instant-cli 1.0.21-branch-cli-codex-update.25195790564.1 → 1.0.21-branch-cli-codex.25196009658.1

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> instant-cli@1.0.21-branch-cli-codex-update.25195790564.1 build /home/runner/work/instant/instant/client/packages/cli
+> instant-cli@1.0.21-branch-cli-codex.25196009658.1 build /home/runner/work/instant/instant/client/packages/cli
 > rm -rf dist; tsc -p tsconfig.build.json
 

package/__tests__/authClientAddGoogle.test.ts

@@ -267,9 +267,7 @@ describe('web: dev credentials', () => {
     expect(output).toContain(
       'For production, use your own Google OAuth credentials.',
     );
-    expect(output).toContain(
-      'instant-cli auth client update --name google-web',
-    );
+    expect(output).not.toContain('instant-cli auth client update');
     expect(output).not.toContain('Add this redirect URI in Google Console');
   });
 
@@ -289,8 +287,9 @@ describe('web: dev credentials', () => {
     expect(output).toContain('Credentials: Instant dev credentials');
     expect(output).toContain('No Google Console setup required');
     expect(output).toContain(
-      'instant-cli auth client update --name google-web',
+      'For production, use your own Google OAuth credentials.',
     );
+    expect(output).not.toContain('instant-cli auth client update');
     expect(output).not.toContain('Add this redirect URI in Google Console');
   });
 

package/dist/commands/auth/client/add.d.ts

@@ -1,9 +1,10 @@
 import { Effect, Schema } from 'effect';
+import { FileSystem } from '@effect/platform';
 import { GlobalOpts } from '../../../context/globalOpts.ts';
 export declare const ClientTypeSchema: Schema.Literal<["google", "github", "apple", "linkedin", "clerk", "firebase"]>;
 export declare const authClientAddCmd: (opts: {
     type?: string | undefined;
     name?: string | undefined;
     app?: string | undefined;
-} & Record<string, unknown>) => Effect.Effect<void | undefined, import("../../../lib/ui.ts").UIError | import("../../../lib/http.ts").InstantHttpError | import("effect/Cause").TimeoutException | import("@effect/platform/HttpClientError").RequestError | import("effect/ParseResult").ParseError | import("@effect/platform/HttpClientError").ResponseError, GlobalOpts | import("@effect/platform/FileSystem").FileSystem | import("../../../lib/http.ts").InstantHttpAuthed | import("../../../context/currentApp.ts").CurrentApp>;
+} & Record<string, unknown>) => Effect.Effect<void | undefined, import("../../../lib/ui.ts").UIError | import("../../../lib/http.ts").InstantHttpError | import("effect/Cause").TimeoutException | import("@effect/platform/HttpClientError").RequestError | import("effect/ParseResult").ParseError | import("@effect/platform/HttpClientError").ResponseError, GlobalOpts | FileSystem.FileSystem | import("../../../lib/http.ts").InstantHttpAuthed | import("../../../context/currentApp.ts").CurrentApp>;
 //# sourceMappingURL=add.d.ts.map

package/dist/commands/auth/client/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../src/commands/auth/client/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAiB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAmD5D,eAAO,MAAM,gBAAgB,gFAO5B,CAAC;AAiqBF,eAAO,MAAM,gBAAgB;;;;wgBAwD5B,CAAC"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../src/commands/auth/client/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAiB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAiC5D,eAAO,MAAM,gBAAgB,gFAO5B,CAAC;AA63BF,eAAO,MAAM,gBAAgB;;;;6eAwD5B,CAAC"}

package/dist/commands/auth/client/add.js

@@ -1,21 +1,17 @@
 import { Effect, Match, Option, Schema } from 'effect';
+import { FileSystem } from '@effect/platform';
 import { BadArgsError } from "../../../errors.js";
 import { GlobalOpts } from "../../../context/globalOpts.js";
-import { optOrPrompt, optOrPromptBoolean, runUIEffect, validateRequired, } from "../../../lib/ui.js";
+import { optOrPrompt, optOrPromptBoolean, runUIEffect, stripFirstBlankLine, validateRequired, } from "../../../lib/ui.js";
 import { addOAuthClient, findName, getClientNameAndProvider, getOrCreateProvider, GoogleAppTypeSchema, OAuthClient, } from "../../../lib/oauth.js";
 import { DEFAULT_OAUTH_CALLBACK_URL, GOOGLE_AUTHORIZATION_ENDPOINT, GOOGLE_DISCOVERY_ENDPOINT, GOOGLE_TOKEN_ENDPOINT, APPLE_AUTHORIZATION_ENDPOINT, APPLE_DISCOVERY_ENDPOINT, APPLE_TOKEN_ENDPOINT, LINKEDIN_AUTHORIZATION_ENDPOINT, LINKEDIN_DISCOVERY_ENDPOINT, LINKEDIN_TOKEN_ENDPOINT, } from '@instantdb/platform';
 import { UI } from "../../../ui/index.js";
 import chalk from 'chalk';
 import boxen from 'boxen';
 import { link } from "../../../logging.js";
-import { appleKeyIdPrompt, applePrivateKeyFilePrompt, appleServicesIdPrompt, appleTeamIdPrompt, clerkPublishableKeyPrompt, clientIdPrompt, clientSecretPrompt, domainFromClerkKey, firebaseDiscoveryEndpoint, firebaseProjectIdPrompt, getFlag, hasAnyFlag, isTrueFlag, readPrivateKeyFile, redirectSetupMessages, redirectUriPrompt, validateFirebaseProjectId, } from "./shared.js";
 export const ClientTypeSchema = Schema.Literal('google', 'github', 'apple', 'linkedin', 'clerk', 'firebase');
-const googleConsoleUrl = 'https://console.developers.google.com/apis/credentials';
-const githubDeveloperUrl = 'https://github.com/settings/developers';
-const linkedinDeveloperUrl = 'https://www.linkedin.com/developers/apps';
-const optionalRedirectPrompt = redirectUriPrompt({
-    heading: 'Custom redirect URI (optional):',
-});
+const isTrueFlag = (value) => value === true || value === 'true';
+const hasFlag = (opts, flag) => flag in opts;
 const selectGoogleAppType = (value) => Effect.gen(function* () {
     const { yes } = yield* GlobalOpts;
     return yield* Option.fromNullable(value).pipe(Effect.catchTag('NoSuchElementException', () => {
@@ -69,12 +65,10 @@ const selectGoogleCredentialMode = Effect.fn(function* () {
 });
 const resolveGoogleCredentialMode = Effect.fn(function* ({ appType, opts, }) {
     const { yes } = yield* GlobalOpts;
-    const devCredentialsFlag = isTrueFlag(getFlag(opts, 'dev-credentials'));
-    const hasProvidedSomeCustomCredentials = hasAnyFlag(opts, [
-        'client-id',
-        'client-secret',
-        'custom-redirect-uri',
-    ]);
+    const devCredentialsFlag = isTrueFlag(opts['dev-credentials']);
+    const hasProvidedSomeCustomCredentials = hasFlag(opts, 'client-id') ||
+        hasFlag(opts, 'client-secret') ||
+        hasFlag(opts, 'custom-redirect-uri');
     if (devCredentialsFlag && appType !== 'web') {
         return yield* BadArgsError.make({
             message: '--dev-credentials is only supported for --app-type web. Native Google clients need credentials from Google.',
@@ -109,19 +103,17 @@ const printGoogleDevCredentialsClient = Effect.fn(function* ({ appType, client,
         'No Google Console setup required.',
         'Works on localhost and Expo during development.',
         '',
-        chalk.bold.underline('For production, use your own Google OAuth credentials.'),
-        'Ready for production? Run:',
-        `  instant-cli auth client update --name ${client.client_name} --client-id <id> --client-secret <secret>`,
+        chalk.bold('For production, use your own Google OAuth credentials.'),
     ].join('\n'), { dimBorder: true, padding: { right: 1, left: 1 } }));
 });
 const printGoogleCustomCredentialsClient = Effect.fn(function* ({ appType, client, clientId, customRedirectUri, redirectUri, }) {
     const redirectMessages = [];
     if (appType === 'web' && redirectUri) {
-        redirectMessages.push(...redirectSetupMessages({
-            prompt: 'Add this redirect URI in Google Console',
-            redirectUri,
-            showCustomRedirectInstructions: Boolean(customRedirectUri),
-        }));
+        redirectMessages.push('', chalk.bold('Add this redirect URI in Google Console:'), chalk.bold(redirectUri));
+        if (customRedirectUri) {
+            redirectMessages.push('', `Your custom redirect must forward to ${chalk.bold(DEFAULT_OAUTH_CALLBACK_URL)} with all query parameters preserved.`);
+            redirectMessages.push(`You can test it by visiting: ${chalk.bold(redirectUri + '?test-redirect=true')}`);
+        }
     }
     yield* Effect.log(boxen([
         `Google OAuth client created: ${client.client_name}`,
@@ -168,7 +160,14 @@ const handleGoogleClient = Effect.fn(function* (opts) {
         required: !useSharedCredentials,
         skipIf: useSharedCredentials,
         skipMessage: '--client-id is not compatible with --dev-credentials. Drop one or the other.',
-        prompt: clientIdPrompt({ providerUrl: googleConsoleUrl }),
+        prompt: {
+            prompt: `Client ID: ${chalk.dim(`(from ${link('https://console.developers.google.com/apis/credentials')})`)}`,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+            validate: validateRequired,
+        },
     });
     const usesCustomWebCredentials = !useSharedCredentials && appType === 'web';
     const clientSecret = yield* optOrPrompt(opts['client-secret'], {
@@ -178,11 +177,34 @@ const handleGoogleClient = Effect.fn(function* (opts) {
         skipMessage: useSharedCredentials
             ? '--client-secret is not compatible with --dev-credentials. Drop one or the other.'
             : undefined,
-        prompt: clientSecretPrompt({ providerUrl: googleConsoleUrl }),
+        prompt: {
+            prompt: `Client Secret: ${chalk.dim(`(from ${link('https://console.developers.google.com/apis/credentials')})`)}`,
+            validate: validateRequired,
+            sensitive: true,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     const customRedirectUri = yield* optOrPrompt(opts['custom-redirect-uri'], {
         required: false,
-        prompt: optionalRedirectPrompt,
+        prompt: {
+            prompt: '',
+            placeholder: 'https://yoursite.com/oauth/callback',
+            modifyOutput: UI.modifiers.piped([
+                (output, status) => {
+                    if (status === 'idle') {
+                        return (`\nCustom redirect URI (optional):
+${chalk.dim('With a custom redirect URI, users will see "Redirecting to yoursite.com..." for a more branded experience.')}
+${chalk.dim(`Your URI must forward to ${DEFAULT_OAUTH_CALLBACK_URL} with all query parameters preserved.`)}\n\n` +
+                            stripFirstBlankLine(output));
+                    }
+                    return `\nCustom redirect URI (optional):\n${stripFirstBlankLine(output)}`;
+                },
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
         simpleName: '--custom-redirect-uri',
         skipIf: !usesCustomWebCredentials,
         skipMessage: useSharedCredentials
@@ -231,19 +253,49 @@ const handleGithubClient = Effect.fn(function* (opts) {
         simpleName: '--client-id',
         required: true,
         skipIf: false,
-        prompt: clientIdPrompt({ providerUrl: githubDeveloperUrl }),
+        prompt: {
+            prompt: `Client ID ${chalk.dim(`(from ${link('https://github.com/settings/developers')})`)}`,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+            validate: validateRequired,
+        },
     });
     const clientSecret = yield* optOrPrompt(opts['client-secret'], {
         required: true,
         skipIf: false,
         simpleName: '--client-secret',
-        prompt: clientSecretPrompt({ providerUrl: githubDeveloperUrl }),
+        prompt: {
+            prompt: `Client Secret: ${chalk.dim(`(from ${link('https://github.com/settings/developers')})`)}`,
+            validate: validateRequired,
+            sensitive: true,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     const customRedirectUri = yield* optOrPrompt(opts['custom-redirect-uri'], {
         required: false,
         simpleName: '--custom-redirect-uri',
         skipIf: false,
-        prompt: optionalRedirectPrompt,
+        prompt: {
+            prompt: '',
+            placeholder: 'https://yoursite.com/oauth/callback',
+            modifyOutput: UI.modifiers.piped([
+                (output, status) => {
+                    if (status === 'idle') {
+                        return (`\nCustom redirect URI (optional):
+${chalk.dim('With a custom redirect URI, users will see "Redirecting to yoursite.com..." for a more branded experience.')}
+${chalk.dim(`Your URI must forward to ${DEFAULT_OAUTH_CALLBACK_URL} with all query parameters preserved.`)}\n\n` +
+                            stripFirstBlankLine(output));
+                    }
+                    return `\nCustom redirect URI (optional):\n${stripFirstBlankLine(output)}`;
+                },
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     if (!clientName) {
         return yield* BadArgsError.make({ message: 'Client name is required.' });
@@ -259,11 +311,13 @@ const handleGithubClient = Effect.fn(function* (opts) {
         redirectTo: redirectUri,
         meta: { providerName: 'github' },
     });
-    const redirectMessages = redirectSetupMessages({
-        prompt: 'Add this callback URL in your GitHub OAuth App settings',
-        redirectUri,
-        showCustomRedirectInstructions: Boolean(customRedirectUri),
-    });
+    const redirectMessages = [
+        chalk.bold(`\nAdd this callback URL in your GitHub OAuth App settings:\n${redirectUri}\n`),
+    ];
+    if (customRedirectUri) {
+        redirectMessages.push(`Your custom redirect must forward to ${chalk.bold(DEFAULT_OAUTH_CALLBACK_URL)} with all query parameters preserved.`);
+        redirectMessages.push(`You can test it by visiting: ${chalk.bold(redirectUri + '?test-redirect=true')}`);
+    }
     yield* Effect.log(boxen([
         `GitHub OAuth client created: ${response.client.client_name}`,
         `ID: ${response.client.id}`,
@@ -277,19 +331,49 @@ const handleLinkedInClient = Effect.fn(function* (opts) {
         simpleName: '--client-id',
         required: true,
         skipIf: false,
-        prompt: clientIdPrompt({ providerUrl: linkedinDeveloperUrl }),
+        prompt: {
+            prompt: `Client ID: ${chalk.dim(`(from ${link('https://www.linkedin.com/developers/apps')})`)}`,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+            validate: validateRequired,
+        },
     });
     const clientSecret = yield* optOrPrompt(opts['client-secret'], {
         required: true,
         skipIf: false,
         simpleName: '--client-secret',
-        prompt: clientSecretPrompt({ providerUrl: linkedinDeveloperUrl }),
+        prompt: {
+            prompt: `Client Secret: ${chalk.dim(`(from ${link('https://www.linkedin.com/developers/apps')})`)}`,
+            validate: validateRequired,
+            sensitive: true,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     const customRedirectUri = yield* optOrPrompt(opts['custom-redirect-uri'], {
         required: false,
         simpleName: '--custom-redirect-uri',
         skipIf: false,
-        prompt: optionalRedirectPrompt,
+        prompt: {
+            prompt: '',
+            placeholder: 'https://yoursite.com/oauth/callback',
+            modifyOutput: UI.modifiers.piped([
+                (output, status) => {
+                    if (status === 'idle') {
+                        return (`\nCustom redirect URI (optional):
+${chalk.dim('With a custom redirect URI, users will see "Redirecting to yoursite.com..." for a more branded experience.')}
+${chalk.dim(`Your URI must forward to ${DEFAULT_OAUTH_CALLBACK_URL} with all query parameters preserved.`)}\n\n` +
+                            stripFirstBlankLine(output));
+                    }
+                    return `\nCustom redirect URI (optional):\n${stripFirstBlankLine(output)}`;
+                },
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     if (!clientName) {
         return yield* BadArgsError.make({ message: 'Client name is required.' });
@@ -305,11 +389,13 @@ const handleLinkedInClient = Effect.fn(function* (opts) {
         discoveryEndpoint: LINKEDIN_DISCOVERY_ENDPOINT,
         redirectTo: redirectUri,
     });
-    const redirectMessages = redirectSetupMessages({
-        prompt: 'Add this redirect URI in your LinkedIn app settings',
-        redirectUri,
-        showCustomRedirectInstructions: Boolean(customRedirectUri),
-    });
+    const redirectMessages = [
+        chalk.bold(`\nAdd this redirect URI in your LinkedIn app settings:\n${redirectUri}\n`),
+    ];
+    if (customRedirectUri) {
+        redirectMessages.push(`Your custom redirect must forward to ${chalk.bold(DEFAULT_OAUTH_CALLBACK_URL)} with all query parameters preserved.`);
+        redirectMessages.push(`You can test it by visiting: ${chalk.bold(redirectUri + '?test-redirect=true')}`);
+    }
     yield* Effect.log(boxen([
         `LinkedIn OAuth client created: ${response.client.client_name}`,
         `ID: ${response.client.id}`,
@@ -317,6 +403,22 @@ const handleLinkedInClient = Effect.fn(function* (opts) {
         ...redirectMessages,
     ].join('\n'), { dimBorder: true, padding: { right: 1, left: 1 } }));
 });
+const readPrivateKeyFile = Effect.fn('readPrivateKeyFile')(function* (path) {
+    const fs = yield* FileSystem.FileSystem;
+    // Strip shell-escape backslashes so paths like "file\ (2).p8" resolve correctly.
+    // Only on POSIX — Windows uses backslashes as path separators.
+    const normalizedPath = process.platform === 'win32' ? path : path.replace(/\\(.)/g, '$1');
+    const contents = yield* fs.readFileString(normalizedPath, 'utf8').pipe(Effect.mapError((e) => new BadArgsError({
+        message: `Could not read private key file at ${normalizedPath}: ${e.message}`,
+    })));
+    const trimmed = contents.trim();
+    if (!trimmed) {
+        return yield* BadArgsError.make({
+            message: `Private key file at ${normalizedPath} is empty.`,
+        });
+    }
+    return trimmed;
+});
 const handleAppleClient = Effect.fn(function* (opts) {
     const { yes } = yield* GlobalOpts;
     const { clientName, provider } = yield* getClientNameAndProvider('apple', opts);
@@ -324,7 +426,14 @@ const handleAppleClient = Effect.fn(function* (opts) {
         simpleName: '--services-id',
         required: true,
         skipIf: false,
-        prompt: appleServicesIdPrompt({}),
+        prompt: {
+            prompt: `Services ID ${chalk.dim(`(from ${link('https://developer.apple.com/account/resources/identifiers/list/serviceId')})`)}`,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+            validate: validateRequired,
+        },
     });
     // If any web-flow flag is provided, enable web flow; otherwise ask
     // (non-interactively with --yes we default to native-only).
@@ -350,21 +459,42 @@ const handleAppleClient = Effect.fn(function* (opts) {
         required: true,
         skipIf: skipWeb,
         skipMessage: `--team-id ${webSkipMessage}`,
-        prompt: appleTeamIdPrompt({}),
+        prompt: {
+            prompt: `Team ID ${chalk.dim(`(from ${link('https://developer.apple.com/account#MembershipDetailsCard')})`)}`,
+            validate: validateRequired,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     const keyId = yield* optOrPrompt(opts['key-id'], {
         simpleName: '--key-id',
         required: true,
         skipIf: skipWeb,
         skipMessage: `--key-id ${webSkipMessage}`,
-        prompt: appleKeyIdPrompt({}),
+        prompt: {
+            prompt: `Key ID ${chalk.dim(`(from ${link('https://developer.apple.com/account/resources/authkeys/list')})`)}`,
+            validate: validateRequired,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     const privateKeyPath = yield* optOrPrompt(opts['private-key-file'], {
         simpleName: '--private-key-file',
         required: true,
         skipIf: skipWeb,
         skipMessage: `--private-key-file ${webSkipMessage}`,
-        prompt: applePrivateKeyFilePrompt({}),
+        prompt: {
+            prompt: `Path to .p8 private key file ${chalk.dim('(downloaded from Apple)')}`,
+            validate: validateRequired,
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     const privateKey = privateKeyPath
         ? yield* readPrivateKeyFile(privateKeyPath)
@@ -374,7 +504,22 @@ const handleAppleClient = Effect.fn(function* (opts) {
         simpleName: '--custom-redirect-uri',
         skipIf: skipWeb,
         skipMessage: `--custom-redirect-uri ${webSkipMessage}`,
-        prompt: optionalRedirectPrompt,
+        prompt: {
+            prompt: '',
+            placeholder: 'https://yoursite.com/oauth/callback',
+            modifyOutput: UI.modifiers.piped([
+                (output, status) => {
+                    if (status === 'idle') {
+                        return (`\nCustom redirect URI (optional):
+${chalk.dim('With a custom redirect URI, users will see "Redirecting to yoursite.com..." for a more branded experience.')}
+${chalk.dim(`Your URI must forward to ${DEFAULT_OAUTH_CALLBACK_URL} with all query parameters preserved.`)}\n\n` +
+                            stripFirstBlankLine(output));
+                    }
+                    return `\nCustom redirect URI (optional):\n${stripFirstBlankLine(output)}`;
+                },
+                UI.modifiers.dimOnComplete,
+            ]),
+        },
     });
     if (!clientName) {
         return yield* BadArgsError.make({ message: 'Client name is required.' });
@@ -403,14 +548,14 @@ const handleAppleClient = Effect.fn(function* (opts) {
         `ID: ${response.client.id}`,
         `Services ID: ${response.client.client_id ?? servicesId}`,
     ];
-    if (privateKey && redirectUri) {
+    if (privateKey) {
         summaryLines.push(`Team ID: ${teamId}`);
         summaryLines.push(`Key ID: ${keyId}`);
-        summaryLines.push(...redirectSetupMessages({
-            prompt: `Add this return URL under your Services ID on ${link('https://developer.apple.com', 'developer.apple.com')}`,
-            redirectUri,
-            showCustomRedirectInstructions: Boolean(customRedirectUri),
-        }));
+        summaryLines.push(chalk.bold(`\nAdd this return URL under your Services ID on ${link('https://developer.apple.com', 'developer.apple.com')}:\n${redirectUri}\n`));
+        if (customRedirectUri) {
+            summaryLines.push(`Your custom redirect must forward to ${chalk.bold(DEFAULT_OAUTH_CALLBACK_URL)} with all query parameters preserved.`);
+            summaryLines.push(`You can test it by visiting: ${chalk.bold(redirectUri + '?test-redirect=true')}`);
+        }
     }
     yield* Effect.log(boxen(summaryLines.join('\n'), {
         dimBorder: true,
@@ -423,7 +568,22 @@ const handleClerkClient = Effect.fn(function* (opts) {
         simpleName: '--publishable-key',
         required: true,
         skipIf: false,
-        prompt: clerkPublishableKeyPrompt({}),
+        prompt: {
+            prompt: `Clerk publishable key ${chalk.dim(`(from ${link('https://dashboard.clerk.com/last-active?path=api-keys')})`)}`,
+            placeholder: 'pk_********************************************************',
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+            validate: (val) => {
+                if (!val) {
+                    return 'Publishable key is required';
+                }
+                if (!val.startsWith('pk_')) {
+                    return 'Invalid publishable key. It should start with "pk_".';
+                }
+            },
+        },
     });
     if (!clientName) {
         return yield* BadArgsError.make({ message: 'Client name is required.' });
@@ -460,11 +620,27 @@ const handleClerkClient = Effect.fn(function* (opts) {
 });
 const handleFirebaseClient = Effect.fn(function* (opts) {
     const { clientName, provider } = yield* getClientNameAndProvider('firebase', opts);
+    const firebaseProjectIdRegex = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
     const projectId = yield* optOrPrompt(opts['project-id'], {
         simpleName: '--project-id',
         required: true,
         skipIf: false,
-        prompt: firebaseProjectIdPrompt({}),
+        prompt: {
+            prompt: `Firebase project ID: (From Project Settings page on ${link('https://console.firebase.google.com/')})`,
+            placeholder: '',
+            modifyOutput: UI.modifiers.piped([
+                UI.modifiers.topPadding,
+                UI.modifiers.dimOnComplete,
+            ]),
+            validate: (val) => {
+                if (!val) {
+                    return 'Project ID is required';
+                }
+                if (!firebaseProjectIdRegex.test(val)) {
+                    return 'Invalid Firebase project ID. It must be 6-30 characters, start with a lowercase letter, contain only lowercase letters, digits, and hyphens, and not end with a hyphen.';
+                }
+            },
+        },
     });
     // typeguard
     if (!clientName || !projectId) {
@@ -472,14 +648,15 @@ const handleFirebaseClient = Effect.fn(function* (opts) {
             message: 'Missing required arguments',
         });
     }
-    const validationError = validateFirebaseProjectId(projectId);
-    if (validationError) {
-        return yield* BadArgsError.make({ message: validationError });
+    if (!firebaseProjectIdRegex.test(projectId)) {
+        return yield* BadArgsError.make({
+            message: 'Invalid Firebase project ID. It must be 6-30 characters, start with a lowercase letter, contain only lowercase letters, digits, and hyphens, and not end with a hyphen.',
+        });
     }
     const response = yield* addOAuthClient({
         providerId: provider.id,
         clientName,
-        discoveryEndpoint: firebaseDiscoveryEndpoint(projectId),
+        discoveryEndpoint: `https://securetoken.google.com/${encodeURIComponent(projectId)}/.well-known/openid-configuration`,
     });
     yield* Effect.log(boxen([
         `Firebase OAuth client created: ${response.client.client_name}`,
@@ -513,4 +690,29 @@ export const authClientAddCmd = Effect.fn(function* (opts) {
     yield* Effect.logError(e.message);
     yield* Effect.log(chalk.dim('hint: run `instant-cli auth client add --help` for the list of available arguments'));
 })));
+function domainFromClerkKey(key) {
+    try {
+        const parts = key.split('_');
+        const domainPartB64 = parts[parts.length - 1];
+        const domainPart = base64Decode(domainPartB64);
+        return domainPart.replace('$', '');
+    }
+    catch (e) {
+        console.error('Error getting domain from clerk key', e);
+        return null;
+    }
+}
+// Base64 decode, switching to url-safe decode if we hit an error
+// Can't be sure which method Clerk uses because you can't generate
+// `+` or `/` with characters that go in a normal host. Urls with
+// chinese characters exist, they might encode to `+` or `/`, and
+// Clerk might support them, so we'll be safe and do both.
+function base64Decode(s) {
+    try {
+        return Buffer.from(s, 'base64').toString('utf-8');
+    }
+    catch (e) {
+        return Buffer.from(s, 'base64url').toString('utf-8');
+    }
+}
 //# sourceMappingURL=add.js.map