ignotum 0.0.8 → 0.0.9

package/dist/cli/bin.mjs

@@ -37,6 +37,7 @@ import * as NodeCrypto from "node:crypto";
 import * as Queue from "effect/Queue";
 import * as NFS from "node:fs";
 import * as OS from "node:os";
+import { homedir } from "node:os";
 import * as Path$2 from "node:path";
 import * as Inspectable from "effect/Inspectable";
 import { pipeArguments } from "effect/Pipeable";
@@ -69,9 +70,11 @@ import * as RcRef from "effect/RcRef";
 import * as Terminal$1 from "effect/Terminal";
 import * as readline from "node:readline";
 import * as Runtime from "effect/Runtime";
-import { Array as Array$1, Brand, Cause, Config, Context, Crypto, DateTime, Effect, Effectable, Encoding, FiberSet, FileSystem, Function as Function$1, HashMap, HashSet, Layer, ManagedRuntime, MutableHashMap, MutableHashSet, Option, Path as Path$1, Predicate, PubSub, Ref, Result, Schedule, Schema, SchemaGetter, Semaphore, Stream, String as String$1, Terminal } from "effect";
+import { Array as Array$1, Brand, Cause, Config, Context, Crypto, DateTime, Effect, Effectable, Encoding, FiberSet, FileSystem, Function as Function$1, HashMap, HashSet, Layer, ManagedRuntime, MutableHashMap, MutableHashSet, Option, Path as Path$1, Predicate, PubSub, Redacted, Ref, Result, Schedule, Schema, SchemaGetter, Semaphore, Stream, String as String$1, Terminal } from "effect";
 import { Argument, CliError, Command, Flag, Prompt } from "effect/unstable/cli";
 import { customAlphabet } from "nanoid";
+import { createAuthClient } from "better-auth/client";
+import { deviceAuthorizationClient, organizationClient } from "better-auth/client/plugins";
 import { HttpClient, HttpClientRequest, HttpClientResponse, HttpServerRequest as HttpServerRequest$1, HttpServerResponse } from "effect/unstable/http";
 import tailwindcss from "@tailwindcss/vite";
 import { build, createServer, defaultClientConditions, defaultServerConditions, normalizePath } from "vite";
@@ -29396,6 +29399,13 @@ const DeploymentId = defineId("dep", "ignotum/hosted/DeploymentId");
 const TeamId = defineId("team", "ignotum/hosted/TeamId");
 const TableId = defineId("table", "ignotum/runtime/TableId");
 const PlatformPrincipalId = defineId("prn", "ignotum/control/PlatformPrincipalId");
+defineId("ses", "ignotum/auth/SessionId");
+defineId("acct", "ignotum/auth/AccountId");
+defineId("ver", "ignotum/auth/VerificationId");
+defineId("mbr", "ignotum/auth/MemberId");
+defineId("invt", "ignotum/auth/InvitationId");
+defineId("dvc", "ignotum/auth/DeviceCodeId");
+defineId("auth", "ignotum/auth/InternalId");
 const InvocationId = defineId("inv", "ignotum/sync/InvocationId");
 const SubscriptionId = defineId("sub", "ignotum/sync/SubscriptionId");
 defineId("conn", "ignotum/gateway/ConnectionId");
@@ -29596,18 +29606,18 @@ const Invoke = Schema.Struct({
 	function: FunctionAddress,
 	args: Schema.Json
 });
-const PrepareMutation = Schema.Struct({
-	type: Schema.Literal("PrepareMutation"),
+const Prepare = Schema.Struct({
+	type: Schema.Literal("Prepare"),
 	id: InvocationId,
 	kind: Schema.Literal("Mutation"),
 	function: FunctionAddress,
 	args: Schema.Json,
-	files: Schema.Array(RuntimeFileOccurrence)
+	files: Schema.Array(FileId)
 });
 const ClientMessage = Schema.Union([
 	Subscribe,
 	Unsubscribe,
-	PrepareMutation,
+	Prepare,
 	Invoke
 ]);
 const SubscriptionOperation = Schema.Struct({
@@ -29644,17 +29654,16 @@ const Snapshot = Schema.Struct({
 	result: WireResult,
 	revision: AppStateRevision,
 	files: Schema.optional(Schema.Array(Schema.Struct({
-		path: RuntimeFileOccurrence.fields.path,
-		file: RuntimeFileMetadata,
+		id: FileId,
 		url: Schema.String
 	})))
 });
-const MutationPrepared = Schema.Struct({
-	type: Schema.Literal("MutationPrepared"),
+const Preparation = Schema.Struct({
+	type: Schema.Literal("Preparation"),
 	id: InvocationId,
+	kind: Schema.Literal("Mutation"),
 	uploads: Schema.Array(Schema.Struct({
-		path: RuntimeFileOccurrence.fields.path,
-		file: RuntimeFileMetadata,
+		id: FileId,
 		url: Schema.optional(Schema.String)
 	}))
 });
@@ -29669,7 +29678,7 @@ const SyncResultFailure = Schema.Struct({
 	id: InvocationId,
 	result: WireFailure
 });
-const ProtocolErrorCode = Schema.Literals([
+const ErrorCode = Schema.Literals([
 	"DuplicateOperationId",
 	"FunctionUnavailable",
 	"InvalidArguments",
@@ -29679,25 +29688,25 @@ const ProtocolErrorCode = Schema.Literals([
 	"UnknownFunction",
 	"WrongFunctionKind"
 ]);
-const ProtocolError = Schema.Struct({
-	type: Schema.Literal("ProtocolError"),
+const SyncError = Schema.Struct({
+	type: Schema.Literal("Error"),
 	operation: Schema.optional(Operation),
-	code: ProtocolErrorCode,
+	code: ErrorCode,
 	message: Schema.String
 });
-const DeploymentChanged = Schema.Struct({
-	type: Schema.Literal("DeploymentChanged"),
+const Deployment = Schema.Struct({
+	type: Schema.Literal("Deployment"),
 	deploymentId: DeploymentId,
 	generation: DeploymentGeneration
 });
 const ServerMessage = Schema.Union([
 	SyncHandshake,
 	Snapshot,
-	MutationPrepared,
+	Preparation,
 	SyncResultSuccess,
 	SyncResultFailure,
-	ProtocolError,
-	DeploymentChanged
+	SyncError,
+	Deployment
 ]);
 const ClientMessageJson = Schema.fromJsonString(ClientMessage);
 const ServerMessageJson = Schema.fromJsonString(ServerMessage);
@@ -30080,7 +30089,7 @@ var IdGenerator = class IdGenerator extends Context.Service()("@ignotum/shared/i
 };
 //#endregion
 //#region package.json
-var version = "0.0.8";
+var version = "0.0.9";
 //#endregion
 //#region src/cli/codegen.ts
 const generatedHeader = "// Generated by `ignotum codegen`. Do not edit.";
@@ -30208,6 +30217,183 @@ const generate = Effect.fn("Codegen.generate")(function* (appDirectory) {
 		written
 	};
 });
+const Credential = initial(Schema.Struct({
+	formatVersion: Schema.Literal(1),
+	authUrl: Schema.URLFromString,
+	token: Schema.String
+}));
+const AuthUrl = Schema.URL.check(Schema.makeFilter((url) => url.protocol === "https:" || url.protocol === "http:" && [
+	"127.0.0.1",
+	"::1",
+	"localhost"
+].includes(url.hostname), { message: "The auth URL must use HTTPS unless it targets localhost." }));
+var AuthCommandError = class extends Schema.TaggedError()("AuthCommandError", {
+	cause: Schema.optional(Schema.Defect()),
+	message: Schema.String
+}) {};
+const commandError = (message, cause) => AuthCommandError.make(cause === void 0 ? { message } : {
+	cause,
+	message
+});
+var AuthCredentialStore = class AuthCredentialStore extends Context.Service()("ignotum/cli/auth-client/AuthCredentialStore") {
+	static layer = Layer.effect(AuthCredentialStore, Effect.gen(function* () {
+		const fileSystem = yield* FileSystem.FileSystem;
+		const path = yield* Path$1.Path;
+		const configured = yield* Config.option(Config.string("IGNOTUM_CONFIG_DIR"));
+		const xdg = yield* Config.option(Config.string("XDG_CONFIG_HOME"));
+		const appData = yield* Config.option(Config.string("APPDATA"));
+		const configurationDirectory = Option.getOrElse(configured, () => Option.getOrElse(xdg, () => process$1.platform === "win32" && Option.isSome(appData) ? appData.value : path.join(homedir(), ".config")));
+		const directory = path.join(configurationDirectory, "ignotum");
+		const credentialPath = path.join(directory, "auth.json");
+		const load = Effect.fn("AuthCredentialStore.load")(function* () {
+			if (!(yield* fileSystem.exists(credentialPath).pipe(Effect.mapError((cause) => commandError("Could not check the saved login.", cause))))) return;
+			const text = yield* fileSystem.readFileString(credentialPath).pipe(Effect.mapError((cause) => commandError("Could not read the saved login.", cause)));
+			const credential = yield* Schema.decodeEffect(Schema.fromJsonString(Credential))(text).pipe(Effect.mapError((cause) => commandError("The saved login is invalid.", cause)));
+			return {
+				authUrl: credential.authUrl,
+				token: Redacted.make(credential.token)
+			};
+		});
+		const save = Effect.fn("AuthCredentialStore.save")(function* (credential) {
+			const value = {
+				formatVersion: 1,
+				authUrl: credential.authUrl,
+				token: Redacted.value(credential.token)
+			};
+			const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(Credential))(value).pipe(Effect.mapError((cause) => commandError("Could not encode the login.", cause)));
+			yield* fileSystem.makeDirectory(directory, {
+				mode: 448,
+				recursive: true
+			}).pipe(Effect.mapError((cause) => commandError("Could not create the config directory.", cause)));
+			yield* Effect.scoped(Effect.gen(function* () {
+				const temporaryPath = yield* fileSystem.makeTempFileScoped({
+					directory,
+					prefix: ".auth-",
+					suffix: ".json"
+				});
+				yield* fileSystem.writeFileString(temporaryPath, `${encoded}\n`, { mode: 384 });
+				yield* fileSystem.rename(temporaryPath, credentialPath);
+			})).pipe(Effect.mapError((cause) => commandError("Could not save the login.", cause)));
+		});
+		const remove = Effect.fn("AuthCredentialStore.remove")(function* () {
+			if (!(yield* fileSystem.exists(credentialPath).pipe(Effect.mapError((cause) => commandError("Could not check the saved login.", cause))))) return false;
+			yield* fileSystem.remove(credentialPath).pipe(Effect.mapError((cause) => commandError("Could not remove the saved login.", cause)));
+			return true;
+		});
+		return AuthCredentialStore.of({
+			load: load(),
+			remove: remove(),
+			save
+		});
+	}));
+};
+const makeClient = (authUrl) => createAuthClient({
+	basePath: "/v1",
+	baseURL: authUrl.href,
+	plugins: [deviceAuthorizationClient(), organizationClient()]
+});
+const authorization = (token) => ({ Authorization: `Bearer ${Redacted.value(token)}` });
+const responseError = (error) => error.error_description ?? error.message ?? "Authentication failed.";
+const login = Effect.fn("Auth.login")(function* () {
+	const store = yield* AuthCredentialStore;
+	const terminal = yield* Terminal.Terminal;
+	const authUrl = yield* Config.schema(AuthUrl, "IGNOTUM_AUTH_URL").pipe(Config.withDefault(new URL("https://auth.ignotum.cloud")), Effect.mapError((cause) => commandError("The auth URL is invalid.", cause)));
+	const client = makeClient(authUrl);
+	const existing = yield* store.load;
+	if (existing !== void 0 && existing.authUrl.href === authUrl.href) {
+		const result = yield* Effect.tryPromise({
+			try: () => client.getSession({ fetchOptions: { headers: authorization(existing.token) } }),
+			catch: (cause) => commandError("Could not check the saved login.", cause)
+		});
+		if (result.data?.user !== void 0) return {
+			email: result.data.user.email,
+			verificationUrl: void 0
+		};
+	}
+	const started = yield* Effect.tryPromise({
+		try: () => client.device.code({
+			client_id: "ignotum-cli",
+			scope: "openid profile email"
+		}),
+		catch: (cause) => commandError("Could not start login.", cause)
+	});
+	if (started.data === null) return yield* commandError(responseError(started.error));
+	const url = started.data.verification_uri_complete ?? started.data.verification_uri;
+	yield* terminal.display(`Open ${started.data.verification_uri}\nCode: ${started.data.user_code}\n\nWaiting for approval...\n`);
+	yield* Effect.tryPromise({
+		try: async () => (await import("open")).default(url),
+		catch: (cause) => commandError("Could not open the browser.", cause)
+	}).pipe(Effect.ignore);
+	let interval = started.data.interval ?? 5;
+	while (true) {
+		yield* Effect.sleep(`${interval} seconds`);
+		const polled = yield* Effect.tryPromise({
+			try: () => client.device.token({
+				client_id: "ignotum-cli",
+				device_code: started.data.device_code,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+			}),
+			catch: (cause) => commandError("Login polling failed.", cause)
+		});
+		if (polled.data?.access_token !== void 0) {
+			const token = Redacted.make(polled.data.access_token);
+			const session = yield* Effect.tryPromise({
+				try: () => client.getSession({ fetchOptions: { headers: authorization(token) } }),
+				catch: (cause) => commandError("Could not read the new session.", cause)
+			});
+			if (session.data?.user === void 0) return yield* commandError("The auth service returned an invalid session.");
+			yield* store.save({
+				authUrl,
+				token
+			});
+			return {
+				email: session.data.user.email,
+				verificationUrl: url
+			};
+		}
+		switch (polled.error?.error) {
+			case "authorization_pending": break;
+			case "slow_down":
+				interval += 5;
+				break;
+			case "access_denied": return yield* commandError("Login was denied.");
+			case "expired_token": return yield* commandError("The login code expired. Run login again.");
+			default: return yield* commandError(polled.error === null ? "Login failed." : responseError(polled.error));
+		}
+	}
+});
+const logout = Effect.fn("Auth.logout")(function* () {
+	const store = yield* AuthCredentialStore;
+	const credential = yield* store.load;
+	if (credential === void 0) return false;
+	const client = makeClient(credential.authUrl);
+	const result = yield* Effect.tryPromise({
+		try: () => client.signOut({ fetchOptions: { headers: authorization(credential.token) } }),
+		catch: (cause) => commandError("Could not revoke the session.", cause)
+	});
+	if (result.error !== null) return yield* commandError(responseError(result.error));
+	yield* store.remove;
+	return true;
+});
+const status = Effect.fn("Auth.status")(function* () {
+	const credential = yield* (yield* AuthCredentialStore).load;
+	if (credential === void 0) return void 0;
+	const client = makeClient(credential.authUrl);
+	const session = yield* Effect.tryPromise({
+		try: () => client.getSession({ fetchOptions: { headers: authorization(credential.token) } }),
+		catch: (cause) => commandError("Could not check login status.", cause)
+	});
+	if (session.data?.user === void 0) return void 0;
+	const teams = yield* Effect.tryPromise({
+		try: () => client.organization.list({ fetchOptions: { headers: authorization(credential.token) } }),
+		catch: (cause) => commandError("Could not load the team.", cause)
+	});
+	return {
+		email: session.data.user.email,
+		name: session.data.user.name,
+		teamName: teams.data?.[0]?.name
+	};
+});
 //#endregion
 //#region src/cli/control-client.ts
 const isLoopbackAddress = (hostname) => {
@@ -30216,9 +30402,13 @@ const isLoopbackAddress = (hostname) => {
 };
 const HostedApiUrl = Schema.URL.check(Schema.makeFilter((url) => url.protocol === "https:" || url.protocol === "http:" && isLoopbackAddress(url.hostname), { message: "The API URL must use HTTPS unless it targets a numeric loopback address." }));
 var HostedControlConfiguration = class HostedControlConfiguration extends Context.Service()("ignotum/cli/control-client/HostedControlConfiguration") {
-	static layer = Layer.effect(HostedControlConfiguration, Config.all({
-		apiUrl: Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(Config.withDefault(new URL("https://api.ignotum.cloud"))),
-		token: Config.redacted("IGNOTUM_API_TOKEN")
+	static layer = Layer.effect(HostedControlConfiguration, Effect.gen(function* () {
+		const credential = yield* (yield* AuthCredentialStore).load;
+		if (credential === void 0) return yield* AuthCommandError.make({ message: "Run 'npx ignotum auth login' first." });
+		return {
+			apiUrl: yield* Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(Config.withDefault(new URL("https://api.ignotum.cloud"))),
+			token: credential.token
+		};
 	}));
 };
 var ControlApiError = class extends Schema.TaggedError()("ControlApiError", {
@@ -30232,7 +30422,7 @@ var ControlClientUnavailable = class extends Schema.TaggedError()("ControlClient
 }) {};
 var ControlClient = class extends Context.Service()("ignotum/cli/control-client/ControlClient") {
 	static get layer() {
-		return controlClientLayer.pipe(Layer.provideMerge(HostedControlConfiguration.layer));
+		return controlClientLayer.pipe(Layer.provideMerge(HostedControlConfiguration.layer.pipe(Layer.provide(AuthCredentialStore.layer))));
 	}
 };
 const unavailable = (message, cause) => ControlClientUnavailable.make({
@@ -33603,11 +33793,11 @@ Schema.Struct({ fields: Schema.String });
 const JsonObjectString = Schema.fromJsonString(Schema.JsonObject);
 const LocalApplicationFiles = Context.Reference("ignotum/dev-runtime/files/LocalApplicationFiles", { defaultValue: () => ({
 	admit: (_invocationId, _functionAddress, args) => Effect.succeed(encodedFileOccurrencesOf(args)),
-	grants: (_subscriptionId, files) => Effect.succeed(files.map((file) => ({
-		...file,
+	grants: (_subscriptionId, files) => Effect.succeed(Array.from(new Set(files.map(({ file }) => file.id)), (id) => ({
+		id,
 		url: ""
 	}))),
-	prepare: (_invocationId, _functionAddress, _args, files) => Effect.succeed(files),
+	prepare: (_invocationId, _functionAddress, _args, fileIds) => Effect.succeed(fileIds.map((id) => ({ id }))),
 	upload: () => Effect.die("Local application file storage is unavailable."),
 	releaseGrants: () => Effect.void,
 	readGrant: () => Effect.succeed(Option.none()),
@@ -33634,23 +33824,26 @@ const localApplicationFilesLayer = (appDirectory) => Layer.effect(LocalApplicati
 	const uploadFiles = /* @__PURE__ */ new Map();
 	const grants = /* @__PURE__ */ new Map();
 	const objectPath = (fileId) => path.join(directory, fileId);
-	const prepare = Effect.fn("LocalApplicationFiles.prepare")(function* (invocationId, functionAddress, args, files) {
+	const prepare = Effect.fn("LocalApplicationFiles.prepare")(function* (invocationId, functionAddress, args, fileIds) {
+		if (fileIds.length === 0) throw new Error("A file preparation must contain a file ID.");
+		const selected = new Set(fileIds);
+		if (selected.size !== fileIds.length) throw new Error("A file preparation contains a duplicate file ID.");
+		const files = encodedFileOccurrencesOf(args).filter((occurrence) => selected.has(occurrence.file.id));
+		if (new Set(files.map((occurrence) => occurrence.file.id)).size !== selected.size) throw new Error("Prepared files do not match the mutation arguments.");
 		const existing = preparations.get(invocationId);
 		if (existing !== void 0) {
 			if (existing.function !== functionAddress || encodeCanonicalJson(existing.args) !== encodeCanonicalJson(args) || encodeCanonicalJson(existing.files) !== encodeCanonicalJson(files)) throw new Error("The invocation ID already belongs to another file preparation.");
-			return files.map((occurrence) => {
-				const token = existing.uploads.get(occurrence.file.id);
-				return token === void 0 ? occurrence : {
-					...occurrence,
+			return fileIds.map((id) => {
+				const token = existing.uploads.get(id);
+				return token === void 0 ? { id } : {
+					id,
 					url: `${fileUploadUrlPrefix}${token}`
 				};
 			});
 		}
-		const all = new Map(encodedFileOccurrencesOf(args).map((occurrence) => [encodeCanonicalJson(occurrence.path), occurrence.file]));
 		const distinct = /* @__PURE__ */ new Map();
 		for (const occurrence of files) {
-			const arg = all.get(encodeCanonicalJson(occurrence.path));
-			if (arg === void 0 || !sameFile(arg, occurrence.file) || !validFilename(occurrence.file.name)) throw new Error("Prepared files do not match the mutation arguments.");
+			if (!validFilename(occurrence.file.name)) throw new Error("Prepared files do not match the mutation arguments.");
 			const prior = distinct.get(occurrence.file.id);
 			if (prior !== void 0 && !sameFile(prior, occurrence.file)) throw new Error("One file ID has conflicting metadata.");
 			distinct.set(occurrence.file.id, occurrence.file);
@@ -33696,10 +33889,10 @@ const localApplicationFilesLayer = (appDirectory) => Layer.effect(LocalApplicati
 			files,
 			uploads
 		});
-		return files.map((occurrence) => {
-			const token = uploads.get(occurrence.file.id);
-			return token === void 0 ? occurrence : {
-				...occurrence,
+		return fileIds.map((id) => {
+			const token = uploads.get(id);
+			return token === void 0 ? { id } : {
+				id,
 				url: `${fileUploadUrlPrefix}${token}`
 			};
 		});
@@ -33738,9 +33931,9 @@ const localApplicationFilesLayer = (appDirectory) => Layer.effect(LocalApplicati
 				file: occurrence.file
 			});
 		}
-		return occurrences.map((occurrence) => ({
-			...occurrence,
-			url: `${fileGrantUrlPrefix}${tokens.get(occurrence.file.id)}`
+		return Array.from(tokens, ([id, token]) => ({
+			id,
+			url: `${fileGrantUrlPrefix}${token}`
 		}));
 	});
 	const reconcile = Effect.gen(function* () {
@@ -33844,14 +34037,14 @@ const operationForSubscription = (subscriptionId) => ({
 	type: "Subscription",
 	id: subscriptionId
 });
-const protocolError = (code, message, operation) => {
+const syncError = (code, message, operation) => {
 	if (operation === void 0) return {
-		type: "ProtocolError",
+		type: "Error",
 		code,
 		message
 	};
 	return {
-		type: "ProtocolError",
+		type: "Error",
 		code,
 		message,
 		operation
@@ -33873,7 +34066,7 @@ const runSession = Effect.fn("SyncServer.runSession")(function* (socket) {
 	});
 	const sendResolutionError = (operation, error, deliver = send) => {
 		const code = error._tag;
-		return deliver(protocolError(code, error.message, operation));
+		return deliver(syncError(code, error.message, operation));
 	};
 	const isActive = (subscriptionId, subscription) => Ref.get(subscriptions).pipe(Effect.map((current) => Option.getOrUndefined(HashMap.get(current, subscriptionId)) === subscription));
 	const sendIfActive = Effect.fn("SyncServer.sendIfActive")(function* (subscriptionId, subscription, message) {
@@ -33938,12 +34131,12 @@ const runSession = Effect.fn("SyncServer.runSession")(function* (socket) {
 	const handleSubscribe = Effect.fn("SyncServer.handleSubscribe")(function* (message) {
 		const operation = operationForSubscription(message.id);
 		if (encodedFileOccurrencesOf(message.args).length > 0) {
-			yield* send(protocolError("InvalidArguments", "Queries cannot take files as arguments.", operation));
+			yield* send(syncError("InvalidArguments", "Queries cannot take files as arguments.", operation));
 			return;
 		}
 		const current = yield* Ref.get(subscriptions);
 		if (HashMap.has(current, message.id)) {
-			yield* send(protocolError("DuplicateOperationId", `Subscription ${message.id} already exists.`, operation));
+			yield* send(syncError("DuplicateOperationId", `Subscription ${message.id} already exists.`, operation));
 			return;
 		}
 		const prepared = yield* runtime.prepare(message.function, "Query", message.args).pipe(Effect.catchTags({
@@ -33967,7 +34160,7 @@ const runSession = Effect.fn("SyncServer.runSession")(function* (socket) {
 			type: "Invocation",
 			id: message.id
 		};
-		if (!(yield* files.admit(message.id, message.function, message.args).pipe(Effect.as(true), Effect.catchCause((cause) => send(protocolError("InvalidArguments", `The mutation files could not be admitted: ${String(cause)}`, operation)).pipe(Effect.as(false)))))) {
+		if (!(yield* files.admit(message.id, message.function, message.args).pipe(Effect.as(true), Effect.catchCause((cause) => send(syncError("InvalidArguments", `The mutation files could not be admitted: ${String(cause)}`, operation)).pipe(Effect.as(false)))))) {
 			yield* files.releasePreparation(message.id);
 			return;
 		}
@@ -33998,25 +34191,26 @@ const runSession = Effect.fn("SyncServer.runSession")(function* (socket) {
 				invalidations: result.invalidations,
 				committedRevision: result.committedRevision
 			})));
-		}), Effect.catchTags({ InvocationIdConflict: () => send(protocolError("InvocationIdConflict", `Invocation ${message.id} was already used with different inputs.`, operation)) }), Effect.ensuring(files.releasePreparation(message.id)), Effect.catchCause((cause) => Effect.logError("A mutation invocation fiber failed.").pipe(Effect.annotateLogs({
+		}), Effect.catchTags({ InvocationIdConflict: () => send(syncError("InvocationIdConflict", `Invocation ${message.id} was already used with different inputs.`, operation)) }), Effect.ensuring(files.releasePreparation(message.id)), Effect.catchCause((cause) => Effect.logError("A mutation invocation fiber failed.").pipe(Effect.annotateLogs({
 			cause,
 			function: message.function,
 			requestId: message.id
 		}))), FiberSet.run(invocationFibers), Effect.asVoid);
 	});
-	const handlePrepareMutation = Effect.fn("SyncServer.handlePrepareMutation")(function* (message) {
+	const handlePrepare = Effect.fn("SyncServer.handlePrepare")(function* (message) {
 		const operation = {
 			type: "Invocation",
 			id: message.id
 		};
 		yield* files.prepare(message.id, message.function, message.args, message.files).pipe(Effect.flatMap((uploads) => send({
-			type: "MutationPrepared",
+			type: "Preparation",
 			id: message.id,
+			kind: message.kind,
 			uploads
-		})), Effect.catchCause((cause) => send(protocolError("InvalidArguments", `The mutation files could not be prepared: ${String(cause)}`, operation))));
+		})), Effect.catchCause((cause) => send(syncError("InvalidArguments", `The mutation files could not be prepared: ${String(cause)}`, operation))));
 	});
 	const handleMessage = Effect.fn("SyncServer.handleMessage")(function* (text) {
-		const message = yield* Schema.decodeEffect(ClientMessageJson)(text).pipe(Effect.catch(() => send(protocolError("InvalidMessage", "The WebSocket frame is not valid Ignotum JSON."))));
+		const message = yield* Schema.decodeEffect(ClientMessageJson)(text).pipe(Effect.catch(() => send(syncError("InvalidMessage", "The WebSocket frame is not valid Ignotum JSON."))));
 		if (message === void 0) return;
 		switch (message.type) {
 			case "Subscribe":
@@ -34027,8 +34221,8 @@ const runSession = Effect.fn("SyncServer.runSession")(function* (socket) {
 				yield* Ref.update(subscriptions, HashMap.remove(message.id));
 				yield* files.releaseGrants(message.id);
 				return;
-			case "PrepareMutation":
-				yield* handlePrepareMutation(message);
+			case "Prepare":
+				yield* handlePrepare(message);
 				return;
 			case "Invoke":
 				yield* handleInvoke(message);
@@ -34274,11 +34468,11 @@ var SKILL_default = "---\nname: ignotum\ndescription: Build and modify an Ignotu
 //#endregion
 //#region src/cli/agent-files.ts
 const references = [
-	["api.md", "---\ntitle: HTTP API\ndescription: Use the authenticated API at api.ignotum.cloud.\nsection: Reference\nslug: api\norder: 73\n---\n\n# HTTP API\n\nThe public API at `https://api.ignotum.cloud` creates apps and manages immutable deployments. The\n`ignotum deploy` command is the normal client for these endpoints. Use the HTTP API directly when\nbuilding deployment tooling or checking an app after an interrupted command.\n\nThe API does not expose application queries and mutations over HTTP. Deployed clients call those\nfunctions through the generated client API.\n\n## Authentication\n\nEvery route except `GET /health` requires a bearer token:\n\n```http\nAuthorization: Bearer <IGNOTUM_API_TOKEN>\n```\n\nTreat the token as an account credential. Do not include it in client code or send it from a\ndeployed app. The API does not enable browser CORS, so call it from a CLI, CI job, or other trusted\nserver environment.\n\nJSON requests require `Content-Type: application/json`. A JSON body may be at most 1 MiB. Responses\nuse JSON unless a route is not found.\n\n## Common values\n\nIgnotum IDs are opaque strings. Their prefixes identify the kind:\n\n```text\napp_000000000000000000000001\ndep_000000000000000000000001\nteam_000000000000000000000001\n```\n\nEach prefix is followed by 24 lowercase letters or digits. Do not parse or generate these IDs.\n\nTimestamps such as `createdAt` and `readyAt` are Unix time in milliseconds.\n\nAn app object has this shape:\n\n```json\n{\n  \"id\": \"app_000000000000000000000001\",\n  \"teamId\": \"team_000000000000000000000001\",\n  \"slug\": \"team-todos\",\n  \"activeDeploymentId\": \"dep_000000000000000000000001\",\n  \"deploymentGeneration\": 3,\n  \"createdAt\": 1787925600000\n}\n```\n\n`activeDeploymentId` is `null` before the first activation. `deploymentGeneration` starts at 0 and\nincreases when a deployment becomes active.\n\n## Health\n\n```http\nGET /health\n```\n\nA healthy API returns `200`:\n\n```json\n{ \"service\": \"api\", \"status\": \"ok\" }\n```\n\nAn infrastructure check failure returns `503` with `status` set to `unavailable`. This route does\nnot require authentication.\n\n## Create an app\n\n```http\nPOST /v1/apps\nContent-Type: application/json\nAuthorization: Bearer <token>\n\n{ \"slug\": \"team-todos\" }\n```\n\nA slug is 1 through 63 lowercase letters, digits, or hyphens. It must start and end with a letter\nor digit. A successful request returns `201` and the new app object.\n\nThis operation is not idempotent. A repeated request for the same slug returns `SlugUnavailable`.\n\n## Get an app\n\nLook up an app by ID:\n\n```http\nGET /v1/apps/app_000000000000000000000001\nAuthorization: Bearer <token>\n```\n\nOr by slug:\n\n```http\nGET /v1/apps/by-slug/team-todos\nAuthorization: Bearer <token>\n```\n\nBoth routes return `200` and the same app shape. The authenticated account must own the app. The\nAPI currently has no route to list apps, rename a slug, or delete an app.\n\n## Deployment flow\n\nA deployment uses four steps:\n\n1. Begin with an inventory.\n2. Upload the canonical `inventory.json` and every file listed by it.\n3. Finalize the deployment.\n4. Activate the ready deployment.\n\nThe deployment is inactive until the last step succeeds.\n\n### Inventory\n\nThe begin request contains a version 1 inventory:\n\n```json\n{\n  \"formatVersion\": 1,\n  \"files\": [\n    {\n      \"path\": \"client/shell.html\",\n      \"size\": 128,\n      \"sha256\": \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\",\n      \"kind\": \"ClientShell\",\n      \"contentType\": \"text/html; charset=utf-8\"\n    }\n  ]\n}\n```\n\nEach file entry has:\n\n| Field             | Meaning                                                                |\n| ----------------- | ---------------------------------------------------------------------- |\n| `path`            | Relative artifact path with `/` separators and no `.` or `..` segment. |\n| `size`            | Byte length as a non-negative integer.                                 |\n| `sha256`          | Lowercase 64-character SHA-256 digest.                                 |\n| `kind`            | The artifact role listed below.                                        |\n| `contentType`     | MIME type stored with the file.                                        |\n| `contentEncoding` | Optional encoding metadata.                                            |\n\nThe defined kinds are `ClientAsset`, `ClientDocument`, `ClientManifest`, `ClientPublicFile`,\n`ClientShell`, `FunctionBundle`, `ServerManifest`, `SourceMap`, and `SchemaSnapshot`.\n\nFiles must be sorted by `path`. The inventory must contain `client/manifest.json`,\n`client/shell.html`, `server/manifest.json`, and `server/schema.json`. Paths and kinds must agree,\nand every manifest reference must match the inventory. `inventory.json` is not listed because it\ncannot contain its own hash.\n\nThe byte limits are in [Limits](limits.md). The public `ignotum` package does not expose an artifact\nbuilder or a build-only command. The formats below let deployment tooling inspect and transport an\nartifact emitted by the CLI. Building function bundles with another compiler is not a supported\npublic extension point.\n\nCanonical `inventory.json` is UTF-8 JSON with object keys sorted lexicographically, array order\npreserved, no insignificant whitespace, and one trailing line feed. Its upload headers contain the\nbyte length and SHA-256 digest of those exact bytes.\n\n### Client manifest\n\n`client/manifest.json` connects hosted URL paths to client files:\n\n```json\n{\n  \"formatVersion\": 1,\n  \"shell\": {\n    \"path\": \"client/shell.html\",\n    \"size\": 128,\n    \"sha256\": \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"\n  },\n  \"routes\": [\n    {\n      \"pathname\": \"/manual.pdf\",\n      \"artifact\": {\n        \"path\": \"client/routes/manual.pdf\",\n        \"size\": 4096,\n        \"sha256\": \"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789\"\n      }\n    }\n  ]\n}\n```\n\nThe shell reference must point to `client/shell.html`. Routes must be sorted by `pathname`. A\npathname starts with `/`, uses only letters, digits, `.`, `_`, `~`, `-`, and `/`, and cannot claim\n`/_ignotum`. Each route points to a matching `ClientDocument` or `ClientPublicFile` inventory entry.\nAn artifact can have only one route, and every document or public-file entry must have one.\n\nFiles under `client/assets/` use `ClientAsset`. Files under `client/routes/` use `ClientDocument`\nwhen their name ends in `.html`; AVIF, GIF, ICO, JPEG, PNG, WebP, and PDF files use\n`ClientPublicFile`. The four fixed client paths use their corresponding fixed kinds.\n\n### Server manifest\n\n`server/manifest.json` lists every callable function and the schema snapshot:\n\n```json\n{\n  \"formatVersion\": 1,\n  \"schema\": {\n    \"path\": \"server/schema.json\",\n    \"size\": 512,\n    \"sha256\": \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"\n  },\n  \"functions\": [\n    {\n      \"address\": \"api.todos.list\",\n      \"kind\": \"Query\",\n      \"bundle\": {\n        \"path\": \"server/functions/todos/list-a1b2c3.mjs\",\n        \"size\": 2048,\n        \"sha256\": \"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789\"\n      },\n      \"sourceMap\": {\n        \"path\": \"server/functions/todos/list-a1b2c3.mjs.map\",\n        \"size\": 1024,\n        \"sha256\": \"123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0\"\n      }\n    }\n  ]\n}\n```\n\nFunction addresses have the form `api.<module>.<export>`, where both names are TypeScript\nidentifiers. `kind` is `Query` or `Mutation`. Addresses and referenced paths must be unique. A\nbundle ends in `.mjs`; its source map is the same path followed by `.map`. Every `server/` file is\nthe manifest, schema, or one referenced bundle or source map.\n\n### Schema snapshot\n\n`server/schema.json` is version 2:\n\n```json\n{\n  \"formatVersion\": 2,\n  \"tables\": [\n    {\n      \"name\": \"todos\",\n      \"fields\": [\n        { \"name\": \"completed\", \"value\": { \"type\": \"boolean\" } },\n        { \"name\": \"text\", \"value\": { \"type\": \"string\" } }\n      ],\n      \"indexes\": [{ \"name\": \"by_completed\", \"fields\": [\"completed\"] }]\n    }\n  ]\n}\n```\n\nSort tables and fields by name. Sort indexes by name and preserve each index's declared field\norder. A value descriptor uses one of these recursive forms:\n\n```text\n{ \"type\": \"boolean\" | \"date\" | \"integer\" | \"never\" | \"null\" | \"number\" | \"string\" }\n{ \"type\": \"id\", \"table\": string }\n{ \"type\": \"literal\", \"value\": string | finite number | boolean }\n{ \"type\": \"literals\", \"values\": Array<string | finite number | boolean> }\n{ \"type\": \"array\" | \"nullable\" | \"optional\" | \"record\", \"value\": descriptor }\n{ \"type\": \"union\", \"members\": Array<descriptor> }\n{ \"type\": \"object\", \"fields\": Array<{ \"name\": string, \"value\": descriptor }> }\n{ \"type\": \"error\", \"tag\": string, \"fields\": Array<{ \"name\": string, \"value\": descriptor }> }\n```\n\nSort object and error fields by name. This snapshot must describe the same schema used to build the\nfunction bundles. After the first activation, table and field descriptors must match the active\nsnapshot exactly; only the `indexes` arrays may change.\n\n### Begin\n\n```http\nPOST /v1/apps/{appId}/deployments\nContent-Type: application/json\nAuthorization: Bearer <token>\n\n{ \"inventory\": { \"formatVersion\": 1, \"files\": [] } }\n```\n\nThe abbreviated body above shows the envelope only. Send a complete valid inventory. Success\nreturns `201` and a deployment object:\n\n```json\n{\n  \"id\": \"dep_000000000000000000000002\",\n  \"appId\": \"app_000000000000000000000001\",\n  \"status\": \"Uploading\",\n  \"inventory\": { \"formatVersion\": 1, \"files\": [] },\n  \"createdAt\": 1787925601000,\n  \"readyAt\": null\n}\n```\n\nThe response repeats the complete accepted inventory. This operation is not idempotent. Repeating\nit creates another deployment.\n\n### Upload a file\n\nUpload each path as one percent-encoded route component. For example,\n`client/shell.html` becomes `client%2Fshell.html`:\n\n```http\nPUT /v1/apps/{appId}/deployments/{deploymentId}/files/client%2Fshell.html\nAuthorization: Bearer <token>\nContent-Length: 128\nX-Ignotum-Sha256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\n\n<128 raw bytes>\n```\n\n`Content-Length` and `X-Ignotum-Sha256` must match the accepted inventory entry. The body is the raw\nfile, not JSON. Upload the canonical `inventory.json` through the same route even though it is not\nin the `files` array.\n\nA new file returns:\n\n```json\n{ \"status\": \"Stored\" }\n```\n\nUploading the same path, bytes, and metadata again is safe and returns `AlreadyStored`. Different\ncontent at an existing path returns `DeploymentFileConflict`; deployment files are immutable.\n\n### Finalize\n\n```http\nPOST /v1/apps/{appId}/deployments/{deploymentId}/finalize\nAuthorization: Bearer <token>\n```\n\nThe request has no body. Finalization checks that every expected file exists, no extra file exists,\nall metadata matches, and the client and server manifests are valid. Success returns `200` with the\ndeployment status changed to `Ready` and `readyAt` set.\n\nFinalizing an already ready deployment is safe and returns its current record.\n\n### Activate\n\n```http\nPOST /v1/apps/{appId}/deployments/{deploymentId}/activate\nAuthorization: Bearer <token>\n```\n\nThe request has no body. Only a ready, unexpired deployment can be activated. Ignotum rejects a\nstored-schema change but permits index changes. See\n[Deployment model](deployment-model.md#schema-compatibility).\n\nSuccess returns `200` with the updated app object. Activating its current deployment again is safe.\nActivation reloads connected app clients.\n\n## Errors\n\nEvery recognized API failure has this body:\n\n```json\n{\n  \"code\": \"SlugUnavailable\",\n  \"message\": \"The app slug is unavailable.\"\n}\n```\n\nTreat `code` as the machine-readable value. Messages may change.\n\n| Status | Codes                                                                                                                                                           |\n| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `400`  | `InvalidRequest`, `DeploymentFileUnexpected`                                                                                                                    |\n| `401`  | `Unauthorized`                                                                                                                                                  |\n| `403`  | `AppAccessDenied`                                                                                                                                               |\n| `404`  | `AppNotFound`, `DeploymentNotFound`                                                                                                                             |\n| `409`  | `SlugUnavailable`, `DeploymentNotUploading`, `DeploymentFileConflict`, `DeploymentIncomplete`, `DeploymentNotReady`, `SchemaIncompatible`, `ActivationConflict` |\n| `503`  | `ApiUnavailable`                                                                                                                                                |\n\n`ApiUnavailable` does not prove whether a state-changing request reached its final step. Read the\napp before deciding how to recover from an unconfirmed activation. Do not automatically retry\n`POST /v1/apps` or the begin-deployment request because either may create a second resource.\n"],
+	["api.md", "---\ntitle: HTTP API\ndescription: Use the authenticated API at api.ignotum.cloud.\nsection: Reference\nslug: api\norder: 73\n---\n\n# HTTP API\n\nThe public API at `https://api.ignotum.cloud` creates apps and manages immutable deployments. The\n`ignotum deploy` command is the normal client for these endpoints. Use the HTTP API directly when\nbuilding deployment tooling or checking an app after an interrupted command.\n\nThe API does not expose application queries and mutations over HTTP. Deployed clients call those\nfunctions through the generated client API.\n\n## Authentication\n\nEvery route except `GET /health` requires a bearer token:\n\n```http\nAuthorization: Bearer <IGNOTUM_SESSION_TOKEN>\n```\n\n`ignotum auth login` obtains this revocable session through the device authorization flow. Treat it\nas an account credential. Do not include it in client code or send it from a deployed app. The API\ndoes not enable browser CORS, so call it from a CLI, CI job, or other trusted server environment.\n\nJSON requests require `Content-Type: application/json`. A JSON body may be at most 1 MiB. Responses\nuse JSON unless a route is not found.\n\n## Common values\n\nIgnotum IDs are opaque strings. Their prefixes identify the kind:\n\n```text\napp_000000000000000000000001\ndep_000000000000000000000001\nteam_000000000000000000000001\n```\n\nEach prefix is followed by 24 lowercase letters or digits. Do not parse or generate these IDs.\n\nTimestamps such as `createdAt` and `readyAt` are Unix time in milliseconds.\n\nAn app object has this shape:\n\n```json\n{\n  \"id\": \"app_000000000000000000000001\",\n  \"teamId\": \"team_000000000000000000000001\",\n  \"slug\": \"team-todos\",\n  \"activeDeploymentId\": \"dep_000000000000000000000001\",\n  \"deploymentGeneration\": 3,\n  \"createdAt\": 1787925600000\n}\n```\n\n`activeDeploymentId` is `null` before the first activation. `deploymentGeneration` starts at 0 and\nincreases when a deployment becomes active.\n\n## Health\n\n```http\nGET /health\n```\n\nA healthy API returns `200`:\n\n```json\n{ \"service\": \"api\", \"status\": \"ok\" }\n```\n\nAn infrastructure check failure returns `503` with `status` set to `unavailable`. This route does\nnot require authentication.\n\n## Create an app\n\n```http\nPOST /v1/apps\nContent-Type: application/json\nAuthorization: Bearer <token>\n\n{ \"slug\": \"team-todos\" }\n```\n\nA slug is 1 through 63 lowercase letters, digits, or hyphens. It must start and end with a letter\nor digit. A successful request returns `201` and the new app object.\n\nThis operation is not idempotent. A repeated request for the same slug returns `SlugUnavailable`.\n\n## Get an app\n\nLook up an app by ID:\n\n```http\nGET /v1/apps/app_000000000000000000000001\nAuthorization: Bearer <token>\n```\n\nOr by slug:\n\n```http\nGET /v1/apps/by-slug/team-todos\nAuthorization: Bearer <token>\n```\n\nBoth routes return `200` and the same app shape. The authenticated account must own the app. The\nAPI currently has no route to list apps, rename a slug, or delete an app.\n\n## Deployment flow\n\nA deployment uses four steps:\n\n1. Begin with an inventory.\n2. Upload the canonical `inventory.json` and every file listed by it.\n3. Finalize the deployment.\n4. Activate the ready deployment.\n\nThe deployment is inactive until the last step succeeds.\n\n### Inventory\n\nThe begin request contains a version 1 inventory:\n\n```json\n{\n  \"formatVersion\": 1,\n  \"files\": [\n    {\n      \"path\": \"client/shell.html\",\n      \"size\": 128,\n      \"sha256\": \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\",\n      \"kind\": \"ClientShell\",\n      \"contentType\": \"text/html; charset=utf-8\"\n    }\n  ]\n}\n```\n\nEach file entry has:\n\n| Field             | Meaning                                                                |\n| ----------------- | ---------------------------------------------------------------------- |\n| `path`            | Relative artifact path with `/` separators and no `.` or `..` segment. |\n| `size`            | Byte length as a non-negative integer.                                 |\n| `sha256`          | Lowercase 64-character SHA-256 digest.                                 |\n| `kind`            | The artifact role listed below.                                        |\n| `contentType`     | MIME type stored with the file.                                        |\n| `contentEncoding` | Optional encoding metadata.                                            |\n\nThe defined kinds are `ClientAsset`, `ClientDocument`, `ClientManifest`, `ClientPublicFile`,\n`ClientShell`, `FunctionBundle`, `ServerManifest`, `SourceMap`, and `SchemaSnapshot`.\n\nFiles must be sorted by `path`. The inventory must contain `client/manifest.json`,\n`client/shell.html`, `server/manifest.json`, and `server/schema.json`. Paths and kinds must agree,\nand every manifest reference must match the inventory. `inventory.json` is not listed because it\ncannot contain its own hash.\n\nThe byte limits are in [Limits](limits.md). The public `ignotum` package does not expose an artifact\nbuilder or a build-only command. The formats below let deployment tooling inspect and transport an\nartifact emitted by the CLI. Building function bundles with another compiler is not a supported\npublic extension point.\n\nCanonical `inventory.json` is UTF-8 JSON with object keys sorted lexicographically, array order\npreserved, no insignificant whitespace, and one trailing line feed. Its upload headers contain the\nbyte length and SHA-256 digest of those exact bytes.\n\n### Client manifest\n\n`client/manifest.json` connects hosted URL paths to client files:\n\n```json\n{\n  \"formatVersion\": 1,\n  \"shell\": {\n    \"path\": \"client/shell.html\",\n    \"size\": 128,\n    \"sha256\": \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"\n  },\n  \"routes\": [\n    {\n      \"pathname\": \"/manual.pdf\",\n      \"artifact\": {\n        \"path\": \"client/routes/manual.pdf\",\n        \"size\": 4096,\n        \"sha256\": \"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789\"\n      }\n    }\n  ]\n}\n```\n\nThe shell reference must point to `client/shell.html`. Routes must be sorted by `pathname`. A\npathname starts with `/`, uses only letters, digits, `.`, `_`, `~`, `-`, and `/`, and cannot claim\n`/_ignotum`. Each route points to a matching `ClientDocument` or `ClientPublicFile` inventory entry.\nAn artifact can have only one route, and every document or public-file entry must have one.\n\nFiles under `client/assets/` use `ClientAsset`. Files under `client/routes/` use `ClientDocument`\nwhen their name ends in `.html`; AVIF, GIF, ICO, JPEG, PNG, WebP, and PDF files use\n`ClientPublicFile`. The four fixed client paths use their corresponding fixed kinds.\n\n### Server manifest\n\n`server/manifest.json` lists every callable function and the schema snapshot:\n\n```json\n{\n  \"formatVersion\": 1,\n  \"schema\": {\n    \"path\": \"server/schema.json\",\n    \"size\": 512,\n    \"sha256\": \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"\n  },\n  \"functions\": [\n    {\n      \"address\": \"api.todos.list\",\n      \"kind\": \"Query\",\n      \"bundle\": {\n        \"path\": \"server/functions/todos/list-a1b2c3.mjs\",\n        \"size\": 2048,\n        \"sha256\": \"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789\"\n      },\n      \"sourceMap\": {\n        \"path\": \"server/functions/todos/list-a1b2c3.mjs.map\",\n        \"size\": 1024,\n        \"sha256\": \"123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0\"\n      }\n    }\n  ]\n}\n```\n\nFunction addresses have the form `api.<module>.<export>`, where both names are TypeScript\nidentifiers. `kind` is `Query` or `Mutation`. Addresses and referenced paths must be unique. A\nbundle ends in `.mjs`; its source map is the same path followed by `.map`. Every `server/` file is\nthe manifest, schema, or one referenced bundle or source map.\n\n### Schema snapshot\n\n`server/schema.json` is version 2:\n\n```json\n{\n  \"formatVersion\": 2,\n  \"tables\": [\n    {\n      \"name\": \"todos\",\n      \"fields\": [\n        { \"name\": \"completed\", \"value\": { \"type\": \"boolean\" } },\n        { \"name\": \"text\", \"value\": { \"type\": \"string\" } }\n      ],\n      \"indexes\": [{ \"name\": \"by_completed\", \"fields\": [\"completed\"] }]\n    }\n  ]\n}\n```\n\nSort tables and fields by name. Sort indexes by name and preserve each index's declared field\norder. A value descriptor uses one of these recursive forms:\n\n```text\n{ \"type\": \"boolean\" | \"date\" | \"integer\" | \"never\" | \"null\" | \"number\" | \"string\" }\n{ \"type\": \"id\", \"table\": string }\n{ \"type\": \"literal\", \"value\": string | finite number | boolean }\n{ \"type\": \"literals\", \"values\": Array<string | finite number | boolean> }\n{ \"type\": \"array\" | \"nullable\" | \"optional\" | \"record\", \"value\": descriptor }\n{ \"type\": \"union\", \"members\": Array<descriptor> }\n{ \"type\": \"object\", \"fields\": Array<{ \"name\": string, \"value\": descriptor }> }\n{ \"type\": \"error\", \"tag\": string, \"fields\": Array<{ \"name\": string, \"value\": descriptor }> }\n```\n\nSort object and error fields by name. This snapshot must describe the same schema used to build the\nfunction bundles. After the first activation, table and field descriptors must match the active\nsnapshot exactly; only the `indexes` arrays may change.\n\n### Begin\n\n```http\nPOST /v1/apps/{appId}/deployments\nContent-Type: application/json\nAuthorization: Bearer <token>\n\n{ \"inventory\": { \"formatVersion\": 1, \"files\": [] } }\n```\n\nThe abbreviated body above shows the envelope only. Send a complete valid inventory. Success\nreturns `201` and a deployment object:\n\n```json\n{\n  \"id\": \"dep_000000000000000000000002\",\n  \"appId\": \"app_000000000000000000000001\",\n  \"status\": \"Uploading\",\n  \"inventory\": { \"formatVersion\": 1, \"files\": [] },\n  \"createdAt\": 1787925601000,\n  \"readyAt\": null\n}\n```\n\nThe response repeats the complete accepted inventory. This operation is not idempotent. Repeating\nit creates another deployment.\n\n### Upload a file\n\nUpload each path as one percent-encoded route component. For example,\n`client/shell.html` becomes `client%2Fshell.html`:\n\n```http\nPUT /v1/apps/{appId}/deployments/{deploymentId}/files/client%2Fshell.html\nAuthorization: Bearer <token>\nContent-Length: 128\nX-Ignotum-Sha256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\n\n<128 raw bytes>\n```\n\n`Content-Length` and `X-Ignotum-Sha256` must match the accepted inventory entry. The body is the raw\nfile, not JSON. Upload the canonical `inventory.json` through the same route even though it is not\nin the `files` array.\n\nA new file returns:\n\n```json\n{ \"status\": \"Stored\" }\n```\n\nUploading the same path, bytes, and metadata again is safe and returns `AlreadyStored`. Different\ncontent at an existing path returns `DeploymentFileConflict`; deployment files are immutable.\n\n### Finalize\n\n```http\nPOST /v1/apps/{appId}/deployments/{deploymentId}/finalize\nAuthorization: Bearer <token>\n```\n\nThe request has no body. Finalization checks that every expected file exists, no extra file exists,\nall metadata matches, and the client and server manifests are valid. Success returns `200` with the\ndeployment status changed to `Ready` and `readyAt` set.\n\nFinalizing an already ready deployment is safe and returns its current record.\n\n### Activate\n\n```http\nPOST /v1/apps/{appId}/deployments/{deploymentId}/activate\nAuthorization: Bearer <token>\n```\n\nThe request has no body. Only a ready, unexpired deployment can be activated. Ignotum rejects a\nstored-schema change but permits index changes. See\n[Deployment model](deployment-model.md#schema-compatibility).\n\nSuccess returns `200` with the updated app object. Activating its current deployment again is safe.\nActivation reloads connected app clients.\n\n## Errors\n\nEvery recognized API failure has this body:\n\n```json\n{\n  \"code\": \"SlugUnavailable\",\n  \"message\": \"The app slug is unavailable.\"\n}\n```\n\nTreat `code` as the machine-readable value. Messages may change.\n\n| Status | Codes                                                                                                                                                           |\n| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `400`  | `InvalidRequest`, `DeploymentFileUnexpected`                                                                                                                    |\n| `401`  | `Unauthorized`                                                                                                                                                  |\n| `403`  | `AppAccessDenied`                                                                                                                                               |\n| `404`  | `AppNotFound`, `DeploymentNotFound`                                                                                                                             |\n| `409`  | `SlugUnavailable`, `DeploymentNotUploading`, `DeploymentFileConflict`, `DeploymentIncomplete`, `DeploymentNotReady`, `SchemaIncompatible`, `ActivationConflict` |\n| `503`  | `ApiUnavailable`                                                                                                                                                |\n\n`ApiUnavailable` does not prove whether a state-changing request reached its final step. Read the\napp before deciding how to recover from an unconfirmed activation. Do not automatically retry\n`POST /v1/apps` or the begin-deployment request because either may create a second resource.\n"],
 	["app-entry.md", "---\ntitle: App entry\ndescription: Define the Web title and root component in client/index.tsx.\nsection: Web\nslug: app-entry\norder: 41\n---\n\n# App entry\n\nThe required `client/index.tsx` file names the page and supplies its root component:\n\n```tsx\nimport { app } from \"ignotum/client\";\n\nfunction App() {\n  return <main>My app</main>;\n}\n\nexport default app({\n  title: \"My app\",\n  component: App,\n});\n```\n\nKeep the entry in this form:\n\n- Import `app` by name from `ignotum/client`, without an alias.\n- Default-export one direct `app(...)` call.\n- Pass one object with exactly `title` and `component`.\n- Write both keys as unquoted properties, without a spread.\n- Use a non-empty quoted string literal for `title`.\n\nThe component can import and render other client modules.\n\nIgnotum does not use an `App.tsx` entry convention. The entry is `client/index.tsx`, and its default\nexport is the `app(...)` definition.\n\nNext: [Preact](preact.md)\n"],
-	["cli.md", "---\ntitle: CLI\ndescription: Look up Ignotum commands, flags, and environment variables.\nsection: Reference\nslug: cli\norder: 72\n---\n\n# CLI\n\nRun commands through the local or downloaded `ignotum` package:\n\n```sh\nnpx ignotum <command>\n```\n\n## Commands\n\n| Command                | Purpose                                                            |\n| ---------------------- | ------------------------------------------------------------------ |\n| `ignotum new <path>`   | Create an app in an empty directory.                               |\n| `ignotum install`      | Install dependencies with pnpm, or npm if pnpm is absent.          |\n| `ignotum codegen`      | Update files under `_generated`.                                   |\n| `ignotum dev`          | Run the local development server.                                  |\n| `ignotum dev db reset` | Delete the local development database while the server is stopped. |\n| `ignotum deploy`       | Build, upload, and activate the app.                               |\n\nUse `ignotum <command> --help` for the command's generated help.\n\n## `new`\n\n```sh\nnpx ignotum new my-app\nnpx ignotum new . --no-git --no-install\n```\n\nThe target directory must be empty. The command installs dependencies and initializes a Git\nrepository by default. Use `--no-install` or `--no-git` to skip either action.\n\n## `dev`\n\n```sh\nnpx ignotum dev --host 0.0.0.0 --port 3000 --open\n```\n\n| Flag     | Default     | Meaning                               |\n| -------- | ----------- | ------------------------------------- |\n| `--host` | `127.0.0.1` | Address used by the local server.     |\n| `--port` | `3210`      | TCP port from 1 through 65,535.       |\n| `--open` | off         | Open the app after the server starts. |\n\n## `deploy`\n\nUse `--app <slug>` to create or link the hosted app on the first deployment:\n\n```sh\nnpx ignotum deploy --app my-app\n```\n\nLater deployments read the link from `.ignotum/app.json` and do not need the flag.\n\n## Environment variables\n\n| Variable            | Meaning                                                |\n| ------------------- | ------------------------------------------------------ |\n| `IGNOTUM_API_TOKEN` | Account token required by `deploy`.                    |\n| `IGNOTUM_API_URL`   | API base URL. Defaults to `https://api.ignotum.cloud`. |\n\n`IGNOTUM_API_URL` must use HTTPS. A numeric loopback address such as `127.0.0.1` or `[::1]` may\nuse HTTP for local platform development.\n"],
+	["cli.md", "---\ntitle: CLI\ndescription: Look up Ignotum commands, flags, and environment variables.\nsection: Reference\nslug: cli\norder: 72\n---\n\n# CLI\n\nRun commands through the local or downloaded `ignotum` package:\n\n```sh\nnpx ignotum <command>\n```\n\n## Commands\n\n| Command                | Purpose                                                            |\n| ---------------------- | ------------------------------------------------------------------ |\n| `ignotum new <path>`   | Create an app in an empty directory.                               |\n| `ignotum install`      | Install dependencies with pnpm, or npm if pnpm is absent.          |\n| `ignotum codegen`      | Update files under `_generated`.                                   |\n| `ignotum dev`          | Run the local development server.                                  |\n| `ignotum dev db reset` | Delete the local development database while the server is stopped. |\n| `ignotum auth login`   | Sign in with GitHub through the device authorization flow.         |\n| `ignotum auth logout`  | Revoke the session and remove it from this computer.               |\n| `ignotum auth status`  | Show the signed-in account and team.                               |\n| `ignotum deploy`       | Build, upload, and activate the app.                               |\n\nUse `ignotum <command> --help` for the command's generated help.\n\n## `new`\n\n```sh\nnpx ignotum new my-app\nnpx ignotum new . --no-git --no-install\n```\n\nThe target directory must be empty. The command installs dependencies and initializes a Git\nrepository by default. Use `--no-install` or `--no-git` to skip either action.\n\n## `dev`\n\n```sh\nnpx ignotum dev --host 0.0.0.0 --port 3000 --open\n```\n\n| Flag     | Default     | Meaning                               |\n| -------- | ----------- | ------------------------------------- |\n| `--host` | `127.0.0.1` | Address used by the local server.     |\n| `--port` | `3210`      | TCP port from 1 through 65,535.       |\n| `--open` | off         | Open the app after the server starts. |\n\n## `deploy`\n\nUse `--app <slug>` to create or link the hosted app on the first deployment:\n\n```sh\nnpx ignotum deploy --app my-app\n```\n\nLater deployments read the link from `.ignotum/app.json` and do not need the flag.\n\n## `auth`\n\nRun `npx ignotum auth login` once before deploying. The terminal prints a short code and opens the\napproval page. Confirm that the browser and terminal show the same code before approving it.\n`auth status` checks the saved session, and `auth logout` revokes it.\n\n## Environment variables\n\n| Variable           | Meaning                                                  |\n| ------------------ | -------------------------------------------------------- |\n| `IGNOTUM_AUTH_URL` | Auth base URL. Defaults to `https://auth.ignotum.cloud`. |\n| `IGNOTUM_API_URL`  | API base URL. Defaults to `https://api.ignotum.cloud`.   |\n\n`IGNOTUM_API_URL` must use HTTPS. A numeric loopback address such as `127.0.0.1` or `[::1]` may\nuse HTTP for local platform development.\n"],
 	["database.md", "---\ntitle: Database overview\nlabel: Overview\ndescription: Understand the persistent data model in an Ignotum app.\nsection: Database\nslug: database\norder: 10\n---\n\n# Database overview\n\nEach Ignotum app has a database described by `server/schema.ts`. A schema contains tables, stored\nfields, and indexes. Every stored document also has a table-specific ID and creation and update\ntimestamps.\n\nQueries and mutations read through `ctx.db`. Only mutations can insert, patch, replace, or delete\ndocuments. All reads and writes in one mutation commit together.\n\n- [Schema](schema.md) defines tables, fields, IDs, and schema changes.\n- [Values](values.md) lists the validators used for stored fields and function contracts.\n- [Reading data](reading-data.md) covers document and table reads.\n- [Writing data](writing-data.md) covers database changes and transaction behavior.\n- [Indexes](indexes.md) covers index definitions, ranges, and ordering.\n- [Pagination](pagination.md) covers cursor-based database and Web pagination.\n\nNext: [Schema](schema.md)\n"],
-	["deploy-app.md", "---\ntitle: Deploy an app\ndescription: Link an app and publish a deployment to Ignotum Cloud.\nsection: Deployments\nslug: deploy\norder: 51\n---\n\n# Deploy an app\n\nSet the API token you were issued:\n\n```sh\nexport IGNOTUM_API_TOKEN=your-token\n```\n\nKeep the token outside the app directory and source control. It can create deployments for every\napp available to its account.\n\n## First deployment\n\nChoose the app slug on the first deployment:\n\n```sh\nnpx ignotum deploy --app my-app\n```\n\nSlugs use lowercase letters, numbers, and hyphens. They are 1 through 63 characters, cannot start\nor end with a hyphen, and must be globally available. The deployed app uses\n`https://my-app.ignotum.app`.\n\nIf the slug already belongs to your account, the CLI links the local directory to that app. If it\nis available, the CLI creates the app. If you omit `--app`, it asks for a slug in an interactive\nterminal.\n\nThe CLI writes the app ID, slug, and API URL to `.ignotum/app.json`. It does not write the token\nthere. The generated `.gitignore` excludes `.ignotum`.\n\n## Later deployments\n\nOnce linked, run:\n\n```sh\nnpx ignotum deploy\n```\n\nThe command updates generated code, builds and validates the complete app, uploads a new\ndeployment, and activates it. There is no separate public build command.\n\nThe active deployment stays unchanged if any of these steps fail. See\n[Deployment model](deployment-model.md) for activation, schema compatibility, and interrupted\ndeployments.\n\nNext: [Deployment model](deployment-model.md)\n"],
+	["deploy-app.md", "---\ntitle: Deploy an app\ndescription: Link an app and publish a deployment to Ignotum Cloud.\nsection: Deployments\nslug: deploy\norder: 51\n---\n\n# Deploy an app\n\nSign in through the browser device flow:\n\n```sh\nnpx ignotum auth login\n```\n\nThe command opens `auth.ignotum.cloud`, asks you to sign in with GitHub, and requires you to approve\nthe code shown in the terminal. The CLI stores the resulting session under your user config\ndirectory with owner-only file permissions. It never writes the session into the app directory.\nIgnotum Cloud accounts are currently invite-only; the email returned by GitHub must have a pending\nplatform invite before the first sign-in.\n\n## First deployment\n\nChoose the app slug on the first deployment:\n\n```sh\nnpx ignotum deploy --app my-app\n```\n\nSlugs use lowercase letters, numbers, and hyphens. They are 1 through 63 characters, cannot start\nor end with a hyphen, and must be globally available. The deployed app uses\n`https://my-app.ignotum.app`.\n\nIf the slug already belongs to your account, the CLI links the local directory to that app. If it\nis available, the CLI creates the app. If you omit `--app`, it asks for a slug in an interactive\nterminal.\n\nThe CLI writes the app ID, slug, and API URL to `.ignotum/app.json`. The generated `.gitignore`\nexcludes `.ignotum`.\n\n## Later deployments\n\nOnce linked, run:\n\n```sh\nnpx ignotum deploy\n```\n\nThe command updates generated code, builds and validates the complete app, uploads a new\ndeployment, and activates it. There is no separate public build command.\n\nThe active deployment stays unchanged if any of these steps fail. See\n[Deployment model](deployment-model.md) for activation, schema compatibility, and interrupted\ndeployments.\n\nNext: [Deployment model](deployment-model.md)\n"],
 	["deployment-model.md", "---\ntitle: Deployment model\ndescription: Understand activation, compatibility, and failure behavior.\nsection: Deployments\nslug: deployment-model\norder: 52\n---\n\n# Deployment model\n\nIgnotum creates a new immutable deployment for each successful `ignotum deploy` run. The active\ndeployment does not change until the new deployment has uploaded, passed validation, and activated.\n\n## Activation\n\nActivation switches the Web part and functions together. Connected browser sessions reload after\nthey learn that the deployment changed, so a session does not intentionally combine Web code from\none deployment with functions from another.\n\nThe CLI has no rollback command. To return to earlier behavior, deploy that source again as a new\ndeployment.\n\n## Schema compatibility\n\nThe first active deployment fixes the stored table and field schema. Later deployments may change\nWeb code, functions, and indexes. Changing a table name, adding or removing a stored field, or\nchanging a field validator causes activation to fail with `SchemaIncompatible`. The active\ndeployment and stored data remain unchanged.\n\nAdding, removing, renaming, or reordering indexes is supported. Ignotum prepares new indexes before\nthe new deployment starts accepting mutations.\n\n## Failed and interrupted deployments\n\nA build, upload, validation, compatibility, or activation failure leaves the current deployment\nactive.\n\nIf an upload or finalization request loses its connection, the CLI prints the new deployment ID.\nUnfinished uploads expire after 24 hours. If activation cannot be confirmed, use the\n[HTTP API](api.md) to inspect the app's `activeDeploymentId`, or run `ignotum deploy` again to create\nand activate a new deployment.\n\nSee [Guarantees](guarantees.md) for the activation contract and [Limits](limits.md) for deployment\nretention.\n"],
 	["deployments.md", "---\ntitle: Deployments overview\nlabel: Overview\ndescription: Understand what an Ignotum deployment publishes.\nsection: Deployments\nslug: deployments\norder: 50\n---\n\n# Deployments overview\n\nA deployment publishes the complete Ignotum app. It contains the Web part, functions, schema, and\npublic assets. Ignotum activates these parts together after the complete deployment passes its\nchecks.\n\nUse `ignotum deploy` to link a local project to a hosted app and publish it. A failed build, upload,\nvalidation, or activation does not replace the active deployment.\n\n- [Deploy an app](deploy-app.md) covers the command, first-time linking, and later deployments.\n- [Deployment model](deployment-model.md) covers activation, schema compatibility, and interrupted\n  deployments.\n- [Limits](limits.md) lists deployment size and retention limits.\n\nNext: [Deploy an app](deploy-app.md)\n"],
 	["errors.md", "---\ntitle: Errors\ndescription: Define, return, and handle typed application errors.\nsection: Functions\nslug: errors\norder: 24\n---\n\n# Errors\n\nFunctions can return typed application errors to the client. Ignotum keeps runtime failures and\nthrown exceptions separate from those public errors.\n\n## Application errors\n\nDefine an application error with `values.error`. Its name becomes `_tag`:\n\n```ts\nconst TodoNotFound = values.error(\"TodoNotFound\", {\n  id: values.id(\"todos\"),\n});\n```\n\n`Result.fail` deliberately stops the operation with a typed error:\n\n```ts\nyield * Result.fail(TodoNotFound({ id: args.id }));\n```\n\nIn a mutation, an application error rolls back every write from that invocation. In a query, it\nbecomes the settled failure for the subscription at the revision the query observed.\n\nThe `errors` field is optional. If omitted, Ignotum infers the handler's remaining application\nerrors. If supplied, it is the public contract and the handler must conform to it:\n\n```ts\nexport const toggle = mutation({\n  args: {\n    id: values.id(\"todos\"),\n  },\n  returns: values.boolean(),\n  errors: TodoNotFound,\n\n  handler: function* (ctx, args) {\n    const todo = yield* ctx.db.get(\"todos\", args.id).catch({\n      DocumentNotFound: (error) => Result.fail(TodoNotFound({ id: error.id })),\n    });\n\n    const completed = !todo.completed;\n    yield* ctx.db.patch(\"todos\", args.id, { completed });\n    return completed;\n  },\n});\n```\n\nCombine public errors with `values.union`:\n\n```ts\nerrors: values.union(InvalidTodoText, TodoLimitReached),\n```\n\n## Catch and recover\n\nEvery Result operation has a partial, tag-based `catch`. Handlers receive the narrowed error type.\nUnmatched errors continue through the channel:\n\n```ts\nconst settings =\n  yield *\n  loadSettings().catch({\n    SettingsNotFound: () => defaultSettings,\n  });\n```\n\nReturn a plain value to recover. Return `Result.fail(...)` to map one error to another. Unknown tag\nnames fail the TypeScript check.\n\nUse `Result.try` for one catch boundary around several operations:\n\n```ts\nconst author =\n  yield *\n  Result.try(function* () {\n    const membership = yield* ctx.db.get(\"memberships\", topic.membershipId);\n    return yield* ctx.db.get(\"users\", membership.userId);\n  }).catch({\n    DocumentNotFound: () => Result.fail(InvalidAuthor({ topicId: topic.id })),\n  });\n```\n\nThere is no async variant. Ignotum operations always use `yield*` in server code.\n\n## Standalone results\n\n`Result.succeed` remains useful for helpers that return a Result:\n\n```ts\nfunction validateName(name: string) {\n  if (name.length === 0) {\n    return Result.fail(InvalidName({}));\n  }\n\n  return Result.succeed(name.trim());\n}\n```\n\nA handler can use the helper with `const name = yield* validateName(args.name)`. Normal handlers do\nnot wrap successful returns in `Result.succeed`.\n\n## Internal failures and defects\n\nDatabase outages, internal runtime failures, and thrown JavaScript exceptions are not application\nerrors. Ignotum logs their full cause and sends only:\n\n```ts\n{\n  _tag: \"InternalServerError\",\n  requestId: \"...\",\n}\n```\n\nEvery generated client function includes `InternalServerError` in its Result error union. The\nrequest ID links the client-visible failure to server logs without exposing private details.\n`InternalServerError` is reserved by Ignotum: never define it with `values.error` or include it in a\nfunction's `errors` schema.\n\nAn internal failure also rolls back a mutation. It does not become one of the application's\ndeclared errors, even if a thrown value happens to have the same shape.\n\n## Web matching\n\nThe client `Result.match` separates `error` and `internalError`. `error` handles only errors declared\nby the function. `internalError` handles the reserved platform error. If `internalError` is absent,\nmatching that result throws the error to the nearest UI error boundary.\n\nProtocol and connection failures are outside the application `Result`. A mutation promise rejects\nfor an operation-scoped protocol failure. A query hook throws a subscription infrastructure\nfailure during rendering so the UI error boundary can handle it.\n"],
@@ -34297,7 +34491,7 @@ const references = [
 	["project-structure.md", "---\ntitle: Project structure\ndescription: Place Web code, functions, data definitions, and shared code in an Ignotum app.\nsection: Start\nslug: project-structure\norder: 4\n---\n\n# Project structure\n\nAn Ignotum project separates browser code from function code while keeping both in one app:\n\n```text\nclient/\n  index.tsx\nserver/\n  schema.ts\n  todos.ts\nshared/\n_generated/\npublic/\n```\n\nOnly `client/index.tsx` and `server/schema.ts` are required. The other paths appear when the app\nneeds them.\n\n## `client`\n\n`client` contains the Web part. Its `index.tsx` file default-exports one `app(...)` definition:\n\n```tsx\nimport { app } from \"ignotum/client\";\n\nfunction App() {\n  return <main>My app</main>;\n}\n\nexport default app({\n  title: \"My app\",\n  component: App,\n});\n```\n\nClient modules import browser APIs and UI exports from `ignotum/client`. They may also import\n`_generated/api.ts`, `_generated/types.ts`, other client modules, shared modules, and\nbrowser-compatible dependencies. They cannot import server modules or `ignotum/server`.\n\n## `server`\n\n`server/schema.ts` defines the database schema. Other `.ts` files directly inside `server` may\nexport queries and mutations. Their file names become generated API modules. For example,\n`server/todos.ts` produces references such as `api.todos.list`.\n\nSchema definitions import `defineSchema` from `ignotum/server`. Functions import schema-bound\n`query`, `mutation`, and `values` from `@/_generated/server.js`. Server modules may import other\nserver modules, shared modules, generated server and data types, and supported dependencies. They\ncannot import client modules or `ignotum/client`.\n\n## `shared`\n\n`shared` contains code that is valid in both runtimes. Shared modules cannot depend on browser-only\nor function-only APIs. Put a type, validator-independent helper, or constant here only when both\nsides use it.\n\n## `_generated`\n\nIgnotum writes generated function references, schema-bound builders, and data types to\n`_generated`. Do not edit these files. See [Generated code](generated-code.md).\n\n## `public`\n\nThe optional top-level `public` directory contains fixed files that keep their relative paths as\nWeb URLs. It is separate from application files stored in database documents. See\n[Public assets](public-assets.md).\n\nNext: [Schema](schema.md)\n"],
 	["public-assets.md", "---\ntitle: Public assets\ndescription: Add a favicon and fixed files to the Web part.\nsection: Web\nslug: public-assets\norder: 44\n---\n\n# Public assets\n\nPublic assets belong to a deployment and keep stable URL paths. They are different from\n[application files](files.md), which belong to database documents and require a current query\nresult.\n\n## Favicon\n\nAdd `client/icon.svg` to use an SVG favicon. Ignotum discovers this exact path. Without the file,\nthe page has no favicon link.\n\nThe icon must be a regular file. Other SVG files cannot go in `public`, but imported SVG assets may\nstill be part of client code.\n\n## `public`\n\nPut files that need fixed URLs in a top-level `public` directory next to `client` and `server`:\n\n```text\npublic/\n  images/\n    logo.png\n  manual.pdf\n```\n\nThese files become `/images/logo.png` and `/manual.pdf`. `client/public` is not supported.\n\nIgnotum accepts AVIF, GIF, ICO, JPEG, PNG, WebP, and PDF. It checks the file signature against the\nextension. Entries must be regular files or directories, not symbolic links. Each path segment may\ncontain letters, numbers, `.`, `_`, `~`, or `-`. The first segment cannot be `_ignotum`, which is\nreserved for platform paths.\n\nEach file is limited to 16 MiB, and all public files count toward the deployment limits. See\n[Limits](limits.md).\n"],
 	["queries.md", "---\ntitle: Queries\ndescription: Define, call, and subscribe to typed queries.\nsection: Functions\nslug: queries\norder: 22\n---\n\n# Queries\n\nA query reads application data and returns a typed result. Web code calls it through a generated\nreference and stays subscribed to relevant data changes.\n\n## Define a query\n\nImport `query` and schema-bound `values` from `_generated/server.ts`. Define the arguments, return\nvalue, and handler together:\n\n```ts\nimport { query, values } from \"@/_generated/server.js\";\n\nexport const get = query({\n  args: { id: values.id(\"todos\") },\n  returns: values.doc(\"todos\"),\n\n  handler: function* (ctx, { id }) {\n    return yield* ctx.db.get(\"todos\", id);\n  },\n});\n```\n\nQueries have a read-only `ctx.db`. Use [Reading data](reading-data.md) for document and table reads,\nand [Indexes](indexes.md) for filtered and ordered results.\n\n## Call a query from Web code\n\nThe exported function above becomes `api.todos.get`. Pass that reference to `useQuery`:\n\n```tsx\nimport { Query, Result, useQuery } from \"ignotum/client\";\nimport { api } from \"@/_generated/api.js\";\nimport type { Id } from \"@/_generated/types.js\";\n\nfunction Todo({ id }: { id: Id<\"todos\"> | undefined }) {\n  const todo = useQuery(api.todos.get, id === undefined ? Query.skip : { id });\n\n  return Result.match(todo, {\n    pending: () => <p>Loading...</p>,\n    value: (value) => <p>{value.text}</p>,\n    error: {\n      DocumentNotFound: () => <p>The todo no longer exists.</p>,\n    },\n  });\n}\n```\n\nArgument-free queries take only the reference:\n\n```tsx\nconst todos = useQuery(api.todos.list);\n```\n\nQueries with arguments require the second parameter. The generated reference supplies its type.\n`Query.skip` keeps the hook pending and opens no subscription. Changing from `Query.skip` to\narguments starts the query. Changing the arguments switches the subscription and returns pending\nuntil the new query has a result.\n\n## Handle the result\n\n`useQuery` first returns a pending `QueryResult`, then a value or application error.\n`Result.match` requires handlers for the states and declared errors in its type:\n\n```tsx\nreturn Result.match(todos, {\n  pending: () => <p class=\"text-zinc-500\">Loading...</p>,\n  value: (items) => (\n    <ul>\n      {items.map((todo) => (\n        <li key={todo.id}>{todo.text}</li>\n      ))}\n    </ul>\n  ),\n});\n```\n\nUse one `error` function when the UI treats all application errors alike. Use an object keyed by\n`_tag` when errors need different handling. `internalError` is optional. Without it, an\n`InternalServerError` is thrown to the nearest UI error boundary. See [Errors](errors.md).\n\n## Realtime behavior\n\nThe hook keeps its subscription until the component stops using it or its reference and arguments\nchange. Components using the same query and arguments share one browser subscription.\n\nAfter a successful mutation, Ignotum refreshes active queries whose recorded reads may have\nchanged. A document lookup responds to writes for that document. An indexed range responds to\nchanges inside its relevant range. A full table query responds to writes in that table.\n\nA lost connection does not change a settled query back to pending. The client keeps the latest\nresult, reconnects with an increasing delay capped at five seconds, then recreates active\nsubscriptions. A deployment change reloads the page.\n\nUse [Pagination](pagination.md) for paginated query definitions and `usePaginatedQuery`. Read\n[Guarantees](guarantees.md) for consistency, reconnect, and update behavior.\n\nNext: [Mutations](mutations.md)\n"],
-	["quickstart.md", "---\ntitle: Quickstart\ndescription: Create, understand, and deploy a small Ignotum app.\nsection: Start\nslug: quickstart\norder: 2\n---\n\n# Quickstart\n\nIgnotum requires Node.js 22.18 or newer. Create the generated counter app and start it:\n\n```sh\nnpx ignotum new my-app\ncd my-app\nnpx ignotum dev\n```\n\nOpen <http://127.0.0.1:3210>. The page shows a counter backed by an Ignotum database.\n\n## Find the app parts\n\nThe files used in this guide are:\n\n```text\nclient/\n  index.tsx\nserver/\n  counter.ts\n  schema.ts\nshared/\n  utils.ts\n_generated/\n```\n\n`server/schema.ts` defines stored data. `server/counter.ts` defines the query and mutation.\n`client/index.tsx` defines the Web app and calls those functions. `shared/utils.ts` is available to\nboth runtimes. Ignotum owns the files under `_generated`.\n\n## Define data\n\nThe generated schema has one table:\n\n```ts\nimport { defineSchema } from \"ignotum/server\";\n\nexport default defineSchema(({ table, values }) => ({\n  counters: table({\n    value: values.number(),\n  }),\n}));\n```\n\nThe schema supplies runtime validation and the document types used by functions and Web code.\n\n## Define a query\n\n`server/counter.ts` exports `get`:\n\n```ts\nimport { mutation, query, values } from \"@/_generated/server.js\";\n\nexport const get = query({\n  returns: values.number(),\n\n  handler: function* (ctx) {\n    const counters = yield* ctx.db.query(\"counters\").collect();\n    return counters[0]?.value ?? 0;\n  },\n});\n```\n\nCode generation gives this function the reference `api.counter.get`. The Web app subscribes to it\nwith `useQuery`:\n\n```tsx\nconst count = useQuery(api.counter.get);\n```\n\n`Result.match` renders the pending state and the returned value:\n\n```tsx\n{\n  Result.match(count, {\n    pending: () => <p>Loading...</p>,\n    value: (value) => <p>{value}</p>,\n  });\n}\n```\n\n## Define a mutation\n\nThe generated `increment` mutation either inserts the first counter document or updates the\nexisting one:\n\n```ts\nexport const increment = mutation({\n  returns: values.number(),\n\n  handler: function* (ctx) {\n    const counters = yield* ctx.db.query(\"counters\").collect();\n    const counter = counters[0];\n    const value = (counter?.value ?? 0) + 1;\n\n    if (counter === undefined) {\n      yield* ctx.db.insert(\"counters\", { value });\n    } else {\n      yield* ctx.db.patch(\"counters\", counter.id, { value });\n    }\n\n    return value;\n  },\n});\n```\n\nWeb code obtains a typed caller from the generated reference:\n\n```tsx\nconst increment = useMutation(api.counter.increment);\n\n<button type=\"button\" onClick={() => void increment()}>\n  Increment\n</button>;\n```\n\nClick the button in one browser window. The mutation commits the new value, then the active query\nreceives an updated result. Open a second window to see both subscriptions follow the same data.\n\n## Deploy the app\n\nSet the API token you were issued, then choose a globally available app slug:\n\n```sh\nexport IGNOTUM_API_TOKEN=your-token\nnpx ignotum deploy --app my-app\n```\n\nThe command prints the hosted URL and links this directory to the hosted app. Later deployments use\nthe saved link:\n\n```sh\nnpx ignotum deploy\n```\n\nRead [Deploy an app](deploy-app.md) for token handling, slug rules, and deployment failure behavior.\n\nNext: [How Ignotum works](how-ignotum-works.md)\n"],
+	["quickstart.md", "---\ntitle: Quickstart\ndescription: Create, understand, and deploy a small Ignotum app.\nsection: Start\nslug: quickstart\norder: 2\n---\n\n# Quickstart\n\nIgnotum requires Node.js 22.18 or newer. Create the generated counter app and start it:\n\n```sh\nnpx ignotum new my-app\ncd my-app\nnpx ignotum dev\n```\n\nOpen <http://127.0.0.1:3210>. The page shows a counter backed by an Ignotum database.\n\n## Find the app parts\n\nThe files used in this guide are:\n\n```text\nclient/\n  index.tsx\nserver/\n  counter.ts\n  schema.ts\nshared/\n  utils.ts\n_generated/\n```\n\n`server/schema.ts` defines stored data. `server/counter.ts` defines the query and mutation.\n`client/index.tsx` defines the Web app and calls those functions. `shared/utils.ts` is available to\nboth runtimes. Ignotum owns the files under `_generated`.\n\n## Define data\n\nThe generated schema has one table:\n\n```ts\nimport { defineSchema } from \"ignotum/server\";\n\nexport default defineSchema(({ table, values }) => ({\n  counters: table({\n    value: values.number(),\n  }),\n}));\n```\n\nThe schema supplies runtime validation and the document types used by functions and Web code.\n\n## Define a query\n\n`server/counter.ts` exports `get`:\n\n```ts\nimport { mutation, query, values } from \"@/_generated/server.js\";\n\nexport const get = query({\n  returns: values.number(),\n\n  handler: function* (ctx) {\n    const counters = yield* ctx.db.query(\"counters\").collect();\n    return counters[0]?.value ?? 0;\n  },\n});\n```\n\nCode generation gives this function the reference `api.counter.get`. The Web app subscribes to it\nwith `useQuery`:\n\n```tsx\nconst count = useQuery(api.counter.get);\n```\n\n`Result.match` renders the pending state and the returned value:\n\n```tsx\n{\n  Result.match(count, {\n    pending: () => <p>Loading...</p>,\n    value: (value) => <p>{value}</p>,\n  });\n}\n```\n\n## Define a mutation\n\nThe generated `increment` mutation either inserts the first counter document or updates the\nexisting one:\n\n```ts\nexport const increment = mutation({\n  returns: values.number(),\n\n  handler: function* (ctx) {\n    const counters = yield* ctx.db.query(\"counters\").collect();\n    const counter = counters[0];\n    const value = (counter?.value ?? 0) + 1;\n\n    if (counter === undefined) {\n      yield* ctx.db.insert(\"counters\", { value });\n    } else {\n      yield* ctx.db.patch(\"counters\", counter.id, { value });\n    }\n\n    return value;\n  },\n});\n```\n\nWeb code obtains a typed caller from the generated reference:\n\n```tsx\nconst increment = useMutation(api.counter.increment);\n\n<button type=\"button\" onClick={() => void increment()}>\n  Increment\n</button>;\n```\n\nClick the button in one browser window. The mutation commits the new value, then the active query\nreceives an updated result. Open a second window to see both subscriptions follow the same data.\n\n## Deploy the app\n\nSign in with GitHub, then choose a globally available app slug:\n\n```sh\nnpx ignotum auth login\nnpx ignotum deploy --app my-app\n```\n\nThe command prints the hosted URL and links this directory to the hosted app. Later deployments use\nthe saved link:\n\n```sh\nnpx ignotum deploy\n```\n\nRead [Deploy an app](deploy-app.md) for login storage, slug rules, and deployment failure behavior.\n\nNext: [How Ignotum works](how-ignotum-works.md)\n"],
 	["reading-data.md", "---\ntitle: Reading data\ndescription: Read individual documents and table results.\nsection: Database\nslug: reading-data\norder: 13\n---\n\n# Reading data\n\nQuery and mutation handlers read documents through `ctx.db`. A read can name one document, scan a\ntable, or select a declared index. Ignotum does not turn an unindexed filter into a hidden table\nscan. Use an [index](indexes.md) for a filtered database read, or read the table and filter it when\nthe table is intentionally small.\n\n## One document\n\nUse `find` when absence is expected:\n\n```ts\nconst todo = yield * ctx.db.find(\"todos\", args.id);\n// Doc<\"todos\"> | undefined\n```\n\nUse `get` when absence is an application error path:\n\n```ts\nconst todo = yield * ctx.db.get(\"todos\", args.id);\n// Doc<\"todos\">\n```\n\nA missing `get` fails with `DocumentNotFound`. The error contains `table` and `id`. Catch it to\nrecover or map it to a public error. If it remains in the handler, it becomes part of that\nfunction's typed application errors.\n\nIDs are scoped to their tables at compile time. A `users` ID cannot be passed to a `todos` read.\n\n## A table\n\nStart a table query with `ctx.db.query`:\n\n```ts\nconst todos = yield * ctx.db.query(\"todos\").collect();\n```\n\nA table query is ordered by `createdAt`, then `id`, both ascending. Reverse both fields with\n`order(\"desc\")`:\n\n```ts\nconst newest = yield * ctx.db.query(\"todos\").order(\"desc\").take(20);\n```\n\nUse a table query when the function needs a table-wide result. Any write in that table can cause a\nsubscribed query that used the result to refresh.\n\n## Result methods\n\nFinish a table or index query with one method:\n\n| Method              | Result                                                                         |\n| ------------------- | ------------------------------------------------------------------------------ |\n| `collect()`         | Every matching document, within hosted collection limits.                      |\n| `take(count)`       | At most `count` documents. `count` may be 0 through 1,000.                     |\n| `first()`           | The first document, or `undefined`.                                            |\n| `unique()`          | The only document, or `undefined`. More than one match is an internal failure. |\n| `paginate(options)` | One page and an opaque cursor.                                                 |\n\n`unique()` checks a result. It does not make the index unique and does not prevent duplicate field\nvalues. Use `first()` when multiple matches are valid.\n\nPrefer `take` or `first` when the function only needs a bounded result. `collect` is capped at\n1,000 documents when hosted and may hit byte limits first.\n\n## Reads inside a mutation\n\nA mutation sees writes it made earlier in the same handler, including through table and index\nqueries:\n\n```ts\nconst todo = yield * ctx.db.get(\"todos\", args.id);\nyield * ctx.db.patch(\"todos\", todo.id, { completed: !todo.completed });\nconst changed = yield * ctx.db.get(\"todos\", todo.id);\n```\n\nNo other mutation can interleave with those operations for the same app. See\n[Writing data](writing-data.md) and [Guarantees](guarantees.md).\n"],
 	["schema.md", "---\ntitle: Schema\ndescription: Define tables, fields, IDs, and stored document types.\nsection: Database\nslug: schema\norder: 11\n---\n\n# Schema\n\nDefine the data model in `server/schema.ts`. The keys returned from `defineSchema` are table\nnames, and each `table` call defines that table's fields:\n\n```ts\nimport { defineSchema } from \"ignotum/server\";\n\nexport default defineSchema(({ table, values }) => ({\n  users: table({\n    name: values.string(),\n  }),\n  todos: table({\n    text: values.string(),\n    completed: values.boolean(),\n    ownerId: values.optional(values.id(\"users\")),\n  }).index(\"by_completed\", [\"completed\"]),\n}));\n```\n\n## Field values\n\nRead [values](values.md) for the complete validator list and the TypeScript type produced by each\none. `values.id` only accepts a table declared in the same schema. Arrays and objects can be nested,\nand their contents can use any value validator.\n\n## System fields\n\nIgnotum adds three fields to every stored document:\n\n| Field       | Type                      |\n| ----------- | ------------------------- |\n| `id`        | The ID type for its table |\n| `createdAt` | `Date`                    |\n| `updatedAt` | `Date`                    |\n\nDo not declare these fields in a table. Do not pass them to `insert`, `patch`, or `replace`.\n\n`createdAt` is set when Ignotum inserts the document. `updatedAt` starts at the same time and\nadvances on every successful patch or replacement. Both are JavaScript `Date` values in function\nand Web code.\n\nChain `index` after a table to declare an ordered index. [Indexes](indexes.md) covers field rules,\nranges, and ordering.\n\n## Generated types\n\n`_generated/types.ts` exports the data model, document, and ID types:\n\n```ts\nimport type { DataModel, Doc, Id } from \"@/_generated/types.js\";\n\ntype Todo = Doc<\"todos\">;\ntype TodoId = Id<\"todos\">;\n```\n\n`Doc<\"todos\">` includes the fields from the `todos` table and its three system fields. An\n`Id<\"todos\">` cannot be passed where an `Id<\"users\">` is required.\n\n## Schema changes\n\nLocal development updates tables and indexes as the schema changes. Existing documents still have\nto match the current field validators when a function reads them.\n\nFor hosted apps, the first active deployment fixes table names, field names, and field validators.\nLater deployments may add, remove, rename, or reorder indexes. They may also change functions and\nWeb code. A deployment that changes the stored table or field schema is built and uploaded, but\nactivation fails with `SchemaIncompatible`, leaving the current deployment active.\n\nSchema migrations are not part of the current public API. Plan the first hosted schema with this\nrestriction in mind.\n\nNext: [Queries](queries.md)\n"],
 	["styling.md", "---\ntitle: Styling\ndescription: Style Web code with Tailwind CSS or imported CSS files.\nsection: Web\nslug: styling\norder: 43\n---\n\n# Styling\n\nIgnotum loads Tailwind CSS automatically. An app does not need a Tailwind configuration file or a\nframework stylesheet.\n\nUse utility classes through JSX's `class` attribute:\n\n```tsx\nfunction App() {\n  return (\n    <main class=\"mx-auto max-w-xl px-6 py-16\">\n      <h1 class=\"text-2xl font-semibold text-zinc-950\">Todos</h1>\n    </main>\n  );\n}\n```\n\nCustom CSS is an ordinary client module. Give the file any name and import it from client code:\n\n```tsx\nimport \"./calendar.css\";\n```\n\nNext: [Public assets](public-assets.md)\n"],
@@ -34509,9 +34703,10 @@ and updates them when the schema or server functions change.
 
 ## Deploy
 
-Set \`IGNOTUM_API_TOKEN\`, then choose a unique slug on the first deployment:
+Sign in, then choose a unique slug on the first deployment:
 
 \`\`\`sh
+npx ignotum auth login
 npx ignotum deploy --app my-app
 \`\`\`
 
@@ -34662,6 +34857,40 @@ const DevPort = Schema.Int.check(Schema.isBetween({
 	minimum: 1,
 	maximum: 65535
 }));
+const authLogin = Command.make("login", {}, Effect.fn("auth login")(function* () {
+	const terminal = yield* Terminal.Terminal;
+	const result = yield* login().pipe(Effect.mapError((error) => CliError.UserError.make({
+		cause: error,
+		userMessage: error.message
+	})));
+	yield* terminal.display(`Signed in as ${result.email}.\n`);
+})).pipe(Command.withDescription("Sign in to Ignotum with GitHub."));
+const authLogout = Command.make("logout", {}, Effect.fn("auth logout")(function* () {
+	const terminal = yield* Terminal.Terminal;
+	const removed = yield* logout().pipe(Effect.mapError((error) => CliError.UserError.make({
+		cause: error,
+		userMessage: error.message
+	})));
+	yield* terminal.display(removed ? "Signed out.\n" : "Not signed in.\n");
+})).pipe(Command.withDescription("Revoke and remove the saved login."));
+const authStatus = Command.make("status", {}, Effect.fn("auth status")(function* () {
+	const terminal = yield* Terminal.Terminal;
+	const current = yield* status().pipe(Effect.mapError((error) => CliError.UserError.make({
+		cause: error,
+		userMessage: error.message
+	})));
+	if (current === void 0) {
+		yield* terminal.display("Not signed in.\n");
+		return;
+	}
+	const team = current.teamName === void 0 ? "" : `\nTeam: ${current.teamName}`;
+	yield* terminal.display(`Signed in as ${current.name} (${current.email}).${team}\n`);
+})).pipe(Command.withDescription("Show the current Ignotum login."));
+const auth = Command.make("auth").pipe(Command.withDescription("Manage your Ignotum login."), Command.withSubcommands([
+	authLogin,
+	authLogout,
+	authStatus
+]));
 const codegen = Command.make("codegen", {}, Effect.fn("codegen")(function* () {
 	const path = yield* Path$1.Path;
 	const terminal = yield* Terminal.Terminal;
@@ -34748,10 +34977,11 @@ const ignotum = Command.make("ignotum").pipe(Command.withSubcommands([
 	install,
 	codegen,
 	dev,
-	deploy
+	deploy,
+	auth
 ]));
 const main = () => {
-	ignotum.pipe(Command.run({ version }), Effect.provide(Layer.mergeAll(layer$1, layerUndici, IdGenerator.layer)), runMain);
+	ignotum.pipe(Command.run({ version }), Effect.provide(Layer.mergeAll(layer$1, layerUndici, IdGenerator.layer, AuthCredentialStore.layer.pipe(Layer.provide(layer$1)))), runMain);
 };
 //#endregion
 //#region src/cli/bin.ts