@samebase/alchemy-convex 0.25.0 → 0.26.0

package/README.md

@@ -320,7 +320,12 @@ call.
   numeric GitHub id of the repository, `{ "repository": "123" }`, which
   `gh api repos/<owner>/<name> --jq .id` prints. The hub reads it before it registers the client, so
   the site must be live first. Outputs `status`, `issuer`, `clientId`, `clientSecret`,
-  `registrationAccessToken`, `registrationClientUri`, `deploymentType`, and `redirectUri`.
+  `registrationAccessToken`, `registrationClientUri`, `deploymentType`, `redirectUri`,
+  `initialAccessToken`, and `repository`.
+  - A production registration also gets the app's initial access token (RFC 7591) and the numeric
+    repository id, which the state keeps. The token registers development clients of the app on a
+    laptop: see `hub-client --shared` below. A renewal keeps both. They are empty for a preview and
+    for the off values.
   - Each deploy reads the saved client on the hub with its own token. A client that is gone gets a
     new one, and a client on another `redirectUri` too.
   - A new client logs the link to the terms of the shared sign-in service. A refusal logs its
@@ -350,6 +355,25 @@ For a separate API-connection callback, register another client with
 `RESOURCE_HUB_CLIENT_ID`, and `RESOURCE_HUB_CLIENT_SECRET`, preserving the sign-in client's
 variables. Each callback remains one exact registered URI.
 
+An app on the central identity hub gets its laptop client with `--shared`. Run it after the first
+push of each dev start, with `CONVEX_ACCESS_TOKEN` or the Convex CLI login of the app's team.
+
+```sh
+npx alchemy-convex hub-client --shared --stack owner/name --app app --callback-path /auth/hub/callback
+```
+
+The team is `--team`, else `CONVEX_TEAM_ID`, else the team of the cloud development deployment that
+`.env.local` selects. A linked git worktree reads the `.env.local` of the main checkout. The command
+renews the client that `HUB_REGISTRATION_URI` and `HUB_REGISTRATION_TOKEN` name, only when
+`HUB_ISSUER` is the hub that it asks (`HUB_URL`, else `https://auth.samebase.com`), the client ID
+and the secret are not `no-hub`, and the hub answers exactly the current callback. Else, it reads
+the initial access token from the `HubClient` row of stage `prod` of the stack, and asks the hub for
+a development client on the deployment's `CONVEX_SITE_URL`. It writes `HUB_ISSUER`, `HUB_CLIENT_ID`,
+`HUB_CLIENT_SECRET`, `HUB_REGISTRATION_URI`, and `HUB_REGISTRATION_TOKEN` in one `env set --force`,
+and `SAMEBASE_REPOSITORY_ID` on an https site. A client that the hub stopped gets the off values.
+Without a token, after a refusal, or after a failure, it prints one line, and the variables stay. It
+never stops a dev start.
+
 ## Pull request comment
 
 `alchemy-convex stack-comment` keeps one comment on a pull request. The comment has a card for each

package/lib/{HubClient-Bs5_j18U.js → SharedHubClient-D-FJJUCZ.js}

@@ -29,7 +29,8 @@ import * as Stream from "effect/Stream";
 import { fileURLToPath } from "node:url";
 import * as Scope from "effect/Scope";
 import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveState } from "alchemy/State";
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
+import * as Cause from "effect/Cause";
 //#region src/Credentials.ts
 var Credentials = class extends Context.Service()("@samebase/alchemy-convex/Credentials") {};
 /** Environment variable for the access token, read by {@link fromConfig}. */
@@ -1575,7 +1576,7 @@ const post = (url, headers, body) => Effect.tryPromise({
 	schedule: Schedule.exponential("100 millis").pipe(Schedule.jittered),
 	times: 5
 }));
-const decode = (schema, what) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => failure(`bad ${what}`)));
+const decode$1 = (schema, what) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => failure(`bad ${what}`)));
 /** The reply of `state:sealing`. */
 const Sealing = Schema.Struct({
 	current: Schema.NullOr(Schema.String),
@@ -1587,7 +1588,7 @@ const makeFunctionApi = (url, key) => ({ call: (path, args) => post(`${url}/api/
 	path,
 	args,
 	format: "json"
-}).pipe(Effect.flatMap(decode(Reply, `reply of ${path}`))) });
+}).pipe(Effect.flatMap(decode$1(Reply, `reply of ${path}`))) });
 /** The value of a reply, or the Convex message, which names the function and the cause, such as a missing key action. */
 const valueOf = (reply) => reply.status === "success" ? Effect.succeed(reply.value) : Effect.fail(failure(reply.errorMessage.trim()));
 /** The functions of the store with Alchemy's encoding: the JSON text of encodeState. */
@@ -1603,8 +1604,8 @@ const remoteOf = (api, record) => {
 			run: currentRun
 		});
 	});
-	const strings = (name, args) => run(name, args).pipe(Effect.flatMap(decode(Schema.Array(Schema.String), name)));
-	const optional = (name, args) => run(name, args).pipe(Effect.flatMap(decode(Schema.NullOr(Schema.String), name)));
+	const strings = (name, args) => run(name, args).pipe(Effect.flatMap(decode$1(Schema.Array(Schema.String), name)));
+	const optional = (name, args) => run(name, args).pipe(Effect.flatMap(decode$1(Schema.NullOr(Schema.String), name)));
 	const encode = (value) => JSON.stringify(encodeState(value));
 	return {
 		listStacks: () => strings("stacks", {}),
@@ -1649,7 +1650,7 @@ const remoteOf = (api, record) => {
 	};
 };
 /** The version that the store answers, or undefined when the deployment has no `state:version`. */
-const storeVersion = (api) => api.call("state:version", {}).pipe(Effect.flatMap((reply) => reply.status === "error" && MISSING_FUNCTION.test(reply.errorMessage) ? Effect.succeed(void 0) : valueOf(reply).pipe(Effect.flatMap(decode(Schema.Number, "store version")))));
+const storeVersion = (api) => api.call("state:version", {}).pipe(Effect.flatMap((reply) => reply.status === "error" && MISSING_FUNCTION.test(reply.errorMessage) ? Effect.succeed(void 0) : valueOf(reply).pipe(Effect.flatMap(decode$1(Schema.Number, "store version")))));
 /**
 * The functions directory of the store app, `src/store/convex` of this
 * package. This file is `src/State.ts` in a checkout and a chunk in `lib/`
@@ -1694,7 +1695,7 @@ const pushStore = (options, deployment) => Effect.gen(function* () {
 * it never reads a key back.
 */
 const ensureSealed = (options, deployment, functions) => Effect.gen(function* () {
-	const { current, sealed } = yield* functions.call("state:sealing", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode(Sealing, "state:sealing")));
+	const { current, sealed } = yield* functions.call("state:sealing", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode$1(Sealing, "state:sealing")));
 	if (current === null) {
 		const keyId = newKeyId();
 		yield* withPushKey(options.api, deployment.name, PUSH_KEY_ACTIONS, (key) => writeVariables(deployment.deploymentUrl, key, [{
@@ -1704,7 +1705,7 @@ const ensureSealed = (options, deployment, functions) => Effect.gen(function* ()
 		yield* functions.call("state:chooseKey", { keyId }).pipe(Effect.flatMap(valueOf));
 	}
 	if (sealed) return;
-	const { failed } = yield* functions.call("state:reseal", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode(Resealed, "state:reseal")));
+	const { failed } = yield* functions.call("state:reseal", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode$1(Resealed, "state:reseal")));
 	if (failed.length > 0) yield* Effect.logWarning(`Convex state: the store could not seal ${failed.join(", ")}. The next run tries again.`);
 });
 /**
@@ -1987,6 +1988,398 @@ const registerDevelopmentClient = (options) => Effect.gen(function* () {
 	return callbackUrl;
 });
 //#endregion
-export { PushTargetMismatch as A, DEPLOY_KEY_ENV as B, DeploymentProvider as C, ConvexAppNotFound as D, CodePushFailed as E, ManagementApi as F, fromValues as H, ManagementApiLive as I, ACCESS_TOKEN_ENV as L, installedCli as M, parseDeployOutput as N, ConvexCliNotFound as O, ConvexApiError as P, Credentials as R, DeploymentIdentityChange as S, ProductionDeploymentNotFound as T, fromConfig as V, ProjectProvider as _, registerDevelopmentClient as a, AmbiguousDeployment as b, RUN_RECORD_KEY as c, withRunRecord as d, AmbiguousProject as f, ProjectNotFound as g, ProjectDeploymentChange as h, HubClientProvider as i, VariablesOwnedBySomeoneElse as j, EnvironmentNeedsDeployKey as k, RunRecordError as l, Project as m, HubClient as n, STORE_PROJECT_NAME as o, CreatedProjectNotFound as p, HubClientFailed as r, state as s, HUB_PROJECT_NAME as t, runRecord as u, ProjectTeamChange as v, DeploymentResource as w, Deployment as x, AbsoluteRootDir as y, CredentialsError as z };
+//#region src/SharedHubClient.ts
+/** A hung service must not hold a deploy: the time limit of one request. */
+const REQUEST_TIMEOUT_MS = 3e4;
+/** The variables of a deployment without a hub client, as the starter writes them. */
+const OFF_VALUES = {
+	issuer: "http://127.0.0.1:1",
+	clientId: "no-hub",
+	clientSecret: "no-hub"
+};
+/** The hub that a run asks, which is also its issuer. */
+const hubUrl = () => process.env["HUB_URL"] ?? "https://auth.samebase.com";
+/** Where a run asks for a new client. */
+const hubClientsUrl = () => `${hubUrl()}/hub-clients`;
+const SharedHubClient = Resource("IdentityHub.SharedClient");
+/** One request gave no usable answer. The reason holds no secret. */
+var SharedHubClientFailed = class extends Schema.TaggedError()("SharedHubClientFailed", { reason: Schema.String }) {};
+const OidcToken = Schema.Struct({ value: Schema.NonEmptyString });
+/** The 201 answer of `POST /hub-clients`. */
+const NewClient = Schema.Struct({
+	issuer: Schema.NonEmptyString,
+	client_id: Schema.NonEmptyString,
+	client_secret: Schema.NonEmptyString,
+	registration_access_token: Schema.NonEmptyString,
+	registration_client_uri: Schema.NonEmptyString,
+	redirect_uri: Schema.NonEmptyString,
+	/** The terms of the shared sign-in service, which the log shows once, for the new client. */
+	terms: Schema.NonEmptyString,
+	/** Only in the answer to a production registration with the GitHub token. */
+	initial_access_token: Schema.optionalKey(Schema.NonEmptyString),
+	repository: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^\d+$/)))
+});
+/** The other answers of `POST /hub-clients`, by status. */
+const REFUSALS = {
+	400: "the identity hub refused the request: the return address must be https on a DNS name, and the app name at most 64 characters",
+	401: "the identity hub refused the GitHub OIDC token",
+	403: "the identity hub does not allow this repository or return address",
+	404: "the identity hub has no /hub-clients",
+	429: "the identity hub limits new clients",
+	502: "GitHub's keys are not available to the identity hub"
+};
+/** The reasons of a 403 that a log line shows. Any other text of the answer is never logged. */
+const NOT_ALLOWED = /* @__PURE__ */ new Map([
+	["paused", "the identity hub pauses new clients of third-party apps"],
+	["run_not_allowed", "the identity hub gives clients only to runs of main and of pull requests"],
+	["blocked", "Samebase blocked this repository or its owner"],
+	["suspended", "the identity hub suspended this repository"],
+	["too_many_apps", "the repository has as many apps on the identity hub as it may"],
+	["too_many_clients", "the app has as many clients on the identity hub as it may"],
+	["app_taken", "the app's name belongs to another app on the identity hub"],
+	["host_unreachable", "the identity hub could not reach the host of the return address"],
+	["verification_file_missing", "the host of the return address does not serve /samebase-verification.json"],
+	["verification_file_invalid", "/samebase-verification.json on the host holds no repository id"],
+	["repository_mismatch", "/samebase-verification.json on the host names another repository"],
+	["app_mismatch", "the initial access token belongs to another app on the identity hub"]
+]);
+/** The windows of a 429, by the name that the answer gives. */
+const RATE_LIMITED = /* @__PURE__ */ new Map([
+	["repository", "the identity hub gives one repository at most 30 new clients an hour"],
+	["owner", "the identity hub gives one owner at most 100 new clients an hour"],
+	["new_owners", "the identity hub takes at most 50 new owners an hour"]
+]);
+const Refusal = Schema.Struct({ reason: Schema.String });
+const RateLimited = Schema.Struct({ window: Schema.String });
+/** The text of a refusal: a known reason of a 403 or window of a 429, else the text of its status. */
+const refusalOf = (status, body) => {
+	return (status === 403 ? NOT_ALLOWED.get(Option.getOrUndefined(Schema.decodeUnknownOption(Refusal)(body))?.reason ?? "") : status === 429 ? RATE_LIMITED.get(Option.getOrUndefined(Schema.decodeUnknownOption(RateLimited)(body))?.window ?? "") : void 0) ?? REFUSALS[status] ?? "the identity hub refused the request";
+};
+const send = (who, url, token, init) => Effect.tryPromise({
+	try: async () => {
+		const response = await fetch(url, {
+			...init,
+			headers: {
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json"
+			},
+			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+		});
+		const body = await response.json().catch(() => void 0);
+		return {
+			status: response.status,
+			body
+		};
+	},
+	catch: () => new SharedHubClientFailed({ reason: `${who} gave no answer` })
+});
+const decode = (schema, who) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => new SharedHubClientFailed({ reason: `${who} gave a bad answer` })));
+/** The OIDC token of this run, read right before the call, because it lives for minutes only. */
+const readOidcToken = (requestUrl, requestToken) => Effect.gen(function* () {
+	const { body, status } = yield* send("GitHub", `${requestUrl}&audience=samebase`, requestToken, { method: "GET" });
+	if (status !== 200) return yield* new SharedHubClientFailed({ reason: `GitHub gave no OIDC token (HTTP ${status})` });
+	return (yield* decode(OidcToken, "GitHub")(body)).value;
+});
+const requestNewClient = (props, requestUrl, requestToken) => Effect.gen(function* () {
+	const token = yield* readOidcToken(requestUrl, requestToken);
+	const { body, status } = yield* send("The identity hub", hubClientsUrl(), token, {
+		method: "POST",
+		body: JSON.stringify({
+			app: props.app,
+			redirectUri: props.redirectUri,
+			softwareVersion: props.softwareVersion ?? "unknown"
+		})
+	});
+	if (status !== 201) return yield* new SharedHubClientFailed({ reason: `${refusalOf(status, body)} (HTTP ${status})` });
+	const client = yield* decode(NewClient, "The identity hub")(body);
+	yield* Effect.logInfo(`Convex.SharedHubClient: ${props.app} on ${client.redirect_uri} has a new client of the identity hub. Its use is under ${client.terms}.`);
+	return {
+		status: "on",
+		issuer: client.issuer,
+		clientId: client.client_id,
+		clientSecret: Redacted.make(client.client_secret),
+		registrationAccessToken: Redacted.make(client.registration_access_token),
+		registrationClientUri: client.registration_client_uri,
+		deploymentType: props.deploymentType,
+		redirectUri: client.redirect_uri,
+		initialAccessToken: Redacted.make(client.initial_access_token ?? ""),
+		repository: client.repository ?? ""
+	};
+});
+/** A new client, or `saved`, or the off values. `saved` holds no off values. */
+const newClient = (props) => {
+	const label = `Convex.SharedHubClient: ${props.app} on ${props.redirectUri} deploys without the hub`;
+	const off = {
+		status: "off",
+		issuer: OFF_VALUES.issuer,
+		clientId: OFF_VALUES.clientId,
+		clientSecret: Redacted.make(OFF_VALUES.clientSecret),
+		registrationAccessToken: Redacted.make(""),
+		registrationClientUri: "",
+		deploymentType: props.deploymentType,
+		redirectUri: "",
+		initialAccessToken: Redacted.make(""),
+		repository: ""
+	};
+	const requestUrl = process.env["ACTIONS_ID_TOKEN_REQUEST_URL"];
+	const requestToken = process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+	if (!requestUrl || !requestToken) return (process.env["GITHUB_ACTIONS"] === "true" ? Effect.logWarning(`${label}: this workflow needs the permission id-token: write.`) : Effect.logInfo(`${label}: this run has no GitHub OIDC token.`)).pipe(Effect.as(off));
+	return requestNewClient(props, requestUrl, requestToken).pipe(Effect.catchTag("SharedHubClientFailed", (error) => Effect.logWarning(`${label}: ${error.reason}. The next deploy asks again.`).pipe(Effect.as(off))));
+};
+/**
+* The token fields of saved attributes. A row of 0.25 and earlier has neither, and they stay empty
+* until the next production registration.
+*/
+const StoredToken = Schema.Struct({
+	initialAccessToken: Schema.optionalKey(Schema.Redacted(Schema.String)),
+	repository: Schema.optionalKey(Schema.String)
+});
+/** The client after a read on the hub, or undefined when the hub says that the client is gone. */
+const renew = (stored) => {
+	const { initialAccessToken = Redacted.make(""), repository = "" } = Schema.decodeUnknownSync(StoredToken)(stored);
+	const saved = {
+		...stored,
+		initialAccessToken,
+		repository
+	};
+	return Effect.gen(function* () {
+		const { status } = yield* send("The identity hub", saved.registrationClientUri, Redacted.value(saved.registrationAccessToken), { method: "GET" });
+		switch (status) {
+			case 200: return {
+				...saved,
+				status: "on"
+			};
+			case 401: return;
+			case 403:
+				yield* Effect.logWarning(`Convex.SharedHubClient: the hub suspended the client of ${saved.redirectUri}. It keeps its values, and nobody can sign in with it.`);
+				return {
+					...saved,
+					status: "suspended"
+				};
+			default: return yield* new SharedHubClientFailed({ reason: `The identity hub answered HTTP ${status}` });
+		}
+	}).pipe(Effect.catchTag("SharedHubClientFailed", (error) => Effect.logWarning(`Convex.SharedHubClient: ${saved.redirectUri} keeps the saved client: ${error.reason}.`).pipe(Effect.as(saved))));
+};
+const SharedHubClientProvider = () => Provider.succeed(SharedHubClient, {
+	diff: ({ news }) => Effect.succeed(isResolved(news) ? { action: "update" } : void 0),
+	read: ({ output }) => Effect.succeed(output),
+	reconcile: Effect.fn(function* ({ news, output }) {
+		const saved = output?.status === "off" ? void 0 : output;
+		return (saved?.redirectUri === news.redirectUri ? yield* renew(saved) : void 0) ?? (yield* newClient(news));
+	}),
+	delete: ({ output }) => output.deploymentType === "production" || output.status === "off" ? Effect.void : Effect.gen(function* () {
+		const { status } = yield* send("The identity hub", output.registrationClientUri, Redacted.value(output.registrationAccessToken), { method: "DELETE" });
+		if (status !== 204 && status !== 401) return yield* new SharedHubClientFailed({ reason: `The identity hub answered HTTP ${status}` });
+	}).pipe(Effect.catchTag("SharedHubClientFailed", (error) => Effect.logWarning(`Convex.SharedHubClient: the client of ${output.redirectUri} stays on the hub until its removal date: ${error.reason}.`)))
+});
+/** The logical id of the client in the stack of the starter. */
+const CLIENT_FQN = "HubClient";
+/** The one action that `state:get` needs. */
+const READ_KEY_ACTIONS = ["deployment:functions:runInternalQueries"];
+/** `CONVEX_DEPLOYMENT` of `.env.local` for a cloud development deployment, such as `dev:happy-otter-123`. */
+const CLOUD_DEPLOYMENT = /^CONVEX_DEPLOYMENT=(?:dev:)?([a-z0-9]+(?:-[a-z0-9]+)*)[ \t]*(?:#.*)?$/m;
+/** The client row of stage `prod` with a token. A row without one fails to decode. */
+const SavedToken = Schema.Struct({
+	resourceType: Schema.Literal("IdentityHub.SharedClient"),
+	attr: Schema.Struct({
+		initialAccessToken: Schema.Redacted(Schema.NonEmptyString),
+		repository: Schema.NonEmptyString
+	})
+});
+/** The part of a client's own record (RFC 7592) that a renewal compares. */
+const ClientRecord = Schema.Struct({ redirect_uris: Schema.Array(Schema.String) });
+/**
+* The directory whose `.env.local` selects the cloud development deployment of `cwd`. A linked git
+* worktree runs a local backend, so the main checkout, the parent of the common git directory,
+* selects it.
+*/
+const selectingDirectory = (cwd) => Effect.try({
+	try: () => execFileSync("git", [
+		"rev-parse",
+		"--path-format=absolute",
+		"--git-dir",
+		"--git-common-dir",
+		"--show-prefix"
+	], {
+		cwd,
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"ignore"
+		]
+	}).split(/\r?\n/),
+	catch: () => void 0
+}).pipe(Effect.map(([gitDir, commonDir, prefix = ""]) => gitDir === void 0 || commonDir === void 0 || gitDir === commonDir ? cwd : join(dirname(commonDir), prefix)), Effect.orElseSucceed(() => cwd));
+/** The team of the cloud development deployment that `.env.local` selects, or undefined. */
+const teamOfSelectedDeployment = (api, cwd) => Effect.gen(function* () {
+	const directory = yield* selectingDirectory(cwd);
+	const text = yield* Effect.tryPromise(() => readFile(join(directory, ".env.local"), "utf8")).pipe(Effect.orElseSucceed(() => ""));
+	const name = CLOUD_DEPLOYMENT.exec(text)?.[1];
+	if (name === void 0) return void 0;
+	const { projectId } = yield* api.request("get deployment", (client) => client.GET("/deployments/{deployment_name}", { params: { path: { deployment_name: name } } })).pipe(Effect.flatMap(Schema.decodeUnknownEffect(DeploymentRow$1)));
+	return (yield* getProjectById(api, projectId))?.teamId;
+});
+/**
+* The initial access token and the repository id in the client row of stage `prod` of `stack`, or
+* undefined. It reads the row with the store's own `state:get` and a key that runs internal queries
+* only. It never builds `Convex.state()`, which can create or upgrade the store.
+*/
+const readSavedToken = (api, team, stack) => Effect.gen(function* () {
+	const project = yield* findProjectByName(api, yield* api.resolveTeamId(team), STORE_PROJECT_NAME);
+	const deployment = project === void 0 ? void 0 : yield* prodDeploymentOf(api, project.id);
+	if (deployment === void 0) return void 0;
+	const reply = yield* withPushKey(api, deployment.name, READ_KEY_ACTIONS, (key) => makeFunctionApi(deployment.deploymentUrl, key).call("state:get", {
+		stack,
+		stage: "prod",
+		fqn: CLIENT_FQN
+	}));
+	if (reply.status === "error") return yield* new SharedHubClientFailed({ reason: "the state store refused the read" });
+	const text = yield* decode(Schema.NullOr(Schema.String), "The state store")(reply.value);
+	if (text === null) return void 0;
+	const row = yield* Effect.try({
+		try: () => JSON.parse(text, reviveState),
+		catch: () => new SharedHubClientFailed({ reason: "the state store gave a bad row" })
+	});
+	return Option.getOrUndefined(Schema.decodeUnknownOption(SavedToken)(row))?.attr;
+});
+/** Replaces any failure or defect of a step with a fixed text, which quotes nothing. */
+const failsWith = (reason) => (effect) => effect.pipe(Effect.catchCause(() => Effect.fail(new SharedHubClientFailed({ reason }))));
+/** What the hub says about the client that the variables name. */
+const readClient = (uri, token, callbackUrl) => Effect.gen(function* () {
+	const { body, status } = yield* send("The identity hub", uri, token, { method: "GET" });
+	switch (status) {
+		case 200: {
+			const [only, ...more] = (yield* decode(ClientRecord, "The identity hub")(body)).redirect_uris;
+			return only === callbackUrl && more.length === 0 ? "renewed" : "moved";
+		}
+		case 401: return "gone";
+		case 403: return "stopped";
+		default: return yield* new SharedHubClientFailed({ reason: `the identity hub answered HTTP ${status}` });
+	}
+});
+/**
+* `alchemy-convex hub-client --shared`: a development client of an app on the central identity hub,
+* for `pnpm run dev` on a laptop, with the initial access token that the stack saved at the
+* production registration (RFC 133). Run it after the first push of each dev start. Answers the one
+* line to print. It fails only for a defect: a refusal, a failed request, or no token keeps the
+* variables and answers why.
+*
+* 1. The team: `team`, else `CONVEX_TEAM_ID`, else the team of the selected cloud development
+*    deployment.
+* 2. The five variables name a client of this hub (`<prefix>_ISSUER` is `HUB_URL` or
+*    `https://auth.samebase.com`) with a real client ID and secret: the hub renews it on a read with
+*    its own token (RFC 7592) when its `redirect_uris` are exactly the current callback. A client on
+*    another address, or one that the hub no longer has, gets a new client. A client that the hub
+*    stopped gets the off values.
+* 3. The token from the client row of stage `prod`, the repository id on an https site, and a new
+*    client, in one `env set --force`.
+*
+* The secret and both tokens reach the Convex CLI on standard input, never in its arguments, and no
+* line holds them.
+*/
+const registerSharedDevelopmentClient = (options) => Effect.gen(function* () {
+	const api = yield* ManagementApi;
+	/** One call of the Convex CLI. Its error can quote the deployment, so it gives a fixed text. */
+	const convex = (args, input) => Effect.try({
+		try: () => options.convex(args, input),
+		catch: () => new SharedHubClientFailed({ reason: `\`convex ${args.slice(0, 2).join(" ")}\` failed` })
+	});
+	const named = options.team ?? process.env["CONVEX_TEAM_ID"];
+	const team = named !== void 0 && named !== "" ? named : yield* teamOfSelectedDeployment(api, options.cwd).pipe(failsWith("the Convex API could not read the selected development deployment"));
+	if (team === void 0) return "No Convex team for Google sign-in on this laptop: set CONVEX_TEAM_ID, or select a cloud development deployment.";
+	const prefix = options.envPrefix ?? "HUB";
+	const siteUrl = yield* decode(Schema.fromJsonString(Schema.String), "The deployment")(yield* convex([
+		"run",
+		"--inline-query",
+		"process.env.CONVEX_SITE_URL"
+	]));
+	const callbackUrl = `${siteUrl.replace(/\/$/, "")}${options.callbackPath}`;
+	const names = (yield* convex([
+		"env",
+		"list",
+		"--names-only"
+	])).split(/\r?\n/);
+	const variable = (name) => `${prefix}_${name}`;
+	const tokenVariable = variable("REGISTRATION_TOKEN");
+	if ([
+		"ISSUER",
+		"CLIENT_ID",
+		"CLIENT_SECRET",
+		"REGISTRATION_URI",
+		"REGISTRATION_TOKEN"
+	].every((name) => names.includes(variable(name))) && (yield* convex([
+		"env",
+		"get",
+		variable("ISSUER")
+	])) === hubUrl() && (yield* convex([
+		"env",
+		"get",
+		variable("CLIENT_ID")
+	])) !== OFF_VALUES.clientId && ![OFF_VALUES.clientSecret, ""].includes(yield* convex([
+		"env",
+		"get",
+		variable("CLIENT_SECRET")
+	]))) {
+		const client = yield* readClient(yield* convex([
+			"env",
+			"get",
+			variable("REGISTRATION_URI")
+		]), yield* convex([
+			"env",
+			"get",
+			tokenVariable
+		]), callbackUrl);
+		if (client === "renewed") return "Hub client renewed.";
+		if (client === "stopped") {
+			yield* convex([
+				"env",
+				"set",
+				"--force"
+			], `${prefix}_ISSUER='${OFF_VALUES.issuer}'\n${prefix}_CLIENT_ID='${OFF_VALUES.clientId}'\n${prefix}_CLIENT_SECRET='${OFF_VALUES.clientSecret}'\n`);
+			yield* convex([
+				"env",
+				"remove",
+				variable("REGISTRATION_URI")
+			]);
+			yield* convex([
+				"env",
+				"remove",
+				tokenVariable
+			]);
+			return "The identity hub stopped the hub client of this laptop (HTTP 403), so the laptop has guest sign-in.";
+		}
+	}
+	const saved = yield* readSavedToken(api, team, options.stack).pipe(failsWith("the state store of the team could not be read"));
+	if (saved === void 0) return "Deploy to main once for Google sign-in on this laptop.";
+	if (new URL(siteUrl).protocol === "https:") yield* convex([
+		"env",
+		"set",
+		"SAMEBASE_REPOSITORY_ID",
+		saved.repository
+	]);
+	const { body, status } = yield* send("The identity hub", hubClientsUrl(), Redacted.value(saved.initialAccessToken), {
+		method: "POST",
+		body: JSON.stringify({
+			app: options.app,
+			redirectUri: callbackUrl,
+			softwareVersion: new URL(siteUrl).host
+		})
+	});
+	if (status !== 201) return `The hub client keeps its values: ${status === 401 ? "the identity hub refused the initial access token of the app" : refusalOf(status, body)} (HTTP ${status}).`;
+	const client = yield* decode(NewClient, "The identity hub")(body);
+	yield* convex([
+		"env",
+		"set",
+		"--force"
+	], `${prefix}_ISSUER='${client.issuer}'\n${prefix}_CLIENT_ID='${client.client_id}'\n${prefix}_CLIENT_SECRET='${client.client_secret}'\n${prefix}_REGISTRATION_URI='${client.registration_client_uri}'\n${tokenVariable}='${client.registration_access_token}'\n`);
+	return `Hub client registered for ${callbackUrl}.`;
+}).pipe(Effect.catchCause((cause) => {
+	const error = Cause.squash(cause);
+	const reason = error instanceof SharedHubClientFailed ? error.reason : "an unexpected failure";
+	return Effect.succeed(`The hub client keeps its values: ${reason}.`);
+}));
+//#endregion
+export { ConvexAppNotFound as A, ACCESS_TOKEN_ENV as B, AmbiguousDeployment as C, DeploymentResource as D, DeploymentProvider as E, installedCli as F, fromValues as G, CredentialsError as H, parseDeployOutput as I, ConvexApiError as L, EnvironmentNeedsDeployKey as M, PushTargetMismatch as N, ProductionDeploymentNotFound as O, VariablesOwnedBySomeoneElse as P, ManagementApi as R, AbsoluteRootDir as S, DeploymentIdentityChange as T, DEPLOY_KEY_ENV as U, Credentials as V, fromConfig as W, Project as _, HubClient as a, ProjectProvider as b, registerDevelopmentClient as c, RUN_RECORD_KEY as d, RunRecordError as f, CreatedProjectNotFound as g, AmbiguousProject as h, HUB_PROJECT_NAME as i, ConvexCliNotFound as j, CodePushFailed as k, STORE_PROJECT_NAME as l, withRunRecord as m, SharedHubClientProvider as n, HubClientFailed as o, runRecord as p, registerSharedDevelopmentClient as r, HubClientProvider as s, SharedHubClient as t, state as u, ProjectDeploymentChange as v, Deployment as w, ProjectTeamChange as x, ProjectNotFound as y, ManagementApiLive as z };
 
-//# sourceMappingURL=HubClient-Bs5_j18U.js.map
+//# sourceMappingURL=SharedHubClient-D-FJJUCZ.js.map