flaghoist 0.4.0 → 0.5.1

package/dist/chunk-LZB44MXJ.js

@@ -0,0 +1,396 @@
+// src/config.ts
+import { parse } from "smol-toml";
+var DEFAULT_CONFIG = {
+  name: "team-flags",
+  storage: "cloudflare-kv",
+  platform: "cloudflare",
+  auth: { admin: "bearer-token", read: "api-key" },
+  dashboard: true
+};
+var STORAGE_KINDS = [
+  "cloudflare-kv",
+  "redis",
+  "postgres",
+  "sqlite",
+  "memory"
+];
+var PLATFORM_KINDS = ["cloudflare", "container"];
+function containerStorageDefault(storage) {
+  return storage === "cloudflare-kv" ? "postgres" : storage;
+}
+function asContainer(config) {
+  return { ...config, platform: "container", storage: containerStorageDefault(config.storage) };
+}
+function parseConfig(text) {
+  const raw = parse(text);
+  const name = typeof raw.name === "string" && raw.name ? raw.name : DEFAULT_CONFIG.name;
+  const storage = STORAGE_KINDS.includes(raw.storage) ? raw.storage : DEFAULT_CONFIG.storage;
+  const platform = raw.platform === "container" ? "container" : DEFAULT_CONFIG.platform;
+  const authRaw = typeof raw.auth === "object" && raw.auth !== null ? raw.auth : {};
+  const admin = authRaw.admin === "oidc" ? "oidc" : "bearer-token";
+  const allowedOrigins = Array.isArray(raw.allowedOrigins) ? raw.allowedOrigins.filter((x) => typeof x === "string") : void 0;
+  const dashboard = raw.dashboard !== false;
+  const accounts = parseAccounts(raw.accounts);
+  return {
+    name,
+    storage,
+    platform,
+    auth: { admin, read: "api-key" },
+    allowedOrigins,
+    dashboard,
+    ...accounts ? { accounts } : {}
+  };
+}
+function parseAccounts(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const table = raw;
+  const enabled = table.enabled === true;
+  const ssoRaw = typeof table.sso === "object" && table.sso !== null ? table.sso : null;
+  const sso = ssoRaw && typeof ssoRaw.issuer === "string" && typeof ssoRaw.clientId === "string" ? {
+    issuer: ssoRaw.issuer,
+    clientId: ssoRaw.clientId,
+    ...typeof ssoRaw.adminGroup === "string" && ssoRaw.adminGroup ? { adminGroup: ssoRaw.adminGroup } : {}
+  } : void 0;
+  return { enabled, ...sso ? { sso } : {} };
+}
+function serializeConfig(config) {
+  const lines = [
+    `name = ${JSON.stringify(config.name)}`,
+    `storage = ${JSON.stringify(config.storage)}`
+  ];
+  if (config.platform !== "cloudflare") {
+    lines.push(`platform = ${JSON.stringify(config.platform)}`);
+  }
+  if (config.allowedOrigins && config.allowedOrigins.length > 0) {
+    lines.push(`allowedOrigins = ${JSON.stringify(config.allowedOrigins)}`);
+  }
+  if (!config.dashboard) {
+    lines.push("dashboard = false");
+  }
+  lines.push(
+    "",
+    "[auth]",
+    `admin = ${JSON.stringify(config.auth.admin)}`,
+    `read = ${JSON.stringify(config.auth.read)}`
+  );
+  if (config.accounts) {
+    lines.push(
+      "",
+      "# Accounts read AUTH_PEPPER from the environment. Never put it in this file.",
+      "[accounts]",
+      `enabled = ${config.accounts.enabled}`
+    );
+    const sso = config.accounts.sso;
+    if (sso) {
+      lines.push(
+        "",
+        "# The client secret comes from SSO_CLIENT_SECRET in the environment.",
+        "[accounts.sso]",
+        `issuer = ${JSON.stringify(sso.issuer)}`,
+        `clientId = ${JSON.stringify(sso.clientId)}`
+      );
+      if (sso.adminGroup) lines.push(`adminGroup = ${JSON.stringify(sso.adminGroup)}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+
+// src/setup.ts
+import { randomBytes } from "crypto";
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { createInterface } from "readline/promises";
+import { Writable } from "stream";
+var MIN_PEPPER_LENGTH = 32;
+var PLATFORMS = [
+  {
+    value: "cloudflare",
+    label: "Cloudflare Workers",
+    hint: "free plan, deploys in one command"
+  },
+  {
+    value: "container",
+    label: "Container, any host",
+    hint: "Render, Fly.io, Railway, a VPS, Kubernetes"
+  }
+];
+function storageChoices(platform) {
+  if (platform === "cloudflare") {
+    return [
+      { value: "cloudflare-kv", label: "Cloudflare KV", hint: "created for you on first deploy" },
+      { value: "redis", label: "Redis", hint: "Upstash, over HTTP" },
+      { value: "postgres", label: "Postgres", hint: "an HTTP-friendly host such as Neon" },
+      { value: "memory", label: "Memory", hint: "flags are lost on restart; for trying it out" }
+    ];
+  }
+  return [
+    { value: "postgres", label: "Postgres" },
+    { value: "redis", label: "Redis" },
+    { value: "sqlite", label: "SQLite", hint: "one file on a mounted volume" },
+    { value: "memory", label: "Memory", hint: "flags are lost on restart; for trying it out" }
+  ];
+}
+function generatePepper() {
+  return randomBytes(32).toString("hex");
+}
+var NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+function validName(name) {
+  return NAME_PATTERN.test(name);
+}
+async function collectSetup(asker, preset = {}) {
+  let name = preset.name ?? "";
+  while (!validName(name)) {
+    if (name)
+      asker.say("  Use lowercase letters, digits and hyphens, starting with a letter or digit.");
+    name = (await asker.text("Project name", DEFAULT_CONFIG.name)).trim().toLowerCase();
+  }
+  const platform = preset.platform ?? await asker.choice("Where will it run?", PLATFORMS, "cloudflare");
+  const choices = storageChoices(platform);
+  const presetStorage = preset.storage && platform === "container" ? containerStorageDefault(preset.storage) : preset.storage;
+  const storage = presetStorage && choices.some((c) => c.value === presetStorage) ? presetStorage : await asker.choice("Storage", choices, choices[0].value);
+  const accountsOn = preset.accounts ?? await asker.yesNo("Accounts and roles, so each person signs in as themselves?", true);
+  const secrets = {};
+  let pepperGenerated = false;
+  let sso;
+  if (accountsOn) {
+    asker.say("");
+    asker.say("  Accounts need an AUTH_PEPPER: a secret that protects stored passwords. With it, a");
+    asker.say("  stolen copy of your database reveals no password hashes an attacker can use.");
+    asker.say(
+      "  Losing it means everyone has to reset their password, so keep a copy somewhere safe."
+    );
+    const source = await asker.choice(
+      "AUTH_PEPPER",
+      [
+        { value: "generate", label: "Generate one for me", hint: "recommended" },
+        { value: "paste", label: "I have one, let me paste it" }
+      ],
+      "generate"
+    );
+    if (source === "paste") {
+      let pasted = "";
+      while (pasted.length < MIN_PEPPER_LENGTH) {
+        if (pasted) asker.say(`  It needs at least ${MIN_PEPPER_LENGTH} characters.`);
+        pasted = (await asker.secret("Paste your AUTH_PEPPER")).trim();
+      }
+      secrets.AUTH_PEPPER = pasted;
+    } else {
+      secrets.AUTH_PEPPER = generatePepper();
+      pepperGenerated = true;
+    }
+    const wantsSso = preset.sso ?? (preset.ssoIssuer !== void 0 || await asker.yesNo("Sign in with your company's identity provider (SSO)?", false));
+    if (wantsSso) {
+      const issuer = preset.ssoIssuer ?? await askUrl(asker, "Issuer URL (for example https://acme.okta.com)");
+      const clientId = preset.ssoClientId ?? await askRequired(asker, "Client ID");
+      const adminGroup = preset.ssoAdminGroup ?? (await asker.text("Group whose members become admins (blank for none)", "")).trim();
+      const clientSecret = (await asker.secret("Client secret (blank if your app is public, or to add it later)")).trim();
+      if (clientSecret) secrets.SSO_CLIENT_SECRET = clientSecret;
+      sso = { issuer, clientId, ...adminGroup ? { adminGroup } : {} };
+    }
+  }
+  const dashboard = preset.dashboard ?? await asker.yesNo("Serve the admin dashboard at /admin?", true);
+  const config = {
+    ...DEFAULT_CONFIG,
+    name,
+    platform,
+    storage,
+    dashboard,
+    ...accountsOn ? { accounts: { enabled: true, ...sso ? { sso } : {} } } : {}
+  };
+  return { config, secrets, pepperGenerated };
+}
+async function askRequired(asker, question) {
+  let answer = "";
+  while (!answer) {
+    answer = (await asker.text(question, "")).trim();
+    if (!answer && asker.interactive === false) {
+      throw new Error(
+        `SSO needs ${question.split(" (")[0].toLowerCase()}: pass --sso-issuer and --sso-client-id.`
+      );
+    }
+  }
+  return answer;
+}
+async function askUrl(asker, question) {
+  for (; ; ) {
+    const answer = await askRequired(asker, question);
+    try {
+      const url = new URL(answer);
+      if (url.protocol === "https:" || url.hostname === "localhost") return answer;
+    } catch {
+    }
+    if (asker.interactive === false) throw new Error(`--sso-issuer must be an https:// URL.`);
+    asker.say("  That needs to be an https:// URL.");
+  }
+}
+var GITIGNORE = [".env", ".dev.vars", "node_modules", ".wrangler", ""].join("\n");
+function writeSetup(dir, result) {
+  writeFileSync(join(dir, "flaghoist.toml"), serializeConfig(result.config));
+  if (Object.keys(result.secrets).length === 0) return {};
+  const envPath = join(dir, ".env");
+  const lines = [
+    "# Secrets for this Flaghoist project. Never commit this file.",
+    ...result.config.platform === "cloudflare" ? ["# `npx flaghoist deploy` sets these as secrets on your Worker."] : [
+      "# Pass them to your container host as environment variables, or run with --env-file .env."
+    ],
+    ...Object.entries(result.secrets).map(([key, value]) => `${key}=${value}`),
+    ""
+  ];
+  writeFileSync(envPath, lines.join("\n"), { mode: 384 });
+  const gitignorePath = join(dir, ".gitignore");
+  if (!existsSync(gitignorePath)) {
+    writeFileSync(gitignorePath, GITIGNORE);
+  } else {
+    const current = readFileSync(gitignorePath, "utf8");
+    if (!/^\.env$/m.test(current)) {
+      writeFileSync(gitignorePath, `${current.replace(/\n?$/, "\n")}.env
+`);
+    }
+  }
+  return { envPath };
+}
+function readEnvFile(path) {
+  if (!existsSync(path)) return {};
+  const out = {};
+  for (const line of readFileSync(path, "utf8").split(/\r?\n/)) {
+    const match = /^\s*([A-Z0-9_]+)\s*=\s*(.*)\s*$/i.exec(line);
+    if (match && !line.trim().startsWith("#"))
+      out[match[1]] = match[2].replace(/^["']|["']$/g, "");
+  }
+  return out;
+}
+function setupSummary(result, envWritten) {
+  const { config } = result;
+  const lines = [
+    "",
+    `  name       ${config.name}`,
+    `  platform   ${config.platform === "cloudflare" ? "Cloudflare Workers" : "container"}`,
+    `  storage    ${config.storage}`,
+    `  accounts   ${config.accounts?.enabled ? "on" : "off"}`,
+    `  sso        ${config.accounts?.sso ? config.accounts.sso.issuer : "off"}`,
+    `  dashboard  ${config.dashboard ? "on" : "off"}`
+  ];
+  if (result.pepperGenerated && result.secrets.AUTH_PEPPER) {
+    lines.push(
+      "",
+      "  Your AUTH_PEPPER (save it in your password manager now; it is not shown again):",
+      "",
+      `    ${result.secrets.AUTH_PEPPER}`
+    );
+  }
+  if (envWritten) {
+    lines.push(
+      "",
+      config.platform === "cloudflare" ? "  Secrets are in .env (git-ignored). `npx flaghoist deploy` sets them on your Worker." : "  Secrets are in .env (git-ignored). Add them to your host as environment variables too."
+    );
+  }
+  return lines;
+}
+function terminalAsker(input = process.stdin, output = process.stdout) {
+  let muted = false;
+  const echo = new Writable({
+    write(chunk, encoding, done) {
+      if (muted) done();
+      else output.write(chunk, encoding, done);
+    }
+  });
+  Object.defineProperty(echo, "columns", {
+    get: () => output.columns ?? 80
+  });
+  const rl = createInterface({ input, output: echo, terminal: true });
+  return {
+    interactive: true,
+    async text(question, fallback) {
+      const answer = (await rl.question(`  ${question}${fallback ? ` (${fallback})` : ""}: `)).trim();
+      return answer || fallback;
+    },
+    async choice(question, options, fallback) {
+      output.write(`
+  ${question}
+`);
+      options.forEach((o, i) => {
+        output.write(`    ${i + 1}) ${o.label}${o.hint ? `   ${o.hint}` : ""}
+`);
+      });
+      const defaultIndex = Math.max(
+        0,
+        options.findIndex((o) => o.value === fallback)
+      ) + 1;
+      for (; ; ) {
+        const answer = (await rl.question(`  Choose (${defaultIndex}): `)).trim();
+        if (!answer) return options[defaultIndex - 1].value;
+        const index = Number(answer);
+        if (Number.isInteger(index) && index >= 1 && index <= options.length) {
+          return options[index - 1].value;
+        }
+        output.write(`  Enter a number from 1 to ${options.length}.
+`);
+      }
+    },
+    async yesNo(question, fallback) {
+      for (; ; ) {
+        const answer = (await rl.question(`
+  ${question} (${fallback ? "Y/n" : "y/N"}): `)).trim().toLowerCase();
+        if (!answer) return fallback;
+        if (answer === "y" || answer === "yes") return true;
+        if (answer === "n" || answer === "no") return false;
+      }
+    },
+    async secret(question) {
+      output.write(`  ${question}: `);
+      muted = true;
+      try {
+        return await rl.question("");
+      } finally {
+        muted = false;
+        output.write("\n");
+      }
+    },
+    say(line) {
+      output.write(`${line}
+`);
+    },
+    close() {
+      rl.close();
+    }
+  };
+}
+function defaultsAsker() {
+  return {
+    interactive: false,
+    async text(_q, fallback) {
+      return fallback;
+    },
+    async choice(_q, _options, fallback) {
+      return fallback;
+    },
+    async yesNo(_q, fallback) {
+      return fallback;
+    },
+    async secret() {
+      return "";
+    },
+    say() {
+    }
+  };
+}
+
+export {
+  DEFAULT_CONFIG,
+  STORAGE_KINDS,
+  PLATFORM_KINDS,
+  containerStorageDefault,
+  asContainer,
+  parseConfig,
+  serializeConfig,
+  MIN_PEPPER_LENGTH,
+  storageChoices,
+  generatePepper,
+  collectSetup,
+  writeSetup,
+  readEnvFile,
+  setupSummary,
+  terminalAsker,
+  defaultsAsker
+};

package/dist/index.js

@@ -1,13 +1,18 @@
 #!/usr/bin/env node
 import {
-  DEFAULT_CONFIG,
   PLATFORM_KINDS,
   STORAGE_KINDS,
   asContainer,
+  collectSetup,
   containerStorageDefault,
+  defaultsAsker,
   parseConfig,
-  serializeConfig
-} from "./chunk-HSDDPXCM.js";
+  readEnvFile,
+  serializeConfig,
+  setupSummary,
+  terminalAsker,
+  writeSetup
+} from "./chunk-LZB44MXJ.js";
 
 // src/index.ts
 import { spawnSync } from "child_process";
@@ -26,20 +31,167 @@ import {
   toggleFlag
 } from "@flaghoist/admin-client";
 
+// src/generate.ts
+function storageSnippet(storage) {
+  switch (storage) {
+    case "cloudflare-kv":
+      return {
+        imports: [`import { cloudflareKV } from '@flaghoist/adapter-cloudflare-kv'`],
+        expr: "cloudflareKV(env.FLAGS)",
+        pkg: "@flaghoist/adapter-cloudflare-kv",
+        version: "^0.3.0"
+      };
+    case "redis":
+      return {
+        imports: [
+          `import { redisAdapter } from '@flaghoist/adapter-redis'`,
+          `import { Redis } from '@upstash/redis/cloudflare'`
+        ],
+        expr: "redisAdapter(Redis.fromEnv(env))",
+        pkg: "@flaghoist/adapter-redis",
+        version: "^0.2.0",
+        extraDeps: { "@upstash/redis": "^1.34.0" }
+      };
+    case "postgres":
+      return {
+        imports: [
+          `import { postgresAdapter } from '@flaghoist/adapter-postgres'`,
+          `import { Pool } from 'pg'`
+        ],
+        expr: "postgresAdapter(new Pool({ connectionString: env.DATABASE_URL }))",
+        pkg: "@flaghoist/adapter-postgres",
+        version: "^0.2.0",
+        extraDeps: { pg: "^8.13.0" }
+      };
+    case "memory":
+      return {
+        imports: [`import { memoryAdapter } from '@flaghoist/adapter-memory'`],
+        expr: "memoryAdapter()",
+        pkg: "@flaghoist/adapter-memory",
+        version: "^0.2.0"
+      };
+    case "sqlite":
+      throw new Error(
+        'SQLite storage requires a Node or container deployment. Use `npx flaghoist deploy` and pick "Another platform".'
+      );
+  }
+}
+function usersBlock(config) {
+  if (!config.accounts?.enabled) return "";
+  const sso = config.accounts.sso;
+  const ssoLines = sso ? [
+    "    sso: {",
+    `      issuer: ${JSON.stringify(sso.issuer)},`,
+    `      clientId: ${JSON.stringify(sso.clientId)},`,
+    "      clientSecret: env.SSO_CLIENT_SECRET,",
+    ...sso.adminGroup ? [`      roleMapping: { ${JSON.stringify(sso.adminGroup)}: 'admin' },`] : [],
+    "      // Everyone else who signs in through your provider starts as a viewer.",
+    "      defaultRole: 'viewer',",
+    "    },"
+  ] : [];
+  return ["", "  users: {", "    pepper: env.AUTH_PEPPER,", ...ssoLines, "  },"].join("\n");
+}
+function adminExpr(admin) {
+  return admin === "oidc" ? "oidc({ issuer: env.OIDC_ISSUER, audience: env.OIDC_AUDIENCE, groupsClaim: 'cognito:groups', allowedGroups: (env.ADMIN_GROUPS ?? '').split(',') })" : "bearerToken(env.ADMIN_TOKEN)";
+}
+function generateWorkerEntry(config) {
+  const storage = storageSnippet(config.storage);
+  const serverImports = [
+    "apiKey",
+    "createFlagServer",
+    config.auth.admin === "oidc" ? "oidc" : "bearerToken"
+  ].sort();
+  const imports = [
+    ...storage.imports,
+    `import { ${serverImports.join(", ")} } from '@flaghoist/server'`,
+    // A subpath import, so a Worker built with `dashboard = false` never pulls the HTML in.
+    ...config.dashboard ? [`import { dashboardHtml } from '@flaghoist/server/dashboard'`] : []
+  ].join("\n");
+  const origins = config.allowedOrigins && config.allowedOrigins.length > 0 ? `
+  allowedOrigins: ${JSON.stringify(config.allowedOrigins)},` : "";
+  const dashboard = config.dashboard ? "\n  dashboard: dashboardHtml," : "";
+  return `${imports}
+
+export default createFlagServer((env) => ({
+  storage: ${storage.expr},
+  auth: {
+    admin: ${adminExpr(config.auth.admin)},
+    read: apiKey(env.READ_API_KEY),
+  },${usersBlock(config)}${origins}${dashboard}
+}))
+`;
+}
+var KV_NAMESPACE_PLACEHOLDER = "<your-kv-namespace-id>";
+function generateWranglerToml(config) {
+  const lines = [
+    `name = ${JSON.stringify(config.name)}`,
+    `main = "src/index.ts"`,
+    `compatibility_date = "2025-01-01"`
+  ];
+  if (config.storage === "cloudflare-kv") {
+    lines.push(
+      "",
+      `# Created for you by \`flaghoist deploy\`, or by: npx wrangler kv namespace create ${config.name}-FLAGS`,
+      "kv_namespaces = [",
+      `  { binding = "FLAGS", id = ${JSON.stringify(KV_NAMESPACE_PLACEHOLDER)} }`,
+      "]"
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function needsKvNamespace(toml) {
+  return toml.includes(KV_NAMESPACE_PLACEHOLDER);
+}
+function fillKvNamespaceId(toml, id) {
+  return toml.replace(/^# Created for you by `flaghoist deploy`.*\n/m, "").replaceAll(KV_NAMESPACE_PLACEHOLDER, id);
+}
+function parseKvNamespaceId(output) {
+  const patterns = [
+    /\bid\s*=\s*"([0-9a-f]{32})"/i,
+    /"id"\s*:\s*"([0-9a-f]{32})"/i,
+    /\b([0-9a-f]{32})\b/i
+  ];
+  for (const re of patterns) {
+    const match = re.exec(output);
+    if (match) return match[1];
+  }
+  return void 0;
+}
+function generatePackageJson(config) {
+  const storage = storageSnippet(config.storage);
+  const dependencies = {
+    "@flaghoist/server": "^0.4.0",
+    [storage.pkg]: storage.version,
+    ...storage.extraDeps
+  };
+  const pkg = {
+    name: config.name,
+    version: "0.0.0",
+    private: true,
+    type: "module",
+    scripts: { dev: "wrangler dev", deploy: "wrangler deploy" },
+    dependencies,
+    devDependencies: { wrangler: "^4.0.0" }
+  };
+  return `${JSON.stringify(pkg, null, 2)}
+`;
+}
+
 // src/generate-container.ts
 var CONTAINER_DEPS = {
-  "@flaghoist/adapter-memory": "^0.1.2",
-  "@flaghoist/adapter-postgres": "^0.1.2",
-  "@flaghoist/adapter-redis": "^0.1.2",
-  "@flaghoist/adapter-sqlite": "^0.1.0",
-  "@flaghoist/server": "^0.3.0",
+  "@flaghoist/adapter-memory": "^0.2.0",
+  "@flaghoist/adapter-postgres": "^0.2.0",
+  "@flaghoist/adapter-redis": "^0.2.0",
+  "@flaghoist/adapter-sqlite": "^0.3.0",
+  "@flaghoist/server": "^0.4.0",
   "@hono/node-server": "^2.1.1",
   "better-sqlite3": "^11.0.0",
   ioredis: "^5.4.0",
   pg: "^8.13.0"
 };
 var CONTAINER_PORT = 8080;
-function adminExpr(admin) {
+function adminExpr2(admin) {
   return admin === "oidc" ? "oidc({ issuer: env.OIDC_ISSUER, audience: env.OIDC_AUDIENCE, groupsClaim: 'cognito:groups', allowedGroups: (env.ADMIN_GROUPS ?? '').split(',') })" : "bearerToken(env.ADMIN_TOKEN)";
 }
 function generateNodeEntry(config) {
@@ -106,9 +258,9 @@ async function makeStorage() {
 const app = createFlagServer({
   storage: await makeStorage(),${dashboard}
   auth: {
-    admin: ${adminExpr(config.auth.admin)},
+    admin: ${adminExpr2(config.auth.admin)},
     read: apiKey(env.READ_API_KEY),
-  },
+  },${usersBlock(config)}
   rateLimit: memoryRateLimit(),
   // Comma-separated list of browser origins allowed to read flags cross-origin.
   allowedOrigins: env.FLAGS_CORS ? env.FLAGS_CORS.split(',').map((o) => o.trim()) : ${origins},
@@ -151,144 +303,26 @@ function generateContainerPackageJson(config) {
     version: "0.0.0",
     private: true,
     type: "module",
-    scripts: { start: "node server.mjs" },
+    scripts: {
+      start: "node server.mjs",
+      // Loads AUTH_PEPPER and the other secrets from .env for a local run. Needs Node 20.6 or later.
+      dev: "node --env-file=.env server.mjs"
+    },
     dependencies: CONTAINER_DEPS
   };
   return `${JSON.stringify(pkg, null, 2)}
 `;
 }
 function generateDockerignore() {
-  return ["node_modules", "npm-debug.log", "Dockerfile", ".dockerignore", "README.md", ""].join(
-    "\n"
-  );
-}
-
-// src/generate.ts
-function storageSnippet(storage) {
-  switch (storage) {
-    case "cloudflare-kv":
-      return {
-        imports: [`import { cloudflareKV } from '@flaghoist/adapter-cloudflare-kv'`],
-        expr: "cloudflareKV(env.FLAGS)",
-        pkg: "@flaghoist/adapter-cloudflare-kv"
-      };
-    case "redis":
-      return {
-        imports: [
-          `import { redisAdapter } from '@flaghoist/adapter-redis'`,
-          `import { Redis } from '@upstash/redis/cloudflare'`
-        ],
-        expr: "redisAdapter(Redis.fromEnv(env))",
-        pkg: "@flaghoist/adapter-redis",
-        extraDeps: { "@upstash/redis": "^1.34.0" }
-      };
-    case "postgres":
-      return {
-        imports: [
-          `import { postgresAdapter } from '@flaghoist/adapter-postgres'`,
-          `import { Pool } from 'pg'`
-        ],
-        expr: "postgresAdapter(new Pool({ connectionString: env.DATABASE_URL }))",
-        pkg: "@flaghoist/adapter-postgres",
-        extraDeps: { pg: "^8.13.0" }
-      };
-    case "memory":
-      return {
-        imports: [`import { memoryAdapter } from '@flaghoist/adapter-memory'`],
-        expr: "memoryAdapter()",
-        pkg: "@flaghoist/adapter-memory"
-      };
-    case "sqlite":
-      throw new Error(
-        'SQLite storage requires a Node or container deployment. Use `npx flaghoist deploy` and pick "Another platform".'
-      );
-  }
-}
-function adminExpr2(admin) {
-  return admin === "oidc" ? "oidc({ issuer: env.OIDC_ISSUER, audience: env.OIDC_AUDIENCE, groupsClaim: 'cognito:groups', allowedGroups: (env.ADMIN_GROUPS ?? '').split(',') })" : "bearerToken(env.ADMIN_TOKEN)";
-}
-function generateWorkerEntry(config) {
-  const storage = storageSnippet(config.storage);
-  const serverImports = [
-    "apiKey",
-    "createFlagServer",
-    config.auth.admin === "oidc" ? "oidc" : "bearerToken"
-  ].sort();
-  const imports = [
-    ...storage.imports,
-    `import { ${serverImports.join(", ")} } from '@flaghoist/server'`,
-    // A subpath import, so a Worker built with `dashboard = false` never pulls the HTML in.
-    ...config.dashboard ? [`import { dashboardHtml } from '@flaghoist/server/dashboard'`] : []
+  return [
+    "node_modules",
+    "npm-debug.log",
+    "Dockerfile",
+    ".dockerignore",
+    "README.md",
+    ".env",
+    ""
   ].join("\n");
-  const origins = config.allowedOrigins && config.allowedOrigins.length > 0 ? `
-  allowedOrigins: ${JSON.stringify(config.allowedOrigins)},` : "";
-  const dashboard = config.dashboard ? "\n  dashboard: dashboardHtml," : "";
-  return `${imports}
-
-export default createFlagServer((env) => ({
-  storage: ${storage.expr},
-  auth: {
-    admin: ${adminExpr2(config.auth.admin)},
-    read: apiKey(env.READ_API_KEY),
-  },${origins}${dashboard}
-}))
-`;
-}
-var KV_NAMESPACE_PLACEHOLDER = "<your-kv-namespace-id>";
-function generateWranglerToml(config) {
-  const lines = [
-    `name = ${JSON.stringify(config.name)}`,
-    `main = "src/index.ts"`,
-    `compatibility_date = "2025-01-01"`
-  ];
-  if (config.storage === "cloudflare-kv") {
-    lines.push(
-      "",
-      `# Created for you by \`flaghoist deploy\`, or by: npx wrangler kv namespace create ${config.name}-FLAGS`,
-      "kv_namespaces = [",
-      `  { binding = "FLAGS", id = ${JSON.stringify(KV_NAMESPACE_PLACEHOLDER)} }`,
-      "]"
-    );
-  }
-  return `${lines.join("\n")}
-`;
-}
-function needsKvNamespace(toml) {
-  return toml.includes(KV_NAMESPACE_PLACEHOLDER);
-}
-function fillKvNamespaceId(toml, id) {
-  return toml.replace(/^# Created for you by `flaghoist deploy`.*\n/m, "").replaceAll(KV_NAMESPACE_PLACEHOLDER, id);
-}
-function parseKvNamespaceId(output) {
-  const patterns = [
-    /\bid\s*=\s*"([0-9a-f]{32})"/i,
-    /"id"\s*:\s*"([0-9a-f]{32})"/i,
-    /\b([0-9a-f]{32})\b/i
-  ];
-  for (const re of patterns) {
-    const match = re.exec(output);
-    if (match) return match[1];
-  }
-  return void 0;
-}
-function generatePackageJson(config) {
-  const storage = storageSnippet(config.storage);
-  const dependencies = {
-    "@flaghoist/server": "^0.1.0",
-    [storage.pkg]: "^0.1.0",
-    ...storage.extraDeps
-  };
-  const pkg = {
-    name: config.name,
-    version: "0.0.0",
-    private: true,
-    type: "module",
-    scripts: { dev: "wrangler dev", deploy: "wrangler deploy" },
-    dependencies,
-    devDependencies: { wrangler: "^4.0.0" }
-  };
-  return `${JSON.stringify(pkg, null, 2)}
-`;
 }
 
 // src/credentials.ts
@@ -577,6 +611,53 @@ async function runUsers(client, serverUrl, positionals, options) {
   }
 }
 
+// src/worker-secrets.ts
+function requiredSecrets(config) {
+  if (!config.accounts?.enabled) return [];
+  return ["AUTH_PEPPER", ...config.accounts.sso ? ["SSO_CLIENT_SECRET"] : []];
+}
+function parseSecretNames(output) {
+  try {
+    const start = output.indexOf("[");
+    const parsed = JSON.parse(output.slice(start));
+    return new Set(parsed.map((s) => s.name).filter((n) => typeof n === "string"));
+  } catch {
+    return null;
+  }
+}
+function syncWorkerSecrets(config, env, run, log) {
+  const needed = requiredSecrets(config);
+  if (needed.length === 0) return { set: [], missing: [] };
+  const listed = run(["secret", "list"]);
+  const existing = listed.status === 0 ? parseSecretNames(listed.stdout) : null;
+  if (!existing) {
+    log("Could not list the Worker secrets, so none were changed. Set them yourself:");
+    for (const name of needed) log(`  npx wrangler secret put ${name}`);
+    return { set: [], missing: needed };
+  }
+  const set = [];
+  const missing = [];
+  for (const name of needed) {
+    if (existing.has(name)) continue;
+    const value = env[name];
+    if (!value) {
+      missing.push(name);
+      continue;
+    }
+    const result = run(["secret", "put", name], value);
+    if (result.status === 0) set.push(name);
+    else missing.push(name);
+  }
+  if (set.length > 0) log(`Set ${set.join(" and ")} on the Worker from .env.`);
+  for (const name of missing) {
+    log(
+      name === "AUTH_PEPPER" ? "AUTH_PEPPER is not set, so accounts cannot sign in yet. Set it with:" : `${name} is not set. Set it with:`
+    );
+    log(`  npx wrangler secret put ${name}`);
+  }
+  return { set, missing };
+}
+
 // src/version.ts
 import { createRequire } from "module";
 var VERSION = createRequire(import.meta.url)("../package.json").version;
@@ -785,14 +866,20 @@ async function runUsersCommand(args) {
     console.log(line);
   }
 }
-function runInit(args) {
+async function runInit(args) {
   const { values } = parseArgs({
     args,
     allowPositionals: true,
     options: {
       name: { type: "string" },
       storage: { type: "string" },
-      platform: { type: "string" }
+      platform: { type: "string" },
+      "no-accounts": { type: "boolean" },
+      "sso-issuer": { type: "string" },
+      "sso-client-id": { type: "string" },
+      "sso-admin-group": { type: "string" },
+      "no-dashboard": { type: "boolean" },
+      yes: { type: "boolean", short: "y" }
     }
   });
   if (existsSync2("flaghoist.toml")) throw new Error("flaghoist.toml already exists.");
@@ -802,15 +889,29 @@ function runInit(args) {
   if (values.platform && !PLATFORM_KINDS.includes(values.platform)) {
     throw new Error(`Unknown platform "${values.platform}". One of: ${PLATFORM_KINDS.join(", ")}.`);
   }
-  const base = {
-    ...DEFAULT_CONFIG,
-    name: values.name ?? DEFAULT_CONFIG.name,
-    storage: values.storage ?? DEFAULT_CONFIG.storage
+  const preset = {
+    name: values.name,
+    storage: values.storage,
+    platform: values.platform,
+    ...values["no-accounts"] ? { accounts: false } : {},
+    ...values["no-dashboard"] ? { dashboard: false } : {},
+    ...values["sso-issuer"] ? { ssoIssuer: values["sso-issuer"] } : {},
+    ...values["sso-client-id"] ? { ssoClientId: values["sso-client-id"] } : {},
+    ...values["sso-admin-group"] ? { ssoAdminGroup: values["sso-admin-group"] } : {}
   };
-  const config = values.platform === "container" ? asContainer(base) : base;
-  writeFileSync2("flaghoist.toml", serializeConfig(config));
-  console.log("Created flaghoist.toml");
-  console.log("Next: `flaghoist deploy` to ship it, or `flaghoist eject` to own the code.");
+  const interactive = process.stdin.isTTY === true && values.yes !== true;
+  const asker = interactive ? terminalAsker() : defaultsAsker();
+  let result;
+  try {
+    result = await collectSetup(asker, preset);
+  } finally {
+    if ("close" in asker) asker.close();
+  }
+  const { envPath } = writeSetup(".", result);
+  console.log("\nCreated flaghoist.toml");
+  const shown = interactive ? result : { ...result, pepperGenerated: false };
+  for (const line of setupSummary(shown, envPath !== void 0)) console.log(line);
+  console.log("\nNext: `flaghoist deploy` to ship it, or `flaghoist eject` to own the code.");
 }
 function entryFile(platform) {
   return platform === "container" ? "server.mjs" : "src/index.ts";
@@ -927,7 +1028,7 @@ DATABASE_URL, ADMIN_TOKEN, READ_API_KEY). Build and run it with Docker:
 
   docker build -t ${container.name} .
   docker run -p 8080:8080 -e ADMIN_TOKEN=... -e READ_API_KEY=... ${container.name}
-
+${accountsNote(container)}
 Or deploy it to a host:
   Render          https://docs.flaghoist.dev/deploy/render/
   Fly.io          https://docs.flaghoist.dev/deploy/fly/
@@ -936,12 +1037,42 @@ Or deploy it to a host:
 
 Missing a platform you need? Open an issue at https://github.com/flaghoist/flaghoist/issues.`);
 }
+function accountsNote(config) {
+  if (!config.accounts?.enabled) return "";
+  const names = config.accounts.sso ? "AUTH_PEPPER and SSO_CLIENT_SECRET" : "AUTH_PEPPER";
+  return `
+Accounts are on, so the server also needs ${names}. They are in .env (git-ignored):
+run locally with \`npm run dev\` or \`docker run --env-file .env ...\`, and add the same values
+to your host's secrets before you deploy. Keep AUTH_PEPPER the same for the life of the server:
+changing it signs everyone out and breaks every password.
+`;
+}
 async function deployCloudflare(config) {
   if (!existsSync2("src/index.ts")) writeProject(config, ".");
   ensureDependencies();
   ensureKvNamespace(config);
   console.log("Deploying with wrangler...");
   const result = spawnSync("npx", ["wrangler", "deploy"], { stdio: "inherit" });
+  if (result.status === 0) {
+    syncWorkerSecrets(
+      config,
+      readEnvFile(".env"),
+      (args, input) => {
+        const run = spawnSync("npx", ["wrangler", ...args], {
+          input,
+          encoding: "utf8",
+          stdio: ["pipe", "pipe", "inherit"]
+        });
+        return { status: run.status, stdout: run.stdout ?? "" };
+      },
+      (line) => console.log(line)
+    );
+    if (config.accounts?.enabled) {
+      console.log(
+        "Open /admin on your Worker and sign in with your ADMIN_TOKEN once to create the owner account."
+      );
+    }
+  }
   process.exit(result.status ?? 0);
 }
 async function runDeploy(args) {
@@ -960,7 +1091,9 @@ function printHelp() {
 Usage: flaghoist <command>
 
 Scaffolding
-  init [--name N] [--storage cloudflare-kv|redis|postgres|memory] [--platform cloudflare|container]
+  init [--name N] [--storage S] [--platform cloudflare|container] [--no-accounts]
+       [--sso-issuer URL --sso-client-id ID [--sso-admin-group G]] [--no-dashboard] [-y]
+                           Set up flaghoist.toml, asking what the flags leave open
   eject                    Generate a code project you own (a Worker, or a container)
   deploy [--target T]      Deploy (prompts for the platform; T is cloudflare or other)
 

package/dist/lib.d.ts

@@ -1,3 +1,5 @@
+import { Readable, Writable } from 'node:stream';
+
 type StorageKind = 'cloudflare-kv' | 'redis' | 'postgres' | 'sqlite' | 'memory';
 type AdminAuthKind = 'bearer-token' | 'oidc';
 /**
@@ -7,6 +9,21 @@ type AdminAuthKind = 'bearer-token' | 'oidc';
  * this key existed still scaffolds a Worker.
  */
 type PlatformKind = 'cloudflare' | 'container';
+/** Single sign-on settings kept in `flaghoist.toml`. The client secret is never stored here. */
+interface SsoSettings {
+    issuer: string;
+    clientId: string;
+    /** Members of this identity-provider group become admins. Everyone else signs in as a viewer. */
+    adminGroup?: string;
+}
+/**
+ * User accounts. Only the choices live in `flaghoist.toml`; the secrets (`AUTH_PEPPER`, and
+ * `SSO_CLIENT_SECRET` with SSO) come from the environment, so the file stays safe to commit.
+ */
+interface AccountsSettings {
+    enabled: boolean;
+    sso?: SsoSettings;
+}
 interface FlaghoistConfig {
     name: string;
     storage: StorageKind;
@@ -19,6 +36,8 @@ interface FlaghoistConfig {
     allowedOrigins?: string[];
     /** Serve the admin dashboard at `/admin`. On by default. */
     dashboard: boolean;
+    /** Absent means off, so a config written before accounts existed behaves as it always did. */
+    accounts?: AccountsSettings;
 }
 declare const DEFAULT_CONFIG: FlaghoistConfig;
 /** Every storage backend selectable by name in `flaghoist.toml`. */
@@ -46,4 +65,70 @@ declare function parseConfig(text: string): FlaghoistConfig;
 /** Render a config back to `flaghoist.toml` text. */
 declare function serializeConfig(config: FlaghoistConfig): string;
 
-export { type AdminAuthKind, type ContainerStorage, DEFAULT_CONFIG, type FlaghoistConfig, PLATFORM_KINDS, type PlatformKind, STORAGE_KINDS, type StorageKind, asContainer, containerStorageDefault, parseConfig, serializeConfig };
+/**
+ * The interactive setup behind `npm create flaghoist` and `flaghoist init`. It asks for the choices
+ * that shape a project, and writes them to `flaghoist.toml`. Secrets (the accounts pepper and an SSO
+ * client secret) never go in that file: they go in a git-ignored `.env`, and `flaghoist deploy`
+ * hands them to Cloudflare as Worker secrets.
+ */
+/** Everything the wizard asks through, so tests can script the answers. */
+interface Asker {
+    text(question: string, fallback: string): Promise<string>;
+    choice<T extends string>(question: string, options: Choice<T>[], fallback: T): Promise<T>;
+    yesNo(question: string, fallback: boolean): Promise<boolean>;
+    secret(question: string): Promise<string>;
+    say(line: string): void;
+    /** False when nobody can answer, so a required value that is missing is an error, not a loop. */
+    interactive?: boolean;
+}
+interface Choice<T extends string> {
+    value: T;
+    label: string;
+    hint?: string;
+}
+/** Answers given up front on the command line. Each one skips its question. */
+interface SetupPreset {
+    name?: string;
+    platform?: PlatformKind;
+    storage?: StorageKind;
+    accounts?: boolean;
+    dashboard?: boolean;
+    sso?: boolean;
+    ssoIssuer?: string;
+    ssoClientId?: string;
+    ssoAdminGroup?: string;
+}
+interface SetupResult {
+    config: FlaghoistConfig;
+    /** Secrets for `.env`: never written to `flaghoist.toml`. */
+    secrets: Record<string, string>;
+    /** True when the pepper was generated here rather than pasted in. */
+    pepperGenerated: boolean;
+}
+declare const MIN_PEPPER_LENGTH = 32;
+/** The stores each platform can reach. Cloudflare KV only exists on Workers; SQLite needs a disk. */
+declare function storageChoices(platform: PlatformKind): Choice<StorageKind>[];
+declare function generatePepper(): string;
+/** Ask every question the preset does not already answer, and build the project from the answers. */
+declare function collectSetup(asker: Asker, preset?: SetupPreset): Promise<SetupResult>;
+/**
+ * Write `flaghoist.toml`, and when there are secrets, a `.env` holding them plus a `.gitignore` that
+ * keeps it out of git. An existing `.gitignore` gets `.env` appended rather than replaced.
+ */
+declare function writeSetup(dir: string, result: SetupResult): {
+    envPath?: string;
+};
+/** Read `KEY=value` lines from a `.env` file. Comments and blank lines are skipped. */
+declare function readEnvFile(path: string): Record<string, string>;
+/** What to tell the person at the end, including the pepper once if it was generated. */
+declare function setupSummary(result: SetupResult, envWritten: boolean): string[];
+/** Ask on a real terminal. Choices are numbered; Enter takes the default shown in brackets. */
+declare function terminalAsker(input?: Readable & {
+    isTTY?: boolean;
+}, output?: Writable): Asker & {
+    close(): void;
+};
+/** The asker used without a terminal: every question takes its default, and nothing is printed. */
+declare function defaultsAsker(): Asker;
+
+export { type AccountsSettings, type AdminAuthKind, type Asker, type Choice, type ContainerStorage, DEFAULT_CONFIG, type FlaghoistConfig, MIN_PEPPER_LENGTH, PLATFORM_KINDS, type PlatformKind, STORAGE_KINDS, type SetupPreset, type SetupResult, type SsoSettings, type StorageKind, asContainer, collectSetup, containerStorageDefault, defaultsAsker, generatePepper, parseConfig, readEnvFile, serializeConfig, setupSummary, storageChoices, terminalAsker, writeSetup };

package/dist/lib.js

@@ -1,18 +1,36 @@
 import {
   DEFAULT_CONFIG,
+  MIN_PEPPER_LENGTH,
   PLATFORM_KINDS,
   STORAGE_KINDS,
   asContainer,
+  collectSetup,
   containerStorageDefault,
+  defaultsAsker,
+  generatePepper,
   parseConfig,
-  serializeConfig
-} from "./chunk-HSDDPXCM.js";
+  readEnvFile,
+  serializeConfig,
+  setupSummary,
+  storageChoices,
+  terminalAsker,
+  writeSetup
+} from "./chunk-LZB44MXJ.js";
 export {
   DEFAULT_CONFIG,
+  MIN_PEPPER_LENGTH,
   PLATFORM_KINDS,
   STORAGE_KINDS,
   asContainer,
+  collectSetup,
   containerStorageDefault,
+  defaultsAsker,
+  generatePepper,
   parseConfig,
-  serializeConfig
+  readEnvFile,
+  serializeConfig,
+  setupSummary,
+  storageChoices,
+  terminalAsker,
+  writeSetup
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flaghoist",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Scaffold, deploy, and manage your Flaghoist feature-flag service from the terminal.",
   "license": "Apache-2.0",
   "type": "module",
@@ -27,9 +27,9 @@
     "@flaghoist/admin-client": "0.3.0"
   },
   "devDependencies": {
+    "@flaghoist/server": "0.4.0",
     "@flaghoist/adapter-memory": "0.2.0",
-    "@flaghoist/core": "0.2.0",
-    "@flaghoist/server": "0.4.0"
+    "@flaghoist/core": "0.2.0"
   },
   "publishConfig": {
     "access": "public"

package/dist/chunk-HSDDPXCM.js

@@ -1,67 +0,0 @@
-// src/config.ts
-import { parse } from "smol-toml";
-var DEFAULT_CONFIG = {
-  name: "team-flags",
-  storage: "cloudflare-kv",
-  platform: "cloudflare",
-  auth: { admin: "bearer-token", read: "api-key" },
-  dashboard: true
-};
-var STORAGE_KINDS = [
-  "cloudflare-kv",
-  "redis",
-  "postgres",
-  "sqlite",
-  "memory"
-];
-var PLATFORM_KINDS = ["cloudflare", "container"];
-function containerStorageDefault(storage) {
-  return storage === "cloudflare-kv" ? "postgres" : storage;
-}
-function asContainer(config) {
-  return { ...config, platform: "container", storage: containerStorageDefault(config.storage) };
-}
-function parseConfig(text) {
-  const raw = parse(text);
-  const name = typeof raw.name === "string" && raw.name ? raw.name : DEFAULT_CONFIG.name;
-  const storage = STORAGE_KINDS.includes(raw.storage) ? raw.storage : DEFAULT_CONFIG.storage;
-  const platform = raw.platform === "container" ? "container" : DEFAULT_CONFIG.platform;
-  const authRaw = typeof raw.auth === "object" && raw.auth !== null ? raw.auth : {};
-  const admin = authRaw.admin === "oidc" ? "oidc" : "bearer-token";
-  const allowedOrigins = Array.isArray(raw.allowedOrigins) ? raw.allowedOrigins.filter((x) => typeof x === "string") : void 0;
-  const dashboard = raw.dashboard !== false;
-  return { name, storage, platform, auth: { admin, read: "api-key" }, allowedOrigins, dashboard };
-}
-function serializeConfig(config) {
-  const lines = [
-    `name = ${JSON.stringify(config.name)}`,
-    `storage = ${JSON.stringify(config.storage)}`
-  ];
-  if (config.platform !== "cloudflare") {
-    lines.push(`platform = ${JSON.stringify(config.platform)}`);
-  }
-  if (config.allowedOrigins && config.allowedOrigins.length > 0) {
-    lines.push(`allowedOrigins = ${JSON.stringify(config.allowedOrigins)}`);
-  }
-  if (!config.dashboard) {
-    lines.push("dashboard = false");
-  }
-  lines.push(
-    "",
-    "[auth]",
-    `admin = ${JSON.stringify(config.auth.admin)}`,
-    `read = ${JSON.stringify(config.auth.read)}`
-  );
-  return `${lines.join("\n")}
-`;
-}
-
-export {
-  DEFAULT_CONFIG,
-  STORAGE_KINDS,
-  PLATFORM_KINDS,
-  containerStorageDefault,
-  asContainer,
-  parseConfig,
-  serializeConfig
-};