instant-cli 1.0.22 → 1.0.23-branch-cli-codex-update.25390498340.1

package/dist/commands/auth/client/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../../src/commands/auth/client/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAI1C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAA6B,EAAE,IAAY,EAAE,EAAE,CACrE,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAA6B,EAAE,IAAY,EAAE,EAAE,CACrE,IAAI,IAAI,IAAI,CAAC;AAEf,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAA6B,EAAE,KAAe,EAAE,EAAE,CAC3E,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,EAAE,CAC3C,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAa,EAAE,GAAW,EAAE,EAAE;IAC1D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,KAAK,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,WAAW,EAA2B,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,cAAc,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE;IAChE,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EACjC,WAAW,GAGZ,EAAE,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,kBAAkB,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE;IACpE,QAAQ,EAAE,gBAAgB;IAC1B,SAAS,EAAE,IAAI;IACf,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAE,OAAO,EAAuB,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,EAAE;IACV,WAAW,EAAE,qCAAqC;IAClD,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,CACL,KAAK,OAAO;EACpB,KAAK,CAAC,GAAG,CAAC,4GAA4G,CAAC;EACvH,KAAK,CAAC,GAAG,CAAC,4BAA4B,0BAA0B,uCAAuC,CAAC,MAAM;oBACtG,mBAAmB,CAAC,MAAM,CAAC,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,OAAO,KAAK,OAAO,aAAa,CAAC;YACnC,CAAC;YACD,OAAO,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EACpC,MAAM,EACN,WAAW,EACX,8BAA8B,GAK/B,EAAE,EAAE;IACH,MAAM,QAAQ,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEzE,IAAI,8BAA8B,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CACX,EAAE,EACF,wCAAwC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,uCAAuC,CACtH,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,gCAAgC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,qBAAqB,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,eAAe,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,0EAA0E,CAAC,GAAG,CAAC,EAAE;IAChI,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,WAAW,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,2DAA2D,CAAC,GAAG,CAAC,EAAE;IAC7G,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,6DAA6D,CAAC,GAAG,CAAC,EAAE;IAC9G,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,gCAAgC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE;IAC9E,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,yBAAyB,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,uDAAuD,CAAC,GAAG,CAAC,EAAE;IACvH,WAAW,EAAE,6DAA6D;IAC1E,QAAQ,EAAE,CAAC,GAAW,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO,6BAA6B,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,sDAAsD,CAAC;QAChE,CAAC;IACH,CAAC;IACD,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,uDAAuD,IAAI,CAAC,sCAAsC,CAAC,GAAG;IAC9G,QAAQ,EAAE,yBAAyB;IACnC,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU;QACvB,EAAE,CAAC,SAAS,CAAC,aAAa;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EACzE,IAAY;IAEZ,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,qEAAqE;IACrE,MAAM,cAAc,GAClB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,YAAY,CAAC;QACf,OAAO,EAAE,sCAAsC,cAAc,KAAK,CAAC,CAAC,OAAO,EAAE;KAC9E,CAAC,CACL,CACF,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;YAC9B,OAAO,EAAE,uBAAuB,cAAc,YAAY;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,cAAc,GAAG,gCAAgC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,wBAAwB,CAAC;IAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,yKAAyK,CAAC;IACnL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,kCAAkC,kBAAkB,CAAC,SAAS,CAAC,mCAAmC,CAAC;AAC5G,CAAC","sourcesContent":["import { FileSystem } from '@effect/platform';\nimport { Effect } from 'effect';\nimport { DEFAULT_OAUTH_CALLBACK_URL } from '@instantdb/platform';\nimport chalk from 'chalk';\nimport { BadArgsError } from '../../../errors.ts';\nimport { link } from '../../../logging.ts';\nimport { stripFirstBlankLine, validateRequired } from '../../../lib/ui.ts';\nimport { UI } from '../../../ui/index.ts';\n\ntype EmptyPromptArgs = Record<string, never>;\n\nexport const getFlag = (opts: Record<string, unknown>, flag: string) =>\n  opts[flag];\n\nexport const hasFlag = (opts: Record<string, unknown>, flag: string) =>\n  flag in opts;\n\nexport const hasAnyFlag = (opts: Record<string, unknown>, flags: string[]) =>\n  flags.some((flag) => hasFlag(opts, flag));\n\nexport const isTrueFlag = (value: unknown) =>\n  value === true || value === 'true';\n\nexport const getMetaString = (meta: unknown, key: string) => {\n  if (!meta || typeof meta !== 'object') return undefined;\n  const value = (meta as Record<string, unknown>)[key];\n  return typeof value === 'string' ? value : undefined;\n};\n\nexport const clientIdPrompt = ({ providerUrl }: { providerUrl: string }) => ({\n  prompt: `Client ID: ${chalk.dim(`(from ${link(providerUrl)})`)}`,\n  validate: validateRequired,\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const clientSecretPrompt = ({\n  providerUrl,\n}: {\n  providerUrl: string;\n}) => ({\n  prompt: `Client Secret: ${chalk.dim(`(from ${link(providerUrl)})`)}`,\n  validate: validateRequired,\n  sensitive: true,\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const redirectUriPrompt = ({ heading }: { heading: string }) => ({\n  prompt: '',\n  placeholder: 'https://yoursite.com/oauth/callback',\n  modifyOutput: UI.modifiers.piped([\n    (output, status) => {\n      if (status === 'idle') {\n        return (\n          `\\n${heading}\n${chalk.dim('With a custom redirect URI, users will see \"Redirecting to yoursite.com...\" for a more branded experience.')}\n${chalk.dim(`Your URI must forward to ${DEFAULT_OAUTH_CALLBACK_URL} with all query parameters preserved.`)}\\n\\n` +\n          stripFirstBlankLine(output)\n        );\n      }\n      const answer = stripFirstBlankLine(output);\n      if (status === 'submitted' && answer.trim() === '') {\n        return `\\n${heading}\\n(skipped)`;\n      }\n      return `\\n${heading}\\n${answer}`;\n    },\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const redirectSetupMessages = ({\n  prompt,\n  redirectUri,\n  showCustomRedirectInstructions,\n}: {\n  prompt: string;\n  redirectUri: string;\n  showCustomRedirectInstructions?: boolean;\n}) => {\n  const messages = ['', chalk.bold(`${prompt}:`), chalk.bold(redirectUri)];\n\n  if (showCustomRedirectInstructions) {\n    messages.push(\n      '',\n      `Your custom redirect must forward to ${chalk.bold(DEFAULT_OAUTH_CALLBACK_URL)} with all query parameters preserved.`,\n    );\n    messages.push(\n      `You can test it by visiting: ${chalk.bold(redirectUri + '?test-redirect=true')}`,\n    );\n  }\n\n  return messages;\n};\n\nexport const appleServicesIdPrompt = (_opts: EmptyPromptArgs) => ({\n  prompt: `Services ID ${chalk.dim(`(from ${link('https://developer.apple.com/account/resources/identifiers/list/serviceId')})`)}`,\n  validate: validateRequired,\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const appleTeamIdPrompt = (_opts: EmptyPromptArgs) => ({\n  prompt: `Team ID ${chalk.dim(`(from ${link('https://developer.apple.com/account#MembershipDetailsCard')})`)}`,\n  validate: validateRequired,\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const appleKeyIdPrompt = (_opts: EmptyPromptArgs) => ({\n  prompt: `Key ID ${chalk.dim(`(from ${link('https://developer.apple.com/account/resources/authkeys/list')})`)}`,\n  validate: validateRequired,\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const applePrivateKeyFilePrompt = (_opts: EmptyPromptArgs) => ({\n  prompt: `Path to .p8 private key file ${chalk.dim('(downloaded from Apple)')}`,\n  validate: validateRequired,\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const clerkPublishableKeyPrompt = (_opts: EmptyPromptArgs) => ({\n  prompt: `Clerk publishable key ${chalk.dim(`(from ${link('https://dashboard.clerk.com/last-active?path=api-keys')})`)}`,\n  placeholder: 'pk_********************************************************',\n  validate: (val: string) => {\n    if (!val) return 'Publishable key is required';\n    if (!val.startsWith('pk_')) {\n      return 'Invalid publishable key. It should start with \"pk_\".';\n    }\n  },\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const firebaseProjectIdPrompt = (_opts: EmptyPromptArgs) => ({\n  prompt: `Firebase project ID: (From Project Settings page on ${link('https://console.firebase.google.com/')})`,\n  validate: validateFirebaseProjectId,\n  modifyOutput: UI.modifiers.piped([\n    UI.modifiers.topPadding,\n    UI.modifiers.dimOnComplete,\n  ]),\n});\n\nexport const readPrivateKeyFile = Effect.fn('readPrivateKeyFile')(function* (\n  path: string,\n) {\n  const fs = yield* FileSystem.FileSystem;\n  // Strip shell escapes so paths like \"file\\ (2).p8\" resolve on POSIX.\n  const normalizedPath =\n    process.platform === 'win32' ? path : path.replace(/\\\\(.)/g, '$1');\n  const contents = yield* fs.readFileString(normalizedPath, 'utf8').pipe(\n    Effect.mapError(\n      (e) =>\n        new BadArgsError({\n          message: `Could not read private key file at ${normalizedPath}: ${e.message}`,\n        }),\n    ),\n  );\n\n  const trimmed = contents.trim();\n  if (!trimmed) {\n    return yield* BadArgsError.make({\n      message: `Private key file at ${normalizedPath} is empty.`,\n    });\n  }\n  return trimmed;\n});\n\nexport function validateFirebaseProjectId(value: string) {\n  const projectIdRegex = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;\n  if (!value) return 'Project ID is required';\n  if (!projectIdRegex.test(value)) {\n    return 'Invalid Firebase project ID. It must be 6-30 characters, start with a lowercase letter, contain only lowercase letters, digits, and hyphens, and not end with a hyphen.';\n  }\n}\n\nexport function firebaseDiscoveryEndpoint(projectId: string) {\n  return `https://securetoken.google.com/${encodeURIComponent(projectId)}/.well-known/openid-configuration`;\n}\n"]}

package/dist/commands/auth/client/update.d.ts

@@ -0,0 +1,8 @@
+import { Effect } from 'effect';
+import { GlobalOpts } from '../../../context/globalOpts.ts';
+export declare const authClientUpdateCmd: (opts: {
+    id?: string | undefined;
+    name?: string | undefined;
+    app?: string | undefined;
+} & Record<string, unknown>) => Effect.Effect<void | undefined, import("../../../lib/ui.ts").UIError | import("../../../lib/http.ts").InstantHttpError | import("effect/Cause").TimeoutException | import("@effect/platform/HttpClientError").RequestError | import("effect/ParseResult").ParseError | import("@effect/platform/HttpClientError").ResponseError, GlobalOpts | import("@effect/platform/FileSystem").FileSystem | import("../../../lib/http.ts").InstantHttpAuthed | import("../../../context/currentApp.ts").CurrentApp>;
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/auth/client/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/commands/auth/client/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAS,MAAM,QAAQ,CAAC;AAGvC,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAoxB5D,eAAO,MAAM,mBAAmB;;;;wgBA6D/B,CAAC"}

package/dist/commands/auth/client/update.js

@@ -0,0 +1,515 @@
+import { Effect, Match } from 'effect';
+import { BadArgsError } from "../../../errors.js";
+import { GlobalOpts } from "../../../context/globalOpts.js";
+import { optOrPrompt, runUIEffect } from "../../../lib/ui.js";
+import { findClientByIdOrName, getAppsAuth, OAuthClient, updateOAuthClient, } from "../../../lib/oauth.js";
+import { UI } from "../../../ui/index.js";
+import { clerkDomainFromPublishableKey, DEFAULT_OAUTH_CALLBACK_URL, } from '@instantdb/platform';
+import chalk from 'chalk';
+import boxen from 'boxen';
+import { appleKeyIdPrompt, applePrivateKeyFilePrompt, appleServicesIdPrompt, appleTeamIdPrompt, clerkPublishableKeyPrompt, clientIdPrompt, clientSecretPrompt, firebaseDiscoveryEndpoint, firebaseProjectIdPrompt, getFlag, getMetaString, hasAnyFlag, hasFlag, isTrueFlag, readPrivateKeyFile, redirectSetupMessages, redirectUriPrompt, validateFirebaseProjectId, } from "./shared.js";
+import { link } from "../../../logging.js";
+const redirectPrompt = redirectUriPrompt({
+    heading: 'Custom redirect URI (optional):',
+});
+const newRedirectPrompt = redirectUriPrompt({ heading: 'New redirect URI:' });
+const googleConsoleUrl = 'https://console.developers.google.com/apis/credentials';
+const resolveClient = Effect.fn(function* (params) {
+    const { yes } = yield* GlobalOpts;
+    if (params.id || params.name) {
+        return yield* findClientByIdOrName({
+            id: params.id,
+            name: params.name,
+        });
+    }
+    if (yes) {
+        return yield* BadArgsError.make({ message: 'Must specify --id or --name' });
+    }
+    const auth = yield* getAppsAuth();
+    const clients = (auth.oauth_clients ?? []);
+    if (clients.length === 0) {
+        return yield* BadArgsError.make({
+            message: 'No OAuth clients found for this app.',
+        });
+    }
+    return yield* runUIEffect(new UI.Select({
+        options: clients.map((client) => ({
+            label: client.client_name +
+                (client.use_shared_credentials
+                    ? chalk.dim(' (dev credentials)')
+                    : '') +
+                chalk.dim(` (${client.id})`),
+            value: client,
+        })),
+        promptText: 'Select a client to update:',
+        modifyOutput: UI.modifiers.dimOnComplete,
+    })).pipe(Effect.catchTag('UIError', (e) => BadArgsError.make({ message: `UI error: ${e.message}` })), Effect.map((client) => ({ auth, client })));
+});
+const selectUpdateAction = Effect.fn(function* (options) {
+    return yield* runUIEffect(new UI.Select({
+        options,
+        promptText: 'What do you want to update?',
+        modifyOutput: UI.modifiers.dimOnComplete,
+    })).pipe(Effect.catchTag('UIError', (e) => BadArgsError.make({ message: `UI error: ${e.message}` })));
+});
+const updateGoogleToDevCredentials = Effect.fn(function* (client) {
+    const response = yield* updateOAuthClient({
+        oauthClientId: client.id,
+        clientId: null,
+        clientSecret: null,
+        useSharedCredentials: true,
+        redirectTo: null,
+    });
+    yield* Effect.log(boxen([
+        `Google OAuth client updated: ${response.client.client_name}`,
+        'Credentials: Instant dev credentials',
+        `ID: ${response.client.id}`,
+        '',
+        'No Google Console setup required.',
+        'Works on localhost and Expo during development.',
+        '',
+        chalk.bold('Ready for production? Run:'),
+        `  instant-cli auth client update --name ${response.client.client_name} --client-id <id> --client-secret <secret>`,
+    ].join('\n'), { dimBorder: true, padding: { right: 1, left: 1 } }));
+});
+const hasGoogleCustomCredentialFlags = (opts) => hasAnyFlag(opts, ['client-id', 'client-secret', 'custom-redirect-uri']);
+const hasGoogleUpdateFlags = (opts) => isTrueFlag(getFlag(opts, 'dev-credentials')) ||
+    hasGoogleCustomCredentialFlags(opts);
+const optOrPromptWhenNeeded = (opts, flag, params) => Effect.gen(function* () {
+    const value = getFlag(opts, flag);
+    if (value === undefined && !params.promptIf)
+        return undefined;
+    return yield* optOrPrompt(value, {
+        simpleName: `--${flag}`,
+        required: params.required ?? params.promptIf,
+        skipIf: false,
+        prompt: params.prompt,
+    });
+});
+const selectGoogleUpdateMode = Effect.fn(function* ({ isWeb, switchingFromShared, }) {
+    if (switchingFromShared) {
+        return yield* runUIEffect(new UI.Select({
+            options: [
+                { label: 'Custom Google credentials', value: 'custom' },
+                {
+                    label: 'Instant dev credentials' + chalk.dim(' (current)'),
+                    value: 'none',
+                },
+            ],
+            promptText: 'Choose credential mode:',
+            modifyOutput: UI.modifiers.dimOnComplete,
+        })).pipe(Effect.catchTag('UIError', (e) => BadArgsError.make({ message: `UI error: ${e.message}` })));
+    }
+    const options = [
+        { label: 'Update Client ID and Client Secret', value: 'custom' },
+    ];
+    if (isWeb) {
+        options.push({
+            label: 'Switch to Instant dev credentials' +
+                chalk.dim(' (localhost and Expo, no Google setup)'),
+            value: 'dev',
+        }, { label: 'Update redirect URI', value: 'redirect' });
+    }
+    return yield* selectUpdateAction(options);
+});
+const resolveGoogleUpdateMode = Effect.fn(function* ({ opts, isWeb, switchingFromShared, }) {
+    const { yes } = yield* GlobalOpts;
+    const devCredentialsFlag = isTrueFlag(getFlag(opts, 'dev-credentials'));
+    const hasProvidedSomeCustomCredentials = hasGoogleCustomCredentialFlags(opts);
+    if (devCredentialsFlag && !isWeb) {
+        return yield* BadArgsError.make({
+            message: '--dev-credentials is only supported for Google web clients.',
+        });
+    }
+    if (!isWeb &&
+        (hasFlag(opts, 'client-secret') || hasFlag(opts, 'custom-redirect-uri'))) {
+        return yield* BadArgsError.make({
+            message: '--client-secret and --custom-redirect-uri are only supported for Google web clients.',
+        });
+    }
+    if (devCredentialsFlag && hasProvidedSomeCustomCredentials) {
+        return yield* BadArgsError.make({
+            message: '--dev-credentials cannot be combined with --client-id, --client-secret, or --custom-redirect-uri.',
+        });
+    }
+    if (devCredentialsFlag) {
+        return 'dev';
+    }
+    const hasAnyUpdateFlag = hasGoogleUpdateFlags(opts);
+    if (yes && !hasAnyUpdateFlag) {
+        return yield* BadArgsError.make({
+            message: 'Must specify at least one of --client-id, --client-secret, --custom-redirect-uri, or --dev-credentials.',
+        });
+    }
+    if (yes &&
+        isWeb &&
+        switchingFromShared &&
+        (!hasFlag(opts, 'client-id') || !hasFlag(opts, 'client-secret'))) {
+        return yield* BadArgsError.make({
+            message: 'Must specify both --client-id and --client-secret when switching from Instant dev credentials to custom credentials with --yes.',
+        });
+    }
+    if (hasAnyUpdateFlag) {
+        return 'custom';
+    }
+    return yield* selectGoogleUpdateMode({ isWeb, switchingFromShared });
+});
+const updateGoogleRedirect = Effect.fn(function* ({ opts, client, }) {
+    const redirectTo = yield* optOrPromptWhenNeeded(opts, 'custom-redirect-uri', {
+        promptIf: true,
+        required: true,
+        prompt: newRedirectPrompt,
+    });
+    if (!redirectTo) {
+        return yield* BadArgsError.make({
+            message: 'Missing required value for --custom-redirect-uri',
+        });
+    }
+    const response = yield* updateOAuthClient({
+        oauthClientId: client.id,
+        redirectTo,
+    });
+    yield* Effect.log(boxen([
+        `Google OAuth client updated: ${response.client.client_name}`,
+        `ID: ${response.client.id}`,
+        ...redirectSetupMessages({
+            prompt: 'Add this redirect URI in Google Console',
+            redirectUri: redirectTo,
+            showCustomRedirectInstructions: true,
+        }),
+    ].join('\n'), { dimBorder: true, padding: { right: 1, left: 1 } }));
+});
+const updateGoogleCustomCredentials = Effect.fn(function* ({ opts, client, isWeb, switchingFromShared, promptCredentials, }) {
+    const mustCollectCredentials = promptCredentials || switchingFromShared;
+    const shouldPromptClientId = promptCredentials || (switchingFromShared && !hasFlag(opts, 'client-id'));
+    const shouldPromptClientSecret = isWeb &&
+        (promptCredentials ||
+            (switchingFromShared && !hasFlag(opts, 'client-secret')));
+    const shouldPromptRedirectUri = isWeb && switchingFromShared && promptCredentials;
+    const clientId = yield* optOrPromptWhenNeeded(opts, 'client-id', {
+        promptIf: shouldPromptClientId,
+        required: mustCollectCredentials,
+        prompt: clientIdPrompt({ providerUrl: googleConsoleUrl }),
+    });
+    const clientSecret = yield* optOrPromptWhenNeeded(opts, 'client-secret', {
+        promptIf: shouldPromptClientSecret,
+        required: isWeb && mustCollectCredentials,
+        prompt: clientSecretPrompt({ providerUrl: googleConsoleUrl }),
+    });
+    const customRedirectUri = isWeb
+        ? yield* optOrPromptWhenNeeded(opts, 'custom-redirect-uri', {
+            promptIf: shouldPromptRedirectUri,
+            required: false,
+            prompt: redirectPrompt,
+        })
+        : undefined;
+    const redirectTo = switchingFromShared
+        ? customRedirectUri || client.redirect_to || DEFAULT_OAUTH_CALLBACK_URL
+        : customRedirectUri;
+    const response = yield* updateOAuthClient({
+        oauthClientId: client.id,
+        clientId,
+        clientSecret,
+        redirectTo,
+        useSharedCredentials: switchingFromShared ? false : undefined,
+    });
+    const lines = [
+        `Google OAuth client updated: ${response.client.client_name}`,
+        'Credentials: custom',
+        `ID: ${response.client.id}`,
+    ];
+    if (switchingFromShared) {
+        lines.push('', 'This client no longer uses Instant dev credentials.');
+    }
+    if (isWeb && redirectTo) {
+        lines.push(...redirectSetupMessages({
+            prompt: 'Add this redirect URI in Google Console',
+            redirectUri: redirectTo,
+            showCustomRedirectInstructions: Boolean(customRedirectUri),
+        }));
+    }
+    yield* Effect.log(boxen(lines.join('\n'), {
+        dimBorder: true,
+        padding: { right: 1, left: 1 },
+    }));
+});
+const handleGoogleUpdate = Effect.fn(function* (opts, client) {
+    const { yes } = yield* GlobalOpts;
+    const appType = getMetaString(client.meta, 'appType');
+    const isWeb = appType === 'web' || !appType;
+    const switchingFromShared = Boolean(client.use_shared_credentials);
+    const hasAnyUpdateFlag = hasGoogleUpdateFlags(opts);
+    if (!hasAnyUpdateFlag && !yes) {
+        yield* Effect.log(`\nCurrent mode: ${switchingFromShared
+            ? chalk.bold('Instant dev credentials')
+            : 'custom credentials'}`);
+    }
+    const updateMode = yield* resolveGoogleUpdateMode({
+        opts,
+        isWeb,
+        switchingFromShared,
+    });
+    if (updateMode === 'dev') {
+        return yield* updateGoogleToDevCredentials(client);
+    }
+    if (updateMode === 'none') {
+        yield* Effect.log(chalk.dim('No changes made.'));
+        return;
+    }
+    if (updateMode === 'redirect') {
+        return yield* updateGoogleRedirect({ opts, client });
+    }
+    return yield* updateGoogleCustomCredentials({
+        opts,
+        client,
+        isWeb,
+        switchingFromShared,
+        promptCredentials: !hasAnyUpdateFlag && !yes,
+    });
+});
+const handleClientIdSecretUpdate = Effect.fn(function* (params) {
+    const { yes } = yield* GlobalOpts;
+    const hasAnyUpdateFlag = hasAnyFlag(params.opts, [
+        'client-id',
+        'client-secret',
+        'custom-redirect-uri',
+    ]);
+    if (yes && !hasAnyUpdateFlag) {
+        return yield* BadArgsError.make({
+            message: 'Must specify at least one of --client-id, --client-secret, or --custom-redirect-uri.',
+        });
+    }
+    let promptCredentials = false;
+    let promptRedirect = false;
+    if (!hasAnyUpdateFlag && !yes) {
+        const action = yield* selectUpdateAction([
+            { label: 'Update Client ID and Client Secret', value: 'rotate' },
+            { label: 'Update redirect URI', value: 'redirect' },
+        ]);
+        promptCredentials = action === 'rotate';
+        promptRedirect = action === 'redirect';
+    }
+    const clientId = yield* optOrPromptWhenNeeded(params.opts, 'client-id', {
+        promptIf: promptCredentials,
+        required: promptCredentials,
+        prompt: clientIdPrompt({ providerUrl: params.providerUrl }),
+    });
+    const clientSecret = yield* optOrPromptWhenNeeded(params.opts, 'client-secret', {
+        promptIf: promptCredentials,
+        required: promptCredentials,
+        prompt: clientSecretPrompt({ providerUrl: params.providerUrl }),
+    });
+    const customRedirectUri = yield* optOrPromptWhenNeeded(params.opts, 'custom-redirect-uri', {
+        promptIf: promptRedirect,
+        required: promptRedirect,
+        prompt: promptRedirect ? newRedirectPrompt : redirectPrompt,
+    });
+    const response = yield* updateOAuthClient({
+        oauthClientId: params.client.id,
+        clientId,
+        clientSecret,
+        redirectTo: customRedirectUri,
+    });
+    const lines = [
+        `${params.providerLabel} OAuth client updated: ${response.client.client_name}`,
+        `ID: ${response.client.id}`,
+    ];
+    if (customRedirectUri) {
+        lines.push(...redirectSetupMessages({
+            prompt: params.redirectSetupPrompt,
+            redirectUri: customRedirectUri,
+            showCustomRedirectInstructions: true,
+        }));
+    }
+    yield* Effect.log(boxen(lines.join('\n'), {
+        dimBorder: true,
+        padding: { right: 1, left: 1 },
+    }));
+});
+const appleWebFlags = [
+    'team-id',
+    'key-id',
+    'private-key-file',
+    'custom-redirect-uri',
+];
+const appleUpdateFlags = ['services-id', ...appleWebFlags];
+const hasAppleWebFlags = (opts) => hasAnyFlag(opts, appleWebFlags);
+const hasAppleUpdateFlags = (opts) => hasAnyFlag(opts, appleUpdateFlags);
+const appleClientHasWebConfig = (client) => Boolean(getMetaString(client.meta, 'teamId') ||
+    getMetaString(client.meta, 'keyId') ||
+    client.redirect_to);
+const resolveAppleUpdateConfig = Effect.fn(function* ({ opts, client, yes, }) {
+    const hasAnyUpdateFlag = hasAppleUpdateFlags(opts);
+    if (yes && !hasAnyUpdateFlag) {
+        return yield* BadArgsError.make({
+            message: 'Must specify at least one of --services-id, --team-id, --key-id, --private-key-file, or --custom-redirect-uri.',
+        });
+    }
+    const promptAll = !hasAnyUpdateFlag && !yes;
+    if (!promptAll) {
+        return { promptAll, configureWeb: hasAppleWebFlags(opts) };
+    }
+    const configureWeb = yield* runUIEffect(new UI.Confirmation({
+        promptText: 'Configure web redirect flow? ' +
+            chalk.dim('(requires Team ID, Key ID, and a .p8 private key from Apple)'),
+        defaultValue: appleClientHasWebConfig(client),
+    })).pipe(Effect.catchTag('UIError', (e) => BadArgsError.make({ message: `UI error: ${e.message}` })));
+    return { promptAll, configureWeb };
+});
+const readAppleWebUpdate = Effect.fn(function* ({ opts, client, promptAll, }) {
+    const teamId = yield* optOrPromptWhenNeeded(opts, 'team-id', {
+        promptIf: promptAll,
+        required: promptAll,
+        prompt: appleTeamIdPrompt({}),
+    });
+    const keyId = yield* optOrPromptWhenNeeded(opts, 'key-id', {
+        promptIf: promptAll,
+        required: promptAll,
+        prompt: appleKeyIdPrompt({}),
+    });
+    const privateKeyPath = yield* optOrPromptWhenNeeded(opts, 'private-key-file', {
+        promptIf: promptAll,
+        required: promptAll,
+        prompt: applePrivateKeyFilePrompt({}),
+    });
+    const privateKey = privateKeyPath
+        ? yield* readPrivateKeyFile(privateKeyPath)
+        : undefined;
+    const customRedirectUri = yield* optOrPromptWhenNeeded(opts, 'custom-redirect-uri', {
+        promptIf: promptAll,
+        required: false,
+        prompt: redirectPrompt,
+    });
+    const meta = {};
+    if (teamId)
+        meta.teamId = teamId;
+    if (keyId)
+        meta.keyId = keyId;
+    return {
+        privateKey,
+        redirectTo: privateKey
+            ? customRedirectUri || client.redirect_to || DEFAULT_OAUTH_CALLBACK_URL
+            : customRedirectUri,
+        customRedirectUri,
+        meta: Object.keys(meta).length ? meta : undefined,
+    };
+});
+const handleAppleUpdate = Effect.fn(function* (opts, client) {
+    const { yes } = yield* GlobalOpts;
+    const { promptAll, configureWeb } = yield* resolveAppleUpdateConfig({
+        opts,
+        client,
+        yes,
+    });
+    const servicesId = yield* optOrPromptWhenNeeded(opts, 'services-id', {
+        promptIf: promptAll,
+        required: promptAll,
+        prompt: appleServicesIdPrompt({}),
+    });
+    const webUpdate = configureWeb
+        ? yield* readAppleWebUpdate({ opts, client, promptAll })
+        : {};
+    const response = yield* updateOAuthClient({
+        oauthClientId: client.id,
+        clientId: servicesId,
+        clientSecret: webUpdate.privateKey,
+        redirectTo: webUpdate.redirectTo,
+        meta: webUpdate.meta,
+    });
+    const lines = [
+        `Apple OAuth client updated: ${response.client.client_name}`,
+        `ID: ${response.client.id}`,
+    ];
+    if (webUpdate.redirectTo) {
+        lines.push(...redirectSetupMessages({
+            prompt: `Add this return URL under your Services ID on ${link('https://developer.apple.com', 'developer.apple.com')}`,
+            redirectUri: webUpdate.redirectTo,
+            showCustomRedirectInstructions: Boolean(webUpdate.customRedirectUri),
+        }));
+    }
+    yield* Effect.log(boxen(lines.join('\n'), {
+        dimBorder: true,
+        padding: { right: 1, left: 1 },
+    }));
+});
+const handleClerkUpdate = Effect.fn(function* (opts, client) {
+    const { yes } = yield* GlobalOpts;
+    const publishableKey = yield* optOrPromptWhenNeeded(opts, 'publishable-key', {
+        promptIf: !yes && !hasFlag(opts, 'publishable-key'),
+        required: true,
+        prompt: clerkPublishableKeyPrompt({}),
+    });
+    if (!publishableKey) {
+        return yield* BadArgsError.make({
+            message: 'Missing required value for --publishable-key',
+        });
+    }
+    const domain = clerkDomainFromPublishableKey(publishableKey);
+    if (!domain) {
+        return yield* BadArgsError.make({
+            message: 'Invalid publishable key. Could not extract domain.',
+        });
+    }
+    const response = yield* updateOAuthClient({
+        oauthClientId: client.id,
+        discoveryEndpoint: `https://${domain}/.well-known/openid-configuration`,
+        meta: { clerkPublishableKey: publishableKey },
+    });
+    yield* Effect.log(boxen([
+        `Clerk OAuth client updated: ${response.client.client_name}`,
+        `ID: ${response.client.id}`,
+        `Clerk Domain: https://${domain}`,
+    ].join('\n'), { dimBorder: true, padding: { right: 1, left: 1 } }));
+});
+const handleFirebaseUpdate = Effect.fn(function* (opts, client) {
+    const { yes } = yield* GlobalOpts;
+    const projectId = yield* optOrPromptWhenNeeded(opts, 'project-id', {
+        promptIf: !yes && !hasFlag(opts, 'project-id'),
+        required: true,
+        prompt: firebaseProjectIdPrompt({}),
+    });
+    const validationError = validateFirebaseProjectId(projectId ?? '');
+    if (validationError) {
+        return yield* BadArgsError.make({ message: validationError });
+    }
+    const response = yield* updateOAuthClient({
+        oauthClientId: client.id,
+        discoveryEndpoint: firebaseDiscoveryEndpoint(projectId),
+    });
+    yield* Effect.log(boxen([
+        `Firebase OAuth client updated: ${response.client.client_name}`,
+        `ID: ${response.client.id}`,
+        `Firebase Project ID: ${projectId}`,
+    ].join('\n'), { dimBorder: true, padding: { right: 1, left: 1 } }));
+});
+export const authClientUpdateCmd = Effect.fn(function* (opts) {
+    const { auth, client: resolvedClient } = yield* resolveClient({
+        id: opts.id,
+        name: opts.name,
+    });
+    const provider = (auth.oauth_service_providers ?? []).find((entry) => entry.id === resolvedClient.provider_id);
+    if (!provider) {
+        return yield* BadArgsError.make({
+            message: `OAuth provider not found for client: ${resolvedClient.client_name}`,
+        });
+    }
+    yield* Match.value(provider.provider_name).pipe(Match.withReturnType(), Match.when('google', () => handleGoogleUpdate(opts, resolvedClient)), Match.when('github', () => handleClientIdSecretUpdate({
+        opts,
+        client: resolvedClient,
+        providerLabel: 'GitHub',
+        providerUrl: 'https://github.com/settings/developers',
+        redirectSetupPrompt: 'Add this callback URL in your GitHub OAuth App settings',
+    })), Match.when('linkedin', () => handleClientIdSecretUpdate({
+        opts,
+        client: resolvedClient,
+        providerLabel: 'LinkedIn',
+        providerUrl: 'https://www.linkedin.com/developers/apps',
+        redirectSetupPrompt: 'Add this redirect URI in your LinkedIn app settings',
+    })), Match.when('apple', () => handleAppleUpdate(opts, resolvedClient)), Match.when('clerk', () => handleClerkUpdate(opts, resolvedClient)), Match.when('firebase', () => handleFirebaseUpdate(opts, resolvedClient)), Match.orElse((providerName) => BadArgsError.make({
+        message: `Updating ${providerName} OAuth clients is not supported.`,
+    })));
+}, Effect.catchTag('BadArgsError', (e) => Effect.gen(function* () {
+    yield* Effect.logError(e.message);
+    yield* Effect.log(chalk.dim('hint: run `instant-cli auth client update --help` for available arguments'));
+})));
+//# sourceMappingURL=update.js.map