@kestack/web-platform 0.0.0-stage → 0.0.0

package/dist/app/gate/gate.js

@@ -0,0 +1,351 @@
+import { backendNamed } from "../host/host.js";
+import { makeStatus } from "../session/status.js";
+import { Device, Sessions, Switching } from "./domain/services.js";
+import { gateMachine } from "./domain/machine.js";
+import { gateMemory, gateTable } from "./memory.js";
+import { Context, Effect, Exit, Layer, ManagedRuntime, Scope } from "effect";
+import { SignIn, namedChooser } from "@kestack/auth-toolkit/client";
+import { createEffectActor } from "@xstate/effect";
+//#region src/app/gate/gate.ts
+const CHECKING = { kind: "checking" };
+const userOf = ({ id, name, email, image }) => ({
+	id,
+	name,
+	email,
+	image
+});
+const accountOf = ({ user, token }) => ({
+	user,
+	token
+});
+const viewOf = (snapshot) => {
+	const { context } = snapshot;
+	if (snapshot.matches("signingOut")) return { kind: "signingOut" };
+	if (snapshot.matches("signedOut")) return {
+		kind: "signedOut",
+		unreachable: context.unreachable
+	};
+	if (snapshot.matches("unopenable") && context.account !== null) return {
+		kind: "unopenable",
+		account: accountOf(context.account)
+	};
+	if (snapshot.matches("accountLost") && context.lost !== null) return {
+		kind: "accountLost",
+		account: {
+			user: context.lost,
+			token: null
+		},
+		accounts: context.accounts.map(accountOf)
+	};
+	if (!snapshot.matches("open") || context.account === null) return CHECKING;
+	if (context.session === null) return {
+		kind: "opening",
+		account: accountOf(context.account)
+	};
+	return {
+		kind: "open",
+		session: context.session,
+		account: accountOf(context.account),
+		accounts: context.accounts.map(accountOf)
+	};
+};
+const stop = async (current) => {
+	await current.runtime.runPromise(Scope.close(current.scope, Exit.void));
+	await current.runtime.dispose();
+};
+/**
+* The Gate: runs sign-in on one device for one app. It keeps the app on the
+* Backend chosen, and the active Account's Session open while that Account
+* stays active. Nothing runs until something first asks. Make one per app.
+*/
+const createGate = (config) => {
+	let made;
+	const host = () => made ??= config.host();
+	let remembering;
+	const memory = () => remembering ??= gateMemory(host().storage.table(gateTable, "gate"));
+	const remember = (change) => Effect.runPromise(memory().update(change));
+	const quiet = /* @__PURE__ */ new Set();
+	const chooser = namedChooser();
+	const loadDevice = config.device;
+	const offered = (backend) => backend === "device" && loadDevice === void 0 ? "cloud" : backend;
+	const tokens = /* @__PURE__ */ new Map();
+	const waiting = /* @__PURE__ */ new Map();
+	const setToken = (id, token) => {
+		tokens.set(id, token);
+		if (token === null) return;
+		const waiters = waiting.get(id);
+		waiting.delete(id);
+		waiters?.forEach((resume) => resume(token));
+	};
+	let verifiedAt = null;
+	const statuses = /* @__PURE__ */ new Map();
+	const statusOf = (id) => (tokens.get(id) ?? null) === null ? {
+		state: "verifying",
+		lastVerifiedAt: null
+	} : {
+		state: "verified",
+		lastVerifiedAt: verifiedAt
+	};
+	const publishStatuses = () => {
+		for (const [id, cell] of statuses) cell.set(statusOf(id));
+	};
+	const waitForToken = (id) => Effect.callback((resume) => {
+		const now = tokens.get(id) ?? null;
+		if (now !== null) return resume(Effect.succeed(now));
+		const waiter = (token) => resume(Effect.succeed(token));
+		const waiters = waiting.get(id) ?? /* @__PURE__ */ new Set();
+		waiters.add(waiter);
+		waiting.set(id, waiters);
+		return Effect.sync(() => void waiting.get(id)?.delete(waiter));
+	});
+	const layerOf = async (backend) => {
+		const lifetime = backend === "device" && loadDevice !== void 0 ? await loadDevice(chooser.choose) : config.cloud();
+		const device = Layer.effect(Device, Effect.gen(function* () {
+			const services = yield* Effect.context();
+			return Device.of({
+				remembered: memory().read.pipe(Effect.map((all) => ({
+					accounts: all[backend].accounts.map(({ user, active }) => ({
+						user,
+						token: null,
+						active
+					})),
+					lost: all[backend].lost
+				}))),
+				remember: ({ accounts, lost }) => Effect.andThen(Effect.sync(() => {
+					verifiedAt = /* @__PURE__ */ new Date();
+				}), memory().update((all) => ({
+					...all,
+					[backend]: {
+						accounts: accounts.map(({ user, active }) => ({
+							user: userOf(user),
+							active
+						})),
+						lost: lost === null ? null : userOf(lost)
+					}
+				}))),
+				signedOutHere: (userId) => Effect.sync(() => quiet.delete(userId)),
+				keep: (userIds) => config.keep === void 0 ? Effect.void : config.keep(userIds).pipe(Effect.provideContext(services))
+			});
+		}));
+		const sessions = Layer.effect(Sessions, Effect.gen(function* () {
+			const services = yield* Effect.context();
+			return Sessions.of({ open: (account) => Effect.gen(function* () {
+				const id = account.user.id;
+				setToken(id, account.token);
+				const status = yield* makeStatus(statusOf(id));
+				statuses.set(id, status);
+				yield* Effect.addFinalizer(() => Effect.sync(() => {
+					if (statuses.get(id) === status) statuses.delete(id);
+				}));
+				const scope = yield* Effect.context();
+				return yield* config.session(accountOf(account), waitForToken(id), status).pipe(Effect.provideContext(Context.merge(services, scope)));
+			}) });
+		}));
+		const switching = Layer.effect(Switching, Effect.gen(function* () {
+			const signIn = yield* SignIn;
+			let chain = Promise.resolve();
+			let latest = null;
+			return Switching.of({
+				switchTo: (token) => Effect.tryPromise({
+					try: () => {
+						latest = token;
+						const run = chain.then(() => latest === token ? Effect.runPromise(signIn.switchTo(token)) : void 0);
+						chain = run.catch(() => {});
+						return run;
+					},
+					catch: (error) => error
+				}),
+				announce: (quiet = []) => Effect.sync(() => host().tabs?.announce({ quiet }))
+			});
+		}));
+		return Layer.mergeAll(device, sessions, switching).pipe(Layer.provideMerge(lifetime));
+	};
+	let running = null;
+	let view = CHECKING;
+	let queue = Promise.resolve();
+	let booted = false;
+	const listeners = /* @__PURE__ */ new Set();
+	const notify = () => listeners.forEach((listener) => listener());
+	const notices = [];
+	const push = (notice) => {
+		notices.push(notice);
+		notify();
+	};
+	const observe = (snapshot) => {
+		const { context } = snapshot;
+		for (const account of context.accounts) if (account.token !== null) setToken(account.user.id, account.token);
+		publishStatuses();
+		view = viewOf(snapshot);
+	};
+	const start = async (backend) => {
+		const runtime = ManagedRuntime.make(await layerOf(backend));
+		const scope = runtime.runSync(Scope.make());
+		const actor = runtime.runSync(createEffectActor(gateMachine).pipe(Scope.provide(scope)));
+		const next = {
+			backend,
+			runtime,
+			scope,
+			actor
+		};
+		actor.subscribe((snapshot) => {
+			if (running !== next) return;
+			observe(snapshot);
+			notify();
+		});
+		runtime.runPromise(Effect.gen(function* () {
+			return yield* (yield* SignIn).takeLoginError;
+		})).then((error) => {
+			if (error !== null) push({
+				kind: "loginError",
+				error
+			});
+		}, report);
+		return next;
+	};
+	/** Runs on `backend`, ending whatever ran before. */
+	const runOn = (backend) => {
+		const change = queue.then(async () => {
+			if (running?.backend === backend) return;
+			const previous = running;
+			running = null;
+			view = CHECKING;
+			notify();
+			if (previous !== null) await stop(previous);
+			const next = await start(backend);
+			running = next;
+			observe(next.actor.getSnapshot());
+			notify();
+		});
+		queue = change.catch(() => {});
+		return change;
+	};
+	const report = (failed) => Effect.runFork(Effect.logError("The Gate could not go on", failed));
+	const chosenBackend = async () => offered(backendNamed((await Effect.runPromise(memory().read)).backend)) ?? "cloud";
+	const settledBackend = async () => {
+		const asked = offered(host().lifecycle.launchBackend());
+		if (asked === null) return chosenBackend();
+		await remember((all) => ({
+			...all,
+			backend: asked
+		}));
+		return asked;
+	};
+	const send = (event) => running?.actor.send(event);
+	const checkAgain = () => send({ type: "CHECK" });
+	const follow = () => chosenBackend().then((backend) => running === null || running.backend === backend ? checkAgain() : runOn(backend)).catch(report);
+	/** Starts on the Backend chosen, once, and looks again whenever the app
+	* comes back into view, the network comes back, or another tab changes
+	* something. */
+	const boot = () => {
+		if (booted) return;
+		booted = true;
+		const { lifecycle, tabs } = host();
+		settledBackend().then(runOn).catch(report);
+		lifecycle.onOnlineChange(() => {
+			if (lifecycle.online()) checkAgain();
+		});
+		lifecycle.onForeground(follow);
+		tabs?.listen((message) => {
+			for (const id of message.quiet) quiet.add(id);
+			follow();
+		});
+	};
+	const subscribe = (changed) => {
+		boot();
+		listeners.add(changed);
+		return () => void listeners.delete(changed);
+	};
+	const online = () => host().lifecycle.online();
+	/** Whether a sign-out can happen now: only the Backend can end a sign-in,
+	* so the cloud Backend has to be reachable. */
+	const canSignOut = () => running?.backend === "device" || online();
+	return {
+		subscribe,
+		/** What every screen shows: checking until the Gate runs, and while the
+		* Backend changes. */
+		view: () => view,
+		/** The Backend running; null until it has started. */
+		backend: () => running?.backend ?? null,
+		/** Whether the device is online. */
+		online,
+		onOnlineChange: (changed) => host().lifecycle.onOnlineChange(changed),
+		canSignOut,
+		/** Chooses `backend` and runs on it at once. Each Backend keeps its own
+		* Signed-in Accounts. */
+		setBackend: async (asked) => {
+			const backend = offered(asked) ?? "cloud";
+			await remember((all) => ({
+				...all,
+				backend
+			}));
+			await runOn(backend);
+			host().tabs?.announce({ quiet: [] });
+		},
+		/** An Account Switch: the account opens at once from what the device
+		* keeps; the Backend hears of it behind. From an Account Lost, the lost
+		* account's Copy is deleted. */
+		switchTo: (userId) => send({
+			type: "SWITCH",
+			userId
+		}),
+		/** Signs one more account in, who becomes the Active Account. On the
+		* cloud Backend the page leaves for the sign-in service; on the device
+		* Backend the Named Sign-In asks who. */
+		addAccount: async () => {
+			const current = running;
+			if (current === null) return;
+			const error = await current.runtime.runPromise(Effect.gen(function* () {
+				const signIn = yield* SignIn;
+				yield* signIn.signIn();
+				return yield* signIn.takeLoginError;
+			}));
+			if (error !== null) push({
+				kind: "loginError",
+				error
+			});
+			checkAgain();
+		},
+		/** Signs the Active Account out of this device; whoever is left opens.
+		* From an Account Lost, forgets the lost account and deletes its Copy.
+		* False, and nothing happens, when the Backend can't be reached. */
+		signOut: () => {
+			if (view.kind === "accountLost") {
+				send({ type: "SIGN_OUT" });
+				return true;
+			}
+			if (!canSignOut()) return false;
+			send({ type: "SIGN_OUT" });
+			return true;
+		},
+		/** Signs every account out of this device. False, and nothing happens,
+		* when the Backend can't be reached. */
+		signOutEveryone: () => {
+			if (!canSignOut()) return false;
+			send({ type: "SIGN_OUT_EVERYONE" });
+			return true;
+		},
+		/** Asks the Backend again who is signed in. */
+		checkAgain,
+		/** Tries again to open an account that would not open. */
+		retry: () => send({ type: "RETRY" }),
+		/** The oldest Gate Notice not yet taken, once; null when none. */
+		takeNotice: () => {
+			const notice = notices.shift() ?? null;
+			if (notice !== null) notify();
+			return notice;
+		},
+		/** The oldest Gate Notice not yet taken, without taking it. */
+		notice: () => notices[0] ?? null,
+		/** Whether the device Backend is asking who signs in, and how to answer:
+		* a choice, or null to sign nobody in. */
+		namedSignIn: {
+			subscribe: chooser.subscribe,
+			isAsking: chooser.isAsking,
+			answer: (choice) => chooser.answer(choice)
+		}
+	};
+};
+//#endregion
+export { createGate };
+
+//# sourceMappingURL=gate.js.map

package/dist/app/gate/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","names":[],"sources":["../../../src/app/gate/gate.ts"],"sourcesContent":["import { Context, Effect, Exit, Layer, ManagedRuntime, Scope } from 'effect';\nimport { createEffectActor, type EffectActor } from '@xstate/effect';\nimport type { SnapshotFrom } from 'xstate';\nimport {\n  type Account,\n  type NamedChoice,\n  namedChooser,\n  SignIn,\n} from '@kestack/auth-toolkit/client';\nimport { type Backend, backendNamed, type Host } from '../host/index.ts';\nimport { makeStatus, type StatusCell } from '../session/index.ts';\nimport {\n  Device,\n  gateMachine,\n  type GateNotice,\n  type GateView,\n  type Held,\n  Sessions,\n  Switching,\n  type User,\n} from './domain/index.ts';\nimport { gateMemory, gateTable } from './memory.ts';\n\n/** What an app gives the Gate. `B` is what the app keeps for as long as it\n * runs on one Backend; `S` is what one Account's Session opens to. */\nexport interface GateConfig<S, B> {\n  /** The Host, made the first time the Gate is asked anything, so the Gate\n   * can be made where the Host is not there yet, as on a server. The Gate\n   * keeps what it remembers in its own `gate` database there. */\n  readonly host: () => Host;\n  /** What runs while the app is on the cloud Backend: its Sign-in and\n   * whatever else the app keeps there. */\n  readonly cloud: () => Layer.Layer<SignIn | B>;\n  /** The same for the device Backend, loaded the first time it is chosen.\n   * `choose` asks who signs in; the Named Sign-In answers it. Without it,\n   * the app has only the cloud Backend. */\n  readonly device?: (\n    choose: Effect.Effect<NamedChoice | null>,\n  ) => Promise<Layer.Layer<SignIn | B>>;\n  /** Opens one Account's Session, with what runs on the Backend; everything\n   * it acquires ends with the scope. `token` is the Account's token at each\n   * call, waited for while the Gate holds none, as when the Account opened\n   * before the Backend answered. `status` says whether it has been\n   * confirmed since; the Gate keeps it. */\n  readonly session: (\n    account: Account,\n    token: Effect.Effect<string>,\n    status: StatusCell,\n  ) => Effect.Effect<S, never, Scope.Scope | B>;\n  /** Deletes what the device keeps for every account but these. */\n  readonly keep?: (\n    userIds: ReadonlyArray<string>,\n  ) => Effect.Effect<void, never, B>;\n}\n\ntype Snapshot = SnapshotFrom<typeof gateMachine>;\ntype Services = SignIn | Device | Sessions | Switching;\n\n/** One Backend at work: what runs on it, and the Gate's machine on it.\n * Closing its scope stops the machine, and with it the Session. */\ntype Running = {\n  readonly backend: Backend;\n  readonly runtime: ManagedRuntime.ManagedRuntime<Services, never>;\n  readonly scope: Scope.Closeable;\n  readonly actor: EffectActor<typeof gateMachine>;\n};\n\nconst CHECKING = { kind: 'checking' } as const;\n\n// Only what the Gate remembers of a User, whatever else the Backend sent.\nconst userOf = ({ id, name, email, image }: User): User => ({\n  id,\n  name,\n  email,\n  image,\n});\n\n// An Account, without what else the Gate holds of it.\nconst accountOf = ({ user, token }: Held): Account => ({ user, token });\n\nconst viewOf = <S>(snapshot: Snapshot): GateView<S> => {\n  const { context } = snapshot;\n  if (snapshot.matches('signingOut')) return { kind: 'signingOut' };\n  if (snapshot.matches('signedOut'))\n    return { kind: 'signedOut', unreachable: context.unreachable };\n  if (snapshot.matches('unopenable') && context.account !== null)\n    return { kind: 'unopenable', account: accountOf(context.account) };\n  if (snapshot.matches('accountLost') && context.lost !== null)\n    return {\n      kind: 'accountLost',\n      account: { user: context.lost, token: null },\n      accounts: context.accounts.map(accountOf),\n    };\n  if (!snapshot.matches('open') || context.account === null) return CHECKING;\n  if (context.session === null)\n    return { kind: 'opening', account: accountOf(context.account) };\n  return {\n    kind: 'open',\n    session: context.session as S,\n    account: accountOf(context.account),\n    accounts: context.accounts.map(accountOf),\n  };\n};\n\nconst stop = async (current: Running) => {\n  await current.runtime.runPromise(Scope.close(current.scope, Exit.void));\n  await current.runtime.dispose();\n};\n\n/**\n * The Gate: runs sign-in on one device for one app. It keeps the app on the\n * Backend chosen, and the active Account's Session open while that Account\n * stays active. Nothing runs until something first asks. Make one per app.\n */\nexport const createGate = <S, B>(config: GateConfig<S, B>) => {\n  let made: Host | undefined;\n  const host = () => (made ??= config.host());\n  let remembering: ReturnType<typeof gateMemory> | undefined;\n  const memory = () =>\n    (remembering ??= gateMemory(host().storage.table(gateTable, 'gate')));\n  const remember = (\n    change: Parameters<ReturnType<typeof memory>['update']>[0],\n  ) => Effect.runPromise(memory().update(change));\n\n  // Accounts this device signed out itself, in this tab or another: their\n  // going is no Account Lost.\n  const quiet = new Set<string>();\n\n  // Asks who signs in on the device Backend; the Named Sign-In answers.\n  const chooser = namedChooser();\n  const loadDevice = config.device;\n\n  // A Backend this app does not have stands for the cloud.\n  const offered = (backend: Backend | null): Backend | null =>\n    backend === 'device' && loadDevice === undefined ? 'cloud' : backend;\n\n  // The token each account's calls carry, refreshed whenever it is checked,\n  // and the calls waiting for an account's first one.\n  const tokens = new Map<string, string | null>();\n  const waiting = new Map<string, Set<(token: string) => void>>();\n  const setToken = (id: string, token: string | null) => {\n    tokens.set(id, token);\n    if (token === null) return;\n    const waiters = waiting.get(id);\n    waiting.delete(id);\n    waiters?.forEach((resume) => resume(token));\n  };\n  // When the Backend last answered who is signed in, and the status of\n  // each Session open now: verified once its Account's token is known.\n  let verifiedAt: Date | null = null;\n  const statuses = new Map<string, StatusCell>();\n  const statusOf = (id: string) =>\n    (tokens.get(id) ?? null) === null\n      ? { state: 'verifying' as const, lastVerifiedAt: null }\n      : { state: 'verified' as const, lastVerifiedAt: verifiedAt };\n  const publishStatuses = () => {\n    for (const [id, cell] of statuses) cell.set(statusOf(id));\n  };\n\n  const waitForToken = (id: string): Effect.Effect<string> =>\n    Effect.callback<string>((resume) => {\n      const now = tokens.get(id) ?? null;\n      if (now !== null) return resume(Effect.succeed(now));\n      const waiter = (token: string) => resume(Effect.succeed(token));\n      const waiters = waiting.get(id) ?? new Set();\n      waiters.add(waiter);\n      waiting.set(id, waiters);\n      return Effect.sync(() => void waiting.get(id)?.delete(waiter));\n    });\n\n  const layerOf = async (backend: Backend): Promise<Layer.Layer<Services>> => {\n    const lifetime =\n      backend === 'device' && loadDevice !== undefined\n        ? await loadDevice(chooser.choose)\n        : config.cloud();\n    const device = Layer.effect(\n      Device,\n      Effect.gen(function* () {\n        const services = yield* Effect.context<B>();\n        return Device.of({\n          remembered: memory().read.pipe(\n            Effect.map((all) => ({\n              accounts: all[backend].accounts.map(({ user, active }) => ({\n                user,\n                token: null,\n                active,\n              })),\n              lost: all[backend].lost,\n            })),\n          ),\n          remember: ({ accounts, lost }) =>\n            Effect.andThen(\n              Effect.sync(() => {\n                // Only an answer from the Backend is remembered.\n                verifiedAt = new Date();\n              }),\n              memory().update((all) => ({\n                ...all,\n                [backend]: {\n                  accounts: accounts.map(({ user, active }) => ({\n                    user: userOf(user),\n                    active,\n                  })),\n                  lost: lost === null ? null : userOf(lost),\n                },\n              })),\n            ),\n          signedOutHere: (userId) => Effect.sync(() => quiet.delete(userId)),\n          keep: (userIds) =>\n            config.keep === undefined\n              ? Effect.void\n              : config.keep(userIds).pipe(Effect.provideContext(services)),\n        });\n      }),\n    );\n\n    const sessions = Layer.effect(\n      Sessions,\n      Effect.gen(function* () {\n        const services = yield* Effect.context<B>();\n        return Sessions.of({\n          open: (account: Held) =>\n            Effect.gen(function* () {\n              const id = account.user.id;\n              setToken(id, account.token);\n              const status = yield* makeStatus(statusOf(id));\n              statuses.set(id, status);\n              yield* Effect.addFinalizer(() =>\n                Effect.sync(() => {\n                  if (statuses.get(id) === status) statuses.delete(id);\n                }),\n              );\n              // The Session's own scope, not the one the Backend's services\n              // were built in.\n              const scope = yield* Effect.context<Scope.Scope>();\n              return yield* config\n                .session(accountOf(account), waitForToken(id), status)\n                .pipe(Effect.provideContext(Context.merge(services, scope)));\n            }),\n        });\n      }),\n    );\n\n    const switching = Layer.effect(\n      Switching,\n      Effect.gen(function* () {\n        const signIn = yield* SignIn;\n        // One browser-wide Account Switch at a time; one asked for while\n        // another runs waits, and only the last one waiting runs.\n        let chain: Promise<void> = Promise.resolve();\n        let latest: string | null = null;\n        return Switching.of({\n          switchTo: (token) =>\n            Effect.tryPromise({\n              try: () => {\n                latest = token;\n                const run = chain.then(() =>\n                  latest === token\n                    ? Effect.runPromise(signIn.switchTo(token))\n                    : undefined,\n                );\n                chain = run.catch(() => {});\n                return run;\n              },\n              catch: (error) => error,\n            }),\n          announce: (quiet = []) =>\n            Effect.sync(() => host().tabs?.announce({ quiet })),\n        });\n      }),\n    );\n\n    return Layer.mergeAll(device, sessions, switching).pipe(\n      Layer.provideMerge(lifetime),\n    ) as Layer.Layer<Services>;\n  };\n\n  let running: Running | null = null;\n  let view: GateView<S> = CHECKING;\n  // Every change of Backend waits for the one before it.\n  let queue: Promise<void> = Promise.resolve();\n  let booted = false;\n  const listeners = new Set<() => void>();\n  const notify = () => listeners.forEach((listener) => listener());\n\n  const notices: GateNotice[] = [];\n\n  const push = (notice: GateNotice) => {\n    notices.push(notice);\n    notify();\n  };\n\n  const observe = (snapshot: Snapshot) => {\n    const { context } = snapshot;\n    for (const account of context.accounts)\n      if (account.token !== null) setToken(account.user.id, account.token);\n    publishStatuses();\n    view = viewOf<S>(snapshot);\n  };\n\n  const start = async (backend: Backend): Promise<Running> => {\n    const runtime = ManagedRuntime.make(await layerOf(backend));\n    const scope = runtime.runSync(Scope.make());\n    const actor = runtime.runSync(\n      createEffectActor(gateMachine).pipe(Scope.provide(scope)),\n    );\n    const next: Running = { backend, runtime, scope, actor };\n    actor.subscribe((snapshot) => {\n      if (running !== next) return;\n      observe(snapshot);\n      notify();\n    });\n    void runtime\n      .runPromise(\n        Effect.gen(function* () {\n          return yield* (yield* SignIn).takeLoginError;\n        }),\n      )\n      .then((error) => {\n        if (error !== null) push({ kind: 'loginError', error });\n      }, report);\n    return next;\n  };\n\n  /** Runs on `backend`, ending whatever ran before. */\n  const runOn = (backend: Backend) => {\n    const change = queue.then(async () => {\n      if (running?.backend === backend) return;\n      const previous = running;\n      running = null;\n      view = CHECKING;\n      notify();\n      if (previous !== null) await stop(previous);\n      const next = await start(backend);\n      running = next;\n      observe(next.actor.getSnapshot());\n      notify();\n    });\n    // A change that failed must not stop the ones after it.\n    queue = change.catch(() => {});\n    return change;\n  };\n\n  // Nobody awaits what the Gate does by itself, so a failure is logged\n  // rather than lost.\n  const report = (failed: unknown) =>\n    Effect.runFork(Effect.logError('The Gate could not go on', failed));\n\n  const chosenBackend = async (): Promise<Backend> =>\n    offered(backendNamed((await Effect.runPromise(memory().read)).backend)) ??\n    'cloud';\n\n  // A Backend the launch asked for is chosen as if by hand.\n  const settledBackend = async (): Promise<Backend> => {\n    const asked = offered(host().lifecycle.launchBackend());\n    if (asked === null) return chosenBackend();\n    await remember((all) => ({ ...all, backend: asked }));\n    return asked;\n  };\n\n  const send = (\n    event: Parameters<EffectActor<typeof gateMachine>['send']>[0],\n  ) => running?.actor.send(event);\n\n  const checkAgain = () => send({ type: 'CHECK' });\n\n  // Follows a Backend chosen elsewhere on this device, or else asks again.\n  const follow = () =>\n    chosenBackend()\n      .then((backend) =>\n        running === null || running.backend === backend\n          ? checkAgain()\n          : runOn(backend),\n      )\n      .catch(report);\n\n  /** Starts on the Backend chosen, once, and looks again whenever the app\n   * comes back into view, the network comes back, or another tab changes\n   * something. */\n  const boot = () => {\n    if (booted) return;\n    booted = true;\n    const { lifecycle, tabs } = host();\n    settledBackend().then(runOn).catch(report);\n    lifecycle.onOnlineChange(() => {\n      if (lifecycle.online()) checkAgain();\n    });\n    lifecycle.onForeground(follow);\n    tabs?.listen((message) => {\n      for (const id of message.quiet) quiet.add(id);\n      follow();\n    });\n  };\n\n  const subscribe = (changed: () => void) => {\n    boot();\n    listeners.add(changed);\n    return () => void listeners.delete(changed);\n  };\n\n  const online = () => host().lifecycle.online();\n\n  /** Whether a sign-out can happen now: only the Backend can end a sign-in,\n   * so the cloud Backend has to be reachable. */\n  const canSignOut = () => running?.backend === 'device' || online();\n\n  return {\n    subscribe,\n    /** What every screen shows: checking until the Gate runs, and while the\n     * Backend changes. */\n    view: (): GateView<S> => view,\n    /** The Backend running; null until it has started. */\n    backend: (): Backend | null => running?.backend ?? null,\n    /** Whether the device is online. */\n    online,\n    onOnlineChange: (changed: () => void) =>\n      host().lifecycle.onOnlineChange(changed),\n    canSignOut,\n\n    /** Chooses `backend` and runs on it at once. Each Backend keeps its own\n     * Signed-in Accounts. */\n    setBackend: async (asked: Backend) => {\n      const backend = offered(asked) ?? 'cloud';\n      await remember((all) => ({ ...all, backend }));\n      await runOn(backend);\n      host().tabs?.announce({ quiet: [] });\n    },\n\n    /** An Account Switch: the account opens at once from what the device\n     * keeps; the Backend hears of it behind. From an Account Lost, the lost\n     * account's Copy is deleted. */\n    switchTo: (userId: string) => send({ type: 'SWITCH', userId }),\n\n    /** Signs one more account in, who becomes the Active Account. On the\n     * cloud Backend the page leaves for the sign-in service; on the device\n     * Backend the Named Sign-In asks who. */\n    addAccount: async () => {\n      const current = running;\n      if (current === null) return;\n      const error = await current.runtime.runPromise(\n        Effect.gen(function* () {\n          const signIn = yield* SignIn;\n          yield* signIn.signIn();\n          return yield* signIn.takeLoginError;\n        }),\n      );\n      // A sign-in that comes back to the app, as on a phone, says here why\n      // it signed nobody in.\n      if (error !== null) push({ kind: 'loginError', error });\n      checkAgain();\n    },\n\n    /** Signs the Active Account out of this device; whoever is left opens.\n     * From an Account Lost, forgets the lost account and deletes its Copy.\n     * False, and nothing happens, when the Backend can't be reached. */\n    signOut: (): boolean => {\n      // Forgetting a lost account needs no Backend.\n      if (view.kind === 'accountLost') {\n        send({ type: 'SIGN_OUT' });\n        return true;\n      }\n      if (!canSignOut()) return false;\n      send({ type: 'SIGN_OUT' });\n      return true;\n    },\n\n    /** Signs every account out of this device. False, and nothing happens,\n     * when the Backend can't be reached. */\n    signOutEveryone: (): boolean => {\n      if (!canSignOut()) return false;\n      send({ type: 'SIGN_OUT_EVERYONE' });\n      return true;\n    },\n\n    /** Asks the Backend again who is signed in. */\n    checkAgain,\n\n    /** Tries again to open an account that would not open. */\n    retry: () => send({ type: 'RETRY' }),\n\n    /** The oldest Gate Notice not yet taken, once; null when none. */\n    takeNotice: (): GateNotice | null => {\n      const notice = notices.shift() ?? null;\n      if (notice !== null) notify();\n      return notice;\n    },\n    /** The oldest Gate Notice not yet taken, without taking it. */\n    notice: (): GateNotice | null => notices[0] ?? null,\n\n    /** Whether the device Backend is asking who signs in, and how to answer:\n     * a choice, or null to sign nobody in. */\n    namedSignIn: {\n      subscribe: chooser.subscribe,\n      isAsking: chooser.isAsking,\n      answer: (choice: NamedChoice | null) => chooser.answer(choice),\n    },\n  };\n};\n\n/** A Gate, as `createGate` makes it. */\nexport type Gate<S> = ReturnType<typeof createGate<S, never>>;\n"],"mappings":";;;;;;;;;AAmEA,MAAM,WAAW,EAAE,MAAM,WAAW;AAGpC,MAAM,UAAU,EAAE,IAAI,MAAM,OAAO,aAAyB;CAC1D;CACA;CACA;CACA;AACF;AAGA,MAAM,aAAa,EAAE,MAAM,aAA4B;CAAE;CAAM;AAAM;AAErE,MAAM,UAAa,aAAoC;CACrD,MAAM,EAAE,YAAY;CACpB,IAAI,SAAS,QAAQ,YAAY,GAAG,OAAO,EAAE,MAAM,aAAa;CAChE,IAAI,SAAS,QAAQ,WAAW,GAC9B,OAAO;EAAE,MAAM;EAAa,aAAa,QAAQ;CAAY;CAC/D,IAAI,SAAS,QAAQ,YAAY,KAAK,QAAQ,YAAY,MACxD,OAAO;EAAE,MAAM;EAAc,SAAS,UAAU,QAAQ,OAAO;CAAE;CACnE,IAAI,SAAS,QAAQ,aAAa,KAAK,QAAQ,SAAS,MACtD,OAAO;EACL,MAAM;EACN,SAAS;GAAE,MAAM,QAAQ;GAAM,OAAO;EAAK;EAC3C,UAAU,QAAQ,SAAS,IAAI,SAAS;CAC1C;CACF,IAAI,CAAC,SAAS,QAAQ,MAAM,KAAK,QAAQ,YAAY,MAAM,OAAO;CAClE,IAAI,QAAQ,YAAY,MACtB,OAAO;EAAE,MAAM;EAAW,SAAS,UAAU,QAAQ,OAAO;CAAE;CAChE,OAAO;EACL,MAAM;EACN,SAAS,QAAQ;EACjB,SAAS,UAAU,QAAQ,OAAO;EAClC,UAAU,QAAQ,SAAS,IAAI,SAAS;CAC1C;AACF;AAEA,MAAM,OAAO,OAAO,YAAqB;CACvC,MAAM,QAAQ,QAAQ,WAAW,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAI,CAAC;CACtE,MAAM,QAAQ,QAAQ,QAAQ;AAChC;;;;;;AAOA,MAAa,cAAoB,WAA6B;CAC5D,IAAI;CACJ,MAAM,aAAc,SAAS,OAAO,KAAK;CACzC,IAAI;CACJ,MAAM,eACH,gBAAgB,WAAW,KAAK,CAAC,CAAC,QAAQ,MAAM,WAAW,MAAM,CAAC;CACrE,MAAM,YACJ,WACG,OAAO,WAAW,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;CAI9C,MAAM,wBAAQ,IAAI,IAAY;CAG9B,MAAM,UAAU,aAAa;CAC7B,MAAM,aAAa,OAAO;CAG1B,MAAM,WAAW,YACf,YAAY,YAAY,eAAe,KAAA,IAAY,UAAU;CAI/D,MAAM,yBAAS,IAAI,IAA2B;CAC9C,MAAM,0BAAU,IAAI,IAA0C;CAC9D,MAAM,YAAY,IAAY,UAAyB;EACrD,OAAO,IAAI,IAAI,KAAK;EACpB,IAAI,UAAU,MAAM;EACpB,MAAM,UAAU,QAAQ,IAAI,EAAE;EAC9B,QAAQ,OAAO,EAAE;EACjB,SAAS,SAAS,WAAW,OAAO,KAAK,CAAC;CAC5C;CAGA,IAAI,aAA0B;CAC9B,MAAM,2BAAW,IAAI,IAAwB;CAC7C,MAAM,YAAY,QACf,OAAO,IAAI,EAAE,KAAK,UAAU,OACzB;EAAE,OAAO;EAAsB,gBAAgB;CAAK,IACpD;EAAE,OAAO;EAAqB,gBAAgB;CAAW;CAC/D,MAAM,wBAAwB;EAC5B,KAAK,MAAM,CAAC,IAAI,SAAS,UAAU,KAAK,IAAI,SAAS,EAAE,CAAC;CAC1D;CAEA,MAAM,gBAAgB,OACpB,OAAO,UAAkB,WAAW;EAClC,MAAM,MAAM,OAAO,IAAI,EAAE,KAAK;EAC9B,IAAI,QAAQ,MAAM,OAAO,OAAO,OAAO,QAAQ,GAAG,CAAC;EACnD,MAAM,UAAU,UAAkB,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9D,MAAM,UAAU,QAAQ,IAAI,EAAE,qBAAK,IAAI,IAAI;EAC3C,QAAQ,IAAI,MAAM;EAClB,QAAQ,IAAI,IAAI,OAAO;EACvB,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC;CAC/D,CAAC;CAEH,MAAM,UAAU,OAAO,YAAqD;EAC1E,MAAM,WACJ,YAAY,YAAY,eAAe,KAAA,IACnC,MAAM,WAAW,QAAQ,MAAM,IAC/B,OAAO,MAAM;EACnB,MAAM,SAAS,MAAM,OACnB,QACA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,OAAO,QAAW;GAC1C,OAAO,OAAO,GAAG;IACf,YAAY,OAAO,CAAC,CAAC,KAAK,KACxB,OAAO,KAAK,SAAS;KACnB,UAAU,IAAI,QAAQ,CAAC,SAAS,KAAK,EAAE,MAAM,cAAc;MACzD;MACA,OAAO;MACP;KACF,EAAE;KACF,MAAM,IAAI,QAAQ,CAAC;IACrB,EAAE,CACJ;IACA,WAAW,EAAE,UAAU,WACrB,OAAO,QACL,OAAO,WAAW;KAEhB,6BAAa,IAAI,KAAK;IACxB,CAAC,GACD,OAAO,CAAC,CAAC,QAAQ,SAAS;KACxB,GAAG;MACF,UAAU;MACT,UAAU,SAAS,KAAK,EAAE,MAAM,cAAc;OAC5C,MAAM,OAAO,IAAI;OACjB;MACF,EAAE;MACF,MAAM,SAAS,OAAO,OAAO,OAAO,IAAI;KAC1C;IACF,EAAE,CACJ;IACF,gBAAgB,WAAW,OAAO,WAAW,MAAM,OAAO,MAAM,CAAC;IACjE,OAAO,YACL,OAAO,SAAS,KAAA,IACZ,OAAO,OACP,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,QAAQ,CAAC;GACjE,CAAC;EACH,CAAC,CACH;EAEA,MAAM,WAAW,MAAM,OACrB,UACA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,OAAO,QAAW;GAC1C,OAAO,SAAS,GAAG,EACjB,OAAO,YACL,OAAO,IAAI,aAAa;IACtB,MAAM,KAAK,QAAQ,KAAK;IACxB,SAAS,IAAI,QAAQ,KAAK;IAC1B,MAAM,SAAS,OAAO,WAAW,SAAS,EAAE,CAAC;IAC7C,SAAS,IAAI,IAAI,MAAM;IACvB,OAAO,OAAO,mBACZ,OAAO,WAAW;KAChB,IAAI,SAAS,IAAI,EAAE,MAAM,QAAQ,SAAS,OAAO,EAAE;IACrD,CAAC,CACH;IAGA,MAAM,QAAQ,OAAO,OAAO,QAAqB;IACjD,OAAO,OAAO,OACX,QAAQ,UAAU,OAAO,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CACrD,KAAK,OAAO,eAAe,QAAQ,MAAM,UAAU,KAAK,CAAC,CAAC;GAC/D,CAAC,EACL,CAAC;EACH,CAAC,CACH;EAEA,MAAM,YAAY,MAAM,OACtB,WACA,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO;GAGtB,IAAI,QAAuB,QAAQ,QAAQ;GAC3C,IAAI,SAAwB;GAC5B,OAAO,UAAU,GAAG;IAClB,WAAW,UACT,OAAO,WAAW;KAChB,WAAW;MACT,SAAS;MACT,MAAM,MAAM,MAAM,WAChB,WAAW,QACP,OAAO,WAAW,OAAO,SAAS,KAAK,CAAC,IACxC,KAAA,CACN;MACA,QAAQ,IAAI,YAAY,CAAC,CAAC;MAC1B,OAAO;KACT;KACA,QAAQ,UAAU;IACpB,CAAC;IACH,WAAW,QAAQ,CAAC,MAClB,OAAO,WAAW,KAAK,CAAC,CAAC,MAAM,SAAS,EAAE,MAAM,CAAC,CAAC;GACtD,CAAC;EACH,CAAC,CACH;EAEA,OAAO,MAAM,SAAS,QAAQ,UAAU,SAAS,CAAC,CAAC,KACjD,MAAM,aAAa,QAAQ,CAC7B;CACF;CAEA,IAAI,UAA0B;CAC9B,IAAI,OAAoB;CAExB,IAAI,QAAuB,QAAQ,QAAQ;CAC3C,IAAI,SAAS;CACb,MAAM,4BAAY,IAAI,IAAgB;CACtC,MAAM,eAAe,UAAU,SAAS,aAAa,SAAS,CAAC;CAE/D,MAAM,UAAwB,CAAC;CAE/B,MAAM,QAAQ,WAAuB;EACnC,QAAQ,KAAK,MAAM;EACnB,OAAO;CACT;CAEA,MAAM,WAAW,aAAuB;EACtC,MAAM,EAAE,YAAY;EACpB,KAAK,MAAM,WAAW,QAAQ,UAC5B,IAAI,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAAK,IAAI,QAAQ,KAAK;EACrE,gBAAgB;EAChB,OAAO,OAAU,QAAQ;CAC3B;CAEA,MAAM,QAAQ,OAAO,YAAuC;EAC1D,MAAM,UAAU,eAAe,KAAK,MAAM,QAAQ,OAAO,CAAC;EAC1D,MAAM,QAAQ,QAAQ,QAAQ,MAAM,KAAK,CAAC;EAC1C,MAAM,QAAQ,QAAQ,QACpB,kBAAkB,WAAW,CAAC,CAAC,KAAK,MAAM,QAAQ,KAAK,CAAC,CAC1D;EACA,MAAM,OAAgB;GAAE;GAAS;GAAS;GAAO;EAAM;EACvD,MAAM,WAAW,aAAa;GAC5B,IAAI,YAAY,MAAM;GACtB,QAAQ,QAAQ;GAChB,OAAO;EACT,CAAC;EACD,QACG,WACC,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ,OAAO,OAAA,CAAQ;EAChC,CAAC,CACH,CAAC,CACA,MAAM,UAAU;GACf,IAAI,UAAU,MAAM,KAAK;IAAE,MAAM;IAAc;GAAM,CAAC;EACxD,GAAG,MAAM;EACX,OAAO;CACT;;CAGA,MAAM,SAAS,YAAqB;EAClC,MAAM,SAAS,MAAM,KAAK,YAAY;GACpC,IAAI,SAAS,YAAY,SAAS;GAClC,MAAM,WAAW;GACjB,UAAU;GACV,OAAO;GACP,OAAO;GACP,IAAI,aAAa,MAAM,MAAM,KAAK,QAAQ;GAC1C,MAAM,OAAO,MAAM,MAAM,OAAO;GAChC,UAAU;GACV,QAAQ,KAAK,MAAM,YAAY,CAAC;GAChC,OAAO;EACT,CAAC;EAED,QAAQ,OAAO,YAAY,CAAC,CAAC;EAC7B,OAAO;CACT;CAIA,MAAM,UAAU,WACd,OAAO,QAAQ,OAAO,SAAS,4BAA4B,MAAM,CAAC;CAEpE,MAAM,gBAAgB,YACpB,QAAQ,cAAc,MAAM,OAAO,WAAW,OAAO,CAAC,CAAC,IAAI,EAAA,CAAG,OAAO,CAAC,KACtE;CAGF,MAAM,iBAAiB,YAA8B;EACnD,MAAM,QAAQ,QAAQ,KAAK,CAAC,CAAC,UAAU,cAAc,CAAC;EACtD,IAAI,UAAU,MAAM,OAAO,cAAc;EACzC,MAAM,UAAU,SAAS;GAAE,GAAG;GAAK,SAAS;EAAM,EAAE;EACpD,OAAO;CACT;CAEA,MAAM,QACJ,UACG,SAAS,MAAM,KAAK,KAAK;CAE9B,MAAM,mBAAmB,KAAK,EAAE,MAAM,QAAQ,CAAC;CAG/C,MAAM,eACJ,cAAc,CAAC,CACZ,MAAM,YACL,YAAY,QAAQ,QAAQ,YAAY,UACpC,WAAW,IACX,MAAM,OAAO,CACnB,CAAC,CACA,MAAM,MAAM;;;;CAKjB,MAAM,aAAa;EACjB,IAAI,QAAQ;EACZ,SAAS;EACT,MAAM,EAAE,WAAW,SAAS,KAAK;EACjC,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,MAAM;EACzC,UAAU,qBAAqB;GAC7B,IAAI,UAAU,OAAO,GAAG,WAAW;EACrC,CAAC;EACD,UAAU,aAAa,MAAM;EAC7B,MAAM,QAAQ,YAAY;GACxB,KAAK,MAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,EAAE;GAC5C,OAAO;EACT,CAAC;CACH;CAEA,MAAM,aAAa,YAAwB;EACzC,KAAK;EACL,UAAU,IAAI,OAAO;EACrB,aAAa,KAAK,UAAU,OAAO,OAAO;CAC5C;CAEA,MAAM,eAAe,KAAK,CAAC,CAAC,UAAU,OAAO;;;CAI7C,MAAM,mBAAmB,SAAS,YAAY,YAAY,OAAO;CAEjE,OAAO;EACL;;;EAGA,YAAyB;;EAEzB,eAA+B,SAAS,WAAW;;EAEnD;EACA,iBAAiB,YACf,KAAK,CAAC,CAAC,UAAU,eAAe,OAAO;EACzC;;;EAIA,YAAY,OAAO,UAAmB;GACpC,MAAM,UAAU,QAAQ,KAAK,KAAK;GAClC,MAAM,UAAU,SAAS;IAAE,GAAG;IAAK;GAAQ,EAAE;GAC7C,MAAM,MAAM,OAAO;GACnB,KAAK,CAAC,CAAC,MAAM,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;EACrC;;;;EAKA,WAAW,WAAmB,KAAK;GAAE,MAAM;GAAU;EAAO,CAAC;;;;EAK7D,YAAY,YAAY;GACtB,MAAM,UAAU;GAChB,IAAI,YAAY,MAAM;GACtB,MAAM,QAAQ,MAAM,QAAQ,QAAQ,WAClC,OAAO,IAAI,aAAa;IACtB,MAAM,SAAS,OAAO;IACtB,OAAO,OAAO,OAAO;IACrB,OAAO,OAAO,OAAO;GACvB,CAAC,CACH;GAGA,IAAI,UAAU,MAAM,KAAK;IAAE,MAAM;IAAc;GAAM,CAAC;GACtD,WAAW;EACb;;;;EAKA,eAAwB;GAEtB,IAAI,KAAK,SAAS,eAAe;IAC/B,KAAK,EAAE,MAAM,WAAW,CAAC;IACzB,OAAO;GACT;GACA,IAAI,CAAC,WAAW,GAAG,OAAO;GAC1B,KAAK,EAAE,MAAM,WAAW,CAAC;GACzB,OAAO;EACT;;;EAIA,uBAAgC;GAC9B,IAAI,CAAC,WAAW,GAAG,OAAO;GAC1B,KAAK,EAAE,MAAM,oBAAoB,CAAC;GAClC,OAAO;EACT;;EAGA;;EAGA,aAAa,KAAK,EAAE,MAAM,QAAQ,CAAC;;EAGnC,kBAAqC;GACnC,MAAM,SAAS,QAAQ,MAAM,KAAK;GAClC,IAAI,WAAW,MAAM,OAAO;GAC5B,OAAO;EACT;;EAEA,cAAiC,QAAQ,MAAM;;;EAI/C,aAAa;GACX,WAAW,QAAQ;GACnB,UAAU,QAAQ;GAClB,SAAS,WAA+B,QAAQ,OAAO,MAAM;EAC/D;CACF;AACF"}

package/dist/app/gate/index.d.ts

@@ -0,0 +1,5 @@
+import { GateNotice, GateView } from "./domain/types.js";
+import "./domain/index.js";
+import { Gate, GateConfig, createGate } from "./gate.js";
+import { GateReact, gateReact } from "./react.js";
+export { type Gate, type GateConfig, type GateNotice, type GateReact, type GateView, createGate, gateReact };

package/dist/app/gate/index.js

@@ -0,0 +1,3 @@
+import { createGate } from "./gate.js";
+import { gateReact } from "./react.js";
+export { createGate, gateReact };

package/dist/app/gate/memory.d.ts

@@ -0,0 +1,97 @@
+import { Effect, Layer, Schema } from "effect";
+import { StdTable, StdTableService } from "@kestack/std-toolkit/db";
+import { ESchema } from "@kestack/std-toolkit/eschema";
+//#region src/app/gate/memory.d.ts
+declare const GateMemory: ESchema<"v1", {
+  /** The Backend chosen; null until one is. */
+  backend: Schema.NullOr<Schema.Literals<readonly ["cloud", "device"]>>;
+  cloud: Schema.Struct<{
+    /** The Remembered Accounts, as the Backend last named them. */
+    readonly accounts: Schema.$Array<Schema.Struct<{
+      readonly user: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly email: Schema.String;
+        readonly image: Schema.NullOr<Schema.String>;
+      }>;
+      readonly active: Schema.Boolean;
+    }>>;
+    /** The account found lost, until the User signs in to it again or opens
+     * another. */
+    readonly lost: Schema.NullOr<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly name: Schema.String;
+      readonly email: Schema.String;
+      readonly image: Schema.NullOr<Schema.String>;
+    }>>;
+  }>;
+  device: Schema.Struct<{
+    /** The Remembered Accounts, as the Backend last named them. */
+    readonly accounts: Schema.$Array<Schema.Struct<{
+      readonly user: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly email: Schema.String;
+        readonly image: Schema.NullOr<Schema.String>;
+      }>;
+      readonly active: Schema.Boolean;
+    }>>;
+    /** The account found lost, until the User signs in to it again or opens
+     * another. */
+    readonly lost: Schema.NullOr<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly name: Schema.String;
+      readonly email: Schema.String;
+      readonly image: Schema.NullOr<Schema.String>;
+    }>>;
+  }>;
+}, "GateMemory">;
+type GateMemory = typeof GateMemory.Type;
+/** Where the Gate keeps what it remembers on this device. Realize it on any
+ * StdTable adapter: Memory, IDB in a browser, SQLite on a phone. */
+export declare const gateTable: StdTable<"auth-gate", import("@kestack/std-toolkit/db").PrimaryIndex<"pk", "sk">, {}, {}>;
+/** A place to keep `gateTable`. */
+export type GateTable = Layer.Layer<StdTableService<typeof gateTable.logicalName>>;
+/** Reads and changes what the Gate remembers, kept in `table`. */
+export declare const gateMemory: (table: GateTable) => {
+  read: Effect.Effect<{
+    readonly backend: "cloud" | "device" | null;
+    readonly cloud: {
+      readonly accounts: readonly {
+        readonly user: {
+          readonly id: string;
+          readonly name: string;
+          readonly email: string;
+          readonly image: string | null;
+        };
+        readonly active: boolean;
+      }[];
+      readonly lost: {
+        readonly id: string;
+        readonly name: string;
+        readonly email: string;
+        readonly image: string | null;
+      } | null;
+    };
+    readonly device: {
+      readonly accounts: readonly {
+        readonly user: {
+          readonly id: string;
+          readonly name: string;
+          readonly email: string;
+          readonly image: string | null;
+        };
+        readonly active: boolean;
+      }[];
+      readonly lost: {
+        readonly id: string;
+        readonly name: string;
+        readonly email: string;
+        readonly image: string | null;
+      } | null;
+    };
+  }, never, never>;
+  update: (change: (current: GateMemory) => GateMemory) => Effect.Effect<void, never, never>;
+};
+//#endregion
+//# sourceMappingURL=memory.d.ts.map

package/dist/app/gate/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","names":[],"sources":["../../../src/app/gate/memory.ts"],"mappings":";;;;cAoBM,YAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAOX,oBAAoB,WAAW;;;qBAMvB,WAAS,wDAAA;;YAGV,YAAY,MAAM,MAC5B,uBAAuB,UAAU;;qBAQtB,aAAU,OAAW;EAChC,MAAI,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKJ,SAAM,SAAY,SAAS,eAAe,eAAU,OAAA"}

package/dist/app/gate/memory.js

@@ -0,0 +1,48 @@
+import { Backend } from "../host/host.js";
+import { Effect, Schema } from "effect";
+import { StdTable } from "@kestack/std-toolkit/db";
+import { ESchema } from "@kestack/std-toolkit/eschema";
+//#region src/app/gate/memory.ts
+const User = Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	email: Schema.String,
+	image: Schema.NullOr(Schema.String)
+});
+const Remembered = Schema.Struct({
+	/** The Remembered Accounts, as the Backend last named them. */
+	accounts: Schema.Array(Schema.Struct({
+		user: User,
+		active: Schema.Boolean
+	})),
+	/** The account found lost, until the User signs in to it again or opens
+	* another. */
+	lost: Schema.NullOr(User)
+});
+const GateMemory = ESchema.make("GateMemory", {
+	/** The Backend chosen; null until one is. */
+	backend: Schema.NullOr(Backend),
+	cloud: Remembered,
+	device: Remembered
+}).build();
+const NOBODY = {
+	accounts: [],
+	lost: null
+};
+/** Where the Gate keeps what it remembers on this device. Realize it on any
+* StdTable adapter: Memory, IDB in a browser, SQLite on a phone. */
+const gateTable = StdTable.make("auth-gate").primary("pk", "sk").build();
+const memory = gateTable.singleEntity(GateMemory).default({
+	backend: null,
+	cloud: NOBODY,
+	device: NOBODY
+});
+/** Reads and changes what the Gate remembers, kept in `table`. */
+const gateMemory = (table) => ({
+	read: memory.get().pipe(Effect.map(({ value }) => value), Effect.provide(table), Effect.orDie),
+	update: (change) => memory.getAndUpdate(change).pipe(Effect.provide(table), Effect.orDie, Effect.asVoid)
+});
+//#endregion
+export { gateMemory, gateTable };
+
+//# sourceMappingURL=memory.js.map

package/dist/app/gate/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","names":[],"sources":["../../../src/app/gate/memory.ts"],"sourcesContent":["import { Effect, type Layer, Schema } from 'effect';\nimport { StdTable, type StdTableService } from '@kestack/std-toolkit/db';\nimport { ESchema } from '@kestack/std-toolkit/eschema';\nimport { Backend } from '../host/index.ts';\n\nconst User = Schema.Struct({\n  id: Schema.String,\n  name: Schema.String,\n  email: Schema.String,\n  image: Schema.NullOr(Schema.String),\n});\n\nconst Remembered = Schema.Struct({\n  /** The Remembered Accounts, as the Backend last named them. */\n  accounts: Schema.Array(Schema.Struct({ user: User, active: Schema.Boolean })),\n  /** The account found lost, until the User signs in to it again or opens\n   * another. */\n  lost: Schema.NullOr(User),\n});\n\nconst GateMemory = ESchema.make('GateMemory', {\n  /** The Backend chosen; null until one is. */\n  backend: Schema.NullOr(Backend),\n  cloud: Remembered,\n  device: Remembered,\n}).build();\n\ntype GateMemory = typeof GateMemory.Type;\n\nconst NOBODY: typeof Remembered.Type = { accounts: [], lost: null };\n\n/** Where the Gate keeps what it remembers on this device. Realize it on any\n * StdTable adapter: Memory, IDB in a browser, SQLite on a phone. */\nexport const gateTable = StdTable.make('auth-gate').primary('pk', 'sk').build();\n\n/** A place to keep `gateTable`. */\nexport type GateTable = Layer.Layer<\n  StdTableService<typeof gateTable.logicalName>\n>;\n\nconst memory = gateTable\n  .singleEntity(GateMemory)\n  .default({ backend: null, cloud: NOBODY, device: NOBODY });\n\n/** Reads and changes what the Gate remembers, kept in `table`. */\nexport const gateMemory = (table: GateTable) => ({\n  read: memory.get().pipe(\n    Effect.map(({ value }): GateMemory => value),\n    Effect.provide(table),\n    Effect.orDie,\n  ),\n  update: (change: (current: GateMemory) => GateMemory) =>\n    memory\n      .getAndUpdate(change)\n      .pipe(Effect.provide(table), Effect.orDie, Effect.asVoid),\n});\n"],"mappings":";;;;;AAKA,MAAM,OAAO,OAAO,OAAO;CACzB,IAAI,OAAO;CACX,MAAM,OAAO;CACb,OAAO,OAAO;CACd,OAAO,OAAO,OAAO,OAAO,MAAM;AACpC,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;;CAE/B,UAAU,OAAO,MAAM,OAAO,OAAO;EAAE,MAAM;EAAM,QAAQ,OAAO;CAAQ,CAAC,CAAC;;;CAG5E,MAAM,OAAO,OAAO,IAAI;AAC1B,CAAC;AAED,MAAM,aAAa,QAAQ,KAAK,cAAc;;CAE5C,SAAS,OAAO,OAAO,OAAO;CAC9B,OAAO;CACP,QAAQ;AACV,CAAC,CAAC,CAAC,MAAM;AAIT,MAAM,SAAiC;CAAE,UAAU,CAAC;CAAG,MAAM;AAAK;;;AAIlE,MAAa,YAAY,SAAS,KAAK,WAAW,CAAC,CAAC,QAAQ,MAAM,IAAI,CAAC,CAAC,MAAM;AAO9E,MAAM,SAAS,UACZ,aAAa,UAAU,CAAC,CACxB,QAAQ;CAAE,SAAS;CAAM,OAAO;CAAQ,QAAQ;AAAO,CAAC;;AAG3D,MAAa,cAAc,WAAsB;CAC/C,MAAM,OAAO,IAAI,CAAC,CAAC,KACjB,OAAO,KAAK,EAAE,YAAwB,KAAK,GAC3C,OAAO,QAAQ,KAAK,GACpB,OAAO,KACT;CACA,SAAS,WACP,OACG,aAAa,MAAM,CAAC,CACpB,KAAK,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,OAAO,MAAM;AAC9D"}

package/dist/app/gate/react.d.ts

@@ -0,0 +1,74 @@
+import { Backend } from "../host/host.js";
+import { GateNotice, GateView } from "./domain/types.js";
+import "./domain/index.js";
+import { Gate } from "./gate.js";
+import "./index.js";
+import { ReactNode } from "react";
+import { NamedChoice } from "@kestack/auth-toolkit/client";
+//#region src/app/gate/react.d.ts
+type NotOpen<S> = Exclude<GateView<S>, {
+  kind: 'open';
+}>;
+/**
+ * A Gate as React sees it, on any platform: `SignedIn` and `SignedOut`
+ * around any part of the app, from the whole of it to one button;
+ * `useGate` anywhere; `useAccounts` and `useSession` inside `SignedIn`. Nothing runs until one of them first renders.
+ */
+export declare const gateReact: <S>(gate: Gate<S>) => {
+  SignedIn: (props: {
+    readonly children: ReactNode;
+    readonly fallback?: ReactNode | ((view: NotOpen<S>) => ReactNode);
+  }) => string | number | bigint | boolean | import("react").JSX.Element | Iterable<ReactNode> | Promise<string | number | bigint | boolean | Iterable<ReactNode> | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | import("react").ReactPortal | null | undefined> | null | undefined;
+  SignedOut: (props: {
+    readonly children: ReactNode;
+  }) => ReactNode;
+  useGate: () => {
+    view: GateView<S>;
+    /** The Backend running; null until it has started. */
+    backend: "cloud" | "device" | null;
+    /** Chooses a Backend and runs on it at once. */
+    setBackend: (asked: Backend) => Promise<void>;
+    /** Whether the device is online. */
+    online: boolean;
+    /** The oldest Gate Notice not yet dismissed. */
+    notice: GateNotice | null;
+    dismissNotice: () => undefined;
+    /** Asks the Backend again who is signed in. */
+    checkAgain: () => void | undefined;
+    /** Tries again to open an account that would not open. */
+    retry: () => void | undefined;
+    /** Signs an account in, the first or one more. */
+    signIn: () => Promise<void>;
+    /** An Account Switch, as from an Account Lost, where nobody is open. */
+    switchTo: (userId: string) => void | undefined;
+    /** Signs the Active Account out, or forgets a lost one; false when the
+     * Backend can't be reached. */
+    signOut: () => boolean;
+    /** Whether the device Backend is asking who signs in, and the answer: a
+     * choice, or null to sign nobody in. */
+    namedSignIn: {
+      asking: boolean;
+      answer: (choice: NamedChoice | null) => void;
+    };
+  };
+  useAccounts: () => {
+    /** The open account. */
+    current: import("@kestack/auth-toolkit/client").Account;
+    /** Every Signed-in Account. */
+    all: readonly import("@kestack/auth-toolkit/client").Account[];
+    /** Signs one more account in, who becomes the Active Account. */
+    add: () => Promise<void>;
+    /** An Account Switch, at once. */
+    switchTo: (userId: string) => void | undefined;
+    /** False when the Backend can't be reached. */
+    signOut: () => boolean;
+    /** False when the Backend can't be reached. */
+    signOutEveryone: () => boolean;
+  };
+  /** The open Account's Session; only inside `SignedIn`. */
+  useSession: () => S;
+};
+/** A Gate's React side, as `gateReact` makes it. */
+export type GateReact<S> = ReturnType<typeof gateReact<S>>;
+//#endregion
+//# sourceMappingURL=react.d.ts.map

package/dist/app/gate/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","names":["_$___host_host_ts0.Backend","_$__index_ts0.GateNotice"],"sources":["../../../src/app/gate/react.tsx"],"mappings":";;;;;;;;KAWK,QAAQ,KAAK,QAAQ,SAAS;EAAM;;;;;;;qBAS5B,YAAa,GAAC,MAAS,KAAK;EAmBd,WAAA;aACd,UAAU;aACV,WAAW,cAAc,MAAM,QAAQ,OAAO;6DACxD,IAAA,UAAA,SAAA,aAAA,6CAAA,SAAA,6BAAA,+CAAA,8CAAA;EAgByB,YAAA;aAAW,UAAU;QAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;MAKlC,SAAA,QAAA;;;;;IAkDpB,gDAAO;;IAEP,qDAAG;;IAEH,WAAG;;IAEH,WAAQ;;IAER;;IAEA;;;EAUc,kBAAA;;;YAKR,UAAU,KAAK,kBAAkB,UAAU"}