
-    "@flaghoist/core": "0.1.2",
-    "@flaghoist/server": "0.3.1"
+    "@flaghoist/adapter-memory": "0.2.0",
+    "@flaghoist/core": "0.2.0",
+    "@flaghoist/server": "0.4.0"
   },
   "publishConfig": {
     "access": "public"