ignotum 0.0.11 → 0.0.13

package/dist/runtime/client.js

@@ -1,9 +1,10 @@
-import { C as RuntimeRequestNonce, T as TableId, _ as AppId, a as RuntimeFileMetadata, b as IdAlphabet, c as fileFormats, d as fileLimits, f as fileMimeTypes, h as makeFileValue, l as fileGrantUrlOf, m as isFileValue, o as RuntimeFileOccurrence, p as grantFileValue, r as FileId, u as fileIdOf, v as DeploymentId, w as SubscriptionId, x as InvocationId, y as GeneratedId } from "./file-C1abuMgd.js";
-import { b as decodeTransportValue, c as upgrade, d as Result$1, h as pending, m as inspectResult, o as PaginationPageSize, p as failureFromWire, s as initial, t as ValueDescriptor, x as encodeTransportObject } from "./descriptor-C5VA9qRl-DuQsowaQ.js";
-import { a as ErrorCode, c as ServerMessageJson, d as WireSuccess, f as AppStateRevision, i as DeploymentCloseCode, l as WireFailure, m as InvocationKey, n as functionPathOf, o as FunctionAddress, p as DeploymentGeneration, r as ClientMessageJson, s as Operation, u as WireResult } from "./api-DzcR7spt.js";
-import { Array as Array$1, Cause, Context, Deferred, Duration, Effect, ErrorReporter, Fiber, HashMap, Layer, ManagedRuntime, Predicate, Schedule, Schema, String } from "effect";
+import { A as RuntimeFileMetadata, B as makeFileValue, D as encodeTransportObject, E as decodeTransportValue, F as fileIdOf, G as IdAlphabet, H as AppId, I as fileLimits, J as SessionEpoch, K as InvocationId, L as fileMimeTypes, N as fileFormats, P as fileGrantUrlOf, R as grantFileValue, U as DeploymentId, W as GeneratedId, X as TableId, Y as SubscriptionId, _ as Result$2, a as SessionResponse, b as inspectResult, d as sessionPath, f as sessionRequestsPath, i as SessionRequest, j as RuntimeFileOccurrence, k as FileId, l as developmentSelectionKey, m as upgrade, n as SessionOutcome, o as SessionState, p as initial, q as RuntimeRequestNonce, r as SessionRedirect, t as DevelopmentSelection, x as pending, y as failureFromWire, z as isFileValue } from "./id-Bt9XWRGL.js";
+import { a as ErrorCode, c as ServerMessageJson, d as WireSuccess, f as AppStateRevision, i as DeploymentCloseCode, l as WireFailure, m as InvocationKey, n as functionPathOf, o as FunctionAddress, p as DeploymentGeneration, r as ClientMessageJson, s as Operation, u as WireResult } from "./api-CAgKDij7.js";
+import { s as PaginationPageSize, t as ValueDescriptor } from "./descriptor-Cyo9FP9n-C0SRVXNW.js";
+import { Array as Array$1, Cause, Context, Deferred, Duration, Effect, ErrorReporter, Fiber, HashMap, Layer, ManagedRuntime, Option, Predicate, Schedule, Schema, Semaphore, String } from "effect";
 import { customAlphabet } from "nanoid";
-import { useCallback, useCallback as useCallback$1, useContext, useDebugValue, useDebugValue as useDebugValue$1, useEffect, useEffect as useEffect$1, useErrorBoundary, useId, useImperativeHandle, useLayoutEffect, useMemo, useMemo as useMemo$1, useReducer, useRef, useState, useState as useState$1 } from "preact/hooks";
+import { FetchHttpClient, HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+import { useCallback, useCallback as useCallback$1, useContext, useDebugValue, useDebugValue as useDebugValue$1, useEffect, useEffect as useEffect$1, useErrorBoundary, useId as useElementId, useImperativeHandle, useLayoutEffect, useMemo, useMemo as useMemo$1, useReducer, useRef, useState, useState as useState$1 } from "preact/hooks";
 import * as Socket from "effect/unstable/socket/Socket";
 import * as BrowserCrypto from "@effect/platform-browser/BrowserCrypto";
 import { Component, Fragment, cloneElement, createContext, createElement, createRef, h, isValidElement, toChildArray } from "preact";
@@ -32,9 +33,10 @@ const Files = { url: (file) => {
 } };
 const formatByMime = {};
 for (const format of fileFormats) formatByMime[fileMimeTypes[format]] = format;
+const MutationObject = Schema.ObjectKeyword.check(Schema.makeFilter((value) => Object.prototype.toString.call(value) === "[object Object]", { message: "Mutation objects must contain ordinary fields; built-in collections are unsupported." }));
 const collectNativeFiles = (value, files) => {
 	if (value instanceof File) {
-		files.push(value);
+		files.add(value);
 		return;
 	}
 	if (isFileValue(value) || Predicate.isDate(value)) return;
@@ -43,7 +45,7 @@ const collectNativeFiles = (value, files) => {
 		return;
 	}
 	if (!Predicate.isObject(value)) return;
-	for (const child of Object.values(value)) collectNativeFiles(child, files);
+	for (const child of Object.values(Schema.decodeSync(MutationObject)(value))) collectNativeFiles(child, files);
 };
 const replaceNativeFiles = (value, replacements) => {
 	if (value instanceof File) return replacements.get(value);
@@ -54,18 +56,23 @@ const replaceNativeFiles = (value, replacements) => {
 };
 const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArguments")(function* (input) {
 	const ids = yield* IdGenerator;
-	const native = [];
-	collectNativeFiles(input, native);
-	const unique = new Set(native);
-	if (unique.size > fileLimits.filesPerMutation) throw new Error(`A mutation may upload at most ${fileLimits.filesPerMutation} files.`);
-	if ([...unique].reduce((total, file) => total + file.size, 0) > fileLimits.mutationBytes) throw new Error(`Mutation uploads may total at most ${fileLimits.mutationBytes} bytes.`);
+	const unique = yield* Effect.try(() => {
+		const files = /* @__PURE__ */ new Set();
+		collectNativeFiles(input, files);
+		if (files.size > fileLimits.filesPerMutation) throw new Error(`A mutation may upload at most ${fileLimits.filesPerMutation} files.`);
+		if ([...files].reduce((total, file) => total + file.size, 0) > fileLimits.mutationBytes) throw new Error(`Mutation uploads may total at most ${fileLimits.mutationBytes} bytes.`);
+		return files;
+	});
 	const replacements = /* @__PURE__ */ new Map();
 	const nativeFiles = /* @__PURE__ */ new Map();
 	for (const file of unique) {
-		const format = formatByMime[file.type.toLowerCase()];
-		if (format === void 0) throw new Error(`File '${file.name}' has unsupported media type '${file.type || "unknown"}'.`);
-		if (file.size === 0 || file.size > fileLimits.fileBytes) throw new Error(`File '${file.name}' must be between 1 and ${fileLimits.fileBytes} bytes.`);
-		if (new TextEncoder().encode(file.name).byteLength > fileLimits.filenameBytes) throw new Error(`File '${file.name}' has a filename that is too long.`);
+		const format = yield* Effect.try(() => {
+			const format = formatByMime[file.type.toLowerCase()];
+			if (format === void 0) throw new Error(`File '${file.name}' has unsupported media type '${file.type || "unknown"}'.`);
+			if (file.size === 0 || file.size > fileLimits.fileBytes) throw new Error(`File '${file.name}' must be between 1 and ${fileLimits.fileBytes} bytes.`);
+			if (new TextEncoder().encode(file.name).byteLength > fileLimits.filenameBytes) throw new Error(`File '${file.name}' has a filename that is too long.`);
+			return format;
+		});
 		const id = yield* ids.generate(FileId);
 		replacements.set(file, makeFileValue(id, {
 			format,
@@ -75,12 +82,13 @@ const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArguments"
 		nativeFiles.set(id, file);
 	}
 	return {
-		value: replaceNativeFiles(input, replacements),
+		value: unique.size === 0 ? input : yield* Effect.try(() => replaceNativeFiles(input, replacements)),
 		nativeFiles,
 		fileIds: Array.from(nativeFiles.keys())
 	};
 });
 const applyFileGrants = (value, grants) => {
+	if (grants.length === 0) return value;
 	const byId = /* @__PURE__ */ new Map();
 	for (const grant of grants) {
 		if (byId.has(grant.id)) throw new Error("A query file grant ID is duplicated.");
@@ -105,14 +113,182 @@ const applyFileGrants = (value, grants) => {
 };
 //#endregion
 //#region ../contracts/dist/json.js
-const encodeScalar = (value) => Schema.decodeSync(Schema.String)(JSON.stringify(value));
-const encodeCanonicalJson = (value) => {
-	if (value === null || Predicate.isString(value) || Predicate.isNumber(value) || Predicate.isBoolean(value)) return encodeScalar(value);
-	if (Predicate.isObject(value)) return `{${Array$1.map(Array$1.sort(String.Order)(Object.keys(value)), (key) => {
-		const field = Schema.decodeUnknownSync(Schema.Json)(value[key]);
-		return `${encodeScalar(key)}:${encodeCanonicalJson(field)}`;
-	}).join(",")}}`;
-	return `[${Schema.decodeUnknownSync(Schema.Array(Schema.Json))(value).map(encodeCanonicalJson).join(",")}]`;
+const encodeJson = (value) => {
+	if (Array$1.isArray(value)) return `[${value.map(encodeJson).join(",")}]`;
+	if (value === null || Predicate.isString(value) || Predicate.isNumber(value) || Predicate.isBoolean(value)) return JSON.stringify(value);
+	return `{${Array$1.sortWith(Object.entries(value), ([key]) => key, String.Order).map(([key, field]) => `${JSON.stringify(key)}:${encodeJson(field)}`).join(",")}}`;
+};
+const encodeCanonicalJson = (value) => encodeJson(Schema.decodeSync(Schema.Json)(value));
+//#endregion
+//#region src/client/id.ts
+var IdRequestError = class extends Schema.TaggedError()("IdRequestError", { message: Schema.String }) {};
+const outcomeKey = "ignotum.id.outcome";
+const selectionJson = Schema.fromJsonString(DevelopmentSelection);
+var BrowserSession = class BrowserSession extends Context.Service()("ignotum/client/id/BrowserSession") {
+	static layer = Layer.effect(BrowserSession, Effect.gen(function* () {
+		const client = (yield* HttpClient.HttpClient).pipe(HttpClient.filterStatusOk);
+		const ids = yield* IdGenerator;
+		const bootstrapLock = yield* Semaphore.make(1);
+		const listeners = /* @__PURE__ */ new Set();
+		let state = { status: "pending" };
+		let current;
+		let generation = 0;
+		let deadline = Infinity;
+		let development = false;
+		let selection;
+		let expiry;
+		const notify = () => {
+			for (const listener of listeners) listener();
+		};
+		const suspend = (error) => {
+			generation += 1;
+			deadline = Infinity;
+			if (expiry !== void 0) clearTimeout(expiry);
+			current = void 0;
+			state = error === void 0 ? {
+				status: "pending",
+				outcome: state.outcome
+			} : {
+				status: "error",
+				error,
+				outcome: state.outcome
+			};
+			notify();
+		};
+		const accept = (session, serverTime) => {
+			generation += 1;
+			if (expiry !== void 0) clearTimeout(expiry);
+			current = session;
+			state = session.user === null ? {
+				status: "signedOut",
+				outcome: state.outcome
+			} : {
+				status: "signedIn",
+				user: session.user,
+				outcome: state.outcome
+			};
+			const delay = Math.max(0, session.validUntil - serverTime);
+			deadline = performance.now() + delay;
+			if (delay < 2147483647) expiry = setTimeout(() => suspend(), delay);
+			notify();
+		};
+		const checkExpiry = () => {
+			if (current !== void 0 && performance.now() >= deadline) suspend();
+		};
+		globalThis.addEventListener?.("focus", checkExpiry);
+		globalThis.document?.addEventListener("visibilitychange", checkExpiry);
+		yield* Effect.addFinalizer(() => Effect.sync(() => {
+			if (expiry !== void 0) clearTimeout(expiry);
+			listeners.clear();
+			globalThis.removeEventListener?.("focus", checkExpiry);
+			globalThis.document?.removeEventListener("visibilitychange", checkExpiry);
+		}));
+		const readOutcome = () => {
+			const raw = globalThis.sessionStorage.getItem(outcomeKey);
+			if (raw !== null) {
+				const decoded = Schema.decodeUnknownOption(SessionOutcome)(raw);
+				if (Option.isSome(decoded)) state = {
+					...state,
+					outcome: decoded.value
+				};
+				globalThis.sessionStorage.removeItem(outcomeKey);
+			}
+		};
+		const parameters = () => {
+			if (!development || selection === void 0) return "";
+			const params = new URLSearchParams({ epoch: selection.epoch });
+			if (selection.username !== null) params.set("username", selection.username);
+			return `?${params}`;
+		};
+		const readSession = Effect.fn("BrowserSession.read")(function* () {
+			return yield* client.get(`${sessionPath}${parameters()}`, { headers: { "x-ignotum-request": "1" } }).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(SessionResponse)));
+		});
+		let bootstrapGeneration = 0;
+		const bootstrap = bootstrapLock.withPermits(1)(Effect.gen(function* () {
+			const admittedGeneration = generation;
+			bootstrapGeneration = admittedGeneration;
+			const startedAt = performance.now();
+			let session = yield* readSession();
+			development = session.development === true;
+			if (development && selection === void 0) {
+				const saved = globalThis.sessionStorage.getItem(developmentSelectionKey);
+				const decoded = saved === null ? Option.none() : Schema.decodeOption(selectionJson)(saved);
+				selection = Option.getOrElse(decoded, () => ({
+					formatVersion: 1,
+					username: null,
+					epoch: ""
+				}));
+				if (selection.epoch === "") selection = {
+					...selection,
+					epoch: yield* ids.generate(SessionEpoch)
+				};
+				globalThis.sessionStorage.setItem(developmentSelectionKey, Schema.encodeSync(selectionJson)(selection));
+				session = yield* readSession();
+			}
+			if (generation !== admittedGeneration) {
+				if (current !== void 0) return current;
+				return yield* IdRequestError.make({ message: "Your ID session changed while loading." });
+			}
+			readOutcome();
+			if (session.outcome !== void 0) state = {
+				...state,
+				outcome: session.outcome
+			};
+			accept(session, session.serverTime + performance.now() - startedAt);
+			return session;
+		})).pipe(Effect.mapError(() => IdRequestError.make({ message: "Could not load your ID session." })), Effect.tapError((error) => Effect.sync(() => {
+			if (generation === bootstrapGeneration) suspend(error.message);
+		})));
+		const start = Effect.fn("BrowserSession.start")(function* (intent, profile, returnTo) {
+			const session = current ?? (yield* bootstrap);
+			if (intent === "requestProfile" && session.user === null) return yield* IdRequestError.make({ message: "Sign in before requesting profile information." });
+			const request = yield* Schema.decodeUnknownEffect(SessionRequest)({
+				intent,
+				profile,
+				sessionEpoch: session.sessionEpoch,
+				returnTo: returnTo ?? `${globalThis.location.pathname}${globalThis.location.search}${globalThis.location.hash}`
+			}).pipe(Effect.mapError(() => IdRequestError.make({ message: "The ID request is invalid." })));
+			const redirect = yield* HttpClientRequest.post(sessionRequestsPath).pipe(HttpClientRequest.setHeader("x-ignotum-request", "1"), HttpClientRequest.bodyJsonUnsafe(request), client.execute, Effect.flatMap(HttpClientResponse.schemaBodyJson(SessionRedirect)), Effect.mapError(() => IdRequestError.make({ message: "Could not start the ID request." })));
+			if (current?.sessionEpoch !== session.sessionEpoch) return yield* IdRequestError.make({ message: "Your ID session changed. Try again." });
+			globalThis.location.assign(redirect.redirectUrl);
+		});
+		const signOut = Effect.gen(function* () {
+			const session = current ?? (yield* bootstrap);
+			yield* HttpClientRequest.delete(sessionPath).pipe(HttpClientRequest.setHeader("x-ignotum-request", "1"), HttpClientRequest.bodyJsonUnsafe({ sessionEpoch: session.sessionEpoch }), client.execute, Effect.mapError(() => IdRequestError.make({ message: "Could not sign out." })));
+			suspend();
+			if (development) {
+				selection = {
+					formatVersion: 1,
+					username: null,
+					epoch: yield* ids.generate(SessionEpoch)
+				};
+				globalThis.sessionStorage.setItem(developmentSelectionKey, Schema.encodeSync(selectionJson)(selection));
+			}
+			globalThis.location.reload();
+		});
+		return BrowserSession.of({
+			snapshot: () => {
+				checkExpiry();
+				return state;
+			},
+			current: () => {
+				checkExpiry();
+				return current;
+			},
+			subscribe: (listener) => {
+				listeners.add(listener);
+				return () => {
+					listeners.delete(listener);
+				};
+			},
+			accept,
+			suspend,
+			bootstrap,
+			start,
+			signOut,
+			socketParameters: parameters
+		});
+	})).pipe(Layer.provide(FetchHttpClient.layer));
 };
 //#endregion
 //#region src/client/errors.ts
@@ -194,7 +370,9 @@ const IndexPointInvalidation = Schema.Struct({
 	index: IndexIdentity,
 	key: EncodedIndexKey
 });
+const IdDependency = Schema.Struct({ type: Schema.Literal("Id") });
 const ReadDependency = Schema.Union([
+	IdDependency,
 	TableDependency,
 	DocumentDependency,
 	IndexRangeDependency
@@ -259,7 +437,8 @@ const InvocationBase = {
 	generation: DeploymentGeneration,
 	invocationKey: InvocationKey,
 	function: FunctionAddress,
-	args: Schema.Json
+	args: Schema.Json,
+	identity: Schema.optional(SessionState)
 };
 const QueryInvocation = Schema.Struct({
 	...InvocationBase,
@@ -282,6 +461,7 @@ var RuntimeDeploymentUnavailable = class extends Schema.TaggedError()("RuntimeDe
 	message: Schema.String
 }) {};
 const RuntimeInvocationRejectionCode = Schema.Literals([
+	"SessionExpired",
 	"FunctionUnavailable",
 	"InvalidArguments",
 	"InvocationIdConflict",
@@ -342,6 +522,7 @@ const ArtifactKind = Schema.Literals([
 	"ClientShell",
 	"FunctionBundle",
 	"ServerManifest",
+	"ServerEnvironment",
 	"SourceMap",
 	"SchemaSnapshot"
 ]);
@@ -366,7 +547,14 @@ const DeploymentInventoryV1 = Schema.Struct({
 	formatVersion: Schema.Literal(1),
 	files: Schema.Array(ArtifactFile)
 });
-initial(DeploymentInventoryV1);
+const DeploymentInventoryV2 = Schema.Struct({
+	formatVersion: Schema.Literal(2),
+	files: Schema.Array(ArtifactFile)
+});
+upgrade(initial(DeploymentInventoryV1), DeploymentInventoryV2, (inventory) => ({
+	formatVersion: 2,
+	files: inventory.files
+}));
 const ClientManifestV1 = Schema.Struct({
 	formatVersion: Schema.Literal(1),
 	shell: ArtifactReference,
@@ -387,6 +575,16 @@ const SchemaSnapshotField = Schema.Struct({
 	name: Schema.String,
 	value: ValueDescriptor
 });
+const EnvironmentArtifactV1 = Schema.Struct({
+	formatVersion: Schema.Literal(1),
+	nonce: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),
+	values: Schema.Record(Schema.String, Schema.String)
+});
+initial(EnvironmentArtifactV1);
+const ServerEnvironmentArtifact = Schema.Struct({
+	artifact: ArtifactReference,
+	fields: Schema.Array(SchemaSnapshotField)
+});
 const SchemaSnapshotIndex = Schema.Struct({
 	name: Schema.String,
 	fields: Schema.Array(Schema.String)
@@ -440,11 +638,22 @@ const ServerBuildManifestV2 = Schema.Struct({
 	schema: ArtifactReference,
 	functions: Schema.Array(ServerFunctionArtifact)
 });
-upgrade(initial(ServerBuildManifestV1), ServerBuildManifestV2, (manifest) => ({
+const ServerBuildManifestThroughV2 = upgrade(initial(ServerBuildManifestV1), ServerBuildManifestV2, (manifest) => ({
 	formatVersion: 2,
 	schema: manifest.schema,
 	functions: manifest.functions
 }));
+const ServerBuildManifestV3 = Schema.Struct({
+	formatVersion: Schema.Literal(3),
+	schema: ArtifactReference,
+	environment: Schema.optional(ServerEnvironmentArtifact),
+	functions: Schema.Array(ServerFunctionArtifact)
+});
+upgrade(ServerBuildManifestThroughV2, ServerBuildManifestV3, (manifest) => ({
+	formatVersion: 3,
+	schema: manifest.schema,
+	functions: manifest.functions
+}));
 ArtifactPath.make("inventory.json");
 ArtifactPath.make("client/manifest.json");
 ArtifactPath.make("client/shell.html");
@@ -452,6 +661,7 @@ ArtifactPath.make("client/shell.html");
 `${ArtifactPath.make("client/routes")}`;
 ArtifactPath.make("server/manifest.json");
 ArtifactPath.make("server/schema.json");
+ArtifactPath.make("server/environment.json");
 //#endregion
 //#region ../contracts/dist/runtime/transport.js
 const runtimeInvocationPath = "/v1/invoke";
@@ -519,78 +729,87 @@ const subscribeMessage = (entry) => ({
 });
 const makeQueryCache = (allocateId, sendLifecycleMessage) => {
 	const queries = /* @__PURE__ */ new Map();
-	const queryKeysById = /* @__PURE__ */ new Map();
+	const queriesById = /* @__PURE__ */ new Map();
+	const observe = Effect.fn("SyncClient.QueryCache.observe")(function* (functionAddress, args) {
+		const key = queryKey(functionAddress, args);
+		let entry = queries.get(key);
+		if (entry === void 0) {
+			const created = {
+				args,
+				function: functionAddress,
+				generation: 0,
+				listeners: /* @__PURE__ */ new Set(),
+				revision: void 0,
+				references: 0,
+				result: pending(),
+				subscriptionId: yield* allocateId
+			};
+			queries.set(key, created);
+			queriesById.set(created.subscriptionId, created);
+			yield* sendLifecycleMessage(subscribeMessage(created));
+			entry = created;
+		}
+		const observed = entry;
+		observed.references += 1;
+		observed.generation += 1;
+		let released = false;
+		return {
+			getSnapshot: () => observed.result,
+			subscribe: (listener) => {
+				observed.listeners.add(listener);
+				return () => observed.listeners.delete(listener);
+			},
+			release: Effect.gen(function* () {
+				if (released) return;
+				released = true;
+				observed.references -= 1;
+				if (observed.references !== 0) return;
+				const generation = ++observed.generation;
+				yield* Effect.sleep("25 millis");
+				if (observed.references !== 0 || observed.generation !== generation || queries.get(key) !== observed) return;
+				queries.delete(key);
+				queriesById.delete(observed.subscriptionId);
+				yield* sendLifecycleMessage({
+					type: "Unsubscribe",
+					id: observed.subscriptionId
+				});
+			})
+		};
+	});
+	const clear = (entry) => {
+		entry.result = pending();
+		entry.revision = void 0;
+		for (const listener of entry.listeners) listener();
+	};
 	return {
-		entries: () => queries.values(),
-		getById: (id) => {
-			const key = queryKeysById.get(id);
-			return key === void 0 ? void 0 : queries.get(key);
+		invalidate: (ids) => {
+			for (const entry of queries.values()) if (ids === void 0 || ids.includes(entry.subscriptionId)) clear(entry);
 		},
-		observe: Effect.fn("SyncClient.QueryCache.observe")(function* (functionAddress, args) {
-			const key = queryKey(functionAddress, args);
-			let entry = queries.get(key);
-			if (entry === void 0) {
-				const created = {
-					args,
-					function: functionAddress,
-					generation: 0,
-					listeners: /* @__PURE__ */ new Set(),
-					revision: void 0,
-					references: 0,
-					result: pending(),
-					subscriptionId: yield* allocateId
-				};
-				queries.set(key, created);
-				queryKeysById.set(created.subscriptionId, key);
-				yield* sendLifecycleMessage(subscribeMessage(created));
-				entry = created;
-			}
-			const observed = entry;
-			observed.references += 1;
-			observed.generation += 1;
-			let released = false;
-			return {
-				getSnapshot: () => observed.result,
-				subscribe: (listener) => {
-					observed.listeners.add(listener);
-					return () => observed.listeners.delete(listener);
-				},
-				release: Effect.gen(function* () {
-					if (released) return;
-					released = true;
-					observed.references -= 1;
-					if (observed.references !== 0) return;
-					const generation = ++observed.generation;
-					yield* Effect.sleep("25 millis");
-					if (observed.references !== 0 || observed.generation !== generation || queries.get(key) !== observed) return;
-					queries.delete(key);
-					queryKeysById.delete(observed.subscriptionId);
-					yield* sendLifecycleMessage({
-						type: "Unsubscribe",
-						id: observed.subscriptionId
-					});
-				})
-			};
-		}),
-		setError: (id, error) => {
-			const key = queryKeysById.get(id);
-			const entry = key === void 0 ? void 0 : queries.get(key);
-			if (entry === void 0) return;
-			entry.result = error;
-			for (const listener of entry.listeners) listener();
+		invalidatePrivate: () => {
+			for (const entry of queries.values()) if (entry.dependsOnId !== false) clear(entry);
 		},
+		entries: () => queries.values(),
+		getById: (id) => queriesById.get(id),
+		observe,
 		setResult: (id, result, revision) => {
-			const key = queryKeysById.get(id);
-			const entry = key === void 0 ? void 0 : queries.get(key);
+			const entry = queriesById.get(id);
 			if (entry === void 0) return;
-			if (entry.revision !== void 0 && revision < entry.revision) return;
-			entry.revision = revision;
+			if (revision !== void 0) {
+				if (entry.revision !== void 0 && revision < entry.revision) return;
+				entry.revision = revision;
+			}
 			entry.result = result;
 			for (const listener of entry.listeners) listener();
 		}
 	};
 };
-const resultFromWire = Effect.fn("SyncClient.resultFromWire")((wire, files = []) => Effect.succeed(wire.type === "Success" ? Result$1.succeed(wire.value === void 0 ? void 0 : applyFileGrants(decodeTransportValue(wire.value, wire.dates ?? []), files)) : failureFromWire(wire.error, wire.dates)));
+const resultFromWire = Effect.fn("SyncClient.resultFromWire")((wire, files = []) => Effect.try({
+	try: () => wire.type === "Success" ? Result$2.succeed(wire.value === void 0 ? void 0 : applyFileGrants(decodeTransportValue(wire.value, wire.dates ?? []), files)) : failureFromWire(wire.error, wire.dates),
+	catch: (cause) => InvalidServerMessage.make({
+		cause,
+		message: "The server returned an invalid function result."
+	})
+}));
 const shouldReloadForCloseCode = (code) => code === DeploymentCloseCode;
 const handshakesMatch = (first, next) => first.appId === next.appId && first.deploymentId === next.deploymentId && first.generation === next.generation;
 const handshakeDecision = (remembered, acceptedOnConnection, next) => {
@@ -613,10 +832,12 @@ const socketUrl = () => {
 var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync/SyncClient") {
 	static layer = Layer.effect(SyncClient, Effect.gen(function* () {
 		const ids = yield* IdGenerator;
+		const session = yield* BrowserSession;
 		let invocations = HashMap.empty();
 		let rememberedHandshake;
 		let reloadRequested = false;
 		let writer;
+		let sessionSuspended;
 		const encode = (message) => Schema.encodeEffect(ClientMessageJson)(message).pipe(Effect.mapError((cause) => InvalidClientMessage.make({
 			cause,
 			message: "Could not encode an Ignotum sync message."
@@ -630,31 +851,72 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 			ConnectionUnavailable: reportClientError,
 			InvalidClientMessage: reportClientError
 		})));
+		const unsubscribeSession = session.subscribe(() => {
+			if (session.current() === void 0) {
+				queryCache.invalidatePrivate();
+				writer = void 0;
+				if (sessionSuspended !== void 0) Deferred.doneUnsafe(sessionSuspended, Effect.void);
+			}
+		});
+		yield* Effect.addFinalizer(() => Effect.sync(unsubscribeSession));
 		const rejectInvocation = (id, error) => {
-			const pendingInvocation = HashMap.getUnsafe(invocations, id);
+			const pendingInvocation = Option.getOrUndefined(HashMap.get(invocations, id));
 			if (pendingInvocation === void 0) return Effect.void;
 			invocations = HashMap.remove(invocations, id);
 			return reportClientError(error).pipe(Effect.andThen(Deferred.fail(pendingInvocation.prepared, error)), Effect.andThen(Deferred.fail(pendingInvocation.deferred, error)), Effect.asVoid);
 		};
 		const handleMessage = Effect.fn("SyncClient.handleMessage")(function* (message) {
 			switch (message.type) {
-				case "Snapshot":
-					if (queryCache.getById(message.id) === void 0) return;
-					yield* resultFromWire(message.result, message.files ?? []).pipe(Effect.tap((result) => Effect.sync(() => queryCache.setResult(message.id, result, message.revision))));
+				case "Session":
+					if (message.event === "Updated") {
+						const previous = session.current();
+						if (previous !== void 0 && previous.sessionEpoch !== message.session.sessionEpoch) return;
+						if (previous?.viewRevision !== message.session.viewRevision) queryCache.invalidatePrivate();
+						session.accept(message.session, message.serverTime);
+					} else {
+						if (rememberedHandshake?.session?.sessionEpoch !== message.sessionEpoch) return;
+						session.suspend(message.event === "Unavailable" ? "Your ID session is temporarily unavailable." : void 0);
+						if (message.event !== "Unavailable") yield* Effect.forEach(HashMap.keys(invocations), (id) => rejectInvocation(id, ServerError.make({
+							code: "SessionChanged",
+							message: "The session changed. This operation may already have completed."
+						})));
+					}
+					return;
+				case "Invalidate":
+					if (message.sessionEpoch === session.current()?.sessionEpoch) queryCache.invalidate(message.ids);
 					return;
+				case "Snapshot": {
+					const current = session.current();
+					if (current === void 0 || message.identity?.sessionEpoch !== current.sessionEpoch) return;
+					if (message.identity.dependsOnId && message.identity.viewRevision !== current.viewRevision) return;
+					const entry = queryCache.getById(message.id);
+					if (entry === void 0) return;
+					entry.dependsOnId = message.identity.dependsOnId;
+					if (entry.revision !== void 0 && message.revision < entry.revision) return;
+					yield* resultFromWire(message.result, message.files ?? []).pipe(Effect.tap((result) => Effect.sync(() => queryCache.setResult(message.id, result, message.revision))), Effect.catchTags({ InvalidServerMessage: (error) => {
+						queryCache.setResult(message.id, error, message.revision);
+						return reportClientError(error);
+					} }));
+					return;
+				}
 				case "Preparation": {
-					const pendingInvocation = HashMap.getUnsafe(invocations, message.id);
+					if (message.sessionEpoch !== session.current()?.sessionEpoch) return;
+					const pendingInvocation = Option.getOrUndefined(HashMap.get(invocations, message.id));
 					if (pendingInvocation !== void 0) yield* Deferred.succeed(pendingInvocation.prepared, message.uploads);
 					return;
 				}
 				case "Result": {
-					const pendingInvocation = HashMap.getUnsafe(invocations, message.id);
+					if (message.sessionEpoch !== session.current()?.sessionEpoch) return;
+					const pendingInvocation = Option.getOrUndefined(HashMap.get(invocations, message.id));
 					if (pendingInvocation === void 0) return;
-					invocations = HashMap.remove(invocations, message.id);
-					yield* resultFromWire(message.result).pipe(Effect.flatMap((result) => Deferred.succeed(pendingInvocation.deferred, result)));
+					yield* resultFromWire(message.result).pipe(Effect.flatMap((result) => {
+						invocations = HashMap.remove(invocations, message.id);
+						return Deferred.succeed(pendingInvocation.deferred, result);
+					}), Effect.catchTags({ InvalidServerMessage: (error) => rejectInvocation(message.id, error) }));
 					return;
 				}
 				case "Error": {
+					if (message.sessionEpoch !== session.current()?.sessionEpoch) return;
 					const error = message.operation === void 0 ? ServerError.make({
 						code: message.code,
 						message: message.message
@@ -665,7 +927,7 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 					});
 					if (message.operation?.type === "Invocation") yield* rejectInvocation(message.operation.id, error);
 					else if (message.operation?.type === "Subscription") {
-						queryCache.setError(message.operation.id, error);
+						queryCache.setResult(message.operation.id, error);
 						yield* reportClientError(error);
 					} else yield* reportClientError(error);
 					return;
@@ -683,7 +945,8 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 		});
 		const connect = Effect.scoped(Effect.gen(function* () {
 			if (reloadRequested) return yield* Effect.never;
-			const socket = yield* Socket.makeWebSocket(socketUrl(), { closeCodeIsError: (code) => {
+			yield* session.bootstrap.pipe(Effect.mapError((error) => ConnectionUnavailable.make({ message: error.message })));
+			const socket = yield* Socket.makeWebSocket(`${socketUrl()}${session.socketParameters()}`, { closeCodeIsError: (code) => {
 				if (shouldReloadForCloseCode(code)) requestReload();
 				return false;
 			} });
@@ -697,6 +960,22 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 					return;
 				}
 				if (decision === "Ignore") return;
+				if (handshake.session === void 0 || handshake.serverTime === void 0) {
+					requestReload();
+					return;
+				}
+				if (rememberedHandshake?.session !== void 0 && rememberedHandshake.session.sessionEpoch !== handshake.session.sessionEpoch) {
+					queryCache.invalidatePrivate();
+					yield* Effect.forEach(HashMap.keys(invocations), (id) => rejectInvocation(id, ServerError.make({
+						code: "SessionChanged",
+						message: "The session changed. This operation may already have completed."
+					})));
+				} else if (rememberedHandshake?.session?.viewRevision !== handshake.session.viewRevision) queryCache.invalidatePrivate();
+				yield* Effect.forEach(HashMap.entries(invocations), ([id, pending]) => pending.sessionEpoch === handshake.session.sessionEpoch ? Effect.void : rejectInvocation(id, ServerError.make({
+					code: "SessionChanged",
+					message: "The session changed. This operation may already have completed."
+				})));
+				session.accept(handshake.session, handshake.serverTime);
 				rememberedHandshake = handshake;
 				handshakeAccepted = true;
 				writer = write;
@@ -722,9 +1001,14 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 				});
 				return yield* handleMessage(message);
 			});
+			const suspended = yield* Deferred.make();
+			sessionSuspended = suspended;
+			yield* Effect.addFinalizer(() => Effect.sync(() => {
+				if (sessionSuspended === suspended) sessionSuspended = void 0;
+			}));
 			const run = yield* socket.runString(handleText).pipe(Effect.forkChild);
 			yield* Effect.raceFirst(Deferred.await(handshakeReceived).pipe(Effect.timeout("10 seconds")), Fiber.join(run));
-			yield* Fiber.join(run);
+			yield* Effect.raceFirst(Fiber.join(run), Deferred.await(suspended));
 		})).pipe(Effect.mapError((cause) => Schema.is(ClientInfrastructureError)(cause) ? cause : ConnectionUnavailable.make({
 			cause,
 			message: "The sync connection was lost."
@@ -735,6 +1019,7 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 			return yield* queryCache.observe(functionAddress, args);
 		});
 		const mutate = Effect.fn("SyncClient.mutate")(function* (functionAddress, args) {
+			const admittedSession = session.current() ?? rememberedHandshake?.session ?? (yield* session.bootstrap.pipe(Effect.mapError((error) => ConnectionUnavailable.make({ message: error.message }))));
 			const invocationId = yield* ids.generate(InvocationId);
 			const preparedArguments = yield* prepareMutationArguments(args).pipe(Effect.provideService(IdGenerator, ids), Effect.mapError((cause) => InvalidMutationArguments.make({
 				cause,
@@ -767,6 +1052,7 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 				files: preparedArguments.fileIds
 			};
 			invocations = HashMap.set(invocations, invocationId, {
+				sessionEpoch: admittedSession.sessionEpoch,
 				deferred,
 				function: functionAddress,
 				message,
@@ -781,6 +1067,7 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 					const uploads = yield* Deferred.await(prepared);
 					const expected = new Set(message.files);
 					const received = /* @__PURE__ */ new Set();
+					const transfers = [];
 					for (const upload of uploads) {
 						if (!expected.has(upload.id) || received.has(upload.id)) return yield* InvalidServerMessage.make({
 							cause: /* @__PURE__ */ new Error(`Unexpected prepared file '${upload.id}'.`),
@@ -793,12 +1080,22 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 							message: "The server prepared an unknown application file."
 						});
 						if (upload.url === void 0) continue;
-						const uploadUrl = upload.url;
+						transfers.push({
+							file,
+							url: upload.url
+						});
+					}
+					if (received.size !== expected.size) return yield* InvalidServerMessage.make({
+						cause: /* @__PURE__ */ new Error("The server omitted a prepared file."),
+						message: "The server returned incomplete application file preparation data."
+					});
+					yield* Effect.forEach(transfers, Effect.fn("SyncClient.uploadFile")(function* ({ file, url }) {
 						const response = yield* Effect.tryPromise({
-							try: () => fetch(uploadUrl, {
+							try: (signal) => fetch(url, {
 								method: "PUT",
 								body: file,
-								headers: { "content-type": file.type }
+								headers: { "content-type": file.type },
+								signal
 							}),
 							catch: (cause) => ConnectionUnavailable.make({
 								cause,
@@ -813,12 +1110,11 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 								message: `File '${file.name}' was rejected by application storage.`
 							});
 						}
-					}
-					if (received.size !== expected.size) return yield* InvalidServerMessage.make({
-						cause: /* @__PURE__ */ new Error("The server omitted a prepared file."),
-						message: "The server returned incomplete application file preparation data."
+					}), {
+						concurrency: 3,
+						discard: true
 					});
-					const pendingInvocation = HashMap.getUnsafe(invocations, invocationId);
+					const pendingInvocation = Option.getOrUndefined(HashMap.get(invocations, invocationId));
 					if (pendingInvocation === void 0) return yield* Deferred.await(deferred);
 					invocations = HashMap.set(invocations, invocationId, {
 						...pendingInvocation,
@@ -840,10 +1136,60 @@ var SyncClient = class SyncClient extends Context.Service()("ignotum/client/sync
 		});
 	})).pipe(Layer.provide(Layer.merge(Socket.layerWebSocketConstructorGlobal, BrowserCrypto.layer)));
 };
-const syncRuntime = ManagedRuntime.make(SyncClient.layer.pipe(Layer.provideMerge(clientErrorReporterLayer), Layer.provideMerge(IdGenerator.layer)));
+const syncRuntime = ManagedRuntime.make(SyncClient.layer.pipe(Layer.provideMerge(BrowserSession.layer), Layer.provideMerge(clientErrorReporterLayer), Layer.provideMerge(IdGenerator.layer)));
 const hot = import.meta.hot;
 if (hot !== void 0) hot.dispose(() => void syncRuntime.dispose());
 //#endregion
+//#region src/client/page-observers.ts
+const makePageObservers = (onChange, releaseObserver) => {
+	const pages = /* @__PURE__ */ new Map();
+	let disposed = false;
+	const releaseEntry = (entry) => {
+		entry.released = true;
+		entry.release?.();
+	};
+	return {
+		observe: Effect.fn("PageObservers.observe")(function* (functionAddress, args) {
+			if (disposed) return;
+			const key = syncClientInternals.queryIdentity(functionAddress, args);
+			const existing = pages.get(key);
+			if (existing !== void 0) return yield* existing.acquire;
+			const entry = {
+				acquire: yield* Effect.cached(Effect.gen(function* () {
+					const observer = yield* (yield* SyncClient).observe(functionAddress, args);
+					if (entry.released) {
+						releaseObserver(observer.release);
+						return;
+					}
+					const unsubscribe = observer.subscribe(onChange);
+					entry.release = () => {
+						unsubscribe();
+						releaseObserver(observer.release);
+					};
+					return observer;
+				})),
+				release: void 0,
+				released: false
+			};
+			pages.set(key, entry);
+			return yield* entry.acquire;
+		}),
+		retain: (keys) => {
+			for (const [key, entry] of pages) {
+				if (keys.has(key)) continue;
+				pages.delete(key);
+				releaseEntry(entry);
+			}
+		},
+		release: () => {
+			if (disposed) return;
+			disposed = true;
+			for (const entry of pages.values()) releaseEntry(entry);
+			pages.clear();
+		}
+	};
+};
+//#endregion
 //#region src/client/hooks.ts
 function useQuery(reference, args) {
 	const functionPath = functionPathOf(reference);
@@ -916,6 +1262,10 @@ function usePaginatedQuery(reference, args, options = {}) {
 		result: pending()
 	}));
 	const loadMore = useCallback$1(() => setRequestedPages((count) => count + 1), []);
+	const pages = useMemo$1(() => makePageObservers(() => setRefresh((version) => version + 1), (release) => {
+		syncRuntime.runFork(release);
+	}), [identity, pageSize]);
+	useEffect$1(() => () => pages.release(), [pages]);
 	useDebugValue$1({
 		args: input,
 		function: functionPath,
@@ -931,9 +1281,8 @@ function usePaginatedQuery(reference, args, options = {}) {
 	useEffect$1(() => {
 		if (skipped) return;
 		let active = true;
-		const releases = [];
+		const usedPages = /* @__PURE__ */ new Set();
 		syncRuntime.runPromise(Effect.gen(function* () {
-			const client = yield* SyncClient;
 			const items = [];
 			let cursor = null;
 			for (let pageNumber = 0; pageNumber < requestedPages; pageNumber += 1) {
@@ -944,18 +1293,9 @@ function usePaginatedQuery(reference, args, options = {}) {
 						pageSize
 					}
 				});
-				const observer = yield* client.observe(functionPath, pageArgs);
-				if (!active) {
-					yield* observer.release;
-					return;
-				}
-				const releaseSubscription = observer.subscribe(() => {
-					if (active) setRefresh((version) => version + 1);
-				});
-				releases.push(() => {
-					releaseSubscription();
-					syncRuntime.runFork(observer.release);
-				});
+				usedPages.add(syncClientInternals.queryIdentity(functionPath, pageArgs));
+				const observer = yield* pages.observe(functionPath, pageArgs);
+				if (!active || observer === void 0) return;
 				const snapshot = observer.getSnapshot();
 				if (Schema.is(ClientInfrastructureError)(snapshot)) {
 					setState({
@@ -968,7 +1308,7 @@ function usePaginatedQuery(reference, args, options = {}) {
 				if (inspected === void 0) {
 					setState({
 						identity,
-						result: items.length === 0 ? pending() : Result$1.succeed({
+						result: items.length === 0 ? pending() : Result$2.succeed({
 							items,
 							loadMore,
 							status: "LoadingMore"
@@ -989,7 +1329,7 @@ function usePaginatedQuery(reference, args, options = {}) {
 				if (cursor === null) {
 					setState({
 						identity,
-						result: Result$1.succeed({
+						result: Result$2.succeed({
 							items,
 							loadMore,
 							status: "Exhausted"
@@ -1000,13 +1340,15 @@ function usePaginatedQuery(reference, args, options = {}) {
 			}
 			setState({
 				identity,
-				result: Result$1.succeed({
+				result: Result$2.succeed({
 					items,
 					loadMore,
 					status: "CanLoadMore"
 				})
 			});
-		})).catch((error) => {
+		}).pipe(Effect.ensuring(Effect.sync(() => {
+			if (active) pages.retain(usedPages);
+		})))).catch((error) => {
 			if (active && Schema.is(ClientInfrastructureError)(error)) setState({
 				identity,
 				result: error
@@ -1014,13 +1356,13 @@ function usePaginatedQuery(reference, args, options = {}) {
 		});
 		return () => {
 			active = false;
-			for (const release of releases) release();
 		};
 	}, [
 		functionPath,
 		identity,
 		loadMore,
 		pageSize,
+		pages,
 		refresh,
 		requestedPages,
 		skipped
@@ -1040,6 +1382,38 @@ const useMutation = (reference) => useMemo$1(() => {
 	};
 	return mutate;
 }, [reference]);
+function useId() {
+	const [state, setState] = useState$1({ status: "pending" });
+	useEffect$1(() => {
+		let active = true;
+		let unsubscribe;
+		syncRuntime.runPromise(BrowserSession).then((session) => {
+			if (!active) return;
+			const update = () => setState(session.snapshot());
+			unsubscribe = session.subscribe(update);
+			update();
+		});
+		return () => {
+			active = false;
+			unsubscribe?.();
+		};
+	}, []);
+	const actions = useMemo$1(() => ({
+		signIn: (options) => syncRuntime.runPromise(Effect.gen(function* () {
+			return yield* (yield* BrowserSession).start("signIn", options?.profile ?? [], options?.returnTo);
+		})),
+		requestProfile: (fields, options) => syncRuntime.runPromise(Effect.gen(function* () {
+			return yield* (yield* BrowserSession).start("requestProfile", fields, options?.returnTo);
+		})),
+		signOut: () => syncRuntime.runPromise(Effect.gen(function* () {
+			return yield* (yield* BrowserSession).signOut;
+		}))
+	}), []);
+	return {
+		...state,
+		...actions
+	};
+}
 //#endregion
 //#region src/client/app.ts
 const app = (definition) => {
@@ -1048,8 +1422,8 @@ const app = (definition) => {
 };
 //#endregion
 //#region src/client/index.ts
-const Result = { match: Result$1.match };
+const Result = { match: Result$2.match };
 //#endregion
-export { Component, Files, Fragment, Query, Result, app, cloneElement, createContext, createElement, createRef, h, isValidElement, toChildArray, useCallback, useContext, useDebugValue, useEffect, useErrorBoundary, useId, useImperativeHandle, useLayoutEffect, useMemo, useMutation, usePaginatedQuery, useQuery, useReducer, useRef, useState };
+export { Component, Files, Fragment, Query, Result, app, cloneElement, createContext, createElement, createRef, h, isValidElement, toChildArray, useCallback, useContext, useDebugValue, useEffect, useElementId, useErrorBoundary, useId, useImperativeHandle, useLayoutEffect, useMemo, useMutation, usePaginatedQuery, useQuery, useReducer, useRef, useState };
 
 //# sourceMappingURL=client.js.map