Client parity follow-ups (re-target to main): unify client, TODOs, tests, CI, versions (#87)

* fix: Restore client parity with server (#75, #76, #77)

- fix(vscode #75): escape nested template literals in endpointTesterPanel
  so the webview HTML literal no longer desyncs the parser; build @flapi/shared
  automatically (shared prepare + extension prebuild) so EndpointConfig types
  resolve. Extension builds and typechecks again (broken since 2025-11-02).
- feat(cli #76): add commands for server capabilities that had no CLI surface:
  health, config env, config filesystem, endpoints parameters,
  cache audit [path], cache gc.
- fix(cli #77): FlapiApiClient.testEndpoint targets the real /template/test
  route instead of the non-existent /test (would 404).
- docs: add CLIENT_PARITY_AUDIT.md documenting findings and resolution.

* refactor: Unify extension on shared API client; cleanup; version align (#81, #83, #85)

- refactor(vscode #83): delete the extension's duplicate FlapiApiClient and
  point extension.ts + yamlValidator at @flapi/shared's client; add slug-based
  validateEndpointConfig/reloadEndpointConfig and X-Config-Token to setToken.
  Fixes the local client's broken base-URL (it read non-existent flapi.host/port).
- fix(vscode #81): remove dead 'Variables provider' editor-change handler.
- chore(#85): align cli, @flapi/shared, and the extension to 26.6.13.

* feat(vscode): resolve {{include}} directives and add endpoint picker (#79, #80)

- feat(#80): add a pure extendedYaml resolver that inlines
  {{include:<section> from <file>}} directives from sibling workspace files;
  CodeLens now uses it instead of stripping includes and parsing blindly.
- feat(#79): when multiple endpoints reference one SQL template, show a
  QuickPick selector instead of silently using the first.

* test+ci: Add VSCode extension test suite and a clients CI gate (#82, #84)

- test(vscode #84): set up Vitest and cover the pure logic — extended-YAML
  include resolution and endpoint-pick label building (12 tests).
- ci(#82): add .github/workflows/clients.yaml that builds @flapi/shared, builds
  and tests the CLI, and typechecks/builds/tests the extension on every PR that
  touches cli/. This would have caught #75.

* chore: Sync cli + shared lockfiles to 26.6.13 (#85)

Keeps package-lock.json in step with the version bump so 'npm ci' (used by the
new clients CI gate) doesn't fail on a version mismatch.

Author: jrosskopf

.github/workflows/clients.yaml

@@ -0,0 +1,63 @@
+name: Clients (CLI + VSCode)
+
+# Compile/test gate for the TypeScript packages under cli/. This exists so a broken
+# build (like the extension being uncompilable for months) is caught on every PR.
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'cli/**'
+      - '.github/workflows/clients.yaml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'cli/**'
+      - '.github/workflows/clients.yaml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  shared:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Build @flapi/shared
+        working-directory: cli/shared
+        run: |
+          npm ci
+          npm run build
+
+  cli:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Build & test flapii CLI
+        working-directory: cli
+        run: |
+          npm ci
+          npm run build
+          npm test
+
+  vscode-extension:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Build, typecheck & test the VSCode extension
+        working-directory: cli/vscode-extension
+        run: |
+          npm ci
+          npm run typecheck
+          npm run build
+          npm test

cli/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "flapii",
-  "version": "0.1.0",
+  "version": "26.6.13",
   "description": "CLI client for flapi ConfigService",
   "license": "MIT",
   "type": "module",

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flapi/shared",
-  "version": "0.1.0",
+  "version": "26.6.13",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

cli/shared/package-lock.json

@@ -1,6 +1,7 @@
 import axios from 'axios';
 import type { AxiosInstance, AxiosRequestConfig, InternalAxiosRequestConfig } from 'axios';
 import { pathToSlug, slugToPath } from './lib/url';
+import type { ValidationResult, ReloadResult } from './lib/types';
 
 /**
  * Configuration options for FlapiApiClient
@@ -188,8 +189,14 @@ export class FlapiApiClient {
   /**
    * Update authentication token
    */
-  setToken(token: string) {
-    this.client.defaults.headers.common['Authorization'] = `Bearer ${token}`;
+  setToken(token: string | undefined) {
+    if (token) {
+      this.client.defaults.headers.common['Authorization'] = `Bearer ${token}`;
+      this.client.defaults.headers.common['X-Config-Token'] = token;
+    } else {
+      delete this.client.defaults.headers.common['Authorization'];
+      delete this.client.defaults.headers.common['X-Config-Token'];
+    }
     if (this.debug) {
       console.log('[FlapiAPI] Token updated');
     }
@@ -347,6 +354,41 @@ export class FlapiApiClient {
     const response = await this.client.get('/api/v1/_config/endpoints');
     return response.data;
   }
+
+  /**
+   * Validate raw endpoint YAML for an already-encoded endpoint slug.
+   * A 400 (invalid config) is returned as a normalized result rather than thrown.
+   */
+  async validateEndpointConfig(slug: string, yamlContent: string): Promise<ValidationResult> {
+    const response = await this.client.post(
+      `/api/v1/_config/endpoints/${encodeURIComponent(slug)}/validate`,
+      yamlContent,
+      {
+        headers: { 'Content-Type': 'application/x-yaml' },
+        validateStatus: (status) => status < 500,
+      },
+    );
+    const result = response.data ?? {};
+    return {
+      valid: result.valid ?? false,
+      errors: result.errors ?? [],
+      warnings: result.warnings ?? [],
+    };
+  }
+
+  /**
+   * Reload an endpoint configuration from disk by already-encoded slug.
+   */
+  async reloadEndpointConfig(slug: string): Promise<ReloadResult> {
+    const response = await this.client.post(
+      `/api/v1/_config/endpoints/${encodeURIComponent(slug)}/reload`,
+    );
+    const result = response.data ?? {};
+    return {
+      success: result.success ?? false,
+      message: result.message ?? '',
+    };
+  }
 }
 
 /**