flaghoist 0.3.1 → 0.5.0

package/dist/lib.d.ts

@@ -1,3 +1,5 @@
+import { Readable, Writable } from 'node:stream';
+
 type StorageKind = 'cloudflare-kv' | 'redis' | 'postgres' | 'sqlite' | 'memory';
 type AdminAuthKind = 'bearer-token' | 'oidc';
 /**
@@ -7,6 +9,21 @@ type AdminAuthKind = 'bearer-token' | 'oidc';
  * this key existed still scaffolds a Worker.
  */
 type PlatformKind = 'cloudflare' | 'container';
+/** Single sign-on settings kept in `flaghoist.toml`. The client secret is never stored here. */
+interface SsoSettings {
+    issuer: string;
+    clientId: string;
+    /** Members of this identity-provider group become admins. Everyone else signs in as a viewer. */
+    adminGroup?: string;
+}
+/**
+ * User accounts. Only the choices live in `flaghoist.toml`; the secrets (`AUTH_PEPPER`, and
+ * `SSO_CLIENT_SECRET` with SSO) come from the environment, so the file stays safe to commit.
+ */
+interface AccountsSettings {
+    enabled: boolean;
+    sso?: SsoSettings;
+}
 interface FlaghoistConfig {
     name: string;
     storage: StorageKind;
@@ -19,6 +36,8 @@ interface FlaghoistConfig {
     allowedOrigins?: string[];
     /** Serve the admin dashboard at `/admin`. On by default. */
     dashboard: boolean;
+    /** Absent means off, so a config written before accounts existed behaves as it always did. */
+    accounts?: AccountsSettings;
 }
 declare const DEFAULT_CONFIG: FlaghoistConfig;
 /** Every storage backend selectable by name in `flaghoist.toml`. */
@@ -46,4 +65,70 @@ declare function parseConfig(text: string): FlaghoistConfig;
 /** Render a config back to `flaghoist.toml` text. */
 declare function serializeConfig(config: FlaghoistConfig): string;
 
-export { type AdminAuthKind, type ContainerStorage, DEFAULT_CONFIG, type FlaghoistConfig, PLATFORM_KINDS, type PlatformKind, STORAGE_KINDS, type StorageKind, asContainer, containerStorageDefault, parseConfig, serializeConfig };
+/**
+ * The interactive setup behind `npm create flaghoist` and `flaghoist init`. It asks for the choices
+ * that shape a project, and writes them to `flaghoist.toml`. Secrets (the accounts pepper and an SSO
+ * client secret) never go in that file: they go in a git-ignored `.env`, and `flaghoist deploy`
+ * hands them to Cloudflare as Worker secrets.
+ */
+/** Everything the wizard asks through, so tests can script the answers. */
+interface Asker {
+    text(question: string, fallback: string): Promise<string>;
+    choice<T extends string>(question: string, options: Choice<T>[], fallback: T): Promise<T>;
+    yesNo(question: string, fallback: boolean): Promise<boolean>;
+    secret(question: string): Promise<string>;
+    say(line: string): void;
+    /** False when nobody can answer, so a required value that is missing is an error, not a loop. */
+    interactive?: boolean;
+}
+interface Choice<T extends string> {
+    value: T;
+    label: string;
+    hint?: string;
+}
+/** Answers given up front on the command line. Each one skips its question. */
+interface SetupPreset {
+    name?: string;
+    platform?: PlatformKind;
+    storage?: StorageKind;
+    accounts?: boolean;
+    dashboard?: boolean;
+    sso?: boolean;
+    ssoIssuer?: string;
+    ssoClientId?: string;
+    ssoAdminGroup?: string;
+}
+interface SetupResult {
+    config: FlaghoistConfig;
+    /** Secrets for `.env`: never written to `flaghoist.toml`. */
+    secrets: Record<string, string>;
+    /** True when the pepper was generated here rather than pasted in. */
+    pepperGenerated: boolean;
+}
+declare const MIN_PEPPER_LENGTH = 32;
+/** The stores each platform can reach. Cloudflare KV only exists on Workers; SQLite needs a disk. */
+declare function storageChoices(platform: PlatformKind): Choice<StorageKind>[];
+declare function generatePepper(): string;
+/** Ask every question the preset does not already answer, and build the project from the answers. */
+declare function collectSetup(asker: Asker, preset?: SetupPreset): Promise<SetupResult>;
+/**
+ * Write `flaghoist.toml`, and when there are secrets, a `.env` holding them plus a `.gitignore` that
+ * keeps it out of git. An existing `.gitignore` gets `.env` appended rather than replaced.
+ */
+declare function writeSetup(dir: string, result: SetupResult): {
+    envPath?: string;
+};
+/** Read `KEY=value` lines from a `.env` file. Comments and blank lines are skipped. */
+declare function readEnvFile(path: string): Record<string, string>;
+/** What to tell the person at the end, including the pepper once if it was generated. */
+declare function setupSummary(result: SetupResult, envWritten: boolean): string[];
+/** Ask on a real terminal. Choices are numbered; Enter takes the default shown in brackets. */
+declare function terminalAsker(input?: Readable & {
+    isTTY?: boolean;
+}, output?: Writable): Asker & {
+    close(): void;
+};
+/** The asker used without a terminal: every question takes its default, and nothing is printed. */
+declare function defaultsAsker(): Asker;
+
+export { type AccountsSettings, type AdminAuthKind, type Asker, type Choice, type ContainerStorage, DEFAULT_CONFIG, type FlaghoistConfig, MIN_PEPPER_LENGTH, PLATFORM_KINDS, type PlatformKind, STORAGE_KINDS, type SetupPreset, type SetupResult, type SsoSettings, type StorageKind, asContainer, collectSetup, containerStorageDefault, defaultsAsker, generatePepper, parseConfig, readEnvFile, serializeConfig, setupSummary, storageChoices, terminalAsker, writeSetup };

package/dist/lib.js

@@ -1,18 +1,36 @@
 import {
   DEFAULT_CONFIG,
+  MIN_PEPPER_LENGTH,
   PLATFORM_KINDS,
   STORAGE_KINDS,
   asContainer,
+  collectSetup,
   containerStorageDefault,
+  defaultsAsker,
+  generatePepper,
   parseConfig,
-  serializeConfig
-} from "./chunk-HSDDPXCM.js";
+  readEnvFile,
+  serializeConfig,
+  setupSummary,
+  storageChoices,
+  terminalAsker,
+  writeSetup
+} from "./chunk-TQ5S6NOA.js";
 export {
   DEFAULT_CONFIG,
+  MIN_PEPPER_LENGTH,
   PLATFORM_KINDS,
   STORAGE_KINDS,
   asContainer,
+  collectSetup,
   containerStorageDefault,
+  defaultsAsker,
+  generatePepper,
   parseConfig,
-  serializeConfig
+  readEnvFile,
+  serializeConfig,
+  setupSummary,
+  storageChoices,
+  terminalAsker,
+  writeSetup
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flaghoist",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Scaffold, deploy, and manage your Flaghoist feature-flag service from the terminal.",
   "license": "Apache-2.0",
   "type": "module",
@@ -24,12 +24,12 @@
   },
   "dependencies": {
     "smol-toml": "^1.8.0",
-    "@flaghoist/admin-client": "0.2.0"
+    "@flaghoist/admin-client": "0.3.0"
   },
   "devDependencies": {
-    "@flaghoist/adapter-memory": "0.1.2",
-    "@flaghoist/core": "0.1.2",
-    "@flaghoist/server": "0.3.1"
+    "@flaghoist/core": "0.2.0",
+    "@flaghoist/server": "0.4.0",
+    "@flaghoist/adapter-memory": "0.2.0"
   },
   "publishConfig": {
     "access": "public"

package/dist/chunk-HSDDPXCM.js

@@ -1,67 +0,0 @@
-// src/config.ts
-import { parse } from "smol-toml";
-var DEFAULT_CONFIG = {
-  name: "team-flags",
-  storage: "cloudflare-kv",
-  platform: "cloudflare",
-  auth: { admin: "bearer-token", read: "api-key" },
-  dashboard: true
-};
-var STORAGE_KINDS = [
-  "cloudflare-kv",
-  "redis",
-  "postgres",
-  "sqlite",
-  "memory"
-];
-var PLATFORM_KINDS = ["cloudflare", "container"];
-function containerStorageDefault(storage) {
-  return storage === "cloudflare-kv" ? "postgres" : storage;
-}
-function asContainer(config) {
-  return { ...config, platform: "container", storage: containerStorageDefault(config.storage) };
-}
-function parseConfig(text) {
-  const raw = parse(text);
-  const name = typeof raw.name === "string" && raw.name ? raw.name : DEFAULT_CONFIG.name;
-  const storage = STORAGE_KINDS.includes(raw.storage) ? raw.storage : DEFAULT_CONFIG.storage;
-  const platform = raw.platform === "container" ? "container" : DEFAULT_CONFIG.platform;
-  const authRaw = typeof raw.auth === "object" && raw.auth !== null ? raw.auth : {};
-  const admin = authRaw.admin === "oidc" ? "oidc" : "bearer-token";
-  const allowedOrigins = Array.isArray(raw.allowedOrigins) ? raw.allowedOrigins.filter((x) => typeof x === "string") : void 0;
-  const dashboard = raw.dashboard !== false;
-  return { name, storage, platform, auth: { admin, read: "api-key" }, allowedOrigins, dashboard };
-}
-function serializeConfig(config) {
-  const lines = [
-    `name = ${JSON.stringify(config.name)}`,
-    `storage = ${JSON.stringify(config.storage)}`
-  ];
-  if (config.platform !== "cloudflare") {
-    lines.push(`platform = ${JSON.stringify(config.platform)}`);
-  }
-  if (config.allowedOrigins && config.allowedOrigins.length > 0) {
-    lines.push(`allowedOrigins = ${JSON.stringify(config.allowedOrigins)}`);
-  }
-  if (!config.dashboard) {
-    lines.push("dashboard = false");
-  }
-  lines.push(
-    "",
-    "[auth]",
-    `admin = ${JSON.stringify(config.auth.admin)}`,
-    `read = ${JSON.stringify(config.auth.read)}`
-  );
-  return `${lines.join("\n")}
-`;
-}
-
-export {
-  DEFAULT_CONFIG,
-  STORAGE_KINDS,
-  PLATFORM_KINDS,
-  containerStorageDefault,
-  asContainer,
-  parseConfig,
-  serializeConfig
-};