ignotum 0.0.7 → 0.0.9

package/src/cli/auth-client.ts

@@ -0,0 +1,286 @@
+import { homedir } from "node:os";
+import process from "node:process";
+
+import * as Versioned from "@ignotum/contracts/versioned";
+import { createAuthClient } from "better-auth/client";
+import { deviceAuthorizationClient, organizationClient } from "better-auth/client/plugins";
+import {
+  Config,
+  Context,
+  Effect,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+  Schema,
+  Terminal,
+} from "effect";
+
+const CredentialV1 = Schema.Struct({
+  formatVersion: Schema.Literal(1),
+  authUrl: Schema.URLFromString,
+  token: Schema.String,
+});
+const CredentialThroughV1 = Versioned.initial(CredentialV1);
+const Credential = CredentialThroughV1;
+type Credential = typeof Credential.Type;
+
+const AuthUrl = Schema.URL.check(
+  Schema.makeFilter(
+    (url) =>
+      url.protocol === "https:" ||
+      (url.protocol === "http:" && ["127.0.0.1", "::1", "localhost"].includes(url.hostname)),
+    { message: "The auth URL must use HTTPS unless it targets localhost." },
+  ),
+);
+
+export class AuthCommandError extends Schema.TaggedError<AuthCommandError>()("AuthCommandError", {
+  cause: Schema.optional(Schema.Defect()),
+  message: Schema.String,
+}) {}
+
+const commandError = (message: string, cause?: unknown) =>
+  AuthCommandError.make(cause === undefined ? { message } : { cause, message });
+
+interface StoredCredential {
+  readonly authUrl: URL;
+  readonly token: Redacted.Redacted<string>;
+}
+
+interface AuthCredentialStoreService {
+  readonly load: Effect.Effect<StoredCredential | undefined, AuthCommandError>;
+  readonly remove: Effect.Effect<boolean, AuthCommandError>;
+  readonly save: (credential: StoredCredential) => Effect.Effect<void, AuthCommandError>;
+}
+
+export class AuthCredentialStore extends Context.Service<
+  AuthCredentialStore,
+  AuthCredentialStoreService
+>()("ignotum/cli/auth-client/AuthCredentialStore") {
+  static readonly layer = Layer.effect(
+    AuthCredentialStore,
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const configured = yield* Config.option(Config.string("IGNOTUM_CONFIG_DIR"));
+      const xdg = yield* Config.option(Config.string("XDG_CONFIG_HOME"));
+      const appData = yield* Config.option(Config.string("APPDATA"));
+      const configurationDirectory = Option.getOrElse(configured, () =>
+        Option.getOrElse(xdg, () =>
+          process.platform === "win32" && Option.isSome(appData)
+            ? appData.value
+            : path.join(homedir(), ".config"),
+        ),
+      );
+      const directory = path.join(configurationDirectory, "ignotum");
+      const credentialPath = path.join(directory, "auth.json");
+
+      const load = Effect.fn("AuthCredentialStore.load")(function* () {
+        if (
+          !(yield* fileSystem
+            .exists(credentialPath)
+            .pipe(
+              Effect.mapError((cause) => commandError("Could not check the saved login.", cause)),
+            ))
+        ) {
+          return undefined;
+        }
+        const text = yield* fileSystem
+          .readFileString(credentialPath)
+          .pipe(Effect.mapError((cause) => commandError("Could not read the saved login.", cause)));
+        const credential = yield* Schema.decodeEffect(Schema.fromJsonString(Credential))(text).pipe(
+          Effect.mapError((cause) => commandError("The saved login is invalid.", cause)),
+        );
+        return {
+          authUrl: credential.authUrl,
+          token: Redacted.make(credential.token),
+        } satisfies StoredCredential;
+      });
+
+      const save = Effect.fn("AuthCredentialStore.save")(function* (credential: StoredCredential) {
+        const value = {
+          formatVersion: 1,
+          authUrl: credential.authUrl,
+          token: Redacted.value(credential.token),
+        } satisfies Credential;
+        const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(Credential))(value).pipe(
+          Effect.mapError((cause) => commandError("Could not encode the login.", cause)),
+        );
+        yield* fileSystem
+          .makeDirectory(directory, { mode: 0o700, recursive: true })
+          .pipe(
+            Effect.mapError((cause) =>
+              commandError("Could not create the config directory.", cause),
+            ),
+          );
+        yield* Effect.scoped(
+          Effect.gen(function* () {
+            const temporaryPath = yield* fileSystem.makeTempFileScoped({
+              directory,
+              prefix: ".auth-",
+              suffix: ".json",
+            });
+            yield* fileSystem.writeFileString(temporaryPath, `${encoded}\n`, { mode: 0o600 });
+            yield* fileSystem.rename(temporaryPath, credentialPath);
+          }),
+        ).pipe(Effect.mapError((cause) => commandError("Could not save the login.", cause)));
+      });
+
+      const remove = Effect.fn("AuthCredentialStore.remove")(function* () {
+        if (
+          !(yield* fileSystem
+            .exists(credentialPath)
+            .pipe(
+              Effect.mapError((cause) => commandError("Could not check the saved login.", cause)),
+            ))
+        ) {
+          return false;
+        }
+        yield* fileSystem
+          .remove(credentialPath)
+          .pipe(
+            Effect.mapError((cause) => commandError("Could not remove the saved login.", cause)),
+          );
+        return true;
+      });
+
+      return AuthCredentialStore.of({ load: load(), remove: remove(), save });
+    }),
+  );
+}
+
+const makeClient = (authUrl: URL) =>
+  createAuthClient({
+    basePath: "/v1",
+    baseURL: authUrl.href,
+    plugins: [deviceAuthorizationClient(), organizationClient()],
+  });
+
+const authorization = (token: Redacted.Redacted<string>) => ({
+  Authorization: `Bearer ${Redacted.value(token)}`,
+});
+
+const responseError = (error: { readonly error_description?: string; readonly message?: string }) =>
+  error.error_description ?? error.message ?? "Authentication failed.";
+
+export const login = Effect.fn("Auth.login")(function* () {
+  const store = yield* AuthCredentialStore;
+  const terminal = yield* Terminal.Terminal;
+  const authUrl = yield* Config.schema(AuthUrl, "IGNOTUM_AUTH_URL").pipe(
+    Config.withDefault(new URL("https://auth.ignotum.cloud")),
+    Effect.mapError((cause) => commandError("The auth URL is invalid.", cause)),
+  );
+  const client = makeClient(authUrl);
+  const existing = yield* store.load;
+  if (existing !== undefined && existing.authUrl.href === authUrl.href) {
+    const result = yield* Effect.tryPromise({
+      try: () => client.getSession({ fetchOptions: { headers: authorization(existing.token) } }),
+      catch: (cause) => commandError("Could not check the saved login.", cause),
+    });
+    if (result.data?.user !== undefined) {
+      return {
+        email: result.data.user.email,
+        verificationUrl: undefined,
+      };
+    }
+  }
+
+  const started = yield* Effect.tryPromise({
+    try: () => client.device.code({ client_id: "ignotum-cli", scope: "openid profile email" }),
+    catch: (cause) => commandError("Could not start login.", cause),
+  });
+  if (started.data === null) {
+    return yield* commandError(responseError(started.error));
+  }
+  const url = started.data.verification_uri_complete ?? started.data.verification_uri;
+  yield* terminal.display(
+    `Open ${started.data.verification_uri}\nCode: ${started.data.user_code}\n\nWaiting for approval...\n`,
+  );
+  yield* Effect.tryPromise({
+    // @effect-diagnostics-next-line asyncFunction:off Dynamic import keeps browser-only code out of other CLI commands.
+    try: async () => (await import("open")).default(url),
+    catch: (cause) => commandError("Could not open the browser.", cause),
+  }).pipe(Effect.ignore);
+
+  let interval = started.data.interval ?? 5;
+  while (true) {
+    yield* Effect.sleep(`${interval} seconds`);
+    const polled = yield* Effect.tryPromise({
+      try: () =>
+        client.device.token({
+          client_id: "ignotum-cli",
+          device_code: started.data.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+      catch: (cause) => commandError("Login polling failed.", cause),
+    });
+    if (polled.data?.access_token !== undefined) {
+      const token = Redacted.make(polled.data.access_token);
+      const session = yield* Effect.tryPromise({
+        try: () => client.getSession({ fetchOptions: { headers: authorization(token) } }),
+        catch: (cause) => commandError("Could not read the new session.", cause),
+      });
+      if (session.data?.user === undefined) {
+        return yield* commandError("The auth service returned an invalid session.");
+      }
+      yield* store.save({ authUrl, token });
+      return { email: session.data.user.email, verificationUrl: url };
+    }
+    switch (polled.error?.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "access_denied":
+        return yield* commandError("Login was denied.");
+      case "expired_token":
+        return yield* commandError("The login code expired. Run login again.");
+      default:
+        return yield* commandError(
+          polled.error === null ? "Login failed." : responseError(polled.error),
+        );
+    }
+  }
+});
+
+export const logout = Effect.fn("Auth.logout")(function* () {
+  const store = yield* AuthCredentialStore;
+  const credential = yield* store.load;
+  if (credential === undefined) return false;
+  const client = makeClient(credential.authUrl);
+  const result = yield* Effect.tryPromise({
+    try: () => client.signOut({ fetchOptions: { headers: authorization(credential.token) } }),
+    catch: (cause) => commandError("Could not revoke the session.", cause),
+  });
+  if (result.error !== null) {
+    return yield* commandError(responseError(result.error));
+  }
+  yield* store.remove;
+  return true;
+});
+
+export const status = Effect.fn("Auth.status")(function* () {
+  const store = yield* AuthCredentialStore;
+  const credential = yield* store.load;
+  if (credential === undefined) return undefined;
+  const client = makeClient(credential.authUrl);
+  const session = yield* Effect.tryPromise({
+    try: () => client.getSession({ fetchOptions: { headers: authorization(credential.token) } }),
+    catch: (cause) => commandError("Could not check login status.", cause),
+  });
+  if (session.data?.user === undefined) return undefined;
+  const teams = yield* Effect.tryPromise({
+    try: () =>
+      client.organization.list({
+        fetchOptions: { headers: authorization(credential.token) },
+      }),
+    catch: (cause) => commandError("Could not load the team.", cause),
+  });
+  return {
+    email: session.data.user.email,
+    name: session.data.user.name,
+    teamName: teams.data?.[0]?.name,
+  };
+});

package/src/cli/build/server.ts

@@ -16,7 +16,15 @@ import {
 } from "@ignotum/contracts/deployment";
 import { FunctionAddress } from "@ignotum/contracts/runtime/sync";
 import type { FunctionKind } from "@ignotum/contracts/runtime/functions";
-import { isDefinedSchema, type DefinedSchema, type Tables } from "@ignotum/contracts/schema";
+import {
+  descriptorContainsFile,
+  descriptorFields,
+  getValueDescriptor,
+  isDefinedSchema,
+  ValueDescriptor,
+  type DefinedSchema,
+  type Tables,
+} from "@ignotum/contracts/schema";
 import {
   artifactReference,
   encodeCanonical,
@@ -41,17 +49,23 @@ const encodeJavaScriptString = Schema.encodeSync(Schema.fromJsonString(Schema.St
 
 const DiscoveredServerFunction = Schema.Struct({
   address: FunctionAddress,
+  args: Schema.optional(ValueDescriptor),
+  errors: Schema.optional(ValueDescriptor),
   exportName: Schema.String,
   kind: Schema.Literals(["Mutation", "Query"]),
   moduleName: Schema.String,
   modulePath: Schema.String,
+  returns: Schema.optional(ValueDescriptor),
 });
 interface DiscoveredServerFunction {
   readonly address: FunctionAddress;
+  readonly args?: ValueDescriptor;
+  readonly errors?: ValueDescriptor;
   readonly exportName: string;
   readonly kind: FunctionKind;
   readonly moduleName: string;
   readonly modulePath: string;
+  readonly returns?: ValueDescriptor;
 }
 
 const ServerDiscoveryManifest = Schema.Struct({
@@ -179,13 +193,68 @@ const discoverModuleFunctions = Effect.fn("Deploy.discoverServerModule")(functio
       continue;
     }
 
-    functions.push({
+    const args =
+      inspected.definition.args === undefined
+        ? undefined
+        : ({ type: "object", fields: descriptorFields(inspected.definition.args) } as const);
+    const returns =
+      inspected.definition.returns === undefined
+        ? undefined
+        : getValueDescriptor(inspected.definition.returns);
+    const errors =
+      inspected.definition.errors === undefined
+        ? undefined
+        : getValueDescriptor(inspected.definition.errors);
+    if (
+      (inspected.definition.returns !== undefined && returns === undefined) ||
+      (inspected.definition.errors !== undefined && errors === undefined)
+    ) {
+      return yield* InvalidServerFunctionExport.make({
+        exportName,
+        message: `${moduleName}.${exportName} uses a validator that was not created by Ignotum values.`,
+        path: modulePath,
+      });
+    }
+    if (
+      inspected.definition._tag === "Query" &&
+      args !== undefined &&
+      descriptorContainsFile(args)
+    ) {
+      return yield* InvalidServerFunctionExport.make({
+        exportName,
+        message: `${moduleName}.${exportName} cannot accept files in query arguments.`,
+        path: modulePath,
+      });
+    }
+    if (
+      inspected.definition._tag === "Mutation" &&
+      returns !== undefined &&
+      descriptorContainsFile(returns)
+    ) {
+      return yield* InvalidServerFunctionExport.make({
+        exportName,
+        message: `${moduleName}.${exportName} cannot return files from a mutation.`,
+        path: modulePath,
+      });
+    }
+    if (errors !== undefined && descriptorContainsFile(errors)) {
+      return yield* InvalidServerFunctionExport.make({
+        exportName,
+        message: `${moduleName}.${exportName} cannot include files in application errors.`,
+        path: modulePath,
+      });
+    }
+
+    const discovered = {
       address: FunctionAddress.make(`api.${moduleName}.${exportName}`),
       exportName,
       kind: inspected.definition._tag,
       moduleName,
       modulePath,
-    });
+    };
+    const withArgs = args === undefined ? discovered : { ...discovered, args };
+    const withErrors = errors === undefined ? withArgs : { ...withArgs, errors };
+    functions.push(returns === undefined ? withErrors : { ...withErrors, returns });
   }
 
   return Array.sortWith(functions, (definition) => definition.address, String.Order);
@@ -319,6 +388,7 @@ const discoverServerFunctions = Effect.fn("Deploy.discoverServerFunctionsIsolate
         appDirectory,
         nodeModulesDirectory(),
         packageRoot,
+        path.join(packageRoot, "node_modules"),
         ...workspaceProbes,
       ].map((allowedPath) => `--allow-fs-read=${allowedPath}`);
       const exitCode = yield* spawner.exitCode(
@@ -476,7 +546,7 @@ const buildServerFunction = Effect.fn("Deploy.buildServerFunction")(function* (
   const bundlePath = normalizePath(path.join("server", relativeFile));
   const sourceMapPath = normalizePath(path.join("server", relativeSourceMap));
 
-  return {
+  const artifact = {
     address: definition.address,
     kind: definition.kind,
     bundle: yield* artifactReference(bundlePath, yield* fileSystem.readFile(absoluteFile)),
@@ -484,7 +554,14 @@ const buildServerFunction = Effect.fn("Deploy.buildServerFunction")(function* (
       sourceMapPath,
       yield* fileSystem.readFile(absoluteSourceMap),
     ),
-  } satisfies ServerFunctionArtifact;
+  };
+  const withArgs =
+    definition.args === undefined ? artifact : { ...artifact, args: definition.args };
+  const withErrors =
+    definition.errors === undefined ? withArgs : { ...withArgs, errors: definition.errors };
+  return definition.returns === undefined
+    ? (withErrors satisfies ServerFunctionArtifact)
+    : ({ ...withErrors, returns: definition.returns } satisfies ServerFunctionArtifact);
 });
 
 export const buildServer = Effect.fn("Deploy.buildServer")(function* (
@@ -507,7 +584,7 @@ export const buildServer = Effect.fn("Deploy.buildServer")(function* (
     { concurrency: 4 },
   );
   const manifest = {
-    formatVersion: 1,
+    formatVersion: 2,
     schema: yield* artifactReference(schemaSnapshotPath, snapshotBytes),
     functions,
   } satisfies ServerBuildManifest;

package/src/cli/command.ts

@@ -6,6 +6,12 @@ import { IdGenerator } from "@ignotum/shared/id";
 
 import packageJson from "../../package.json" with { type: "json" };
 import { generate } from "./codegen.js";
+import {
+  AuthCredentialStore,
+  login as runLogin,
+  logout as runLogout,
+  status as readAuthStatus,
+} from "./auth-client.js";
 import { ControlClient } from "./control-client.js";
 import { deploy as runDeploy } from "./deploy.js";
 import { resetDevDatabase } from "../dev-runtime/dev-database.js";
@@ -15,6 +21,58 @@ import { installDependencies } from "./package-manager.js";
 
 const DevPort = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65_535 }));
 
+const authLogin = Command.make(
+  "login",
+  {},
+  Effect.fn("auth login")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const result = yield* runLogin().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    yield* terminal.display(`Signed in as ${result.email}.\n`);
+  }),
+).pipe(Command.withDescription("Sign in to Ignotum with GitHub."));
+
+const authLogout = Command.make(
+  "logout",
+  {},
+  Effect.fn("auth logout")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const removed = yield* runLogout().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    yield* terminal.display(removed ? "Signed out.\n" : "Not signed in.\n");
+  }),
+).pipe(Command.withDescription("Revoke and remove the saved login."));
+
+const authStatus = Command.make(
+  "status",
+  {},
+  Effect.fn("auth status")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const current = yield* readAuthStatus().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    if (current === undefined) {
+      yield* terminal.display("Not signed in.\n");
+      return;
+    }
+    const team = current.teamName === undefined ? "" : `\nTeam: ${current.teamName}`;
+    yield* terminal.display(`Signed in as ${current.name} (${current.email}).${team}\n`);
+  }),
+).pipe(Command.withDescription("Show the current Ignotum login."));
+
+const auth = Command.make("auth").pipe(
+  Command.withDescription("Manage your Ignotum login."),
+  Command.withSubcommands([authLogin, authLogout, authStatus]),
+);
+
 const codegen = Command.make(
   "codegen",
   {},
@@ -172,7 +230,7 @@ const newApp = Command.make(
 );
 
 const ignotum = Command.make("ignotum").pipe(
-  Command.withSubcommands([newApp, install, codegen, dev, deploy]),
+  Command.withSubcommands([newApp, install, codegen, dev, deploy, auth]),
 );
 
 export const main = (): void => {
@@ -180,7 +238,12 @@ export const main = (): void => {
     Command.run({ version: packageJson.version }),
     // @effect-diagnostics-next-line strictEffectProvide:off
     Effect.provide(
-      Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, IdGenerator.layer),
+      Layer.mergeAll(
+        NodeServices.layer,
+        NodeHttpClient.layerUndici,
+        IdGenerator.layer,
+        AuthCredentialStore.layer.pipe(Layer.provide(NodeServices.layer)),
+      ),
     ),
     NodeRuntime.runMain,
   );

package/src/cli/control-client.ts

@@ -41,6 +41,7 @@ import {
 } from "effect";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
 import type { HttpClientRequest as HttpRequest } from "effect/unstable/http/HttpClientRequest";
+import { AuthCommandError, AuthCredentialStore } from "./auth-client.js";
 
 export interface HostedControlConfig {
   readonly apiUrl: URL;
@@ -69,11 +70,19 @@ export class HostedControlConfiguration extends Context.Service<
 >()("ignotum/cli/control-client/HostedControlConfiguration") {
   static readonly layer = Layer.effect(
     HostedControlConfiguration,
-    Config.all({
-      apiUrl: Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(
-        Config.withDefault(new URL("https://api.ignotum.cloud")),
-      ),
-      token: Config.redacted("IGNOTUM_API_TOKEN"),
+    Effect.gen(function* () {
+      const credential = yield* (yield* AuthCredentialStore).load;
+      if (credential === undefined) {
+        return yield* AuthCommandError.make({
+          message: "Run 'npx ignotum auth login' first.",
+        });
+      }
+      return {
+        apiUrl: yield* Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(
+          Config.withDefault(new URL("https://api.ignotum.cloud")),
+        ),
+        token: credential.token,
+      };
     }),
   );
 }
@@ -133,7 +142,11 @@ export class ControlClient extends Context.Service<ControlClient, ControlClientS
   "ignotum/cli/control-client/ControlClient",
 ) {
   static get layer() {
-    return controlClientLayer.pipe(Layer.provideMerge(HostedControlConfiguration.layer));
+    return controlClientLayer.pipe(
+      Layer.provideMerge(
+        HostedControlConfiguration.layer.pipe(Layer.provide(AuthCredentialStore.layer)),
+      ),
+    );
   }
 }
 

package/src/cli/new-app.ts

@@ -207,6 +207,18 @@ Open <http://127.0.0.1:3210>.
 The app generator creates \`_generated\`. The dev server checks those files before it starts
 and updates them when the schema or server functions change.
 
+## Deploy
+
+Sign in, then choose a unique slug on the first deployment:
+
+\`\`\`sh
+npx ignotum auth login
+npx ignotum deploy --app my-app
+\`\`\`
+
+The command prints the hosted URL and records the app link in \`.ignotum/app.json\`. Later
+deployments use \`npx ignotum deploy\` without the \`--app\` flag.
+
 ## App files
 
 - \`server/schema.ts\` defines the database tables.
@@ -216,6 +228,7 @@ and updates them when the schema or server functions change.
 - Ignotum loads Tailwind CSS automatically. Custom CSS files are ordinary client modules.
 - \`shared/utils.ts\` contains code shared across the app.
 - \`_generated\` contains Ignotum's generated types and bindings. Do not edit it by hand.
+- \`.agents/skills/ignotum\` contains the app skill and references used by coding agents.
 
 Run the typechecker after a change:
 
@@ -224,6 +237,9 @@ npx ignotum codegen
 npx tsc --noEmit
 \`\`\`
 
+The [Ignotum documentation](https://docs.ignotum.cloud) covers schema values, indexes, queries,
+mutations, client hooks, deployment, guarantees, and hosted limits.
+
 ## Claude Code
 
 If you use Claude Code, rename \`AGENTS.md\` to \`CLAUDE.md\` and \`.agents\` to \`.claude\` so it

package/src/client/errors.ts

@@ -1,7 +1,7 @@
 /** @effect-diagnostics globalConsole:skip-file */
 import { Cause, Effect, ErrorReporter, Schema } from "effect";
 
-import { FunctionAddress, Operation, ProtocolErrorCode } from "@ignotum/contracts/runtime/sync";
+import { ErrorCode, FunctionAddress, Operation } from "@ignotum/contracts/runtime/sync";
 
 export class ConnectionUnavailable extends Schema.TaggedError<ConnectionUnavailable>()(
   "ConnectionUnavailable",
@@ -36,21 +36,18 @@ export class InvalidServerMessage extends Schema.TaggedError<InvalidServerMessag
   },
 ) {}
 
-export class ServerProtocolError extends Schema.TaggedError<ServerProtocolError>()(
-  "ServerProtocolError",
-  {
-    code: ProtocolErrorCode,
-    message: Schema.String,
-    operation: Schema.optional(Operation),
-  },
-) {}
+export class ServerError extends Schema.TaggedError<ServerError>()("ServerError", {
+  code: ErrorCode,
+  message: Schema.String,
+  operation: Schema.optional(Operation),
+}) {}
 
 export const ClientInfrastructureError = Schema.Union([
   ConnectionUnavailable,
   InvalidClientMessage,
   InvalidMutationArguments,
   InvalidServerMessage,
-  ServerProtocolError,
+  ServerError,
 ]);
 export type ClientInfrastructureError = typeof ClientInfrastructureError.Type;