ignotum 0.0.8 → 0.0.10

package/src/cli/command.ts

@@ -6,6 +6,12 @@ import { IdGenerator } from "@ignotum/shared/id";
 
 import packageJson from "../../package.json" with { type: "json" };
 import { generate } from "./codegen.js";
+import {
+  AuthCredentialStore,
+  login as runLogin,
+  logout as runLogout,
+  status as readAuthStatus,
+} from "./auth-client.js";
 import { ControlClient } from "./control-client.js";
 import { deploy as runDeploy } from "./deploy.js";
 import { resetDevDatabase } from "../dev-runtime/dev-database.js";
@@ -15,6 +21,58 @@ import { installDependencies } from "./package-manager.js";
 
 const DevPort = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65_535 }));
 
+const authLogin = Command.make(
+  "login",
+  {},
+  Effect.fn("auth login")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const result = yield* runLogin().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    yield* terminal.display(`Signed in as ${result.email}.\n`);
+  }),
+).pipe(Command.withDescription("Sign in to Ignotum with GitHub."));
+
+const authLogout = Command.make(
+  "logout",
+  {},
+  Effect.fn("auth logout")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const removed = yield* runLogout().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    yield* terminal.display(removed ? "Signed out.\n" : "Not signed in.\n");
+  }),
+).pipe(Command.withDescription("Revoke and remove the saved login."));
+
+const authStatus = Command.make(
+  "status",
+  {},
+  Effect.fn("auth status")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const current = yield* readAuthStatus().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    if (current === undefined) {
+      yield* terminal.display("Not signed in.\n");
+      return;
+    }
+    const team = current.teamName === undefined ? "" : `\nTeam: ${current.teamName}`;
+    yield* terminal.display(`Signed in as ${current.name} (${current.email}).${team}\n`);
+  }),
+).pipe(Command.withDescription("Show the current Ignotum login."));
+
+const auth = Command.make("auth").pipe(
+  Command.withDescription("Manage your Ignotum login."),
+  Command.withSubcommands([authLogin, authLogout, authStatus]),
+);
+
 const codegen = Command.make(
   "codegen",
   {},
@@ -172,7 +230,7 @@ const newApp = Command.make(
 );
 
 const ignotum = Command.make("ignotum").pipe(
-  Command.withSubcommands([newApp, install, codegen, dev, deploy]),
+  Command.withSubcommands([newApp, install, codegen, dev, deploy, auth]),
 );
 
 export const main = (): void => {
@@ -180,7 +238,12 @@ export const main = (): void => {
     Command.run({ version: packageJson.version }),
     // @effect-diagnostics-next-line strictEffectProvide:off
     Effect.provide(
-      Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, IdGenerator.layer),
+      Layer.mergeAll(
+        NodeServices.layer,
+        NodeHttpClient.layerUndici,
+        IdGenerator.layer,
+        AuthCredentialStore.layer.pipe(Layer.provide(NodeServices.layer)),
+      ),
     ),
     NodeRuntime.runMain,
   );

package/src/cli/control-client.ts

@@ -41,6 +41,7 @@ import {
 } from "effect";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
 import type { HttpClientRequest as HttpRequest } from "effect/unstable/http/HttpClientRequest";
+import { AuthCommandError, AuthCredentialStore } from "./auth-client.js";
 
 export interface HostedControlConfig {
   readonly apiUrl: URL;
@@ -69,11 +70,19 @@ export class HostedControlConfiguration extends Context.Service<
 >()("ignotum/cli/control-client/HostedControlConfiguration") {
   static readonly layer = Layer.effect(
     HostedControlConfiguration,
-    Config.all({
-      apiUrl: Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(
-        Config.withDefault(new URL("https://api.ignotum.cloud")),
-      ),
-      token: Config.redacted("IGNOTUM_API_TOKEN"),
+    Effect.gen(function* () {
+      const credential = yield* (yield* AuthCredentialStore).load;
+      if (credential === undefined) {
+        return yield* AuthCommandError.make({
+          message: "Run 'npx ignotum auth login' first.",
+        });
+      }
+      return {
+        apiUrl: yield* Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(
+          Config.withDefault(new URL("https://api.ignotum.cloud")),
+        ),
+        token: credential.token,
+      };
     }),
   );
 }
@@ -133,7 +142,11 @@ export class ControlClient extends Context.Service<ControlClient, ControlClientS
   "ignotum/cli/control-client/ControlClient",
 ) {
   static get layer() {
-    return controlClientLayer.pipe(Layer.provideMerge(HostedControlConfiguration.layer));
+    return controlClientLayer.pipe(
+      Layer.provideMerge(
+        HostedControlConfiguration.layer.pipe(Layer.provide(AuthCredentialStore.layer)),
+      ),
+    );
   }
 }
 

package/src/cli/new-app.ts

@@ -209,9 +209,10 @@ and updates them when the schema or server functions change.
 
 ## Deploy
 
-Set \`IGNOTUM_API_TOKEN\`, then choose a unique slug on the first deployment:
+Sign in, then choose a unique slug on the first deployment:
 
 \`\`\`sh
+npx ignotum auth login
 npx ignotum deploy --app my-app
 \`\`\`
 

package/src/client/errors.ts

@@ -1,7 +1,7 @@
 /** @effect-diagnostics globalConsole:skip-file */
 import { Cause, Effect, ErrorReporter, Schema } from "effect";
 
-import { FunctionAddress, Operation, ProtocolErrorCode } from "@ignotum/contracts/runtime/sync";
+import { ErrorCode, FunctionAddress, Operation } from "@ignotum/contracts/runtime/sync";
 
 export class ConnectionUnavailable extends Schema.TaggedError<ConnectionUnavailable>()(
   "ConnectionUnavailable",
@@ -36,21 +36,18 @@ export class InvalidServerMessage extends Schema.TaggedError<InvalidServerMessag
   },
 ) {}
 
-export class ServerProtocolError extends Schema.TaggedError<ServerProtocolError>()(
-  "ServerProtocolError",
-  {
-    code: ProtocolErrorCode,
-    message: Schema.String,
-    operation: Schema.optional(Operation),
-  },
-) {}
+export class ServerError extends Schema.TaggedError<ServerError>()("ServerError", {
+  code: ErrorCode,
+  message: Schema.String,
+  operation: Schema.optional(Operation),
+}) {}
 
 export const ClientInfrastructureError = Schema.Union([
   ConnectionUnavailable,
   InvalidClientMessage,
   InvalidMutationArguments,
   InvalidServerMessage,
-  ServerProtocolError,
+  ServerError,
 ]);
 export type ClientInfrastructureError = typeof ClientInfrastructureError.Type;
 

package/src/client/files.ts

@@ -10,7 +10,6 @@ import {
   makeFileValue,
   type FileFormat,
   type FileValue,
-  type RuntimeFileOccurrence,
 } from "@ignotum/contracts/schema/file";
 import { IdGenerator } from "@ignotum/shared/id";
 import { Effect, Predicate } from "effect";
@@ -28,30 +27,22 @@ export const Files = {
 const formatByMime: Partial<Record<string, FileFormat>> = {};
 for (const format of fileFormats) formatByMime[fileMimeTypes[format]] = format;
 
-interface NativeOccurrence {
-  readonly path: ReadonlyArray<string | number>;
-  readonly value: File;
-}
-
 const collectNativeFiles = (
   // oxlint-disable-next-line anti-slop/no-unknown-parameters -- This is the recursive parser for generated mutation arguments and native File values.
   value: unknown,
-  path: ReadonlyArray<string | number>,
-  occurrences: Array<NativeOccurrence>,
+  files: Array<File>,
 ): void => {
   if (value instanceof File) {
-    occurrences.push({ path, value });
+    files.push(value);
     return;
   }
   if (isFileValue(value) || Predicate.isDate(value)) return;
   if (globalThis.Array.isArray(value)) {
-    for (const [index, child] of value.entries())
-      collectNativeFiles(child, [...path, index], occurrences);
+    for (const child of value) collectNativeFiles(child, files);
     return;
   }
   if (!Predicate.isObject(value)) return;
-  for (const [key, child] of Object.entries(value))
-    collectNativeFiles(child, [...path, key], occurrences);
+  for (const child of Object.values(value)) collectNativeFiles(child, files);
 };
 
 const replaceNativeFiles = (
@@ -73,7 +64,7 @@ const replaceNativeFiles = (
 export interface PreparedMutationArguments {
   readonly value: unknown;
   readonly nativeFiles: ReadonlyMap<FileId, File>;
-  readonly occurrences: ReadonlyArray<RuntimeFileOccurrence>;
+  readonly fileIds: ReadonlyArray<FileId>;
 }
 
 export const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArguments")(function* (
@@ -81,9 +72,9 @@ export const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArg
   input: unknown,
 ) {
   const ids = yield* IdGenerator;
-  const native: NativeOccurrence[] = [];
-  collectNativeFiles(input, [], native);
-  const unique = new Set(native.map(({ value }) => value));
+  const native: File[] = [];
+  collectNativeFiles(input, native);
+  const unique = new Set(native);
   if (unique.size > fileLimits.filesPerMutation) {
     throw new Error(`A mutation may upload at most ${fileLimits.filesPerMutation} files.`);
   }
@@ -111,58 +102,52 @@ export const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArg
     nativeFiles.set(id, file);
   }
   const value = replaceNativeFiles(input, replacements);
-  const occurrences = native.map(({ path, value: file }) => {
-    const replacement = replacements.get(file);
-    if (replacement === undefined) throw new Error("A native file replacement is missing.");
-    return {
-      path,
-      file: {
-        id: fileIdOf(replacement),
-        format: replacement.format,
-        name: replacement.name,
-        size: replacement.size,
-      },
-    } satisfies RuntimeFileOccurrence;
-  });
-  return { value, nativeFiles, occurrences } satisfies PreparedMutationArguments;
+  return {
+    value,
+    nativeFiles,
+    fileIds: Array.from(nativeFiles.keys()),
+  } satisfies PreparedMutationArguments;
 });
 
-interface FileGrantOccurrence extends RuntimeFileOccurrence {
+interface FileGrant {
+  readonly id: FileId;
   readonly url: string;
 }
 
-const pathKey = (path: ReadonlyArray<string | number>): string => JSON.stringify(path);
-
 // @effect-diagnostics-next-line missingPipeableSignature:off File grant attachment naturally takes the decoded value first.
 export const applyFileGrants = (
-  // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Query result types are erased at the wire decoding boundary and checked against grant paths below.
+  // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Query result types are erased at the wire decoding boundary and checked against grant identities below.
   value: unknown,
-  grants: ReadonlyArray<FileGrantOccurrence>,
+  grants: ReadonlyArray<FileGrant>,
   // oxlint-disable-next-line anti-slop/no-unknown-returns -- The traversal preserves the decoded query result shape while attaching private symbols.
 ): unknown => {
-  const byPath = new Map(grants.map((grant) => [pathKey(grant.path), grant] as const));
+  const byId = new Map<FileId, string>();
+  for (const grant of grants) {
+    if (byId.has(grant.id)) throw new Error("A query file grant ID is duplicated.");
+    byId.set(grant.id, grant.url);
+  }
+  const matched = new Set<FileId>();
   const visit = (
-    // oxlint-disable-next-line anti-slop/no-unknown-parameters -- This recursive visitor validates a grant and file ID before replacement.
+    // oxlint-disable-next-line anti-slop/no-unknown-parameters -- This recursive visitor identifies file values before attaching grants.
     current: unknown,
-    path: ReadonlyArray<string | number>,
     // oxlint-disable-next-line anti-slop/no-unknown-returns -- Recursive branches preserve their input shape.
   ): unknown => {
-    const grant = byPath.get(pathKey(path));
-    if (grant !== undefined) {
-      if (!isFileValue(current) || fileIdOf(current) !== grant.file.id) {
-        throw new Error("A query file grant does not match its result value.");
-      }
-      return grantFileValue(current, grant.url);
+    if (isFileValue(current)) {
+      const id = fileIdOf(current);
+      const url = byId.get(id);
+      if (url === undefined) return current;
+      matched.add(id);
+      return grantFileValue(current, url);
     }
     if (globalThis.Array.isArray(current)) {
-      return current.map((child, index) => visit(child, [...path, index]));
+      return current.map(visit);
     }
-    if (!Predicate.isObject(current) || Predicate.isDate(current) || isFileValue(current)) {
+    if (!Predicate.isObject(current) || Predicate.isDate(current)) {
       return current;
     }
-    return Object.fromEntries(
-      Object.entries(current).map(([key, child]) => [key, visit(child, [...path, key])]),
-    );
+    return Object.fromEntries(Object.entries(current).map(([key, child]) => [key, visit(child)]));
   };
-  return visit(value, []);
+  const granted = visit(value);
+  if (matched.size !== byId.size) throw new Error("A query file grant has no result value.");
+  return granted;
 };

package/src/client/sync.ts

@@ -26,7 +26,7 @@ import type {
 import { failureFromWire, pending, Result } from "@ignotum/contracts/runtime/result";
 import {
   ClientMessageJson,
-  DeploymentChangedCloseCode,
+  DeploymentCloseCode,
   InvocationId,
   ServerMessageJson,
   SubscriptionId,
@@ -42,7 +42,7 @@ import {
   ConnectionUnavailable,
   InvalidClientMessage,
   InvalidServerMessage,
-  ServerProtocolError,
+  ServerError,
   InvalidMutationArguments,
   clientErrorReporterLayer,
   reportClientError,
@@ -213,8 +213,7 @@ const resultFromWire = Effect.fn("SyncClient.resultFromWire")(
     ),
 );
 
-export const shouldReloadForCloseCode = (code: number): boolean =>
-  code === DeploymentChangedCloseCode;
+export const shouldReloadForCloseCode = (code: number): boolean => code === DeploymentCloseCode;
 
 const handshakesMatch = (first: SyncHandshake, next: SyncHandshake): boolean =>
   first.appId === next.appId &&
@@ -265,9 +264,9 @@ interface PendingInvocation {
     ClientInfrastructureError
   >;
   readonly function: FunctionAddress;
-  readonly message: Extract<ClientMessage, { readonly type: "Invoke" | "PrepareMutation" }>;
+  readonly message: Extract<ClientMessage, { readonly type: "Invoke" | "Prepare" }>;
   readonly prepared: Deferred.Deferred<
-    Extract<ServerMessage, { readonly type: "MutationPrepared" }>["uploads"],
+    Extract<ServerMessage, { readonly type: "Preparation" }>["uploads"],
     ClientInfrastructureError
   >;
 }
@@ -339,7 +338,7 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
       };
 
       const handleMessage = Effect.fn("SyncClient.handleMessage")(function* (
-        message: Exclude<ServerMessage, SyncHandshake | { readonly type: "DeploymentChanged" }>,
+        message: Exclude<ServerMessage, SyncHandshake | { readonly type: "Deployment" }>,
       ) {
         switch (message.type) {
           case "Snapshot": {
@@ -352,7 +351,7 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
             );
             return;
           }
-          case "MutationPrepared": {
+          case "Preparation": {
             const pendingInvocation = HashMap.getUnsafe(invocations, message.id);
             if (pendingInvocation !== undefined) {
               yield* Deferred.succeed(pendingInvocation.prepared, message.uploads);
@@ -368,14 +367,14 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
             );
             return;
           }
-          case "ProtocolError": {
+          case "Error": {
             const error =
               message.operation === undefined
-                ? ServerProtocolError.make({
+                ? ServerError.make({
                     code: message.code,
                     message: message.message,
                   })
-                : ServerProtocolError.make({
+                : ServerError.make({
                     code: message.code,
                     message: message.message,
                     operation: message.operation,
@@ -449,7 +448,7 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
               ),
             );
             if (message.type === "Handshake") return yield* acceptHandshake(message);
-            if (message.type === "DeploymentChanged") {
+            if (message.type === "Deployment") {
               requestReload();
               return;
             }
@@ -534,7 +533,7 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
             ClientInfrastructureError
           >();
           const prepared = yield* Deferred.make<
-            Extract<ServerMessage, { readonly type: "MutationPrepared" }>["uploads"],
+            Extract<ServerMessage, { readonly type: "Preparation" }>["uploads"],
             ClientInfrastructureError
           >();
           const invokeMessage: Extract<ClientMessage, { readonly type: "Invoke" }> = {
@@ -545,15 +544,15 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
             args: jsonArgs,
           };
           const message: PendingInvocation["message"] =
-            preparedArguments.occurrences.length === 0
+            preparedArguments.fileIds.length === 0
               ? invokeMessage
               : {
-                  type: "PrepareMutation",
+                  type: "Prepare",
                   id: invocationId,
                   kind: "Mutation",
                   function: functionAddress,
                   args: jsonArgs,
-                  files: preparedArguments.occurrences,
+                  files: preparedArguments.fileIds,
                 };
           invocations = HashMap.set(invocations, invocationId, {
             deferred,
@@ -570,20 +569,27 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
                 }),
               );
             }
-            if (message.type === "PrepareMutation") {
+            if (message.type === "Prepare") {
               const uploads = yield* Deferred.await(prepared);
-              const uploaded = new Set<string>();
+              const expected = new Set(message.files);
+              const received = new Set<string>();
               for (const upload of uploads) {
-                if (upload.url === undefined || uploaded.has(upload.file.id)) continue;
-                const uploadUrl = upload.url;
-                uploaded.add(upload.file.id);
-                const file = preparedArguments.nativeFiles.get(upload.file.id);
+                if (!expected.has(upload.id) || received.has(upload.id)) {
+                  return yield* InvalidServerMessage.make({
+                    cause: new Error(`Unexpected prepared file '${upload.id}'.`),
+                    message: "The server returned invalid application file preparation data.",
+                  });
+                }
+                received.add(upload.id);
+                const file = preparedArguments.nativeFiles.get(upload.id);
                 if (file === undefined) {
                   return yield* InvalidServerMessage.make({
-                    cause: new Error(`Missing native file '${upload.file.id}'.`),
+                    cause: new Error(`Missing native file '${upload.id}'.`),
                     message: "The server prepared an unknown application file.",
                   });
                 }
+                if (upload.url === undefined) continue;
+                const uploadUrl = upload.url;
                 const response = yield* Effect.tryPromise({
                   try: () =>
                     fetch(uploadUrl, {
@@ -606,6 +612,12 @@ export class SyncClient extends Context.Service<SyncClient, SyncClientService>()
                   });
                 }
               }
+              if (received.size !== expected.size) {
+                return yield* InvalidServerMessage.make({
+                  cause: new Error("The server omitted a prepared file."),
+                  message: "The server returned incomplete application file preparation data.",
+                });
+              }
               const pendingInvocation = HashMap.getUnsafe(invocations, invocationId);
               if (pendingInvocation === undefined) return yield* Deferred.await(deferred);
               invocations = HashMap.set(invocations, invocationId, {

package/src/dev-runtime/files.ts

@@ -45,8 +45,8 @@ interface LocalApplicationFilesService {
     invocationId: InvocationId,
     functionAddress: FunctionAddress,
     args: Schema.Json,
-    files: ReadonlyArray<RuntimeFileOccurrenceValue>,
-  ) => Effect.Effect<ReadonlyArray<RuntimeFileOccurrenceValue & { readonly url?: string }>>;
+    fileIds: ReadonlyArray<FileId>,
+  ) => Effect.Effect<ReadonlyArray<{ readonly id: FileId; readonly url?: string }>>;
   readonly admit: (
     invocationId: InvocationId,
     functionAddress: FunctionAddress,
@@ -56,7 +56,7 @@ interface LocalApplicationFilesService {
   readonly grants: (
     subscriptionId: SubscriptionId,
     files: ReadonlyArray<RuntimeFileOccurrenceValue>,
-  ) => Effect.Effect<ReadonlyArray<RuntimeFileOccurrenceValue & { readonly url: string }>>;
+  ) => Effect.Effect<ReadonlyArray<{ readonly id: FileId; readonly url: string }>>;
   readonly releaseGrants: (subscriptionId: SubscriptionId) => Effect.Effect<void>;
   readonly readGrant: (
     token: FileGrantToken,
@@ -74,8 +74,11 @@ export const LocalApplicationFiles = Context.Reference<LocalApplicationFilesServ
       admit: (_invocationId, _functionAddress, args) =>
         Effect.succeed(encodedFileOccurrencesOf(args)),
       grants: (_subscriptionId, files) =>
-        Effect.succeed(files.map((file) => ({ ...file, url: "" }))),
-      prepare: (_invocationId, _functionAddress, _args, files) => Effect.succeed(files),
+        Effect.succeed(
+          Array.from(new Set(files.map(({ file }) => file.id)), (id) => ({ id, url: "" })),
+        ),
+      prepare: (_invocationId, _functionAddress, _args, fileIds) =>
+        Effect.succeed(fileIds.map((id) => ({ id }))),
       upload: () => Effect.die("Local application file storage is unavailable."),
       releaseGrants: () => Effect.void,
       readGrant: () => Effect.succeed(Option.none()),
@@ -125,8 +128,19 @@ export const localApplicationFilesLayer = (appDirectory: string) =>
         invocationId: InvocationId,
         functionAddress: FunctionAddress,
         args: Schema.Json,
-        files: ReadonlyArray<RuntimeFileOccurrenceValue>,
+        fileIds: ReadonlyArray<FileId>,
       ) {
+        if (fileIds.length === 0) throw new Error("A file preparation must contain a file ID.");
+        const selected = new Set(fileIds);
+        if (selected.size !== fileIds.length) {
+          throw new Error("A file preparation contains a duplicate file ID.");
+        }
+        const files = encodedFileOccurrencesOf(args).filter((occurrence) =>
+          selected.has(occurrence.file.id),
+        );
+        if (new Set(files.map((occurrence) => occurrence.file.id)).size !== selected.size) {
+          throw new Error("Prepared files do not match the mutation arguments.");
+        }
         const existing = preparations.get(invocationId);
         if (existing !== undefined) {
           if (
@@ -136,27 +150,14 @@ export const localApplicationFilesLayer = (appDirectory: string) =>
           ) {
             throw new Error("The invocation ID already belongs to another file preparation.");
           }
-          return files.map((occurrence) => {
-            const token = existing.uploads.get(occurrence.file.id);
-            return token === undefined
-              ? occurrence
-              : { ...occurrence, url: `${fileUploadUrlPrefix}${token}` };
+          return fileIds.map((id) => {
+            const token = existing.uploads.get(id);
+            return token === undefined ? { id } : { id, url: `${fileUploadUrlPrefix}${token}` };
           });
         }
-        const all = new Map(
-          encodedFileOccurrencesOf(args).map((occurrence) => [
-            encodeCanonicalJson(occurrence.path),
-            occurrence.file,
-          ]),
-        );
         const distinct = new Map<FileId, RuntimeFileMetadata>();
         for (const occurrence of files) {
-          const arg = all.get(encodeCanonicalJson(occurrence.path));
-          if (
-            arg === undefined ||
-            !sameFile(arg, occurrence.file) ||
-            !validFilename(occurrence.file.name)
-          ) {
+          if (!validFilename(occurrence.file.name)) {
             throw new Error("Prepared files do not match the mutation arguments.");
           }
           const prior = distinct.get(occurrence.file.id);
@@ -214,11 +215,9 @@ export const localApplicationFilesLayer = (appDirectory: string) =>
           `;
         }
         preparations.set(invocationId, { function: functionAddress, args, files, uploads });
-        return files.map((occurrence) => {
-          const token = uploads.get(occurrence.file.id);
-          return token === undefined
-            ? occurrence
-            : { ...occurrence, url: `${fileUploadUrlPrefix}${token}` };
+        return fileIds.map((id) => {
+          const token = uploads.get(id);
+          return token === undefined ? { id } : { id, url: `${fileUploadUrlPrefix}${token}` };
         });
       });
 
@@ -279,9 +278,9 @@ export const localApplicationFilesLayer = (appDirectory: string) =>
           tokens.set(occurrence.file.id, token);
           grants.set(token, { subscriptionId, file: occurrence.file });
         }
-        return occurrences.map((occurrence) => ({
-          ...occurrence,
-          url: `${fileGrantUrlPrefix}${tokens.get(occurrence.file.id)}`,
+        return Array.from(tokens, ([id, token]) => ({
+          id,
+          url: `${fileGrantUrlPrefix}${token}`,
         }));
       });