flaghoist 0.3.1 → 0.5.0

package/dist/index.js

@@ -1,19 +1,25 @@
 #!/usr/bin/env node
 import {
-  DEFAULT_CONFIG,
   PLATFORM_KINDS,
   STORAGE_KINDS,
   asContainer,
+  collectSetup,
   containerStorageDefault,
+  defaultsAsker,
   parseConfig,
-  serializeConfig
-} from "./chunk-HSDDPXCM.js";
+  readEnvFile,
+  serializeConfig,
+  setupSummary,
+  terminalAsker,
+  writeSetup
+} from "./chunk-TQ5S6NOA.js";
 
 // src/index.ts
 import { spawnSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
-import { createInterface } from "readline/promises";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { hostname } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { createInterface as createInterface2 } from "readline/promises";
 import { parseArgs } from "util";
 
 // src/admin.ts
@@ -25,20 +31,167 @@ import {
   toggleFlag
 } from "@flaghoist/admin-client";
 
+// src/generate.ts
+function storageSnippet(storage) {
+  switch (storage) {
+    case "cloudflare-kv":
+      return {
+        imports: [`import { cloudflareKV } from '@flaghoist/adapter-cloudflare-kv'`],
+        expr: "cloudflareKV(env.FLAGS)",
+        pkg: "@flaghoist/adapter-cloudflare-kv",
+        version: "^0.3.0"
+      };
+    case "redis":
+      return {
+        imports: [
+          `import { redisAdapter } from '@flaghoist/adapter-redis'`,
+          `import { Redis } from '@upstash/redis/cloudflare'`
+        ],
+        expr: "redisAdapter(Redis.fromEnv(env))",
+        pkg: "@flaghoist/adapter-redis",
+        version: "^0.2.0",
+        extraDeps: { "@upstash/redis": "^1.34.0" }
+      };
+    case "postgres":
+      return {
+        imports: [
+          `import { postgresAdapter } from '@flaghoist/adapter-postgres'`,
+          `import { Pool } from 'pg'`
+        ],
+        expr: "postgresAdapter(new Pool({ connectionString: env.DATABASE_URL }))",
+        pkg: "@flaghoist/adapter-postgres",
+        version: "^0.2.0",
+        extraDeps: { pg: "^8.13.0" }
+      };
+    case "memory":
+      return {
+        imports: [`import { memoryAdapter } from '@flaghoist/adapter-memory'`],
+        expr: "memoryAdapter()",
+        pkg: "@flaghoist/adapter-memory",
+        version: "^0.2.0"
+      };
+    case "sqlite":
+      throw new Error(
+        'SQLite storage requires a Node or container deployment. Use `npx flaghoist deploy` and pick "Another platform".'
+      );
+  }
+}
+function usersBlock(config) {
+  if (!config.accounts?.enabled) return "";
+  const sso = config.accounts.sso;
+  const ssoLines = sso ? [
+    "    sso: {",
+    `      issuer: ${JSON.stringify(sso.issuer)},`,
+    `      clientId: ${JSON.stringify(sso.clientId)},`,
+    "      clientSecret: env.SSO_CLIENT_SECRET,",
+    ...sso.adminGroup ? [`      roleMapping: { ${JSON.stringify(sso.adminGroup)}: 'admin' },`] : [],
+    "      // Everyone else who signs in through your provider starts as a viewer.",
+    "      defaultRole: 'viewer',",
+    "    },"
+  ] : [];
+  return ["", "  users: {", "    pepper: env.AUTH_PEPPER,", ...ssoLines, "  },"].join("\n");
+}
+function adminExpr(admin) {
+  return admin === "oidc" ? "oidc({ issuer: env.OIDC_ISSUER, audience: env.OIDC_AUDIENCE, groupsClaim: 'cognito:groups', allowedGroups: (env.ADMIN_GROUPS ?? '').split(',') })" : "bearerToken(env.ADMIN_TOKEN)";
+}
+function generateWorkerEntry(config) {
+  const storage = storageSnippet(config.storage);
+  const serverImports = [
+    "apiKey",
+    "createFlagServer",
+    config.auth.admin === "oidc" ? "oidc" : "bearerToken"
+  ].sort();
+  const imports = [
+    ...storage.imports,
+    `import { ${serverImports.join(", ")} } from '@flaghoist/server'`,
+    // A subpath import, so a Worker built with `dashboard = false` never pulls the HTML in.
+    ...config.dashboard ? [`import { dashboardHtml } from '@flaghoist/server/dashboard'`] : []
+  ].join("\n");
+  const origins = config.allowedOrigins && config.allowedOrigins.length > 0 ? `
+  allowedOrigins: ${JSON.stringify(config.allowedOrigins)},` : "";
+  const dashboard = config.dashboard ? "\n  dashboard: dashboardHtml," : "";
+  return `${imports}
+
+export default createFlagServer((env) => ({
+  storage: ${storage.expr},
+  auth: {
+    admin: ${adminExpr(config.auth.admin)},
+    read: apiKey(env.READ_API_KEY),
+  },${usersBlock(config)}${origins}${dashboard}
+}))
+`;
+}
+var KV_NAMESPACE_PLACEHOLDER = "<your-kv-namespace-id>";
+function generateWranglerToml(config) {
+  const lines = [
+    `name = ${JSON.stringify(config.name)}`,
+    `main = "src/index.ts"`,
+    `compatibility_date = "2025-01-01"`
+  ];
+  if (config.storage === "cloudflare-kv") {
+    lines.push(
+      "",
+      `# Created for you by \`flaghoist deploy\`, or by: npx wrangler kv namespace create ${config.name}-FLAGS`,
+      "kv_namespaces = [",
+      `  { binding = "FLAGS", id = ${JSON.stringify(KV_NAMESPACE_PLACEHOLDER)} }`,
+      "]"
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function needsKvNamespace(toml) {
+  return toml.includes(KV_NAMESPACE_PLACEHOLDER);
+}
+function fillKvNamespaceId(toml, id) {
+  return toml.replace(/^# Created for you by `flaghoist deploy`.*\n/m, "").replaceAll(KV_NAMESPACE_PLACEHOLDER, id);
+}
+function parseKvNamespaceId(output) {
+  const patterns = [
+    /\bid\s*=\s*"([0-9a-f]{32})"/i,
+    /"id"\s*:\s*"([0-9a-f]{32})"/i,
+    /\b([0-9a-f]{32})\b/i
+  ];
+  for (const re of patterns) {
+    const match = re.exec(output);
+    if (match) return match[1];
+  }
+  return void 0;
+}
+function generatePackageJson(config) {
+  const storage = storageSnippet(config.storage);
+  const dependencies = {
+    "@flaghoist/server": "^0.4.0",
+    [storage.pkg]: storage.version,
+    ...storage.extraDeps
+  };
+  const pkg = {
+    name: config.name,
+    version: "0.0.0",
+    private: true,
+    type: "module",
+    scripts: { dev: "wrangler dev", deploy: "wrangler deploy" },
+    dependencies,
+    devDependencies: { wrangler: "^4.0.0" }
+  };
+  return `${JSON.stringify(pkg, null, 2)}
+`;
+}
+
 // src/generate-container.ts
 var CONTAINER_DEPS = {
-  "@flaghoist/adapter-memory": "^0.1.2",
-  "@flaghoist/adapter-postgres": "^0.1.2",
-  "@flaghoist/adapter-redis": "^0.1.2",
-  "@flaghoist/adapter-sqlite": "^0.1.0",
-  "@flaghoist/server": "^0.3.0",
+  "@flaghoist/adapter-memory": "^0.2.0",
+  "@flaghoist/adapter-postgres": "^0.2.0",
+  "@flaghoist/adapter-redis": "^0.2.0",
+  "@flaghoist/adapter-sqlite": "^0.3.0",
+  "@flaghoist/server": "^0.4.0",
   "@hono/node-server": "^2.1.1",
   "better-sqlite3": "^11.0.0",
   ioredis: "^5.4.0",
   pg: "^8.13.0"
 };
 var CONTAINER_PORT = 8080;
-function adminExpr(admin) {
+function adminExpr2(admin) {
   return admin === "oidc" ? "oidc({ issuer: env.OIDC_ISSUER, audience: env.OIDC_AUDIENCE, groupsClaim: 'cognito:groups', allowedGroups: (env.ADMIN_GROUPS ?? '').split(',') })" : "bearerToken(env.ADMIN_TOKEN)";
 }
 function generateNodeEntry(config) {
@@ -105,9 +258,9 @@ async function makeStorage() {
 const app = createFlagServer({
   storage: await makeStorage(),${dashboard}
   auth: {
-    admin: ${adminExpr(config.auth.admin)},
+    admin: ${adminExpr2(config.auth.admin)},
     read: apiKey(env.READ_API_KEY),
-  },
+  },${usersBlock(config)}
   rateLimit: memoryRateLimit(),
   // Comma-separated list of browser origins allowed to read flags cross-origin.
   allowedOrigins: env.FLAGS_CORS ? env.FLAGS_CORS.split(',').map((o) => o.trim()) : ${origins},
@@ -150,144 +303,359 @@ function generateContainerPackageJson(config) {
     version: "0.0.0",
     private: true,
     type: "module",
-    scripts: { start: "node server.mjs" },
+    scripts: {
+      start: "node server.mjs",
+      // Loads AUTH_PEPPER and the other secrets from .env for a local run. Needs Node 20.6 or later.
+      dev: "node --env-file=.env server.mjs"
+    },
     dependencies: CONTAINER_DEPS
   };
   return `${JSON.stringify(pkg, null, 2)}
 `;
 }
 function generateDockerignore() {
-  return ["node_modules", "npm-debug.log", "Dockerfile", ".dockerignore", "README.md", ""].join(
-    "\n"
-  );
+  return [
+    "node_modules",
+    "npm-debug.log",
+    "Dockerfile",
+    ".dockerignore",
+    "README.md",
+    ".env",
+    ""
+  ].join("\n");
 }
 
-// src/generate.ts
-function storageSnippet(storage) {
-  switch (storage) {
-    case "cloudflare-kv":
-      return {
-        imports: [`import { cloudflareKV } from '@flaghoist/adapter-cloudflare-kv'`],
-        expr: "cloudflareKV(env.FLAGS)",
-        pkg: "@flaghoist/adapter-cloudflare-kv"
-      };
-    case "redis":
-      return {
-        imports: [
-          `import { redisAdapter } from '@flaghoist/adapter-redis'`,
-          `import { Redis } from '@upstash/redis/cloudflare'`
-        ],
-        expr: "redisAdapter(Redis.fromEnv(env))",
-        pkg: "@flaghoist/adapter-redis",
-        extraDeps: { "@upstash/redis": "^1.34.0" }
-      };
-    case "postgres":
-      return {
-        imports: [
-          `import { postgresAdapter } from '@flaghoist/adapter-postgres'`,
-          `import { Pool } from 'pg'`
-        ],
-        expr: "postgresAdapter(new Pool({ connectionString: env.DATABASE_URL }))",
-        pkg: "@flaghoist/adapter-postgres",
-        extraDeps: { pg: "^8.13.0" }
-      };
-    case "memory":
-      return {
-        imports: [`import { memoryAdapter } from '@flaghoist/adapter-memory'`],
-        expr: "memoryAdapter()",
-        pkg: "@flaghoist/adapter-memory"
-      };
-    case "sqlite":
-      throw new Error(
-        'SQLite storage requires a Node or container deployment. Use `npx flaghoist deploy` and pick "Another platform".'
-      );
+// src/credentials.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function credentialsPath(env = process.env, platform = process.platform, home = homedir()) {
+  const dir = env.FLAGHOIST_CONFIG_DIR ?? (platform === "win32" && env.APPDATA ? join(env.APPDATA, "flaghoist") : join(env.XDG_CONFIG_HOME ?? join(home, ".config"), "flaghoist"));
+  return join(dir, "credentials.json");
+}
+function serverKey(url) {
+  return url.trim().replace(/\/+$/, "");
+}
+function read(path) {
+  if (!existsSync(path)) return { servers: {} };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return { servers: parsed.servers && typeof parsed.servers === "object" ? parsed.servers : {} };
+  } catch {
+    throw new Error(`Could not read ${path}. Fix or delete it, then sign in again.`);
   }
 }
-function adminExpr2(admin) {
-  return admin === "oidc" ? "oidc({ issuer: env.OIDC_ISSUER, audience: env.OIDC_AUDIENCE, groupsClaim: 'cognito:groups', allowedGroups: (env.ADMIN_GROUPS ?? '').split(',') })" : "bearerToken(env.ADMIN_TOKEN)";
+function write(path, file) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function savedCredential(path, url) {
+  return read(path).servers[serverKey(url)] ?? null;
+}
+function savedServers(path) {
+  return Object.keys(read(path).servers);
+}
+function saveCredential(path, url, credential) {
+  const file = read(path);
+  file.servers[serverKey(url)] = credential;
+  write(path, file);
+}
+function removeCredential(path, url) {
+  const file = read(path);
+  const key = serverKey(url);
+  if (!file.servers[key]) return false;
+  delete file.servers[key];
+  write(path, file);
+  return true;
 }
-function generateWorkerEntry(config) {
-  const storage = storageSnippet(config.storage);
-  const serverImports = [
-    "apiKey",
-    "createFlagServer",
-    config.auth.admin === "oidc" ? "oidc" : "bearerToken"
-  ].sort();
-  const imports = [
-    ...storage.imports,
-    `import { ${serverImports.join(", ")} } from '@flaghoist/server'`,
-    // A subpath import, so a Worker built with `dashboard = false` never pulls the HTML in.
-    ...config.dashboard ? [`import { dashboardHtml } from '@flaghoist/server/dashboard'`] : []
-  ].join("\n");
-  const origins = config.allowedOrigins && config.allowedOrigins.length > 0 ? `
-  allowedOrigins: ${JSON.stringify(config.allowedOrigins)},` : "";
-  const dashboard = config.dashboard ? "\n  dashboard: dashboardHtml," : "";
-  return `${imports}
 
-export default createFlagServer((env) => ({
-  storage: ${storage.expr},
-  auth: {
-    admin: ${adminExpr2(config.auth.admin)},
-    read: apiKey(env.READ_API_KEY),
-  },${origins}${dashboard}
-}))
-`;
+// src/prompt.ts
+import { createInterface } from "readline/promises";
+async function readPassword(options) {
+  const input = options.input ?? process.stdin;
+  const output = options.output ?? process.stdout;
+  if (options.fromStdin) {
+    const chunks = [];
+    for await (const chunk of input) chunks.push(Buffer.from(chunk));
+    const password = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+    if (!password) throw new Error("--password-stdin was set but nothing was piped in.");
+    return password;
+  }
+  if (!input.isTTY) {
+    throw new Error(
+      "No terminal to ask for a password in. Run this in a terminal, or pipe the password in with --password-stdin."
+    );
+  }
+  const rl = createInterface({ input, output, terminal: true });
+  output.write("Password: ");
+  rl._writeToOutput = () => {
+  };
+  try {
+    return await rl.question("");
+  } finally {
+    rl.close();
+    output.write("\n");
+  }
 }
-var KV_NAMESPACE_PLACEHOLDER = "<your-kv-namespace-id>";
-function generateWranglerToml(config) {
-  const lines = [
-    `name = ${JSON.stringify(config.name)}`,
-    `main = "src/index.ts"`,
-    `compatibility_date = "2025-01-01"`
-  ];
-  if (config.storage === "cloudflare-kv") {
-    lines.push(
-      "",
-      `# Created for you by \`flaghoist deploy\`, or by: npx wrangler kv namespace create ${config.name}-FLAGS`,
-      "kv_namespaces = [",
-      `  { binding = "FLAGS", id = ${JSON.stringify(KV_NAMESPACE_PLACEHOLDER)} }`,
-      "]"
+
+// src/tokens.ts
+import {
+  createAdminClient as createAdminClient2,
+  createAuthClient,
+  isTwoFactorChallenge
+} from "@flaghoist/admin-client";
+var ROLES = ["viewer", "editor", "admin", "owner"];
+var TOKENS_USAGE = `  tokens list
+  tokens create <name> [--role <role>] [--expires-days N|never]
+  tokens revoke <id or name>`;
+function when(iso) {
+  return iso ? iso.slice(0, 10) : "never";
+}
+function parseExpiry(value) {
+  if (value === void 0) return void 0;
+  if (value === "never") return null;
+  const days = Number(value);
+  if (!Number.isInteger(days) || days < 1 || days > 3650) {
+    throw new Error('--expires-days must be a whole number from 1 to 3650, or "never".');
+  }
+  return days;
+}
+function findToken(tokens, ref) {
+  const byId = tokens.find((t) => t.id === ref);
+  if (byId) return byId;
+  const byName = tokens.filter((t) => t.name === ref);
+  if (byName.length === 1) return byName[0];
+  if (byName.length > 1) throw new Error(`More than one token is named "${ref}". Use its id.`);
+  throw new Error(`No token with the id or name "${ref}".`);
+}
+async function runTokens(client, positionals, options) {
+  const [sub, a] = positionals;
+  switch (sub) {
+    case "list": {
+      const tokens = await client.listTokens();
+      if (tokens.length === 0) return ["No access tokens."];
+      return tokens.map(
+        (t) => `${t.id}  ${t.name.padEnd(24)} ${t.role.padEnd(7)} ${t.prefix}...  expires ${when(
+          t.expiresAt
+        )}  last used ${when(t.lastUsedAt)}`
+      );
+    }
+    case "create": {
+      if (!a) throw new Error("Usage: flaghoist tokens create <name> [--role r] [--expires-days N]");
+      if (options.role && !ROLES.includes(options.role)) {
+        throw new Error(`Role must be one of ${ROLES.join(", ")}.`);
+      }
+      const { token, info } = await client.createToken({
+        name: a,
+        ...options.role ? { role: options.role } : {},
+        ...options.expiresDays !== void 0 ? { expiresInDays: parseExpiry(options.expiresDays) } : {}
+      });
+      return [
+        `Created "${info.name}" (${info.role}, expires ${when(info.expiresAt)}). Copy it now; it is not shown again:`,
+        token
+      ];
+    }
+    case "revoke": {
+      if (!a) throw new Error("Usage: flaghoist tokens revoke <id or name>");
+      const token = findToken(await client.listTokens(), a);
+      await client.revokeToken(token.id);
+      return [`Revoked "${token.name}".`];
+    }
+    default:
+      throw new Error(`Unknown tokens command: ${sub ?? "(none)"}. Try "flaghoist tokens list".`);
+  }
+}
+async function loginForToken(input) {
+  const auth = createAuthClient({ url: input.url, fetch: input.fetch });
+  const config = await auth.config();
+  if (!config.accounts) {
+    throw new Error(
+      "This server has no user accounts. Use its admin token with --token or FLAGS_ADMIN_TOKEN."
     );
   }
-  return `${lines.join("\n")}
-`;
+  const first = await auth.signIn(input.email, input.password);
+  let signedIn;
+  if (isTwoFactorChallenge(first)) {
+    if (!input.twoFactorCode) {
+      throw new Error("This account uses two-factor codes. Pass the current one with --code.");
+    }
+    signedIn = await auth.completeTwoFactor(first.challenge, await input.twoFactorCode());
+  } else {
+    signedIn = first;
+  }
+  const session = createAdminClient2({ url: input.url, token: signedIn.token, fetch: input.fetch });
+  try {
+    const { token, info } = await session.createToken({ name: input.tokenName });
+    return {
+      token,
+      tokenId: info.id,
+      email: signedIn.user.email,
+      role: info.role,
+      expiresAt: info.expiresAt
+    };
+  } finally {
+    await session.logout().catch(() => {
+    });
+  }
 }
-function needsKvNamespace(toml) {
-  return toml.includes(KV_NAMESPACE_PLACEHOLDER);
+
+// src/users.ts
+import { inviteLink } from "@flaghoist/admin-client";
+var ROLES2 = ["viewer", "editor", "admin", "owner"];
+var USERS_USAGE = `  users list
+  users invite <email> [--role viewer|editor|admin|owner]
+  users role <email> <role> [--env E]   With --env, the role in one environment; "default" clears it
+  users disable <email>
+  users enable <email>
+  users remove <email>
+  users reset <email>        Print a link that sets a new password (valid 24 hours)
+  users revoke <email>       Cancel an open invite`;
+async function memberByEmail(client, email) {
+  const wanted = email.trim().toLowerCase();
+  const member = (await client.listMembers()).find((m) => m.email === wanted);
+  if (!member) throw new Error(`No member with the email ${wanted}.`);
+  return member;
 }
-function fillKvNamespaceId(toml, id) {
-  return toml.replace(/^# Created for you by `flaghoist deploy`.*\n/m, "").replaceAll(KV_NAMESPACE_PLACEHOLDER, id);
+function requireRole(role) {
+  if (!role || !ROLES2.includes(role)) throw new Error(`Role must be one of ${ROLES2.join(", ")}.`);
+  return role;
 }
-function parseKvNamespaceId(output) {
-  const patterns = [
-    /\bid\s*=\s*"([0-9a-f]{32})"/i,
-    /"id"\s*:\s*"([0-9a-f]{32})"/i,
-    /\b([0-9a-f]{32})\b/i
-  ];
-  for (const re of patterns) {
-    const match = re.exec(output);
-    if (match) return match[1];
+function when2(iso) {
+  return iso ? iso.slice(0, 16).replace("T", " ") : "never";
+}
+async function runUsers(client, serverUrl, positionals, options) {
+  const [sub, a, b] = positionals;
+  const dashboard = `${serverUrl.replace(/\/+$/, "")}/admin/`;
+  switch (sub) {
+    case "list": {
+      const [members, invites] = await Promise.all([client.listMembers(), client.listInvites()]);
+      const lines = members.map(
+        (m) => `${m.email.padEnd(32)} ${m.role.padEnd(8)} ${m.status.padEnd(9)} last active ${when2(m.lastActiveAt)}`
+      );
+      for (const i of invites) {
+        lines.push(
+          `${i.email.padEnd(32)} ${i.role.padEnd(8)} invited   expires ${when2(i.expiresAt)}`
+        );
+      }
+      return lines.length > 0 ? lines : ["No members yet."];
+    }
+    case "invite": {
+      if (!a) throw new Error("Usage: flaghoist users invite <email> [--role viewer]");
+      const role = requireRole(options.role ?? "viewer");
+      const { token, invite, emailed } = await client.createInvite({
+        email: a,
+        role,
+        dashboardUrl: dashboard
+      });
+      return [
+        emailed ? `Invited ${invite.email} as ${invite.role} and emailed them the link (valid until ${when2(invite.expiresAt)}):` : `Invited ${invite.email} as ${invite.role}. Send them this link (valid until ${when2(invite.expiresAt)}):`,
+        inviteLink(dashboard, token)
+      ];
+    }
+    case "role": {
+      if (!a || !b) throw new Error("Usage: flaghoist users role <email> <role> [--env E]");
+      const member = await memberByEmail(client, a);
+      if (options.env) {
+        const clear = b === "default";
+        if (!clear && (!ROLES2.includes(b) || b === "owner")) {
+          throw new Error('An environment role must be viewer, editor or admin, or "default".');
+        }
+        const updated2 = await client.updateMember(member.id, {
+          environmentRoles: { ...member.environmentRoles, [options.env]: clear ? null : b }
+        });
+        const now = updated2.environmentRoles?.[options.env];
+        return [
+          now ? `${updated2.email} is ${now} in ${options.env}.` : `${updated2.email} has their main role (${updated2.role}) in ${options.env}.`
+        ];
+      }
+      const updated = await client.updateMember(member.id, { role: requireRole(b) });
+      return [`${updated.email} is now ${updated.role}.`];
+    }
+    case "disable":
+    case "enable": {
+      if (!a) throw new Error(`Usage: flaghoist users ${sub} <email>`);
+      const member = await memberByEmail(client, a);
+      const status = sub === "disable" ? "disabled" : "active";
+      await client.updateMember(member.id, { status });
+      return [`${member.email} is ${sub === "disable" ? "disabled and signed out" : "enabled"}.`];
+    }
+    case "remove": {
+      if (!a) throw new Error("Usage: flaghoist users remove <email>");
+      const member = await memberByEmail(client, a);
+      await client.removeMember(member.id);
+      return [`Removed ${member.email}.`];
+    }
+    case "reset": {
+      if (!a) throw new Error("Usage: flaghoist users reset <email>");
+      const member = await memberByEmail(client, a);
+      const { token, invite, emailed } = await client.createResetLink(member.id, {
+        dashboardUrl: dashboard
+      });
+      return [
+        emailed ? `Emailed ${member.email} a link to set a new password (valid until ${when2(invite.expiresAt)}):` : `Send ${member.email} this link to set a new password (valid until ${when2(invite.expiresAt)}):`,
+        inviteLink(dashboard, token)
+      ];
+    }
+    case "revoke": {
+      if (!a) throw new Error("Usage: flaghoist users revoke <email>");
+      const wanted = a.trim().toLowerCase();
+      const invite = (await client.listInvites()).find((i) => i.email === wanted);
+      if (!invite) throw new Error(`No open invite for ${wanted}.`);
+      await client.revokeInvite(invite.id);
+      return [`Cancelled the invite for ${wanted}.`];
+    }
+    default:
+      throw new Error(`Unknown users command: ${sub ?? "(none)"}. Try "flaghoist users list".`);
   }
-  return void 0;
 }
-function generatePackageJson(config) {
-  const storage = storageSnippet(config.storage);
-  const dependencies = {
-    "@flaghoist/server": "^0.1.0",
-    [storage.pkg]: "^0.1.0",
-    ...storage.extraDeps
-  };
-  const pkg = {
-    name: config.name,
-    version: "0.0.0",
-    private: true,
-    type: "module",
-    scripts: { dev: "wrangler dev", deploy: "wrangler deploy" },
-    dependencies,
-    devDependencies: { wrangler: "^4.0.0" }
-  };
-  return `${JSON.stringify(pkg, null, 2)}
-`;
+
+// src/worker-secrets.ts
+function requiredSecrets(config) {
+  if (!config.accounts?.enabled) return [];
+  return ["AUTH_PEPPER", ...config.accounts.sso ? ["SSO_CLIENT_SECRET"] : []];
+}
+function parseSecretNames(output) {
+  try {
+    const start = output.indexOf("[");
+    const parsed = JSON.parse(output.slice(start));
+    return new Set(parsed.map((s) => s.name).filter((n) => typeof n === "string"));
+  } catch {
+    return null;
+  }
+}
+function syncWorkerSecrets(config, env, run, log) {
+  const needed = requiredSecrets(config);
+  if (needed.length === 0) return { set: [], missing: [] };
+  const listed = run(["secret", "list"]);
+  const existing = listed.status === 0 ? parseSecretNames(listed.stdout) : null;
+  if (!existing) {
+    log("Could not list the Worker secrets, so none were changed. Set them yourself:");
+    for (const name of needed) log(`  npx wrangler secret put ${name}`);
+    return { set: [], missing: needed };
+  }
+  const set = [];
+  const missing = [];
+  for (const name of needed) {
+    if (existing.has(name)) continue;
+    const value = env[name];
+    if (!value) {
+      missing.push(name);
+      continue;
+    }
+    const result = run(["secret", "put", name], value);
+    if (result.status === 0) set.push(name);
+    else missing.push(name);
+  }
+  if (set.length > 0) log(`Set ${set.join(" and ")} on the Worker from .env.`);
+  for (const name of missing) {
+    log(
+      name === "AUTH_PEPPER" ? "AUTH_PEPPER is not set, so accounts cannot sign in yet. Set it with:" : `${name} is not set. Set it with:`
+    );
+    log(`  npx wrangler secret put ${name}`);
+  }
+  return { set, missing };
 }
 
 // src/version.ts
@@ -296,21 +664,110 @@ var VERSION = createRequire(import.meta.url)("../package.json").version;
 
 // src/index.ts
 function writeFileSafe(path, content) {
-  mkdirSync(dirname(path) || ".", { recursive: true });
-  writeFileSync(path, content);
+  mkdirSync2(dirname2(path) || ".", { recursive: true });
+  writeFileSync2(path, content);
 }
 function loadConfig() {
-  if (!existsSync("flaghoist.toml")) {
+  if (!existsSync2("flaghoist.toml")) {
     throw new Error("No flaghoist.toml found in this directory. Run `flaghoist init` first.");
   }
-  return parseConfig(readFileSync("flaghoist.toml", "utf8"));
+  return parseConfig(readFileSync2("flaghoist.toml", "utf8"));
+}
+function serverFrom(values) {
+  const url = values.url ?? process.env.FLAGS_URL;
+  if (url) return url;
+  const saved = savedServers(credentialsPath());
+  if (saved.length === 1) return saved[0];
+  throw new Error("Missing server URL. Pass --url or set FLAGS_URL.");
 }
 function clientFrom(values) {
+  const url = serverFrom(values);
+  const token = values.token ?? process.env.FLAGS_ADMIN_TOKEN ?? savedCredential(credentialsPath(), url)?.token;
+  if (!token) {
+    throw new Error(
+      "Not signed in. Run `flaghoist login`, or pass --token or set FLAGS_ADMIN_TOKEN."
+    );
+  }
+  return createAdminClient({ url, token });
+}
+async function runLogin(args) {
+  const { values } = parseArgs({
+    args,
+    options: {
+      url: { type: "string" },
+      email: { type: "string" },
+      "password-stdin": { type: "boolean" },
+      code: { type: "string" }
+    }
+  });
   const url = values.url ?? process.env.FLAGS_URL;
-  const token = values.token ?? process.env.FLAGS_ADMIN_TOKEN;
   if (!url) throw new Error("Missing server URL. Pass --url or set FLAGS_URL.");
-  if (!token) throw new Error("Missing admin token. Pass --token or set FLAGS_ADMIN_TOKEN.");
-  return createAdminClient({ url, token });
+  let email = values.email;
+  if (!email) {
+    if (!process.stdin.isTTY) throw new Error("Pass your email with --email.");
+    const rl = createInterface2({ input: process.stdin, output: process.stdout });
+    email = (await rl.question("Email: ")).trim();
+    rl.close();
+  }
+  const password = await readPassword({ fromStdin: values["password-stdin"] === true });
+  console.log(`Signing in to ${url} as ${email}...`);
+  const result = await loginForToken({
+    url,
+    email,
+    password,
+    tokenName: `flaghoist CLI on ${hostname()}`,
+    twoFactorCode: async () => {
+      if (values.code) return values.code;
+      if (!process.stdin.isTTY) {
+        throw new Error("This account uses two-factor codes. Pass the current one with --code.");
+      }
+      const rl = createInterface2({ input: process.stdin, output: process.stdout });
+      try {
+        return (await rl.question("Two-factor code (or a recovery code): ")).trim();
+      } finally {
+        rl.close();
+      }
+    }
+  });
+  const path = credentialsPath();
+  saveCredential(path, url, {
+    token: result.token,
+    tokenId: result.tokenId,
+    email: result.email,
+    savedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  console.log(
+    `Signed in to ${url} as ${result.email} (${result.role}). The access token expires ${result.expiresAt?.slice(0, 10) ?? "never"} and is saved in ${path}.`
+  );
+}
+async function runLogout(args) {
+  const { values } = parseArgs({ args, options: { url: { type: "string" } } });
+  const url = serverFrom(values);
+  const path = credentialsPath();
+  const saved = savedCredential(path, url);
+  if (!saved) return console.log(`Not signed in to ${url}.`);
+  const revoked = await createAdminClient({ url, token: saved.token }).logout().then(() => true).catch(() => false);
+  removeCredential(path, url);
+  console.log(
+    revoked ? `Signed out of ${url}. The access token is revoked.` : `Removed the saved token for ${url}. The server could not be reached to revoke it; revoke it from the dashboard's Account page.`
+  );
+}
+async function runTokensCommand(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      url: { type: "string" },
+      token: { type: "string" },
+      role: { type: "string" },
+      "expires-days": { type: "string" }
+    }
+  });
+  const lines = await runTokens(clientFrom(values), positionals, {
+    role: values.role,
+    expiresDays: values["expires-days"]
+  });
+  for (const line of lines) console.log(line);
 }
 function flagState(flag) {
   if (!flag.enabled) return "disabled";
@@ -381,7 +838,7 @@ async function runFlag(args) {
       if (a !== "set" || !b)
         throw new Error("Usage: flaghoist flag rules set <key> --file rules.json");
       if (!values.file) throw new Error("Missing --file <rules.json>");
-      const rules = JSON.parse(readFileSync(values.file, "utf8"));
+      const rules = JSON.parse(readFileSync2(values.file, "utf8"));
       if (!Array.isArray(rules)) throw new Error("Rules file must contain a JSON array");
       const flag = await setRules(clientFrom(values), b, rules);
       console.log(`Updated rules for "${b}"`);
@@ -391,32 +848,70 @@ async function runFlag(args) {
       throw new Error(`Unknown flag command: ${sub ?? "(none)"}. Try "flaghoist flag list".`);
   }
 }
-function runInit(args) {
+async function runUsersCommand(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      url: { type: "string" },
+      token: { type: "string" },
+      role: { type: "string" },
+      env: { type: "string" }
+    }
+  });
+  const client = clientFrom(values);
+  const url = serverFrom(values);
+  const options = { role: values.role, env: values.env };
+  for (const line of await runUsers(client, url, positionals, options)) {
+    console.log(line);
+  }
+}
+async function runInit(args) {
   const { values } = parseArgs({
     args,
     allowPositionals: true,
     options: {
       name: { type: "string" },
       storage: { type: "string" },
-      platform: { type: "string" }
+      platform: { type: "string" },
+      "no-accounts": { type: "boolean" },
+      "sso-issuer": { type: "string" },
+      "sso-client-id": { type: "string" },
+      "sso-admin-group": { type: "string" },
+      "no-dashboard": { type: "boolean" },
+      yes: { type: "boolean", short: "y" }
     }
   });
-  if (existsSync("flaghoist.toml")) throw new Error("flaghoist.toml already exists.");
+  if (existsSync2("flaghoist.toml")) throw new Error("flaghoist.toml already exists.");
   if (values.storage && !STORAGE_KINDS.includes(values.storage)) {
     throw new Error(`Unknown storage "${values.storage}". One of: ${STORAGE_KINDS.join(", ")}.`);
   }
   if (values.platform && !PLATFORM_KINDS.includes(values.platform)) {
     throw new Error(`Unknown platform "${values.platform}". One of: ${PLATFORM_KINDS.join(", ")}.`);
   }
-  const base = {
-    ...DEFAULT_CONFIG,
-    name: values.name ?? DEFAULT_CONFIG.name,
-    storage: values.storage ?? DEFAULT_CONFIG.storage
+  const preset = {
+    name: values.name,
+    storage: values.storage,
+    platform: values.platform,
+    ...values["no-accounts"] ? { accounts: false } : {},
+    ...values["no-dashboard"] ? { dashboard: false } : {},
+    ...values["sso-issuer"] ? { ssoIssuer: values["sso-issuer"] } : {},
+    ...values["sso-client-id"] ? { ssoClientId: values["sso-client-id"] } : {},
+    ...values["sso-admin-group"] ? { ssoAdminGroup: values["sso-admin-group"] } : {}
   };
-  const config = values.platform === "container" ? asContainer(base) : base;
-  writeFileSync("flaghoist.toml", serializeConfig(config));
-  console.log("Created flaghoist.toml");
-  console.log("Next: `flaghoist deploy` to ship it, or `flaghoist eject` to own the code.");
+  const interactive = process.stdin.isTTY === true && values.yes !== true;
+  const asker = interactive ? terminalAsker() : defaultsAsker();
+  let result;
+  try {
+    result = await collectSetup(asker, preset);
+  } finally {
+    if ("close" in asker) asker.close();
+  }
+  const { envPath } = writeSetup(".", result);
+  console.log("\nCreated flaghoist.toml");
+  const shown = interactive ? result : { ...result, pepperGenerated: false };
+  for (const line of setupSummary(shown, envPath !== void 0)) console.log(line);
+  console.log("\nNext: `flaghoist deploy` to ship it, or `flaghoist eject` to own the code.");
 }
 function entryFile(platform) {
   return platform === "container" ? "server.mjs" : "src/index.ts";
@@ -438,7 +933,7 @@ function projectFiles(config) {
 }
 function writeProject(config, dir) {
   const files = projectFiles(config);
-  const existing = files.map(([name]) => name).filter((name) => existsSync(join(dir, name)));
+  const existing = files.map(([name]) => name).filter((name) => existsSync2(join2(dir, name)));
   if (existing.length > 0) {
     throw new Error(
       `Refusing to overwrite ${existing.join(", ")} in this directory.
@@ -446,12 +941,12 @@ Flaghoist deploys as its own service, so give it a directory of its own:
   npm create flaghoist@latest team-flags`
     );
   }
-  for (const [name, contents] of files) writeFileSafe(join(dir, name), contents);
+  for (const [name, contents] of files) writeFileSafe(join2(dir, name), contents);
 }
 function runEject() {
   const config = loadConfig();
   const entry = entryFile(config.platform);
-  if (existsSync(entry)) throw new Error(`${entry} already exists. Already ejected?`);
+  if (existsSync2(entry)) throw new Error(`${entry} already exists. Already ejected?`);
   writeProject(config, ".");
   if (config.platform === "container") {
     console.log("Ejected to a code project you own: server.mjs, Dockerfile, package.json");
@@ -468,7 +963,7 @@ function runEject() {
 }
 function ensureKvNamespace(config) {
   if (config.storage !== "cloudflare-kv") return;
-  const toml = readFileSync("wrangler.toml", "utf8");
+  const toml = readFileSync2("wrangler.toml", "utf8");
   if (!needsKvNamespace(toml)) return;
   const title = `${config.name}-FLAGS`;
   console.log(`Creating the ${title} KV namespace...`);
@@ -489,11 +984,11 @@ function ensureKvNamespace(config) {
       "Created the namespace but could not read its id from wrangler output. Paste the id above into wrangler.toml, then run `flaghoist deploy` again."
     );
   }
-  writeFileSync("wrangler.toml", fillKvNamespaceId(toml, id));
+  writeFileSync2("wrangler.toml", fillKvNamespaceId(toml, id));
   console.log(`Bound FLAGS to namespace ${id} in wrangler.toml`);
 }
 function ensureDependencies() {
-  if (existsSync("node_modules")) return;
+  if (existsSync2("node_modules")) return;
   console.log("Installing dependencies...");
   const result = spawnSync("npm", ["install", "--no-audit", "--no-fund"], { stdio: "inherit" });
   if (result.status !== 0) {
@@ -511,7 +1006,7 @@ async function promptDeployTarget() {
   console.log("Where do you want to deploy?");
   console.log("  1) Cloudflare Workers   recommended, deploys in one command");
   console.log("  2) Another platform     Render, a container, any Node host");
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const answer = (await rl.question("Choose [1]: ")).trim().toLowerCase();
     return answer === "2" || answer.startsWith("o") || answer.startsWith("r") ? "other" : "cloudflare";
@@ -522,9 +1017,9 @@ async function promptDeployTarget() {
 function deployContainer(config) {
   const container = asContainer(config);
   if (config.platform !== container.platform || config.storage !== container.storage) {
-    writeFileSync("flaghoist.toml", serializeConfig(container));
+    writeFileSync2("flaghoist.toml", serializeConfig(container));
   }
-  if (!existsSync(entryFile("container"))) writeProject(container, ".");
+  if (!existsSync2(entryFile("container"))) writeProject(container, ".");
   console.log(`
 Scaffolded a container project: server.mjs, Dockerfile, package.json.
 
@@ -533,7 +1028,7 @@ DATABASE_URL, ADMIN_TOKEN, READ_API_KEY). Build and run it with Docker:
 
   docker build -t ${container.name} .
   docker run -p 8080:8080 -e ADMIN_TOKEN=... -e READ_API_KEY=... ${container.name}
-
+${accountsNote(container)}
 Or deploy it to a host:
   Render          https://docs.flaghoist.dev/deploy/render/
   Fly.io          https://docs.flaghoist.dev/deploy/fly/
@@ -542,12 +1037,42 @@ Or deploy it to a host:
 
 Missing a platform you need? Open an issue at https://github.com/flaghoist/flaghoist/issues.`);
 }
+function accountsNote(config) {
+  if (!config.accounts?.enabled) return "";
+  const names = config.accounts.sso ? "AUTH_PEPPER and SSO_CLIENT_SECRET" : "AUTH_PEPPER";
+  return `
+Accounts are on, so the server also needs ${names}. They are in .env (git-ignored):
+run locally with \`npm run dev\` or \`docker run --env-file .env ...\`, and add the same values
+to your host's secrets before you deploy. Keep AUTH_PEPPER the same for the life of the server:
+changing it signs everyone out and breaks every password.
+`;
+}
 async function deployCloudflare(config) {
-  if (!existsSync("src/index.ts")) writeProject(config, ".");
+  if (!existsSync2("src/index.ts")) writeProject(config, ".");
   ensureDependencies();
   ensureKvNamespace(config);
   console.log("Deploying with wrangler...");
   const result = spawnSync("npx", ["wrangler", "deploy"], { stdio: "inherit" });
+  if (result.status === 0) {
+    syncWorkerSecrets(
+      config,
+      readEnvFile(".env"),
+      (args, input) => {
+        const run = spawnSync("npx", ["wrangler", ...args], {
+          input,
+          encoding: "utf8",
+          stdio: ["pipe", "pipe", "inherit"]
+        });
+        return { status: run.status, stdout: run.stdout ?? "" };
+      },
+      (line) => console.log(line)
+    );
+    if (config.accounts?.enabled) {
+      console.log(
+        "Open /admin on your Worker and sign in with your ADMIN_TOKEN once to create the owner account."
+      );
+    }
+  }
   process.exit(result.status ?? 0);
 }
 async function runDeploy(args) {
@@ -566,24 +1091,43 @@ function printHelp() {
 Usage: flaghoist <command>
 
 Scaffolding
-  init [--name N] [--storage cloudflare-kv|redis|postgres|memory] [--platform cloudflare|container]
+  init [--name N] [--storage S] [--platform cloudflare|container] [--no-accounts]
+       [--sso-issuer URL --sso-client-id ID [--sso-admin-group G]] [--no-dashboard] [-y]
+                           Set up flaghoist.toml, asking what the flags leave open
   eject                    Generate a code project you own (a Worker, or a container)
   deploy [--target T]      Deploy (prompts for the platform; T is cloudflare or other)
 
-Flag management (needs --url/--token or FLAGS_URL/FLAGS_ADMIN_TOKEN)
+Signing in, on a server with user accounts
+  login [--url U] [--email E] [--password-stdin] [--code C]
+                               Sign in and save a personal access token for this server
+  logout [--url U]             Revoke that token and forget it
+${TOKENS_USAGE}
+
+Flag management (needs --url/--token or FLAGS_URL/FLAGS_ADMIN_TOKEN, or \`flaghoist login\`)
   flag list
   flag get <key>
   flag create <key> [--on] [--rollout N] [--desc "..."]
   flag toggle <key> [--on|--off]
   flag rollout <key> <percentage>
   flag rules set <key> --file rules.json
-  flag delete <key>`);
+  flag delete <key>
+
+Members, on a server with accounts on (same --url/--token; needs the admin role)
+${USERS_USAGE}`);
 }
 async function main() {
   const [command, ...rest] = process.argv.slice(2);
   switch (command) {
     case "flag":
       return runFlag(rest);
+    case "users":
+      return runUsersCommand(rest);
+    case "login":
+      return runLogin(rest);
+    case "logout":
+      return runLogout(rest);
+    case "tokens":
+      return runTokensCommand(rest);
     case "init":
       return runInit(rest);
     case "eject":