@samebase/alchemy-convex 0.26.0 → 0.27.0

package/README.md

@@ -313,38 +313,52 @@ call.
   - A destroy deletes a preview or development client. It does nothing to a production client,
     because the production deployment can stay.
 
-- `Convex.SharedHubClient`: `{ app, redirectUri, deploymentType, softwareVersion? }` gets a client
-  of the central identity hub, for an app that deploys in its own GitHub Actions run, on any host.
-  The workflow needs `permissions: id-token: write`, and no key and no Samebase account. `app` is at
-  most 64 characters. The origin of `redirectUri` must serve `/samebase-verification.json` with the
-  numeric GitHub id of the repository, `{ "repository": "123" }`, which
-  `gh api repos/<owner>/<name> --jq .id` prints. The hub reads it before it registers the client, so
-  the site must be live first. Outputs `status`, `issuer`, `clientId`, `clientSecret`,
-  `registrationAccessToken`, `registrationClientUri`, `deploymentType`, `redirectUri`,
-  `initialAccessToken`, and `repository`.
+- `Convex.SharedHubClient`:
+  `{ app, redirectUri, deploymentType, initialAccessToken?, softwareVersion? }` gets a client of the
+  central identity hub, for an app that deploys in its own GitHub Actions run, on any host, and for
+  a laptop as a stage of the same stack. `deploymentType` is `production`, `preview`, or
+  `development`. A production or preview client needs `permissions: id-token: write` in the
+  workflow, and no key and no Samebase account. `app` is at most 64 characters. The origin of an
+  https `redirectUri` must serve `/samebase-verification.json` with the numeric GitHub id of the
+  repository, `{ "repository": "123" }`, which `gh api repos/<owner>/<name> --jq .id` prints. The
+  hub reads it before it registers the client, so the site must be live first. Outputs `status`,
+  `issuer`, `clientId`, `clientSecret`, `registrationAccessToken`, `registrationClientUri`,
+  `deploymentType`, `redirectUri`, `initialAccessToken`, and `repository`.
   - A production registration also gets the app's initial access token (RFC 7591) and the numeric
-    repository id, which the state keeps. The token registers development clients of the app on a
-    laptop: see `hub-client --shared` below. A renewal keeps both. They are empty for a preview and
-    for the off values.
+    repository id, which the state keeps. A renewal keeps both. They are empty for a preview, for a
+    development client, and for the off values.
+  - A development client needs `initialAccessToken`, and only a development client takes it. The
+    client asks the hub with this token in place of the GitHub OIDC token, so it works on a laptop.
+    With an empty token, the client gets the off values, and the log says "deploy to main once for
+    Google sign-in on this laptop". See "The development stage" below.
   - Each deploy reads the saved client on the hub with its own token. A client that is gone gets a
-    new one, and a client on another `redirectUri` too.
+    new one, and a client on another `redirectUri` or of another `deploymentType` too.
   - A new client logs the link to the terms of the shared sign-in service. A refusal logs its
-    reason, such as a host that does not serve the file, a block, or the hourly limit it reached.
+    reason, such as a host that does not serve the file, a block, a token of another app, or the
+    hourly limit it reached.
   - No failure stops a deploy or a destroy. A failed renewal keeps the saved values. Without saved
     values, `status` is `off`, and `issuer`, `clientId`, and `clientSecret` are the `no-hub` values
-    of a checkout without a hub. A run without a GitHub OIDC token, such as on a laptop, does the
-    same, and logs no warning.
-  - `status` is `suspended` when the hub suspended the client. The client keeps its values.
-  - A destroy deletes a preview client. It does nothing to a production client, because the
-    production deployment can stay.
+    of a checkout without a hub. A production or preview run without a GitHub OIDC token, such as on
+    a laptop, does the same, and logs no warning.
+  - `status` is `suspended` when the hub suspended the client. The state keeps the client and its
+    values, so the client works again when the hub lifts the suspension.
+  - `Convex.SharedHubClient.variables(client)` gives `issuer`, `clientId`, and `clientSecret` for
+    the app's deployment: the client's values when `status` is `on`, and the `no-hub` values when it
+    is `off` or `suspended`. Give these to the deployment, not the outputs of the client.
+  - `Convex.SharedHubClient.read(id, { stage })` gives the attributes of the client `id` in another
+    stage of the same stack, from the state store of the stack. When that stage has no row, it gives
+    the off attributes and does not fail. `Convex.SharedHubClient.ref` fails when the row is
+    missing, and a laptop before the first deploy to main has no `prod` row.
+  - A destroy deletes a preview or development client. It does nothing to a production client,
+    because the production deployment can stay.
   - `HUB_URL` replaces `https://auth.samebase.com`, the hub that the run asks at `/hub-clients`.
 
-A development deployment has no stack, so the package has a command for it. Run it in the directory
-of the app, before the first push and at each dev start, with `CONVEX_ACCESS_TOKEN` or the Convex
-CLI login. It renews the client that `HUB_CLIENT_ID` names, so the client expires 14 days after the
-last dev start or use. A deployment without all three variables, or whose client the hub no longer
-has, gets a new client, and the command writes `HUB_ISSUER`, `HUB_CLIENT_ID`, and
-`HUB_CLIENT_SECRET` to it.
+A development deployment of a team app (`Convex.HubClient`) has no stack, so the package has a
+command for it. Run it in the directory of the app, before the first push and at each dev start,
+with `CONVEX_ACCESS_TOKEN` or the Convex CLI login. It renews the client that `HUB_CLIENT_ID` names,
+so the client expires 14 days after the last dev start or use. A deployment without all three
+variables, or whose client the hub no longer has, gets a new client, and the command writes
+`HUB_ISSUER`, `HUB_CLIENT_ID`, and `HUB_CLIENT_SECRET` to it.
 
 ```sh
 npx alchemy-convex hub-client --team my-team --app scout --callback-path /auth/hub/callback
@@ -355,24 +369,59 @@ For a separate API-connection callback, register another client with
 `RESOURCE_HUB_CLIENT_ID`, and `RESOURCE_HUB_CLIENT_SECRET`, preserving the sign-in client's
 variables. Each callback remains one exact registered URI.
 
-An app on the central identity hub gets its laptop client with `--shared`. Run it after the first
-push of each dev start, with `CONVEX_ACCESS_TOKEN` or the Convex CLI login of the app's team.
+### The development stage
 
-```sh
-npx alchemy-convex hub-client --shared --stack owner/name --app app --callback-path /auth/hub/callback
+A laptop is a stage `dev-<name>` of the app's stack, with its own cloud development deployment. Run
+`alchemy deploy --stage dev-<name>` with `CONVEX_ACCESS_TOKEN` or the Convex CLI login of the app's
+team, before `convex dev`. The stage has the same three rows as a preview:
+
+```ts
+// The stage is dev-<name>. `project` is the project of the deployment that the Convex CLI selects.
+const prod = Convex.SharedHubClient.read("HubClient", { stage: "prod" });
+const deployment =
+  yield *
+  Convex.Deployment("Deployment", {
+    project,
+    type: "dev",
+    name: stage,
+    source: "./convex",
+    env: { SAMEBASE_REPOSITORY_ID: prod.repository },
+  }).pipe(adopt(true));
+const hub =
+  yield *
+  Convex.SharedHubClient("HubClient", {
+    app: "scout",
+    redirectUri: Output.interpolate`${deployment.siteUrl}/auth/hub/callback`,
+    deploymentType: "development",
+    initialAccessToken: prod.initialAccessToken,
+  });
+const variables = Convex.SharedHubClient.variables(hub);
+yield *
+  Convex.Deployment("Site", {
+    project,
+    type: "dev",
+    name: stage,
+    env: {
+      HUB_ISSUER: variables.issuer,
+      HUB_CLIENT_ID: variables.clientId,
+      HUB_CLIENT_SECRET: variables.clientSecret,
+    },
+  }).pipe(adopt(true));
 ```
 
-The team is `--team`, else `CONVEX_TEAM_ID`, else the team of the cloud development deployment that
-`.env.local` selects. A linked git worktree reads the `.env.local` of the main checkout. The command
-renews the client that `HUB_REGISTRATION_URI` and `HUB_REGISTRATION_TOKEN` name, only when
-`HUB_ISSUER` is the hub that it asks (`HUB_URL`, else `https://auth.samebase.com`), the client ID
-and the secret are not `no-hub`, and the hub answers exactly the current callback. Else, it reads
-the initial access token from the `HubClient` row of stage `prod` of the stack, and asks the hub for
-a development client on the deployment's `CONVEX_SITE_URL`. It writes `HUB_ISSUER`, `HUB_CLIENT_ID`,
-`HUB_CLIENT_SECRET`, `HUB_REGISTRATION_URI`, and `HUB_REGISTRATION_TOKEN` in one `env set --force`,
-and `SAMEBASE_REPOSITORY_ID` on an https site. A client that the hub stopped gets the off values.
-Without a token, after a refusal, or after a failure, it prints one line, and the variables stay. It
-never stops a dev start.
+The imports are `alchemy/AdoptPolicy` for `adopt` and `alchemy/Output` for `Output`.
+
+1. `read` gives the initial access token and the repository id from the `HubClient` row of stage
+   `prod`. Before the first deploy to main, they are empty.
+2. "Deployment" finds the development deployment by its reference, or creates it. It sets
+   `SAMEBASE_REPOSITORY_ID`, which the site serves as `/samebase-verification.json`, and pushes.
+3. "HubClient" asks the hub for a development client on the deployment's site URL with the token.
+   Each later run renews it. A development client expires 14 days after its last run or use.
+4. "Site" writes the three variables. It removes only a name that leaves its own `env`, so
+   `SAMEBASE_REPOSITORY_ID` stays.
+
+Both deployment rows keep the default removal policy `retain`. `alchemy destroy --stage dev-<name>`
+deletes the development client and keeps the deployment.
 
 ## Pull request comment
 

package/lib/{SharedHubClient-D-FJJUCZ.js → HubClient-Bs5_j18U.js}

@@ -29,8 +29,7 @@ import * as Stream from "effect/Stream";
 import { fileURLToPath } from "node:url";
 import * as Scope from "effect/Scope";
 import { STATE_STORE_VERSION, State, StateStoreError, encodeState, reviveState } from "alchemy/State";
-import { execFile, execFileSync } from "node:child_process";
-import * as Cause from "effect/Cause";
+import { execFile } from "node:child_process";
 //#region src/Credentials.ts
 var Credentials = class extends Context.Service()("@samebase/alchemy-convex/Credentials") {};
 /** Environment variable for the access token, read by {@link fromConfig}. */
@@ -1576,7 +1575,7 @@ const post = (url, headers, body) => Effect.tryPromise({
 	schedule: Schedule.exponential("100 millis").pipe(Schedule.jittered),
 	times: 5
 }));
-const decode$1 = (schema, what) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => failure(`bad ${what}`)));
+const decode = (schema, what) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => failure(`bad ${what}`)));
 /** The reply of `state:sealing`. */
 const Sealing = Schema.Struct({
 	current: Schema.NullOr(Schema.String),
@@ -1588,7 +1587,7 @@ const makeFunctionApi = (url, key) => ({ call: (path, args) => post(`${url}/api/
 	path,
 	args,
 	format: "json"
-}).pipe(Effect.flatMap(decode$1(Reply, `reply of ${path}`))) });
+}).pipe(Effect.flatMap(decode(Reply, `reply of ${path}`))) });
 /** The value of a reply, or the Convex message, which names the function and the cause, such as a missing key action. */
 const valueOf = (reply) => reply.status === "success" ? Effect.succeed(reply.value) : Effect.fail(failure(reply.errorMessage.trim()));
 /** The functions of the store with Alchemy's encoding: the JSON text of encodeState. */
@@ -1604,8 +1603,8 @@ const remoteOf = (api, record) => {
 			run: currentRun
 		});
 	});
-	const strings = (name, args) => run(name, args).pipe(Effect.flatMap(decode$1(Schema.Array(Schema.String), name)));
-	const optional = (name, args) => run(name, args).pipe(Effect.flatMap(decode$1(Schema.NullOr(Schema.String), name)));
+	const strings = (name, args) => run(name, args).pipe(Effect.flatMap(decode(Schema.Array(Schema.String), name)));
+	const optional = (name, args) => run(name, args).pipe(Effect.flatMap(decode(Schema.NullOr(Schema.String), name)));
 	const encode = (value) => JSON.stringify(encodeState(value));
 	return {
 		listStacks: () => strings("stacks", {}),
@@ -1650,7 +1649,7 @@ const remoteOf = (api, record) => {
 	};
 };
 /** The version that the store answers, or undefined when the deployment has no `state:version`. */
-const storeVersion = (api) => api.call("state:version", {}).pipe(Effect.flatMap((reply) => reply.status === "error" && MISSING_FUNCTION.test(reply.errorMessage) ? Effect.succeed(void 0) : valueOf(reply).pipe(Effect.flatMap(decode$1(Schema.Number, "store version")))));
+const storeVersion = (api) => api.call("state:version", {}).pipe(Effect.flatMap((reply) => reply.status === "error" && MISSING_FUNCTION.test(reply.errorMessage) ? Effect.succeed(void 0) : valueOf(reply).pipe(Effect.flatMap(decode(Schema.Number, "store version")))));
 /**
 * The functions directory of the store app, `src/store/convex` of this
 * package. This file is `src/State.ts` in a checkout and a chunk in `lib/`
@@ -1695,7 +1694,7 @@ const pushStore = (options, deployment) => Effect.gen(function* () {
 * it never reads a key back.
 */
 const ensureSealed = (options, deployment, functions) => Effect.gen(function* () {
-	const { current, sealed } = yield* functions.call("state:sealing", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode$1(Sealing, "state:sealing")));
+	const { current, sealed } = yield* functions.call("state:sealing", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode(Sealing, "state:sealing")));
 	if (current === null) {
 		const keyId = newKeyId();
 		yield* withPushKey(options.api, deployment.name, PUSH_KEY_ACTIONS, (key) => writeVariables(deployment.deploymentUrl, key, [{
@@ -1705,7 +1704,7 @@ const ensureSealed = (options, deployment, functions) => Effect.gen(function* ()
 		yield* functions.call("state:chooseKey", { keyId }).pipe(Effect.flatMap(valueOf));
 	}
 	if (sealed) return;
-	const { failed } = yield* functions.call("state:reseal", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode$1(Resealed, "state:reseal")));
+	const { failed } = yield* functions.call("state:reseal", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode(Resealed, "state:reseal")));
 	if (failed.length > 0) yield* Effect.logWarning(`Convex state: the store could not seal ${failed.join(", ")}. The next run tries again.`);
 });
 /**
@@ -1988,398 +1987,6 @@ const registerDevelopmentClient = (options) => Effect.gen(function* () {
 	return callbackUrl;
 });
 //#endregion
-//#region src/SharedHubClient.ts
-/** A hung service must not hold a deploy: the time limit of one request. */
-const REQUEST_TIMEOUT_MS = 3e4;
-/** The variables of a deployment without a hub client, as the starter writes them. */
-const OFF_VALUES = {
-	issuer: "http://127.0.0.1:1",
-	clientId: "no-hub",
-	clientSecret: "no-hub"
-};
-/** The hub that a run asks, which is also its issuer. */
-const hubUrl = () => process.env["HUB_URL"] ?? "https://auth.samebase.com";
-/** Where a run asks for a new client. */
-const hubClientsUrl = () => `${hubUrl()}/hub-clients`;
-const SharedHubClient = Resource("IdentityHub.SharedClient");
-/** One request gave no usable answer. The reason holds no secret. */
-var SharedHubClientFailed = class extends Schema.TaggedError()("SharedHubClientFailed", { reason: Schema.String }) {};
-const OidcToken = Schema.Struct({ value: Schema.NonEmptyString });
-/** The 201 answer of `POST /hub-clients`. */
-const NewClient = Schema.Struct({
-	issuer: Schema.NonEmptyString,
-	client_id: Schema.NonEmptyString,
-	client_secret: Schema.NonEmptyString,
-	registration_access_token: Schema.NonEmptyString,
-	registration_client_uri: Schema.NonEmptyString,
-	redirect_uri: Schema.NonEmptyString,
-	/** The terms of the shared sign-in service, which the log shows once, for the new client. */
-	terms: Schema.NonEmptyString,
-	/** Only in the answer to a production registration with the GitHub token. */
-	initial_access_token: Schema.optionalKey(Schema.NonEmptyString),
-	repository: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^\d+$/)))
-});
-/** The other answers of `POST /hub-clients`, by status. */
-const REFUSALS = {
-	400: "the identity hub refused the request: the return address must be https on a DNS name, and the app name at most 64 characters",
-	401: "the identity hub refused the GitHub OIDC token",
-	403: "the identity hub does not allow this repository or return address",
-	404: "the identity hub has no /hub-clients",
-	429: "the identity hub limits new clients",
-	502: "GitHub's keys are not available to the identity hub"
-};
-/** The reasons of a 403 that a log line shows. Any other text of the answer is never logged. */
-const NOT_ALLOWED = /* @__PURE__ */ new Map([
-	["paused", "the identity hub pauses new clients of third-party apps"],
-	["run_not_allowed", "the identity hub gives clients only to runs of main and of pull requests"],
-	["blocked", "Samebase blocked this repository or its owner"],
-	["suspended", "the identity hub suspended this repository"],
-	["too_many_apps", "the repository has as many apps on the identity hub as it may"],
-	["too_many_clients", "the app has as many clients on the identity hub as it may"],
-	["app_taken", "the app's name belongs to another app on the identity hub"],
-	["host_unreachable", "the identity hub could not reach the host of the return address"],
-	["verification_file_missing", "the host of the return address does not serve /samebase-verification.json"],
-	["verification_file_invalid", "/samebase-verification.json on the host holds no repository id"],
-	["repository_mismatch", "/samebase-verification.json on the host names another repository"],
-	["app_mismatch", "the initial access token belongs to another app on the identity hub"]
-]);
-/** The windows of a 429, by the name that the answer gives. */
-const RATE_LIMITED = /* @__PURE__ */ new Map([
-	["repository", "the identity hub gives one repository at most 30 new clients an hour"],
-	["owner", "the identity hub gives one owner at most 100 new clients an hour"],
-	["new_owners", "the identity hub takes at most 50 new owners an hour"]
-]);
-const Refusal = Schema.Struct({ reason: Schema.String });
-const RateLimited = Schema.Struct({ window: Schema.String });
-/** The text of a refusal: a known reason of a 403 or window of a 429, else the text of its status. */
-const refusalOf = (status, body) => {
-	return (status === 403 ? NOT_ALLOWED.get(Option.getOrUndefined(Schema.decodeUnknownOption(Refusal)(body))?.reason ?? "") : status === 429 ? RATE_LIMITED.get(Option.getOrUndefined(Schema.decodeUnknownOption(RateLimited)(body))?.window ?? "") : void 0) ?? REFUSALS[status] ?? "the identity hub refused the request";
-};
-const send = (who, url, token, init) => Effect.tryPromise({
-	try: async () => {
-		const response = await fetch(url, {
-			...init,
-			headers: {
-				Authorization: `Bearer ${token}`,
-				"Content-Type": "application/json"
-			},
-			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-		});
-		const body = await response.json().catch(() => void 0);
-		return {
-			status: response.status,
-			body
-		};
-	},
-	catch: () => new SharedHubClientFailed({ reason: `${who} gave no answer` })
-});
-const decode = (schema, who) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => new SharedHubClientFailed({ reason: `${who} gave a bad answer` })));
-/** The OIDC token of this run, read right before the call, because it lives for minutes only. */
-const readOidcToken = (requestUrl, requestToken) => Effect.gen(function* () {
-	const { body, status } = yield* send("GitHub", `${requestUrl}&audience=samebase`, requestToken, { method: "GET" });
-	if (status !== 200) return yield* new SharedHubClientFailed({ reason: `GitHub gave no OIDC token (HTTP ${status})` });
-	return (yield* decode(OidcToken, "GitHub")(body)).value;
-});
-const requestNewClient = (props, requestUrl, requestToken) => Effect.gen(function* () {
-	const token = yield* readOidcToken(requestUrl, requestToken);
-	const { body, status } = yield* send("The identity hub", hubClientsUrl(), token, {
-		method: "POST",
-		body: JSON.stringify({
-			app: props.app,
-			redirectUri: props.redirectUri,
-			softwareVersion: props.softwareVersion ?? "unknown"
-		})
-	});
-	if (status !== 201) return yield* new SharedHubClientFailed({ reason: `${refusalOf(status, body)} (HTTP ${status})` });
-	const client = yield* decode(NewClient, "The identity hub")(body);
-	yield* Effect.logInfo(`Convex.SharedHubClient: ${props.app} on ${client.redirect_uri} has a new client of the identity hub. Its use is under ${client.terms}.`);
-	return {
-		status: "on",
-		issuer: client.issuer,
-		clientId: client.client_id,
-		clientSecret: Redacted.make(client.client_secret),
-		registrationAccessToken: Redacted.make(client.registration_access_token),
-		registrationClientUri: client.registration_client_uri,
-		deploymentType: props.deploymentType,
-		redirectUri: client.redirect_uri,
-		initialAccessToken: Redacted.make(client.initial_access_token ?? ""),
-		repository: client.repository ?? ""
-	};
-});
-/** A new client, or `saved`, or the off values. `saved` holds no off values. */
-const newClient = (props) => {
-	const label = `Convex.SharedHubClient: ${props.app} on ${props.redirectUri} deploys without the hub`;
-	const off = {
-		status: "off",
-		issuer: OFF_VALUES.issuer,
-		clientId: OFF_VALUES.clientId,
-		clientSecret: Redacted.make(OFF_VALUES.clientSecret),
-		registrationAccessToken: Redacted.make(""),
-		registrationClientUri: "",
-		deploymentType: props.deploymentType,
-		redirectUri: "",
-		initialAccessToken: Redacted.make(""),
-		repository: ""
-	};
-	const requestUrl = process.env["ACTIONS_ID_TOKEN_REQUEST_URL"];
-	const requestToken = process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
-	if (!requestUrl || !requestToken) return (process.env["GITHUB_ACTIONS"] === "true" ? Effect.logWarning(`${label}: this workflow needs the permission id-token: write.`) : Effect.logInfo(`${label}: this run has no GitHub OIDC token.`)).pipe(Effect.as(off));
-	return requestNewClient(props, requestUrl, requestToken).pipe(Effect.catchTag("SharedHubClientFailed", (error) => Effect.logWarning(`${label}: ${error.reason}. The next deploy asks again.`).pipe(Effect.as(off))));
-};
-/**
-* The token fields of saved attributes. A row of 0.25 and earlier has neither, and they stay empty
-* until the next production registration.
-*/
-const StoredToken = Schema.Struct({
-	initialAccessToken: Schema.optionalKey(Schema.Redacted(Schema.String)),
-	repository: Schema.optionalKey(Schema.String)
-});
-/** The client after a read on the hub, or undefined when the hub says that the client is gone. */
-const renew = (stored) => {
-	const { initialAccessToken = Redacted.make(""), repository = "" } = Schema.decodeUnknownSync(StoredToken)(stored);
-	const saved = {
-		...stored,
-		initialAccessToken,
-		repository
-	};
-	return Effect.gen(function* () {
-		const { status } = yield* send("The identity hub", saved.registrationClientUri, Redacted.value(saved.registrationAccessToken), { method: "GET" });
-		switch (status) {
-			case 200: return {
-				...saved,
-				status: "on"
-			};
-			case 401: return;
-			case 403:
-				yield* Effect.logWarning(`Convex.SharedHubClient: the hub suspended the client of ${saved.redirectUri}. It keeps its values, and nobody can sign in with it.`);
-				return {
-					...saved,
-					status: "suspended"
-				};
-			default: return yield* new SharedHubClientFailed({ reason: `The identity hub answered HTTP ${status}` });
-		}
-	}).pipe(Effect.catchTag("SharedHubClientFailed", (error) => Effect.logWarning(`Convex.SharedHubClient: ${saved.redirectUri} keeps the saved client: ${error.reason}.`).pipe(Effect.as(saved))));
-};
-const SharedHubClientProvider = () => Provider.succeed(SharedHubClient, {
-	diff: ({ news }) => Effect.succeed(isResolved(news) ? { action: "update" } : void 0),
-	read: ({ output }) => Effect.succeed(output),
-	reconcile: Effect.fn(function* ({ news, output }) {
-		const saved = output?.status === "off" ? void 0 : output;
-		return (saved?.redirectUri === news.redirectUri ? yield* renew(saved) : void 0) ?? (yield* newClient(news));
-	}),
-	delete: ({ output }) => output.deploymentType === "production" || output.status === "off" ? Effect.void : Effect.gen(function* () {
-		const { status } = yield* send("The identity hub", output.registrationClientUri, Redacted.value(output.registrationAccessToken), { method: "DELETE" });
-		if (status !== 204 && status !== 401) return yield* new SharedHubClientFailed({ reason: `The identity hub answered HTTP ${status}` });
-	}).pipe(Effect.catchTag("SharedHubClientFailed", (error) => Effect.logWarning(`Convex.SharedHubClient: the client of ${output.redirectUri} stays on the hub until its removal date: ${error.reason}.`)))
-});
-/** The logical id of the client in the stack of the starter. */
-const CLIENT_FQN = "HubClient";
-/** The one action that `state:get` needs. */
-const READ_KEY_ACTIONS = ["deployment:functions:runInternalQueries"];
-/** `CONVEX_DEPLOYMENT` of `.env.local` for a cloud development deployment, such as `dev:happy-otter-123`. */
-const CLOUD_DEPLOYMENT = /^CONVEX_DEPLOYMENT=(?:dev:)?([a-z0-9]+(?:-[a-z0-9]+)*)[ \t]*(?:#.*)?$/m;
-/** The client row of stage `prod` with a token. A row without one fails to decode. */
-const SavedToken = Schema.Struct({
-	resourceType: Schema.Literal("IdentityHub.SharedClient"),
-	attr: Schema.Struct({
-		initialAccessToken: Schema.Redacted(Schema.NonEmptyString),
-		repository: Schema.NonEmptyString
-	})
-});
-/** The part of a client's own record (RFC 7592) that a renewal compares. */
-const ClientRecord = Schema.Struct({ redirect_uris: Schema.Array(Schema.String) });
-/**
-* The directory whose `.env.local` selects the cloud development deployment of `cwd`. A linked git
-* worktree runs a local backend, so the main checkout, the parent of the common git directory,
-* selects it.
-*/
-const selectingDirectory = (cwd) => Effect.try({
-	try: () => execFileSync("git", [
-		"rev-parse",
-		"--path-format=absolute",
-		"--git-dir",
-		"--git-common-dir",
-		"--show-prefix"
-	], {
-		cwd,
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		]
-	}).split(/\r?\n/),
-	catch: () => void 0
-}).pipe(Effect.map(([gitDir, commonDir, prefix = ""]) => gitDir === void 0 || commonDir === void 0 || gitDir === commonDir ? cwd : join(dirname(commonDir), prefix)), Effect.orElseSucceed(() => cwd));
-/** The team of the cloud development deployment that `.env.local` selects, or undefined. */
-const teamOfSelectedDeployment = (api, cwd) => Effect.gen(function* () {
-	const directory = yield* selectingDirectory(cwd);
-	const text = yield* Effect.tryPromise(() => readFile(join(directory, ".env.local"), "utf8")).pipe(Effect.orElseSucceed(() => ""));
-	const name = CLOUD_DEPLOYMENT.exec(text)?.[1];
-	if (name === void 0) return void 0;
-	const { projectId } = yield* api.request("get deployment", (client) => client.GET("/deployments/{deployment_name}", { params: { path: { deployment_name: name } } })).pipe(Effect.flatMap(Schema.decodeUnknownEffect(DeploymentRow$1)));
-	return (yield* getProjectById(api, projectId))?.teamId;
-});
-/**
-* The initial access token and the repository id in the client row of stage `prod` of `stack`, or
-* undefined. It reads the row with the store's own `state:get` and a key that runs internal queries
-* only. It never builds `Convex.state()`, which can create or upgrade the store.
-*/
-const readSavedToken = (api, team, stack) => Effect.gen(function* () {
-	const project = yield* findProjectByName(api, yield* api.resolveTeamId(team), STORE_PROJECT_NAME);
-	const deployment = project === void 0 ? void 0 : yield* prodDeploymentOf(api, project.id);
-	if (deployment === void 0) return void 0;
-	const reply = yield* withPushKey(api, deployment.name, READ_KEY_ACTIONS, (key) => makeFunctionApi(deployment.deploymentUrl, key).call("state:get", {
-		stack,
-		stage: "prod",
-		fqn: CLIENT_FQN
-	}));
-	if (reply.status === "error") return yield* new SharedHubClientFailed({ reason: "the state store refused the read" });
-	const text = yield* decode(Schema.NullOr(Schema.String), "The state store")(reply.value);
-	if (text === null) return void 0;
-	const row = yield* Effect.try({
-		try: () => JSON.parse(text, reviveState),
-		catch: () => new SharedHubClientFailed({ reason: "the state store gave a bad row" })
-	});
-	return Option.getOrUndefined(Schema.decodeUnknownOption(SavedToken)(row))?.attr;
-});
-/** Replaces any failure or defect of a step with a fixed text, which quotes nothing. */
-const failsWith = (reason) => (effect) => effect.pipe(Effect.catchCause(() => Effect.fail(new SharedHubClientFailed({ reason }))));
-/** What the hub says about the client that the variables name. */
-const readClient = (uri, token, callbackUrl) => Effect.gen(function* () {
-	const { body, status } = yield* send("The identity hub", uri, token, { method: "GET" });
-	switch (status) {
-		case 200: {
-			const [only, ...more] = (yield* decode(ClientRecord, "The identity hub")(body)).redirect_uris;
-			return only === callbackUrl && more.length === 0 ? "renewed" : "moved";
-		}
-		case 401: return "gone";
-		case 403: return "stopped";
-		default: return yield* new SharedHubClientFailed({ reason: `the identity hub answered HTTP ${status}` });
-	}
-});
-/**
-* `alchemy-convex hub-client --shared`: a development client of an app on the central identity hub,
-* for `pnpm run dev` on a laptop, with the initial access token that the stack saved at the
-* production registration (RFC 133). Run it after the first push of each dev start. Answers the one
-* line to print. It fails only for a defect: a refusal, a failed request, or no token keeps the
-* variables and answers why.
-*
-* 1. The team: `team`, else `CONVEX_TEAM_ID`, else the team of the selected cloud development
-*    deployment.
-* 2. The five variables name a client of this hub (`<prefix>_ISSUER` is `HUB_URL` or
-*    `https://auth.samebase.com`) with a real client ID and secret: the hub renews it on a read with
-*    its own token (RFC 7592) when its `redirect_uris` are exactly the current callback. A client on
-*    another address, or one that the hub no longer has, gets a new client. A client that the hub
-*    stopped gets the off values.
-* 3. The token from the client row of stage `prod`, the repository id on an https site, and a new
-*    client, in one `env set --force`.
-*
-* The secret and both tokens reach the Convex CLI on standard input, never in its arguments, and no
-* line holds them.
-*/
-const registerSharedDevelopmentClient = (options) => Effect.gen(function* () {
-	const api = yield* ManagementApi;
-	/** One call of the Convex CLI. Its error can quote the deployment, so it gives a fixed text. */
-	const convex = (args, input) => Effect.try({
-		try: () => options.convex(args, input),
-		catch: () => new SharedHubClientFailed({ reason: `\`convex ${args.slice(0, 2).join(" ")}\` failed` })
-	});
-	const named = options.team ?? process.env["CONVEX_TEAM_ID"];
-	const team = named !== void 0 && named !== "" ? named : yield* teamOfSelectedDeployment(api, options.cwd).pipe(failsWith("the Convex API could not read the selected development deployment"));
-	if (team === void 0) return "No Convex team for Google sign-in on this laptop: set CONVEX_TEAM_ID, or select a cloud development deployment.";
-	const prefix = options.envPrefix ?? "HUB";
-	const siteUrl = yield* decode(Schema.fromJsonString(Schema.String), "The deployment")(yield* convex([
-		"run",
-		"--inline-query",
-		"process.env.CONVEX_SITE_URL"
-	]));
-	const callbackUrl = `${siteUrl.replace(/\/$/, "")}${options.callbackPath}`;
-	const names = (yield* convex([
-		"env",
-		"list",
-		"--names-only"
-	])).split(/\r?\n/);
-	const variable = (name) => `${prefix}_${name}`;
-	const tokenVariable = variable("REGISTRATION_TOKEN");
-	if ([
-		"ISSUER",
-		"CLIENT_ID",
-		"CLIENT_SECRET",
-		"REGISTRATION_URI",
-		"REGISTRATION_TOKEN"
-	].every((name) => names.includes(variable(name))) && (yield* convex([
-		"env",
-		"get",
-		variable("ISSUER")
-	])) === hubUrl() && (yield* convex([
-		"env",
-		"get",
-		variable("CLIENT_ID")
-	])) !== OFF_VALUES.clientId && ![OFF_VALUES.clientSecret, ""].includes(yield* convex([
-		"env",
-		"get",
-		variable("CLIENT_SECRET")
-	]))) {
-		const client = yield* readClient(yield* convex([
-			"env",
-			"get",
-			variable("REGISTRATION_URI")
-		]), yield* convex([
-			"env",
-			"get",
-			tokenVariable
-		]), callbackUrl);
-		if (client === "renewed") return "Hub client renewed.";
-		if (client === "stopped") {
-			yield* convex([
-				"env",
-				"set",
-				"--force"
-			], `${prefix}_ISSUER='${OFF_VALUES.issuer}'\n${prefix}_CLIENT_ID='${OFF_VALUES.clientId}'\n${prefix}_CLIENT_SECRET='${OFF_VALUES.clientSecret}'\n`);
-			yield* convex([
-				"env",
-				"remove",
-				variable("REGISTRATION_URI")
-			]);
-			yield* convex([
-				"env",
-				"remove",
-				tokenVariable
-			]);
-			return "The identity hub stopped the hub client of this laptop (HTTP 403), so the laptop has guest sign-in.";
-		}
-	}
-	const saved = yield* readSavedToken(api, team, options.stack).pipe(failsWith("the state store of the team could not be read"));
-	if (saved === void 0) return "Deploy to main once for Google sign-in on this laptop.";
-	if (new URL(siteUrl).protocol === "https:") yield* convex([
-		"env",
-		"set",
-		"SAMEBASE_REPOSITORY_ID",
-		saved.repository
-	]);
-	const { body, status } = yield* send("The identity hub", hubClientsUrl(), Redacted.value(saved.initialAccessToken), {
-		method: "POST",
-		body: JSON.stringify({
-			app: options.app,
-			redirectUri: callbackUrl,
-			softwareVersion: new URL(siteUrl).host
-		})
-	});
-	if (status !== 201) return `The hub client keeps its values: ${status === 401 ? "the identity hub refused the initial access token of the app" : refusalOf(status, body)} (HTTP ${status}).`;
-	const client = yield* decode(NewClient, "The identity hub")(body);
-	yield* convex([
-		"env",
-		"set",
-		"--force"
-	], `${prefix}_ISSUER='${client.issuer}'\n${prefix}_CLIENT_ID='${client.client_id}'\n${prefix}_CLIENT_SECRET='${client.client_secret}'\n${prefix}_REGISTRATION_URI='${client.registration_client_uri}'\n${tokenVariable}='${client.registration_access_token}'\n`);
-	return `Hub client registered for ${callbackUrl}.`;
-}).pipe(Effect.catchCause((cause) => {
-	const error = Cause.squash(cause);
-	const reason = error instanceof SharedHubClientFailed ? error.reason : "an unexpected failure";
-	return Effect.succeed(`The hub client keeps its values: ${reason}.`);
-}));
-//#endregion
-export { ConvexAppNotFound as A, ACCESS_TOKEN_ENV as B, AmbiguousDeployment as C, DeploymentResource as D, DeploymentProvider as E, installedCli as F, fromValues as G, CredentialsError as H, parseDeployOutput as I, ConvexApiError as L, EnvironmentNeedsDeployKey as M, PushTargetMismatch as N, ProductionDeploymentNotFound as O, VariablesOwnedBySomeoneElse as P, ManagementApi as R, AbsoluteRootDir as S, DeploymentIdentityChange as T, DEPLOY_KEY_ENV as U, Credentials as V, fromConfig as W, Project as _, HubClient as a, ProjectProvider as b, registerDevelopmentClient as c, RUN_RECORD_KEY as d, RunRecordError as f, CreatedProjectNotFound as g, AmbiguousProject as h, HUB_PROJECT_NAME as i, ConvexCliNotFound as j, CodePushFailed as k, STORE_PROJECT_NAME as l, withRunRecord as m, SharedHubClientProvider as n, HubClientFailed as o, runRecord as p, registerSharedDevelopmentClient as r, HubClientProvider as s, SharedHubClient as t, state as u, ProjectDeploymentChange as v, Deployment as w, ProjectTeamChange as x, ProjectNotFound as y, ManagementApiLive as z };
+export { PushTargetMismatch as A, DEPLOY_KEY_ENV as B, DeploymentProvider as C, ConvexAppNotFound as D, CodePushFailed as E, ManagementApi as F, fromValues as H, ManagementApiLive as I, ACCESS_TOKEN_ENV as L, installedCli as M, parseDeployOutput as N, ConvexCliNotFound as O, ConvexApiError as P, Credentials as R, DeploymentIdentityChange as S, ProductionDeploymentNotFound as T, fromConfig as V, ProjectProvider as _, registerDevelopmentClient as a, AmbiguousDeployment as b, RUN_RECORD_KEY as c, withRunRecord as d, AmbiguousProject as f, ProjectNotFound as g, ProjectDeploymentChange as h, HubClientProvider as i, VariablesOwnedBySomeoneElse as j, EnvironmentNeedsDeployKey as k, RunRecordError as l, Project as m, HubClient as n, STORE_PROJECT_NAME as o, CreatedProjectNotFound as p, HubClientFailed as r, state as s, HUB_PROJECT_NAME as t, runRecord as u, ProjectTeamChange as v, DeploymentResource as w, Deployment as x, AbsoluteRootDir as y, CredentialsError as z };
 
-//# sourceMappingURL=SharedHubClient-D-FJJUCZ.js.map
+//# sourceMappingURL=HubClient-Bs5_j18U.js.map