@shivaedev/contract 0.18.0 → 0.19.0

package/dist/publicConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicConfig.js","sourceRoot":"","sources":["../src/publicConfig.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,UAAU,YAAY,CAAO,MAA0B;IAC5D,OAAO,QAAQ,CAAC,uBAAuB,EAAE;QACxC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;KAC7D,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"publicConfig.js","sourceRoot":"","sources":["../src/publicConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,UAAU,YAAY,CAAO,MAA0B;IAC5D,OAAO,QAAQ,CAAC,uBAAuB,EAAE;QACxC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;KACrG,CAAC,CAAC;AACJ,CAAC"}

package/dist/querySubscription.d.ts

@@ -0,0 +1,15 @@
+import { Effect, type Option } from "effect";
+import type { Key } from "@shivaedev/changes/keys.ts";
+import { type Viewer } from "#readPolicy.ts";
+import type { QueryRequest } from "#serverMetadata.ts";
+export interface QuerySubscription {
+    readonly authorized: Effect.Effect<boolean>;
+    readonly keys: readonly Key[];
+    readonly scopes: readonly (readonly Key[])[];
+}
+export declare const querySubscription: (queries: readonly QueryRequest[], viewer: Option.Option<Viewer>) => Effect.Effect<{
+    authorized: Effect.Effect<boolean, never, never>;
+    keys: Key[];
+    scopes: (readonly Key[])[];
+}, import("./readPolicyErrors.ts").MissingReadPolicy | import("./readPolicyErrors.ts").QueryReadDenied, never>;
+//# sourceMappingURL=querySubscription.d.ts.map

package/dist/querySubscription.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"querySubscription.d.ts","sourceRoot":"","sources":["../src/querySubscription.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,EAAE,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC;CAC7C;AAED,eAAO,MAAM,iBAAiB;;;;8GAS5B,CAAC"}

package/dist/querySubscription.js

@@ -0,0 +1,10 @@
+import { Context, Effect } from "effect";
+import { checkQuery } from "#readPolicy.ts";
+export const querySubscription = Effect.fnUntraced(function* (queries, viewer) {
+    yield* Effect.forEach(queries, ({ query, payload }) => checkQuery(query, payload, viewer));
+    const context = Context.makeUnsafe((yield* Effect.context()).mapUnsafe);
+    const scopes = queries.map(({ query, payload }) => query.reads(payload, viewer));
+    const authorized = Effect.map(Effect.forEach(queries, ({ query, payload }) => Effect.provideContext(query.readPolicy?.(payload, viewer) ?? Effect.succeed(false), context)), (permissions) => permissions.every(Boolean));
+    return { authorized, keys: scopes.flat(), scopes };
+});
+//# sourceMappingURL=querySubscription.js.map

package/dist/querySubscription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"querySubscription.js","sourceRoot":"","sources":["../src/querySubscription.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAe,MAAM,gBAAgB,CAAC;AASzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAgC,EAAE,MAA6B;IAC5H,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAC5B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,EAC7I,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAC3C,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAA8B,CAAC;AAChF,CAAC,CAAC,CAAC"}

package/dist/readPolicy.d.ts

@@ -1,10 +1,15 @@
-import { Context, type Duration, Effect } from "effect";
+import { Context, Effect, Option } from "effect";
 import type { Rpc } from "effect/rpc";
-import type { Key } from "./keys.ts";
-export declare const ReadPolicy: Context.Reference<(key: Key) => Effect.Effect<boolean, unknown>>;
-export declare const ReadPolicyMemoWindow: Context.Reference<Duration.Input>;
-export declare const authorizeReads: <A, E, R, TPolicyServices, TDenied, TPolicyError>(effect: Effect.Effect<A, E, R>, request: {
+import type { QueryShape } from "#operation.ts";
+import { MissingReadPolicy, QueryReadDenied } from "#readPolicyErrors.ts";
+export interface Viewer {
+    readonly id: string;
+}
+export type QueryReadPolicy<TPayload> = (payload: TPayload, viewer: Option.Option<Viewer>) => Effect.Effect<boolean, never, unknown>;
+export declare const CurrentViewer: Context.Reference<Option.Option<Viewer>>;
+export declare const checkQuery: (query: QueryShape, payload: unknown, viewer: Option.Option<Viewer>) => Effect.Effect<undefined, MissingReadPolicy | QueryReadDenied, never>;
+export declare const authorizeReads: <A, E, R>(effect: Effect.Effect<A, E, R>, request: {
     readonly rpc: Rpc.AnyWithProps;
     readonly payload: unknown;
-}, policy: (key: Key) => Effect.Effect<boolean, TPolicyError, TPolicyServices>, denied: Effect.Effect<never, TDenied, never>) => Effect.Effect<A, E | TDenied | TPolicyError, TPolicyServices | Exclude<R, never>>;
+}, viewer: Option.Option<Viewer>) => Effect.Effect<A, E | MissingReadPolicy | QueryReadDenied, Exclude<R, never>>;
 //# sourceMappingURL=readPolicy.d.ts.map

package/dist/readPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readPolicy.d.ts","sourceRoot":"","sources":["../src/readPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AAChE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGrC,eAAO,MAAM,UAAU,0BAA2B,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAEvF,CAAC;AAEH,eAAO,MAAM,oBAAoB,mCAE/B,CAAC;AAEH,eAAO,MAAM,cAAc,GAAgC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY;kBAEhF,GAAG,CAAC,YAAY;sBAAoB,OAAO;iBACtD,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,oIAgB1E,CAAC"}
+{"version":3,"file":"readPolicy.d.ts","sourceRoot":"","sources":["../src/readPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG1E,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACpB;AACD,MAAM,MAAM,eAAe,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAErI,eAAO,MAAM,aAAa,0CAA+G,CAAC;AAC1I,eAAO,MAAM,UAAU,8IAQrB,CAAC;AAEH,eAAO,MAAM,cAAc,GAAgC,CAAC,EAAE,CAAC,EAAE,CAAC;kBAExC,GAAG,CAAC,YAAY;sBAAoB,OAAO;iHAQnE,CAAC"}

package/dist/readPolicy.js

@@ -1,24 +1,21 @@
 import { Context, Effect, Option } from "effect";
-import { QueryReads } from "./serverMetadata.js";
-export const ReadPolicy = Context.Reference("@shivaedev/contract/ReadPolicy", {
-    defaultValue: () => () => Effect.succeed(true),
-});
-export const ReadPolicyMemoWindow = Context.Reference("@shivaedev/contract/ReadPolicyMemoWindow", {
-    defaultValue: () => "1 second",
-});
-export const authorizeReads = Effect.fnUntraced(function* (effect, request, policy, denied) {
-    const context = yield* Effect.context();
-    function canRead(key) {
-        return Effect.provideContext(policy(key), context);
+import { MissingReadPolicy, QueryReadDenied } from "#readPolicyErrors.ts";
+import { QueryDefinition } from "#serverMetadata.ts";
+export const CurrentViewer = Context.Reference("@shivaedev/contract/CurrentViewer", { defaultValue: Option.none });
+export const checkQuery = Effect.fnUntraced(function* (query, payload, viewer) {
+    if (query.readPolicy === undefined) {
+        return yield* new MissingReadPolicy({ message: `Declare a readPolicy on query ${query.name} before running it live or subscribing` });
     }
-    const reads = Context.getOption(request.rpc.annotations, QueryReads);
-    if (Option.isSome(reads)) {
-        for (const key of reads.value(request.payload)) {
-            if (!(yield* canRead(key))) {
-                return yield* denied;
-            }
-        }
+    const context = Context.makeUnsafe((yield* Effect.context()).mapUnsafe);
+    if (!(yield* Effect.provideContext(query.readPolicy(payload, viewer), context))) {
+        return yield* new QueryReadDenied({ message: `Read not allowed for query ${query.name}` });
+    }
+});
+export const authorizeReads = Effect.fnUntraced(function* (effect, request, viewer) {
+    const definition = Context.getOption(request.rpc.annotations, QueryDefinition);
+    if (Option.isSome(definition) && definition.value.definition.readPolicy !== undefined) {
+        yield* checkQuery(definition.value.definition, request.payload, viewer);
     }
-    return yield* Effect.provideService(effect, ReadPolicy, canRead);
+    return yield* Effect.provideService(effect, CurrentViewer, viewer);
 });
 //# sourceMappingURL=readPolicy.js.map

package/dist/readPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"readPolicy.js","sourceRoot":"","sources":["../src/readPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAgD,gCAAgC,EAAE;IAC5H,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAiB,0CAA0C,EAAE;IACjH,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACxD,MAA8B,EAC9B,OAAsE,EACtE,MAA2E,EAC3E,MAAqC;IAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAmB,CAAC;IACzD,SAAS,OAAO,CAAC,GAAQ;QACxB,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;YACtB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"readPolicy.js","sourceRoot":"","sources":["../src/readPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAOrD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAwB,mCAAmC,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1I,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,KAAiB,EAAE,OAAgB,EAAE,MAA6B;IACxH,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,iCAAiC,KAAK,CAAC,IAAI,wCAAwC,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,8BAA8B,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;AACF,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACxD,MAA8B,EAC9B,OAAsE,EACtE,MAA6B;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvF,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC"}

package/dist/readPolicyErrors.d.ts

@@ -0,0 +1,13 @@
+import { Schema } from "effect";
+declare const MissingReadPolicy_base: Schema.Class<MissingReadPolicy, Schema.TaggedStruct<"MissingReadPolicy", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class MissingReadPolicy extends MissingReadPolicy_base {
+}
+declare const QueryReadDenied_base: Schema.Class<QueryReadDenied, Schema.TaggedStruct<"QueryReadDenied", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class QueryReadDenied extends QueryReadDenied_base {
+}
+export {};
+//# sourceMappingURL=readPolicyErrors.d.ts.map

package/dist/readPolicyErrors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readPolicyErrors.d.ts","sourceRoot":"","sources":["../src/readPolicyErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;AAEhC,qBAAa,iBAAkB,SAAQ,sBAAwF;CAAG;;;;AAClI,qBAAa,eAAgB,SAAQ,oBAAoF;CAAG"}

package/dist/readPolicyErrors.js

@@ -0,0 +1,6 @@
+import { Schema } from "effect";
+export class MissingReadPolicy extends Schema.TaggedError()("MissingReadPolicy", { message: Schema.String }) {
+}
+export class QueryReadDenied extends Schema.TaggedError()("QueryReadDenied", { message: Schema.String }) {
+}
+//# sourceMappingURL=readPolicyErrors.js.map

package/dist/readPolicyErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readPolicyErrors.js","sourceRoot":"","sources":["../src/readPolicyErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;CAAG;AAClI,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;CAAG"}

package/dist/serverMetadata.d.ts

@@ -1,11 +1,26 @@
-import { Context, Schema } from "effect";
+import { Context, Effect, Option, Schema } from "effect";
 import { Rpc } from "effect/rpc";
-import type { Key } from "#keys.ts";
-import type { QueryShape } from "#operation.ts";
-declare const QueryReads_base: Context.ServiceClass<QueryReads, "@shivaedev/contract/QueryReads", import("@shivaedev/types/Bivariant.ts").Bivariant<(payload: unknown) => readonly Key[]>>;
-export declare class QueryReads extends QueryReads_base {
+import type { Key } from "@shivaedev/changes/keys.ts";
+import type { CommandShape, QueryShape } from "#operation.ts";
+import type { Viewer } from "#readPolicy.ts";
+import { MissingReadPolicy, QueryReadDenied } from "#readPolicyErrors.ts";
+declare const QueryDefinition_base: Context.ServiceClass<QueryDefinition, "@shivaedev/contract/QueryDefinition", {
+    readonly definition: QueryShape;
+}>;
+export declare class QueryDefinition extends QueryDefinition_base {
 }
-declare const CommandInvalidation_base: Context.ServiceClass<CommandInvalidation, "@shivaedev/contract/CommandInvalidation", import("@shivaedev/types/Bivariant.ts").Bivariant<(payload: unknown, result: unknown) => readonly Key[]>>;
+export interface QueryRequest {
+    readonly payload: unknown;
+    readonly query: QueryShape;
+}
+declare const ChangesQueries_base: Context.ServiceClass<ChangesQueries, "@shivaedev/contract/ChangesQueries", {
+    readonly resolve: (references: readonly QueryReference[]) => Effect.Effect<readonly QueryRequest[]>;
+}>;
+export declare class ChangesQueries extends ChangesQueries_base {
+}
+declare const CommandInvalidation_base: Context.ServiceClass<CommandInvalidation, "@shivaedev/contract/CommandInvalidation", {
+    readonly invalidates: CommandShape["invalidates"];
+}>;
 export declare class CommandInvalidation extends CommandInvalidation_base {
 }
 declare const KeyScope_base: Context.ServiceClass<KeyScope, "@shivaedev/contract/KeyScope", "session">;
@@ -19,15 +34,17 @@ type ReferenceSchema<TQuery extends QueryShape> = TQuery extends QueryShape ? Sc
     query: Schema.Literal<TQuery["name"]>;
     payload: TQuery["payload"];
 }> : never;
-declare const ChangesReads_base: Context.ServiceClass<ChangesReads, "@shivaedev/contract/ChangesReads", (references: readonly QueryReference[]) => readonly Key[]>;
-export declare class ChangesReads extends ChangesReads_base {
-}
-export declare function queryKeys(queries: readonly QueryShape[], requested: readonly QueryReference[]): readonly Key[];
+export declare const queryKeys: (queries: readonly QueryShape[], requested: readonly QueryReference[], viewer?: Option.Option<Viewer> | undefined) => Effect.Effect<readonly Key[], never, never>;
 export declare function changesRpc<const TName extends string, const TQueries extends readonly QueryShape[]>(name: TName, queries: TQueries): Rpc.Rpc<`${TName}.$changes`, Schema.Struct<{
     queries: Schema.$Array<Schema.Union<readonly ReferenceSchema<TQueries[number]>[]>>;
 }>, import("effect/rpc/RpcSchema").Stream<Schema.Union<readonly [Schema.Struct<{
     readonly _tag: Schema.Literal<"Changed">;
     readonly keys: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+        readonly _tag: Schema.Literal<"Bucket">;
+        readonly collection: Schema.String;
+        readonly field: Schema.String;
+        readonly value: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    }>, Schema.Struct<{
         readonly _tag: Schema.Literal<"List">;
         readonly collection: Schema.String;
     }>, Schema.Struct<{
@@ -35,8 +52,9 @@ export declare function changesRpc<const TName extends string, const TQueries ex
         readonly collection: Schema.String;
         readonly id: Schema.Union<readonly [Schema.String, Schema.Number]>;
     }>]>>;
+    readonly queryIndexes: Schema.optional<Schema.$Array<Schema.Number>>;
 }>, Schema.Struct<{
     readonly _tag: Schema.Literal<"Resync">;
-}>]>, Schema.Never>, Schema.Never, never, never>;
+}>]>, Schema.Union<readonly [typeof MissingReadPolicy, typeof QueryReadDenied]>>, Schema.Never, never, never>;
 export {};
 //# sourceMappingURL=serverMetadata.d.ts.map

package/dist/serverMetadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serverMetadata.d.ts","sourceRoot":"","sources":["../src/serverMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,eAAe,CAAC;;AAE9D,qBAAa,UAAW,SAAQ,eAAoF;CAAG;;AAEvH,qBAAa,mBAAoB,SAAQ,wBAExC;CAAG;;AAEJ,qBAAa,QAAS,SAAQ,aAAsE;CAAG;AAEvG,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,KAAK,eAAe,CAAC,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,UAAU,GACxE,MAAM,CAAC,MAAM,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;CAAE,CAAC,GACpF,KAAK,CAAC;qHAEoE,SAAS,cAAc,EAAE,KAAK,SAAS,GAAG,EAAE;AAAzH,qBAAa,YAAa,SAAQ,iBAEjC;CAAG;AAEJ,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,GAAG,EAAE,CAQ9G;AASD,wBAAgB,UAAU,CAAC,KAAK,CAAC,KAAK,SAAS,MAAM,EAAE,KAAK,CAAC,QAAQ,SAAS,SAAS,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ;;;;;;;;;;;;;;iDAKlI"}
+{"version":3,"file":"serverMetadata.d.ts","sourceRoot":"","sources":["../src/serverMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,4BAA4B,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;;yBAEmB,UAAU;;AAAvG,qBAAa,eAAgB,SAAQ,oBAA8G;CAAG;AACtJ,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC3B;;sBAImB,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,YAAY,EAAE,CAAC;;AAHrG,qBAAa,cAAe,SAAQ,mBAKK;CAAG;;0BAE0D,YAAY,CAAC,aAAa,CAAC;;AAAjI,qBAAa,mBAAoB,SAAQ,wBAExC;CAAG;;AAEJ,qBAAa,QAAS,SAAQ,aAAsE;CAAG;AAEvG,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,KAAK,eAAe,CAAC,MAAM,SAAS,UAAU,IAAI,MAAM,SAAS,UAAU,GACxE,MAAM,CAAC,MAAM,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;CAAE,CAAC,GACpF,KAAK,CAAC;AAST,eAAO,MAAM,SAAS,mKAOpB,CAAC;AASH,wBAAgB,UAAU,CAAC,KAAK,CAAC,KAAK,SAAS,MAAM,EAAE,KAAK,CAAC,QAAQ,SAAS,SAAS,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;8GAOlI"}

package/dist/serverMetadata.js

@@ -1,27 +1,34 @@
-import { Context, Schema } from "effect";
+import { Context, Effect, Option, Schema } from "effect";
 import { Rpc } from "effect/rpc";
 import { LiveHint } from "#live.ts";
-export class QueryReads extends Context.Service()("@shivaedev/contract/QueryReads") {
+import { MissingReadPolicy, QueryReadDenied } from "#readPolicyErrors.ts";
+export class QueryDefinition extends Context.Service()("@shivaedev/contract/QueryDefinition") {
+}
+export class ChangesQueries extends Context.Service()("@shivaedev/contract/ChangesQueries") {
 }
 export class CommandInvalidation extends Context.Service()("@shivaedev/contract/CommandInvalidation") {
 }
 export class KeyScope extends Context.Service()("@shivaedev/contract/KeyScope") {
 }
-export class ChangesReads extends Context.Service()("@shivaedev/contract/ChangesReads") {
-}
-export function queryKeys(queries, requested) {
-    return requested.flatMap((reference) => {
-        const declared = queries.find((candidate) => candidate.name === reference.query);
-        if (declared === undefined) {
-            throw new Error(`Unknown query: ${reference.query}`);
-        }
-        return declared.reads(reference.payload);
+function resolveQueries(queries, requested) {
+    return Effect.forEach(requested, (reference) => {
+        const query = queries.find((candidate) => candidate.name === reference.query);
+        return query === undefined ? Effect.die(new Error(`Unknown query: ${reference.query}`)) : Effect.succeed({ payload: reference.payload, query });
     });
 }
+export const queryKeys = Effect.fnUntraced(function* (queries, requested, viewer = Option.none()) {
+    const resolved = yield* resolveQueries(queries, requested);
+    return resolved.flatMap(({ query, payload }) => query.reads(payload, viewer));
+});
 function referenceSchemas(queries) {
     return Schema.Array(Schema.Union(queries.map((query) => Schema.Struct({ payload: query.payload, query: Schema.Literal(query.name) }))));
 }
 export function changesRpc(name, queries) {
-    return Rpc.make(`${name}.$changes`, { payload: { queries: referenceSchemas(queries) }, stream: true, success: LiveHint }).annotate(ChangesReads, (requested) => queryKeys(queries, requested));
+    return Rpc.make(`${name}.$changes`, {
+        error: Schema.Union([MissingReadPolicy, QueryReadDenied]),
+        payload: { queries: referenceSchemas(queries) },
+        stream: true,
+        success: LiveHint,
+    }).annotate(ChangesQueries, { resolve: (references) => resolveQueries(queries, references) });
 }
 //# sourceMappingURL=serverMetadata.js.map

package/dist/serverMetadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverMetadata.js","sourceRoot":"","sources":["../src/serverMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGpC,MAAM,OAAO,UAAW,SAAQ,OAAO,CAAC,OAAO,EAAmC,CAAC,gCAAgC,CAAC;CAAG;AAEvH,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAAoD,CAC3G,yCAAyC,CACzC;CAAG;AAEJ,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAAuB,CAAC,8BAA8B,CAAC;CAAG;AAWvG,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAA2E,CAC3H,kCAAkC,CAClC;CAAG;AAEJ,MAAM,UAAU,SAAS,CAAC,OAA8B,EAAE,SAAoC;IAC7F,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACJ,CAAC;AAKD,SAAS,gBAAgB,CAAC,OAA8B;IACvD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzI,CAAC;AAED,MAAM,UAAU,UAAU,CAA2E,IAAW,EAAE,OAAiB;IAClI,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CACjI,YAAY,EACZ,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAC5C,CAAC;AACH,CAAC"}
+{"version":3,"file":"serverMetadata.js","sourceRoot":"","sources":["../src/serverMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGpC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE1E,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAAwD,CAAC,qCAAqC,CAAC;CAAG;AAKtJ,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAKhD,CAAC,oCAAoC,CAAC;CAAG;AAE5C,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAA8E,CACrI,yCAAyC,CACzC;CAAG;AAEJ,MAAM,OAAO,QAAS,SAAQ,OAAO,CAAC,OAAO,EAAuB,CAAC,8BAA8B,CAAC;CAAG;AAWvG,SAAS,cAAc,CAAC,OAA8B,EAAE,SAAoC;IAC3F,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9E,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACjJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACnD,OAA8B,EAC9B,SAAoC,EACpC,MAAM,GAA0B,MAAM,CAAC,IAAI,EAAE;IAE7C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAKH,SAAS,gBAAgB,CAAC,OAA8B;IACvD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzI,CAAC;AAED,MAAM,UAAU,UAAU,CAA2E,IAAW,EAAE,OAAiB;IAClI,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QACzD,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE;QAC/C,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,QAAQ;KACjB,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC"}

package/dist/testing.d.ts

@@ -1,5 +1,5 @@
 import { type Duration, Effect, Stream, SubscriptionRef } from "effect";
-import type { Key } from "./keys.ts";
+import type { Key } from "@shivaedev/changes/keys.ts";
 import type { LiveHint } from "./live.ts";
 export interface HintViewer<E> {
     readonly finished: Effect.Effect<void, E>;
@@ -8,6 +8,11 @@ export interface HintViewer<E> {
 export declare const watchHints: <E, R>(stream: Stream.Stream<{
     readonly _tag: "Changed";
     readonly keys: readonly ({
+        readonly _tag: "Bucket";
+        readonly collection: string;
+        readonly field: string;
+        readonly value: string | number;
+    } | {
         readonly _tag: "List";
         readonly collection: string;
     } | {
@@ -15,6 +20,7 @@ export declare const watchHints: <E, R>(stream: Stream.Stream<{
         readonly collection: string;
         readonly id: string | number;
     })[];
+    readonly queryIndexes?: readonly number[] | undefined;
 } | {
     readonly _tag: "Resync";
 }, E, R>) => Effect.Effect<{
@@ -22,6 +28,11 @@ export declare const watchHints: <E, R>(stream: Stream.Stream<{
     hints: SubscriptionRef.SubscriptionRef<readonly ({
         readonly _tag: "Changed";
         readonly keys: readonly ({
+            readonly _tag: "Bucket";
+            readonly collection: string;
+            readonly field: string;
+            readonly value: string | number;
+        } | {
             readonly _tag: "List";
             readonly collection: string;
         } | {
@@ -29,6 +40,7 @@ export declare const watchHints: <E, R>(stream: Stream.Stream<{
             readonly collection: string;
             readonly id: string | number;
         })[];
+        readonly queryIndexes?: readonly number[] | undefined;
     } | {
         readonly _tag: "Resync";
     })[]>;

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,EAAS,MAAM,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,eAAe,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;CACrE;AAED,eAAO,MAAM,UAAU,GAA2C,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAYpE,CAAC;AAEH,eAAO,MAAM,KAAK,GAAsC,CAAC;sBAG3B,QAAQ,CAAC,KAAK;kDAU1C,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,EAAS,MAAM,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,eAAe,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;CACrE;AAED,eAAO,MAAM,UAAU,GAA2C,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAYpE,CAAC;AAEH,eAAO,MAAM,KAAK,GAAsC,CAAC;sBAG3B,QAAQ,CAAC,KAAK;kDAU1C,CAAC"}

package/dist/testing.js

@@ -12,9 +12,6 @@ export const heard = Effect.fn("Live.heard")(function* (viewer, keys, options =
     return yield* Effect.raceFirst(matching, Effect.as(viewer.finished, false)).pipe(Effect.timeoutOrElse({ duration: options.within ?? "1 second", orElse: () => Effect.succeed(false) }));
 });
 function namesKeys(hint, keys) {
-    return (hint._tag === "Changed"
-        && keys.every((key) => hint.keys.some((actual) => actual._tag === key._tag
-            && actual.collection === key.collection
-            && (key._tag === "List" || (actual._tag === "Item" && actual.id === key.id)))));
+    return hint._tag === "Changed" && keys.every((key) => hint.keys.some((actual) => JSON.stringify(actual) === JSON.stringify(key)));
 }
 //# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAiB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AASzF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAQ,MAAqC;IAC5G,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAsB,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAC/B,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1B,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CACzH,EACD,MAAM,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAA0B,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,EACrD,MAAqB,EACrB,IAAoB,EACpB,OAAO,GAAyC,EAAE;IAElD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EACrE,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CACf,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CACrG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,IAAc,EAAE,IAAoB;IACtD,OAAO,CACN,IAAI,CAAC,IAAI,KAAK,SAAS;WACpB,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACrB,IAAI,CAAC,IAAI,CAAC,IAAI,CACb,CAAC,MAAM,EAAE,EAAE,CACV,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;eACrB,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU;eACpC,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAC7E,CACD,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAiB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AASzF,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAQ,MAAqC;IAC5G,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAsB,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAC/B,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1B,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CACzH,EACD,MAAM,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAA0B,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,EACrD,MAAqB,EACrB,IAAoB,EACpB,OAAO,GAAyC,EAAE;IAElD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EACrE,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CACf,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CACrG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,IAAc,EAAE,IAAoB;IACtD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/contract",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Typed query and command contracts over native Effect RPC and reactivity",
   "keywords": [
     "effect"
@@ -44,19 +44,20 @@
     "README.md"
   ],
   "dependencies": {
+    "@shivaedev/changes": "0.5.0",
     "@shivaedev/types": "0.3.0"
   },
   "devDependencies": {
     "@effect/platform-node": "4.0.5",
     "@effect/vitest": "4.0.5",
-    "@shivaedev/quality": "0.42.0",
+    "@shivaedev/quality": "0.43.0",
     "@shivaedev/test": "0.10.0",
-    "@shivaedev/test-sql": "0.10.1",
-    "@shivaedev/test-story": "0.21.1",
+    "@shivaedev/test-sql": "0.10.2",
+    "@shivaedev/test-story": "0.22.0",
     "@types/node": "24.19.2",
     "effect": "4.0.5",
     "esbuild": "0.28.2",
-    "happy-dom": "21.0.3",
+    "happy-dom": "21.0.4",
     "typescript": "7.0.2",
     "vitest": "5.0.5"
   },

package/src/automaticLive.ts

@@ -2,8 +2,9 @@ import { type Duration, Effect, Stream, SubscriptionRef } from "effect";
 import * as Atom from "effect/reactivity/Atom";
 import * as AtomRegistry from "effect/reactivity/AtomRegistry";
 import type * as AtomRpc from "effect/reactivity/AtomRpc";
+import { type Key, readKeys } from "@shivaedev/changes/keys.ts";
 import type { BindingOwner } from "#internal/bindingOwner.ts";
-import { type Key, readKeys } from "#keys.ts";
+import { localQueryKeys, queryHint } from "#internal/queryHints.ts";
 import { type LiveStatus, live } from "#live.ts";
 import { type ResumeSource, type ResumeWindow, resumeSignal } from "#resume.ts";
 import type { changesRpc, QueryReference } from "#serverMetadata.ts";
@@ -68,13 +69,17 @@ export function automaticLive(service: ChangesClient, name: string, owner?: Bind
 			return Stream.never;
 		}
 		const queries = [...current.values()].map(({ reference }) => reference);
-		return Stream.unwrap(service.use((client) => Effect.succeed(client(`${name}.$changes`, { queries }))));
+		return Stream.unwrap(
+			service.use((client) =>
+				Effect.succeed(client(`${name}.$changes`, { queries }).pipe(Stream.map((hint) => queryHint(hint, [...current.values()])))),
+			),
+		);
 	}
 	const signal = resumeSignal({ ...(typeof window === "undefined" ? {} : { window }), ...(resume === undefined ? {} : { native: resume }) });
 	const subscription = live(service.runtime, {
 		keyContext: owner?.context,
 		resume: signal,
-		resyncKeys: (registry) => [...Effect.runSync(SubscriptionRef.get(registry.get(tracked))).values()].flatMap(({ keys }) => keys),
+		resyncKeys: (registry) => [...Effect.runSync(SubscriptionRef.get(registry.get(tracked))).values()].flatMap(({ keys }) => localQueryKeys(keys)),
 		stream: Stream.unwrap(
 			Effect.map(AtomRegistry.AtomRegistry, (registry) =>
 				Stream.zipLatest(SubscriptionRef.changes(registry.get(tracked)), AtomRegistry.toStream(registry, signal)).pipe(

package/src/bind.ts

@@ -1,17 +1,20 @@
-import type { Duration, Effect, Stream } from "effect";
+import type { Duration, Effect, Layer, Stream } from "effect";
 import type { Headers } from "effect/http";
 import type * as AsyncResult from "effect/reactivity/AsyncResult";
 import type * as Atom from "effect/reactivity/Atom";
 import type * as AtomRegistry from "effect/reactivity/AtomRegistry";
 import type * as AtomRpc from "effect/reactivity/AtomRpc";
 import type * as Reactivity from "effect/reactivity/Reactivity";
-import type { Rpc } from "effect/rpc";
+import type { Rpc, RpcGroup } from "effect/rpc";
 import type { RpcClientError } from "effect/rpc/RpcClientError";
 import { automaticLive, type LiveBound, LiveConnection } from "#automaticLive.ts";
+import type { ClientOptions, MadeClient } from "#clientOptions.ts";
 import type { Contract, Declared, Tag } from "#contract.ts";
 import { bindingOwner } from "#internal/bindingOwner.ts";
 import { boundCommand, boundQuery, boundStream } from "#internal/clientOperations.ts";
+import { type HttpGroup, httpClient } from "#internal/httpClient.ts";
 import type { CommandShape, QueryShape, StreamShape } from "#operation.ts";
+import type { MissingReadPolicy } from "#readPolicyErrors.ts";
 import type { ResumeSource } from "#resume.ts";
 
 export type Failure<R extends Rpc.Any> =
@@ -31,7 +34,10 @@ export interface QueryOptions {
 }
 
 export interface BoundQuery<R extends Rpc.Any, TSelf> {
-	readonly query: (payload: Rpc.Payload<R>, options?: QueryOptions) => Atom.Atom<AsyncResult.AsyncResult<Rpc.Success<R>, Failure<R>>>;
+	readonly query: (
+		payload: Rpc.Payload<R>,
+		options?: QueryOptions,
+	) => Atom.Atom<AsyncResult.AsyncResult<Rpc.Success<R>, Failure<R> | MissingReadPolicy>>;
 	readonly run: (payload: Rpc.Payload<R>) => Effect.Effect<Rpc.Success<R>, RunFailure<R>, TSelf>;
 }
 
@@ -89,6 +95,14 @@ export function bind(
 	service: AtomRpc.AtomRpcClient<unknown, string, Rpc.Any>,
 	options?: BindOptions,
 ): unknown {
+	return bindApi(contract, service, options);
+}
+
+function bindApi(
+	contract: { readonly declaration: Declared<string, readonly QueryShape[], readonly CommandShape[], readonly StreamShape[], "session" | undefined> },
+	service: AtomRpc.AtomRpcClient<unknown, string, Rpc.Any>,
+	options?: BindOptions,
+) {
 	const { name, queries, commands, streams, keyScope } = contract.declaration;
 	const owner = bindingOwner(keyScope, options?.registry);
 	const automatic = automaticLive(service, name, owner, options?.resume);
@@ -101,3 +115,31 @@ export function bind(
 		{ [LiveConnection]: automatic.subscription },
 	);
 }
+
+export function makeClient<
+	TName extends string,
+	TQueries extends readonly QueryShape[],
+	TCommands extends readonly CommandShape[],
+	TRpcs extends Rpc.Any,
+	TStreams extends readonly StreamShape[],
+	TScope extends "session" | undefined,
+	TExtra extends Rpc.Any = never,
+>(
+	contract: Contract<TName, TQueries, TCommands, TRpcs, TStreams, TScope>,
+	options: ClientOptions & { readonly group?: RpcGroup.RpcGroup<TRpcs | TExtra> } & ("session" extends TScope
+			? { readonly registry: AtomRegistry.AtomRegistry }
+			: { readonly registry?: AtomRegistry.AtomRegistry }),
+): MadeClient<TName, TQueries, TCommands, TRpcs, TStreams, TExtra>;
+export function makeClient(
+	contract: HttpGroup & {
+		readonly declaration: Declared<string, readonly QueryShape[], readonly CommandShape[], readonly StreamShape[], "session" | undefined>;
+	},
+	options: ClientOptions & {
+		readonly group?: HttpGroup;
+		readonly registry?: AtomRegistry.AtomRegistry;
+	},
+): Layer.Layer<never> {
+	const connection = httpClient(contract.declaration.name, options.group ?? contract, options);
+	const api = bindApi(contract, connection.Client, options);
+	return Object.assign(connection, { api });
+}

package/src/clientOptions.ts

@@ -0,0 +1,35 @@
+import type { Context, Effect, Layer, Scope } from "effect";
+import type { HttpClient } from "effect/http/HttpClient";
+import type * as Atom from "effect/reactivity/Atom";
+import type * as AtomRpc from "effect/reactivity/AtomRpc";
+import type { Rpc, RpcClient, RpcSerialization } from "effect/rpc";
+import type { RpcClientError } from "effect/rpc/RpcClientError";
+import type { LiveBound } from "#automaticLive.ts";
+import type { Bound } from "#bind.ts";
+import type { CommandShape, QueryShape, StreamShape } from "#operation.ts";
+
+export interface ClientOptions {
+	readonly httpClient?: Layer.Layer<HttpClient>;
+	readonly serialization?: Layer.Layer<RpcSerialization.RpcSerialization>;
+	readonly transformClient?: NonNullable<Parameters<typeof RpcClient.layerProtocolHttp>[0]["transformClient"]>;
+	readonly url: string;
+}
+
+export type ClientService<TName extends string, TRpcs extends Rpc.Any> = Context.ServiceClass.Shape<
+	`${TName}/Client`,
+	RpcClient.RpcClient.Flat<TRpcs, RpcClientError>
+>;
+
+export type MadeClient<
+	TName extends string,
+	TQueries extends readonly QueryShape[],
+	TCommands extends readonly CommandShape[],
+	TRpcs extends Rpc.Any,
+	TStreams extends readonly StreamShape[],
+	TExtra extends Rpc.Any,
+> = Layer.Layer<ClientService<TName, TRpcs | TExtra>> & {
+	readonly api: Bound<TName, TQueries, TCommands, TRpcs, ClientService<TName, TRpcs | TExtra>, TStreams> & LiveBound;
+	readonly Client: AtomRpc.AtomRpcClient<ClientService<TName, TRpcs | TExtra>, `${TName}/Client`, TRpcs | TExtra>;
+	readonly client: Effect.Effect<RpcClient.RpcClient<TRpcs | TExtra, RpcClientError>, never, Scope.Scope | Rpc.MiddlewareClient<TRpcs | TExtra>>;
+	readonly runtime: Atom.AtomRuntime<ClientService<TName, TRpcs | TExtra>>;
+};

package/src/contract.ts

@@ -1,14 +1,19 @@
-import { Context, type Schema } from "effect";
+import { Context, Schema } from "effect";
 import { Rpc, RpcGroup, type RpcMiddleware, type RpcSchema } from "effect/rpc";
 import type { CommandShape, OperationShape, QueryShape, StreamShape } from "#operation.ts";
-import { CommandInvalidation, changesRpc, KeyScope, QueryReads } from "#serverMetadata.ts";
+import { QueryReadDenied } from "#readPolicyErrors.ts";
+import { CommandInvalidation, changesRpc, KeyScope, QueryDefinition } from "#serverMetadata.ts";
 
 export type Tag<TContract extends string, TName extends string> = `${TContract}.${TName}`;
 
+type OperationError<TOperation extends OperationShape> = TOperation extends QueryShape
+	? Schema.Union<readonly [TOperation["error"], typeof QueryReadDenied]>
+	: TOperation["error"];
+
 export type OperationRpc<TContract extends string, TOperation> = TOperation extends OperationShape
 	? TOperation extends StreamShape
 		? Rpc.Rpc<Tag<TContract, TOperation["name"]>, TOperation["payload"], RpcSchema.Stream<TOperation["success"], TOperation["error"]>, Schema.Never>
-		: Rpc.Rpc<Tag<TContract, TOperation["name"]>, TOperation["payload"], TOperation["success"], TOperation["error"]>
+		: Rpc.Rpc<Tag<TContract, TOperation["name"]>, TOperation["payload"], TOperation["success"], OperationError<TOperation>>
 	: never;
 
 export interface Declared<
@@ -61,9 +66,9 @@ function assertUnique(operations: readonly OperationShape[]) {
 function annotations(operation: QueryShape | CommandShape | StreamShape, keyScope: "session" | undefined) {
 	const scope = keyScope === undefined ? Context.empty() : Context.make(KeyScope, keyScope);
 	if (operation.kind === "command") {
-		return Context.add(scope, CommandInvalidation, operation.invalidates);
+		return Context.add(scope, CommandInvalidation, { invalidates: operation.invalidates });
 	}
-	return operation.kind === "query" ? Context.add(scope, QueryReads, operation.reads) : scope;
+	return operation.kind === "query" ? Context.add(scope, QueryDefinition, { definition: operation }) : scope;
 }
 
 type AnyDeclared = Declared<string, readonly QueryShape[], readonly CommandShape[], readonly StreamShape[], "session" | undefined>;
@@ -122,7 +127,7 @@ export function contract(
 	assertUnique([...queries, ...commands, ...streams]);
 	const rpcs = [...queries, ...commands, ...streams].map((operation) =>
 		Rpc.make(`${name}.${operation.name}`, {
-			error: operation.error,
+			error: operation.kind === "query" ? Schema.Union([operation.error, QueryReadDenied]) : operation.error,
 			payload: operation.payload,
 			stream: operation.kind === "stream",
 			success: operation.success,

package/src/internal/bindingOwner.ts

@@ -1,5 +1,5 @@
 import type * as AtomRegistry from "effect/reactivity/AtomRegistry";
-import type { KeyContext } from "#keys.ts";
+import type { KeyContext } from "@shivaedev/changes/keys.ts";
 
 export interface BindingOwner {
 	readonly context: KeyContext;