@kairos-es/core 0.0.0

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@kairos-es/core",
+  "version": "0.0.0",
+  "description": "DCB-first event-sourcing contract and in-memory store for Effect v3",
+  "license": "BSD-3-Clause",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/neverbland/kairos-es.git",
+    "directory": "packages/core"
+  },
+  "sideEffects": [],
+  "homepage": "https://github.com/neverbland/kairos-es",
+  "peerDependencies": {
+    "effect": "^3.22.0"
+  },
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/dts/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/dts/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "default": "./dist/cjs/index.js"
+    },
+    "./testing": {
+      "types": "./dist/dts/testing.d.ts",
+      "import": "./dist/esm/testing.js",
+      "default": "./dist/cjs/testing.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "typesVersions": {
+    "*": {
+      "testing": [
+        "./dist/dts/testing.d.ts"
+      ]
+    }
+  }
+}

package/src/AppendCondition.ts

@@ -0,0 +1,18 @@
+/**
+ * The optimistic-concurrency guard for `append`. The append fails if any event
+ * matching `failIfEventsMatch` exists strictly after `after`. This is the whole
+ * DCB consistency mechanism: "fail if anything I based my decision on has
+ * changed since I read it."
+ *
+ * `after` is exact-optional (absent, never `undefined`) per
+ * `exactOptionalPropertyTypes`. Absent means "scan the whole log".
+ */
+import { Schema } from 'effect'
+import { Position } from './Event'
+import { Query } from './Query'
+
+export const AppendCondition = Schema.Struct({
+  failIfEventsMatch: Query,
+  after: Schema.optionalWith(Position, { exact: true }),
+})
+export type AppendCondition = typeof AppendCondition.Type

package/src/ContractStore.ts

@@ -0,0 +1,148 @@
+/**
+ * `makeContractStore` — the shared contract-enforcement POLICY every
+ * `DcbEventStore` engine wears, factored out of the engines so the policy is
+ * DEFINITIONALLY identical across backends rather than identical by inspection.
+ *
+ * Each engine implements only the MECHANICS (`RawDcbEventStore`): the actual
+ * read/append/subscribe, free to surface infrastructure faults on the error
+ * channel (`never` for the pure in-memory engine; `SqlError` for either SQL one).
+ * The decorator wraps those mechanics with the policy the contract demands — the
+ * policy the first two engines hand-duplicated, with the Postgres one even
+ * needing a bespoke `catchAll`/`instanceof`:
+ *
+ * - `assertServableQuery` at every verb's entry (read, the append condition's
+ *   guard query, subscribe) — a non-servable query is a DEFECT in every engine;
+ * - `ReadLimit` decode on `read`'s `limit` — a negative/non-integer limit is a
+ *   DEFECT (so `read` keeps `E = never`), validated through the branded schema
+ *   even at an untyped boundary that reaches the store as `unknown`;
+ * - `orDie` on read/subscribe infrastructure errors — `read`/`subscribe` are
+ *   `E = never` on the contract, so a raw fault is a defect, not a channel value;
+ * - the `AppendConditionFailed`-else-die classification on append, matched by
+ *   `_tag` and never by class identity — ONLY the contract conflict rides the
+ *   error channel; every other fault is a defect.
+ *
+ * The throws are deferred into the returned Effect/Stream (via `Effect.suspend`
+ * / `Effect.sync`), so a validation failure surfaces as a DEFECT WHEN THE EFFECT
+ * RUNS — never as a synchronous throw at the call site. This gives the contract
+ * suite a single trusted choke point and makes a further backend impossible to get
+ * subtly wrong: it supplies mechanics, the policy is inherited whole. That is how
+ * the third engine, `@kairos-es/store-sqlite`, acquired the policy — it writes not
+ * a line of it.
+ */
+import type { Array as Arr, Scope } from 'effect'
+import { Effect, Predicate, Schema, Stream } from 'effect'
+import type { AppendCondition } from './AppendCondition'
+import type { DcbEventStore, ReadOptions, ReadResponse } from './DcbEventStore'
+import type { DcbEvent, Position, SequencedEvent } from './Event'
+import { ReadLimit } from './Event'
+import type { AppendConditionFailed } from './errors'
+import { assertServableQuery, type Query } from './Query'
+
+/** Decode an unknown limit through `ReadLimit`, dying on a defect-worthy value. */
+const decodeReadLimit = Schema.decodeUnknownSync(ReadLimit)
+
+/**
+ * The MECHANICS half of a store: the same three verbs as the `DcbEventStore`
+ * contract, but free to surface infrastructure faults (`E`) on the error
+ * channel. `E` is `never` for a pure engine (in-memory) and e.g. `SqlError` for
+ * a database engine. `append` may additionally fail with the contract's
+ * `AppendConditionFailed`. `makeContractStore` turns this into the contract.
+ */
+export interface RawDcbEventStore<E> {
+  readonly read: (
+    query: Query,
+    options?: ReadOptions,
+  ) => Effect.Effect<ReadResponse, E>
+  readonly append: (
+    events: Arr.NonEmptyReadonlyArray<DcbEvent>,
+    condition?: AppendCondition,
+  ) => Effect.Effect<Position, AppendConditionFailed | E>
+  readonly subscribe: (
+    query: Query,
+    after?: Position,
+  ) => Stream.Stream<SequencedEvent, E, Scope.Scope>
+}
+
+/**
+ * Wrap a raw engine's mechanics with the shared contract-enforcement policy,
+ * producing a full `DcbEventStore` service value.
+ */
+export const makeContractStore = <E>(
+  raw: RawDcbEventStore<E>,
+): DcbEventStore['Type'] => ({
+  read: (query, options) =>
+    Effect.suspend(() => {
+      // Defects (surface when the Effect runs), keeping `read` at `E = never`.
+      assertServableQuery(query)
+      if (options?.limit !== undefined) {
+        decodeReadLimit(options.limit)
+      }
+      // Infrastructure faults are defects, not contract values.
+      return Effect.orDie(raw.read(query, options))
+    }),
+
+  append: (events, condition) =>
+    Effect.suspend(() => {
+      // An EMPTY batch is a plain-data caller bypassing the
+      // `NonEmptyReadonlyArray` type: there is nothing to append. The engines
+      // diverge on it at an unchecked boundary — Postgres inserts zero rows and
+      // its conditional function returns zero rows, indistinguishable from a
+      // conflict, so it surfaces a PHANTOM `AppendConditionFailed`, whereas
+      // in-memory silently returns the previous head (`start - 1n`). Make it a
+      // DEFECT here, at the one choke point, so the policy is definitionally
+      // identical across engines and zero-rows stays an unambiguous conflict
+      // signal (a throw inside the suspend becomes a defect, like
+      // `assertServableQuery`).
+      if (events.length === 0) {
+        throw new Error(
+          'makeContractStore.append: the events batch is empty; append requires ' +
+            'at least one event (a NonEmptyReadonlyArray). An empty batch is a ' +
+            'plain-data caller bypassing the type — a defect, not a conflict.',
+        )
+      }
+      // A non-servable guard query is a defect in every engine.
+      if (condition !== undefined) {
+        assertServableQuery(condition.failIfEventsMatch)
+      }
+      // Only `AppendConditionFailed` belongs on the contract error channel;
+      // every other fault (a `SqlError`, a `55P03` lock-timeout abort, …) is
+      // infrastructure and surfaces OFF the shared contract as a defect.
+      //
+      // Classified by `_tag`, NEVER by `instanceof`, and this is the site where
+      // that matters most: it is the ONE gate every backend's conflicts pass
+      // through, so a class-identity check here is a single point of silent
+      // failure for the whole write side. `@kairos-es/core` ships dual ESM/CJS,
+      // so a consumer's graph can hold two distinct `AppendConditionFailed`
+      // classes for one error — an engine wired against one copy of core and
+      // wrapped by a `makeContractStore` from another. Under `instanceof` that
+      // engine's GENUINE conflicts fail the class check and are `Effect.die`d
+      // as infrastructure, which does not merely mislabel them: it takes the
+      // conflict OFF the error channel, where `retryOnConflict` (which already
+      // matches on the tag, and correctly) can never see it to retry. The tag
+      // is the error's identity across realms; `retryOnConflict.ts` makes the
+      // argument at length and this is its other end.
+      //
+      // `Predicate.isTagged` is total over `unknown` — an object check, then
+      // `_tag` equality — so a `null`, a string or a raw `SqlError` on the
+      // engine's channel simply answers false and dies as it should. It also
+      // narrows the raw `AppendConditionFailed | E` to the contract's single
+      // error, which is what keeps `append` at `E = AppendConditionFailed`.
+      return Effect.catchAll(raw.append(events, condition), (error) =>
+        Predicate.isTagged('AppendConditionFailed')(error)
+          ? Effect.fail(error)
+          : Effect.die(error),
+      )
+    }),
+
+  subscribe: (query, after) =>
+    // `Effect.sync` runs when the stream is executed; a throw from
+    // `assertServableQuery` becomes a stream defect (identical rule to
+    // read/append). Infrastructure faults on the live tail die (subscribe is
+    // `E = never`).
+    Stream.unwrap(
+      Effect.sync(() => {
+        assertServableQuery(query)
+        return Stream.orDie(raw.subscribe(query, after))
+      }),
+    ),
+})

package/src/DcbEventStore.ts

@@ -0,0 +1,77 @@
+/**
+ * The `DcbEventStore` contract: a `Context.Tag` with no bundled implementation.
+ * Consumers supply a `Layer` (the in-memory one lives in this package; each SQL
+ * engine is a package of its own — `@kairos-es/store-postgres` and
+ * `@kairos-es/store-sqlite`).
+ *
+ * Head semantics (ported from `popo.py:62-65`):
+ * - `read` with no `limit`  => `head` = the global last position (ignoring the
+ *   query filter) if the store is non-empty, else `ORIGIN` (0n).
+ * - `read` with a `limit`   => `head` = the last *returned* event's position
+ *   (post-filter, post-limit), or `ORIGIN` if none returned.
+ *
+ * `append` returns the last new position (read-your-writes). `subscribe` is
+ * catch-up then live and requires a `Scope` so the live subscription is cleaned
+ * up on scope close.
+ */
+import type { Array as Arr, Effect, Scope, Stream } from 'effect'
+import { Context } from 'effect'
+import type { AppendCondition } from './AppendCondition'
+import type { DcbEvent, Position, ReadLimit, SequencedEvent } from './Event'
+import type { AppendConditionFailed } from './errors'
+import type { Query } from './Query'
+
+/** Options for a read: a lower position bound and/or a maximum count. */
+export interface ReadOptions {
+  /** Only events strictly after this position (exclusive). Absent = from the start. */
+  readonly after?: Position
+  /**
+   * Cap the number of events returned (a branded non-negative integer). `0`
+   * returns none; absent = all matching events. A negative/non-integer value is
+   * a defect at the store boundary — see `ReadLimit`.
+   */
+  readonly limit?: ReadLimit
+}
+
+/**
+ * The result of a read: a stream of matching events (ascending by position)
+ * plus the consistency `head`.
+ */
+export interface ReadResponse {
+  readonly events: Stream.Stream<SequencedEvent>
+  readonly head: Position
+}
+
+export class DcbEventStore extends Context.Tag('@kairos-es/core/DcbEventStore')<
+  DcbEventStore,
+  {
+    /**
+     * Read events matching `query` (empty query = all), optionally bounded by
+     * `after`/`limit`. See head semantics in the module docs.
+     */
+    readonly read: (
+      query: Query,
+      options?: ReadOptions,
+    ) => Effect.Effect<ReadResponse>
+
+    /**
+     * Append one or more events atomically. If `condition` is given, the append
+     * fails with `AppendConditionFailed` when its query matches any event after
+     * `condition.after`. Returns the last new position.
+     */
+    readonly append: (
+      events: Arr.NonEmptyReadonlyArray<DcbEvent>,
+      condition?: AppendCondition,
+    ) => Effect.Effect<Position, AppendConditionFailed>
+
+    /**
+     * Subscribe to matching events: first the backlog after `after` (catch-up),
+     * then live events as they are appended. Scoped: the live subscription is
+     * released when the scope closes.
+     */
+    readonly subscribe: (
+      query: Query,
+      after?: Position,
+    ) => Stream.Stream<SequencedEvent, never, Scope.Scope>
+  }
+>() {}

package/src/Event.ts

@@ -0,0 +1,135 @@
+/**
+ * Core domain types for the DCB event log: branded scalars and the wire
+ * `DcbEvent`/`SequencedEvent` shapes.
+ *
+ * `data` is opaque bytes at the store layer; the codec (`@kairos-es/codec`) turns typed
+ * payloads into these bytes. Ordering is by `position` alone; `occurredAt` is
+ * producer-supplied domain time and is informational only.
+ */
+import { Schema } from 'effect'
+
+/**
+ * A position in the single global event log: a branded, non-negative `bigint`.
+ *
+ * The log is 64-bit (`bigserial` in Postgres) and exceeds JS `number` safety at
+ * 2^53, so positions are a `bigint`. They are compared, never arithmetic'd.
+ * `Schema.BigInt` encodes to a decimal string (JSON-safe) and decodes to
+ * `bigint`. `0n` is the "before the first event" sentinel used by `after` and by
+ * an empty store's head.
+ */
+export const Position = Schema.BigInt.pipe(
+  Schema.nonNegativeBigInt(),
+  Schema.brand('Position'),
+)
+export type Position = typeof Position.Type
+
+/** The sentinel position meaning "before the first event". */
+export const ORIGIN: Position = Position.make(0n)
+
+/**
+ * A business identifier attached to an event, following the `key:value`
+ * convention (e.g. `student:s1`). Tags replace the per-stream id of classic
+ * event sourcing; a query matches an event when the event carries all of an
+ * item's tags (superset test).
+ */
+export const Tag = Schema.String.pipe(
+  Schema.pattern(/^[^:]+:.+/, { identifier: 'Tag' }),
+  Schema.brand('Tag'),
+)
+export type Tag = typeof Tag.Type
+
+/**
+ * A reusable tag identity: a `key` plus a `.make(value)` that composes the
+ * branded `Tag` `` `${key}:${value}` `` through core's `Tag` schema. Define an
+ * identity once (`const CourseId = tagIdentity('course')`) and reuse
+ * `CourseId.make(id)` everywhere that entity is tagged. The `key` is exposed for
+ * key-aware tooling (e.g. a tag-vocabulary index, a future retag pass).
+ *
+ * The same constructor authors an event's tags (in a codec `tagsFor` mapper,
+ * ADR-0006) and a query's tags, so the `key:value` string a mapper writes and
+ * the string a query matches are produced by one function and cannot drift. It
+ * lives here beside `Tag` — pure (no clock, no RNG, no effect) — so it is
+ * reachable from every tag-authoring site, including core's own query
+ * constructors.
+ *
+ * `key` and `value` are each a single colon-free atom: the `key:value` grammar
+ * splits on the first colon, so both are validated to be non-empty and contain
+ * no `:` — `key` once at construction, `value` on each `make`. This keeps
+ * composition unambiguous and catches the double-prefix footgun loudly:
+ * `CourseId.make('course:123')` throws rather than silently yielding
+ * `course:course:123`. Raw `Tag.make` remains the escape hatch for a value that
+ * must itself contain a colon.
+ */
+export interface TagIdentity {
+  readonly key: string
+  readonly make: (value: string) => Tag
+}
+
+export const tagIdentity = (key: string): TagIdentity => {
+  if (key.length === 0 || key.includes(':')) {
+    throw new Error(
+      `tagIdentity: key must be non-empty and contain no ':' (got ${JSON.stringify(key)})`,
+    )
+  }
+  return {
+    key,
+    make: (value) => {
+      if (value.length === 0 || value.includes(':')) {
+        throw new Error(
+          `tagIdentity(${JSON.stringify(key)}).make: value must be non-empty and contain no ':' (got ${JSON.stringify(value)})`,
+        )
+      }
+      return Tag.make(`${key}:${value}`)
+    },
+  }
+}
+
+/**
+ * A read cap: a branded non-negative integer bounding how many events a `read`
+ * returns. `0` returns none; an absent limit returns all matching events.
+ *
+ * The bound lives in the type, not merely in prose: a negative or non-integer
+ * limit is a programming error, so it is a DEFECT at the store boundary — the
+ * store validates through this schema and dies rather than surfacing it on the
+ * error channel (`read` keeps `E = never`). Constructed at call sites with
+ * `ReadLimit.make(n)`.
+ */
+export const ReadLimit = Schema.Int.pipe(
+  Schema.greaterThanOrEqualTo(0),
+  Schema.brand('ReadLimit'),
+)
+export type ReadLimit = typeof ReadLimit.Type
+
+/**
+ * An event type name, a branded non-empty string. Versioning is by convention
+ * in the name (e.g. `course-registered.v2`); only non-emptiness is enforced.
+ */
+export const EventType = Schema.String.pipe(
+  Schema.nonEmptyString(),
+  Schema.brand('EventType'),
+)
+export type EventType = typeof EventType.Type
+
+/**
+ * An event as stored: an opaque payload plus its type, tags, a
+ * producer-supplied `uuid`, and producer-supplied `occurredAt` domain time.
+ *
+ * `data` is `Uint8Array` (opaque bytes); the store does not interpret it.
+ * `uuid` is producer-supplied to keep `core` deterministic (no RNG in core).
+ * `occurredAt` is informational only; ordering is by position alone.
+ */
+export const DcbEvent = Schema.Struct({
+  type: EventType,
+  data: Schema.Uint8ArrayFromSelf,
+  tags: Schema.Array(Tag),
+  uuid: Schema.UUID,
+  occurredAt: Schema.DateTimeUtc,
+})
+export type DcbEvent = typeof DcbEvent.Type
+
+/** A persisted event: the event together with the position it was written at. */
+export const SequencedEvent = Schema.Struct({
+  event: DcbEvent,
+  position: Position,
+})
+export type SequencedEvent = typeof SequencedEvent.Type

package/src/Projection.ts

@@ -0,0 +1,168 @@
+/**
+ * Pure projections and the composition primitive they fold through.
+ *
+ * A `Projection<S>` = `{ initialState, query, evolve }`: a query selecting the
+ * events it cares about and a pure `evolve` folding an already-*decoded* event
+ * into state. Decoding (wire bytes -> typed payload via `Schema`) is not core's
+ * job — it needs `Schema` and a `Serializer`, which core must not depend on —
+ * so `evolve` folds a `DecodedEvent` (the sequenced envelope plus an opaque
+ * `payload`). `composeProjections` merges several projections into one whose
+ * state is a named record.
+ *
+ * There is no builder and no decision-model orchestration here: both are the
+ * decode-aware `@kairos-es/codec` package's job (its `projection(...)` builder
+ * produces schema-backed projections, and its `modelAtHead` performs the effectful
+ * decode then folds through `composeProjections`, which `buildDecisionModel` builds
+ * on). Core keeps only the pure fold primitives.
+ *
+ * `Projection<S>` is *invariant* in `S`, so a heterogeneous record of
+ * projections (different state per key) cannot be bounded by
+ * `Projection<unknown>`. `AnyProjection` is the single authoritative,
+ * state-erased bound that owns that unsoundness in one place (built only via
+ * `AnyProjection.of`), so no downstream package writes `Projection<any>`; the
+ * precise per-key state is recovered by `StateOf` / `CompositeState`.
+ *
+ * The fold itself is pure and Effect-free.
+ */
+import type { SequencedEvent } from './Event'
+import type { Query } from './Query'
+import { matchesSequenced } from './Query'
+
+// The wildcard query, built directly (not via the public `query` surface).
+// Decision-model composition assembles `Query` values from plain data because
+// it may legitimately produce shapes the public fast-path surface withholds:
+// composing a type-only projection with tagged ones yields an OR that mixes a
+// tagless item with tagged items. That is the one restriction edge left
+// un-enforced by construction, deliberately, in this internal layer.
+const WILDCARD: Query = { items: [] }
+
+/**
+ * An already-decoded event handed to a projection's fold: the sequenced wire
+ * envelope (position, type, tags, timings) plus the decoded `payload`.
+ *
+ * Core does not decode — it only folds events another layer has already decoded
+ * — so `payload` is `unknown` at this layer. `@kairos-es/codec`'s builder emits
+ * a projection whose `evolve` narrows `payload` per matched event type.
+ */
+export interface DecodedEvent {
+  readonly sequenced: SequencedEvent
+  readonly payload: unknown
+}
+
+/**
+ * A pure projection: the events it reads (`query`), its starting state, and a
+ * fold step.
+ *
+ * `evolve` contract: a projection is only ever invoked with an event that
+ * matches its `query`. `composeProjections` enforces this — it gates every
+ * sub-projection on its own query before dispatching — so an `evolve` may
+ * assume the event matched and need not re-check `matchesSequenced` itself. (It
+ * still dispatches by the event's type, which selects the fold; that is fold
+ * *selection*, not query gating.) `payload` has already been decoded by the
+ * codec layer.
+ */
+export interface Projection<S> {
+  readonly initialState: S
+  readonly query: Query
+  readonly evolve: (state: S, event: DecodedEvent) => S
+}
+
+/**
+ * A state-erased view of a `Projection<S>`: the single authoritative bound for
+ * a *heterogeneous* record of projections. `Projection<S>` is invariant in `S`
+ * (S is both a parameter and the result of `evolve`), so `Record<string,
+ * Projection<unknown>>` rejects a record whose keys fold different state types.
+ * Rather than leak `Projection<any>` into every package that holds such a
+ * record, this type hides the invariant `evolve` behind an erased
+ * `(unknown) => unknown` surface and carries `S` only through the covariant
+ * `initialState`, so `Record<string, AnyProjection>` is sound with no `any`
+ * anywhere. Build one only via `AnyProjection.of`; recover the precise per-key
+ * `S` with `StateOf` / `CompositeState`. The `evolve` contract is the same as
+ * `Projection`'s: it is only ever called with an event matching `query`
+ * (`composeProjections` gates first), so an implementation may assume the match.
+ */
+export interface AnyProjection<out S = unknown> {
+  readonly initialState: S
+  readonly query: Query
+  readonly evolve: (state: unknown, event: DecodedEvent) => unknown
+}
+
+export const AnyProjection = {
+  /**
+   * View a typed `Projection<S>` as an opaque `AnyProjection<S>`. This is the
+   * one place the invariant `evolve` is widened to the erased surface, so the
+   * unsoundness of a heterogeneous projection record is discharged here and
+   * nowhere else. `composeProjections` calls `evolve` with each projection's
+   * own state, so the widening is sound at runtime.
+   */
+  of: <S>(projection: Projection<S>): AnyProjection<S> =>
+    projection as unknown as AnyProjection<S>,
+} as const
+
+/** Recover the state type a projection folds to. */
+export type StateOf<P> = P extends AnyProjection<infer S> ? S : never
+
+/**
+ * The record of named sub-states a composed projection (or decision model)
+ * folds to: each key's precise state type, recovered from its `AnyProjection`.
+ */
+export type CompositeState<T extends Record<string, AnyProjection>> = {
+  readonly [K in keyof T]: StateOf<T[K]>
+}
+
+/** Merge two queries by OR-ing their items; either wildcard yields a wildcard. */
+const mergeQuery = (left: Query, right: Query): Query => {
+  if (left.items.length === 0 || right.items.length === 0) {
+    return WILDCARD
+  }
+  return { items: [...left.items, ...right.items] }
+}
+
+/**
+ * Compose named projections into one whose state is a record of sub-states and
+ * whose query is the OR-merge of all sub-queries. Each sub-projection only
+ * folds events matching its own query — the guarantee that `Projection.evolve`'s
+ * contract lets sub-projections rely on (so they need not re-gate themselves).
+ *
+ * The fold always writes each *matching* sub-result into a fresh record and
+ * returns it (no `changed` short-circuit, no `evolved !== prev` reference
+ * check): an in-place-mutating fold that returns the same reference would
+ * otherwise be silently dropped. At decision-model scale the extra copy is nil.
+ */
+export const composeProjections = <T extends Record<string, AnyProjection>>(
+  projections: T,
+): Projection<CompositeState<T>> => {
+  const keys = Object.keys(projections) as ReadonlyArray<keyof T & string>
+
+  const initialState = Object.fromEntries(
+    keys.map((key) => [key, projections[key].initialState]),
+  ) as CompositeState<T>
+
+  // Seeding the reduce with the wildcard would swallow everything (mergeQuery
+  // treats an empty-items query as a wildcard), so fold the sub-queries
+  // directly with no seed.
+  const mergedQuery =
+    keys.length === 0
+      ? WILDCARD
+      : keys
+          .map((key) => projections[key].query)
+          .reduce((acc, q) => mergeQuery(acc, q))
+
+  return {
+    initialState,
+    query: mergedQuery,
+    evolve: (state, decoded) => {
+      const next = { ...state } as { [K in keyof T]: StateOf<T[K]> }
+      for (const key of keys) {
+        const projection = projections[key]
+        if (!matchesSequenced(decoded.sequenced, projection.query)) {
+          continue
+        }
+        next[key] = projection.evolve(state[key], decoded) as StateOf<
+          T[typeof key]
+        >
+      }
+      return next
+    },
+  }
+}