@shivaedev/react 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.21.0 - 2026-10-28
+
+### Added
+
+- `@shivaedev/contract/bind.ts` builds a bound HTTP RPC client and atom runtime from a contract and URL, with an inferred request transform for cookies or bearer tokens.
+- `@shivaedev/react/client/useNow.ts` exports `useNow(interval, runtime?)` to render the runtime's Effect clock and refresh on the requested interval, including with TestClock.
+- `useSignOut` coordinates explicit sign-out with TanStack Router so `permissionGuard` and `signInSearch` omit the return target during the following session refresh.
+- `authQuery` turns Better Auth reads into input-keyed native query atoms, preserving typed auth errors, mapping rejected promises to `AuthActionUnavailable`, and aborting pending requests when their readers unmount.
+
+### Fixed
+
+- Session boundaries deliver the latest committed `recheck` to query, action and save hooks without repeating a refused result when the callback changes identity.
+
+## 0.20.0 - 2026-10-27
+
+### Added
+
+- Read session grants with `can` and `useCan`, guard TanStack routes with `staticData.permission` and `permissionGuard`, and render one `PermissionBoundary` fallback for refused routes and forbidden queries. Signed-out route visits redirect to the application's sign-in path with their return location.
+
 ## 0.19.0 - 2026-10-27
 
 ### Breaking

package/README.md

@@ -32,6 +32,19 @@ A **session generation** is the string returned by `identify(session)`. `Session
 
 `useEditor` and `useCreate` opt into persisted input with `persistedDraft: { key }`. Choose a stable key for the record or create request, independent of its server revision. The adapters use form's browser storage and inherit ownership from `SessionBoundary`: reload and query refresh preserve edits, successful submission clears accepted input, and a committed session replacement drops tracked drafts. A suspended replacement that is canceled keeps the visible session's draft and future writes. Later edits made during a save remain persisted. Optional `storage`, `maxBytes` and `maxAgeMs` customize the provider and bounds; defaults are `localStorage`, 256 KiB of UTF-8 JSON and seven days. See [form's persisted input API](https://github.com/ShivaeDev/platform/tree/main/packages/form#persist-input-across-reloads) for direct form hooks and limits.
 
+### Read the current time
+
+`useNow(interval, runtime?)` from `@shivaedev/react/client/useNow.ts` returns epoch milliseconds from Effect's `Clock` and re-renders at the given interval in milliseconds. Pass the component's atom runtime to use its clock:
+
+```ts
+import { useNow } from "@shivaedev/react/client/useNow.ts";
+
+const now = useNow(60_000, client.runtime);
+const minutesAgo = Math.floor((now - savedAt) / 60_000);
+```
+
+Without a runtime it uses a native empty atom runtime. Stories supply a runtime with their TestClock service so advancing that clock updates the rendered time.
+
 ### 1. Once per application: own the registry
 
 For a screen without a session boundary, wrap it in the native provider:
@@ -384,6 +397,30 @@ function SignInButton({ email, password }: { email: string; password: string })
 
 The example uses `authAction`, `useAction`, `effect/reactivity/AsyncResult` and `effect/Option`, with an application-owned `authClient`. Returned auth errors keep their fields in the typed failure channel. Rejected promises become `AuthActionUnavailable` with the original rejection in `cause`. The application chooses error text and what happens after success.
 
+`authQuery` from `@shivaedev/react/client/authQuery.ts` creates an input-keyed query atom family for Better Auth reads. Render it with `useQuery`, just like a contract query atom:
+
+```tsx
+const authSession = authQuery((disableCookieCache: boolean, signal) =>
+  authClient.getSession({ query: { disableCookieCache }, fetchOptions: { signal } }),
+);
+
+function Account() {
+  const query = useQuery(authSession(true));
+  const failure = AsyncResult.error(query.result);
+  return (
+    <>
+      {query.pending && <p>Loading…</p>}
+      {Option.isSome(query.data) && <p>{query.data.value?.user.name ?? "Signed out"}</p>}
+      {Option.isSome(failure) && <p role="alert">Could not read the session</p>}
+    </>
+  );
+}
+```
+
+The example uses the application's Better Auth client. Reads preserve returned auth errors and use the same `AuthActionUnavailable` failure as actions for rejected promises. Releasing a pending read interrupts its Effect and aborts the supplied signal.
+
+For an explicit sign-out in a TanStack route, use `useSignOut(signOut, { signIn: "/sign-in" })` from `@shivaedev/react/client/useSignOut.ts` in place of `useAction`. It exposes the same state and a `dispatch()` handler. The hook records sign-out intent before the request and navigates to sign-in after success. `permissionGuard` and `signInSearch(location)` omit `returnTo` for that intent, including when the auth owner's session refresh reruns guards first. Use `signInSearch` for module sign-in links too; ordinary visits retain the full requested location. Applications do not need history markers or Better Auth completion timing hooks.
+
 ### Commands with a pending display value
 
 Use `usePendingCommand` for a command acting on a query row, such as a list toggle. Give each row a stable action atom with the existing bound command, so the command's declared invalidation keys still drive refetches:
@@ -704,6 +741,81 @@ const query = Atom.swr(atom, {
 
 `atom` is the underlying native query. `Atom.swr` owns the staleness decision; the signal only reports that the application resumed.
 
+### Session permissions and guarded routes
+
+Permissions come from the session payload's `user.permissions`, populated by `@shivaedev/access` through the server's role policy. `can(session, permission)` reads exact name and strength grants without making a request. `useCan()` supplies the same check from the nearest `PermissionBoundary` for component controls. A signed-out session has no grants. These checks control visibility; the server still authorizes every request.
+
+Declare a route's requirement in TanStack's native `staticData.permission`. Install `permissionGuard` once as the root route's `beforeLoad`; it checks the matched routes before their loaders run. Signed-out visitors go to the app's `signIn` path with the full requested location in the `returnTo` search field. A signed-in session without a required grant throws the shared `Forbidden` failure.
+
+```tsx
+import { RegistryContext } from "@effect/atom-react";
+import { createRootRouteWithContext, createRoute, createRouter, RouterProvider } from "@tanstack/react-router";
+import type * as AtomRegistry from "effect/reactivity/AtomRegistry";
+import { permission } from "@shivaedev/access/permission.ts";
+import { PermissionBoundary, useCan } from "@shivaedev/react/client/permissionBoundary.ts";
+import { useLoaderQuery } from "@shivaedev/react/client/useLoaderQuery.ts";
+import { permissionGuard } from "@shivaedev/react/permissionGuard.ts";
+import { can, type PermissionSession } from "@shivaedev/react/permissions.ts";
+import { queryRoute } from "@shivaedev/react/queryRoute.ts";
+import { api, registry } from "./notes-client.ts";
+import { auth, SignIn } from "./auth.tsx";
+
+const ReadNotes = permission("notes.read");
+const root = createRootRouteWithContext<{ registry: AtomRegistry.AtomRegistry }>()({
+  beforeLoad: permissionGuard({ session: () => auth.session, signIn: "/login" }),
+});
+const note = createRoute({
+  getParentRoute: () => root,
+  path: "/notes/$id",
+  staticData: { permission: ReadNotes },
+  ...queryRoute(({ params }: { params: { id: string }; search: Record<string, never> }) =>
+    api.get.query({ id: params.id, page: 1 }),
+  ),
+  component: () => {
+    const query = useLoaderQuery(api.get.query({ ...note.useParams(), page: 1 }), note.useLoaderData());
+    return <h1>{query.data.title}</h1>;
+  },
+});
+const login = createRoute({
+  getParentRoute: () => root,
+  path: "/login",
+  validateSearch: (search: Record<string, unknown>) => ({
+    returnTo: typeof search.returnTo === "string" ? search.returnTo : "/",
+  }),
+  component: () => {
+    const { returnTo } = login.useSearch();
+    return <SignIn onSignedIn={() => router.navigate({ href: returnTo })} />;
+  },
+});
+const router = createRouter({
+  context: { registry },
+  routeTree: root.addChildren([note, login]),
+  disableGlobalCatchBoundary: true,
+});
+
+function Controls() {
+  const can = useCan();
+  return can(ReadNotes) ? <button type="button">Read notes</button> : null;
+}
+
+export function App({ session }: { readonly session: PermissionSession | undefined }) {
+  return (
+    <PermissionBoundary session={session} fallback={<h1>Permission denied</h1>}>
+      <RegistryContext.Provider value={registry}>
+        <Controls />
+        <RouterProvider router={router} />
+      </RegistryContext.Provider>
+    </PermissionBoundary>
+  );
+}
+
+const showNotes = can(auth.session, ReadNotes);
+```
+
+`auth` owns the current session and passes it to `App`; `SignIn` updates that session before invoking `onSignedIn`. Use the session's registry for router context and React, as with other query routes. Importing `permissionGuard` augments TanStack's `StaticDataRouteOption`; route options and their inference remain native.
+
+`PermissionBoundary` renders the app's one fallback at the denied URL for a refused route, a loader's `Forbidden`, or a `useQuery`/`useLoaderQuery` result tagged `Forbidden`. Other errors propagate to an enclosing error boundary. Set TanStack's `disableGlobalCatchBoundary: true` and leave permission failures to this boundary; a route-specific `errorComponent` that consumes an error owns its rendering instead. Without a permission boundary, query failures keep their normal typed state. Like a React error boundary, remount it to clear a caught failure.
+
 ### API
 
 `useQuery(atom)` and `useAction(atom)` return these shared fields:
@@ -741,7 +853,7 @@ import { act, createElement } from "react";
 import { expect } from "vitest";
 import { bind } from "@shivaedev/contract/bind.ts";
 import { contract } from "@shivaedev/contract/contract.ts";
-import { collection } from "@shivaedev/contract/keys.ts";
+import { collection } from "@shivaedev/changes/keys.ts";
 import { command, query } from "@shivaedev/contract/operation.ts";
 import { useAction, useQuery } from "@shivaedev/react/client/resultState.ts";
 import { eventually, expectNoReactWarnings, render } from "@shivaedev/react/client/testing.ts";

package/dist/client/authQuery.d.ts

@@ -0,0 +1,5 @@
+import type * as AsyncResult from "effect/reactivity/AsyncResult";
+import * as Atom from "effect/reactivity/Atom";
+import { type AuthActionResult, AuthActionUnavailable } from "./authAction.ts";
+export declare function authQuery<TInput, A, E extends object = never>(run: (input: TInput, signal: AbortSignal) => Promise<AuthActionResult<A, E>>): (input: TInput) => Atom.Atom<AsyncResult.AsyncResult<A, E | AuthActionUnavailable>>;
+//# sourceMappingURL=authQuery.d.ts.map

package/dist/client/authQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authQuery.d.ts","sourceRoot":"","sources":["../../src/client/authQuery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,KAAK,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,KAAK,EAC5D,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC1E,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,qBAAqB,CAAC,CAAC,CASrF"}

package/dist/client/authQuery.js

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import * as Atom from "effect/reactivity/Atom";
+import { AuthActionUnavailable } from "./authAction.js";
+export function authQuery(run) {
+    return Atom.family((input) => Atom.make(Effect.tryPromise({
+        catch: (cause) => new AuthActionUnavailable({ cause }),
+        try: (signal) => run(input, signal),
+    }).pipe(Effect.flatMap((result) => (result.error === null ? Effect.succeed(result.data) : Effect.fail(result.error))))));
+}
+//# sourceMappingURL=authQuery.js.map

package/dist/client/authQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authQuery.js","sourceRoot":"","sources":["../../src/client/authQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAyB,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,MAAM,UAAU,SAAS,CACxB,GAA4E;IAE5E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE,CACpC,IAAI,CAAC,IAAI,CACR,MAAM,CAAC,UAAU,CAAC;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC;QACtD,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;KACnC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACtH,CACD,CAAC;AACH,CAAC"}

package/dist/client/permissionBoundary.d.ts

@@ -0,0 +1,11 @@
+import { type ReactNode } from "react";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { type PermissionSession } from "#permissions.ts";
+export interface PermissionBoundaryProps {
+    readonly children: ReactNode;
+    readonly fallback: ReactNode;
+    readonly session: PermissionSession | null | undefined;
+}
+export declare function useCan(): (permission: Permission) => boolean;
+export declare function PermissionBoundary({ children, fallback, session }: PermissionBoundaryProps): ReactNode;
+//# sourceMappingURL=permissionBoundary.d.ts.map

package/dist/client/permissionBoundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBoundary.d.ts","sourceRoot":"","sources":["../../src/client/permissionBoundary.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,SAAS,EAAc,MAAM,OAAO,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAO,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,CAAC;CACvD;AAED,wBAAgB,MAAM,IAAI,CAAC,UAAU,EAAE,UAAU,KAAK,OAAO,CAG5D;AAUD,wBAAgB,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,uBAAuB,GAAG,SAAS,CAMtG"}

package/dist/client/permissionBoundary.js

@@ -0,0 +1,20 @@
+import { CatchBoundary } from "@tanstack/react-router";
+import { Predicate } from "effect";
+import { createElement, useContext } from "react";
+import { PermissionContext } from "#internal/PermissionContext.ts";
+import { can } from "#permissions.ts";
+export function useCan() {
+    const context = useContext(PermissionContext);
+    return (permission) => can(context?.session, permission);
+}
+function PermissionFailure({ error }) {
+    const context = useContext(PermissionContext);
+    if (!Predicate.isTagged(error, "Forbidden")) {
+        throw error;
+    }
+    return context?.fallback;
+}
+export function PermissionBoundary({ children, fallback, session }) {
+    return createElement(PermissionContext.Provider, { value: { fallback, session } }, createElement(CatchBoundary, { children, errorComponent: PermissionFailure, getResetKey: () => "permission" }));
+}
+//# sourceMappingURL=permissionBoundary.js.map

package/dist/client/permissionBoundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBoundary.js","sourceRoot":"","sources":["../../src/client/permissionBoundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,aAAa,EAAkB,UAAU,EAAE,MAAM,OAAO,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,GAAG,EAA0B,MAAM,iBAAiB,CAAC;AAQ9D,MAAM,UAAU,MAAM;IACrB,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAE,KAAK,EAA+B;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,OAAO,EAAE,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAA2B;IAC1F,OAAO,aAAa,CACnB,iBAAiB,CAAC,QAAQ,EAC1B,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAChC,aAAa,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAC9G,CAAC;AACH,CAAC"}

package/dist/client/resultState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resultState.d.ts","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,EAAa,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAIpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,uBAAuB,CAAC;AAG5E,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC/C;AAUD,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAEhE;AASD,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC7B;AACD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,KAAK,gBAAgB,GAAG,SAAS,CAAC;CAC9H;AASD,wBAAgB,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,YAAY,CAAC,CAAC,CAAM,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAyB9H;AACD,MAAM,WAAW,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AACD,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1G,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EACvD,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,EAC3C,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GACjE,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC"}
+{"version":3,"file":"resultState.d.ts","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,EAAa,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAIpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,uBAAuB,CAAC;AAG5E,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC/C;AAUD,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAEhE;AASD,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC7B;AACD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,KAAK,gBAAgB,GAAG,SAAS,CAAC;CAC9H;AASD,wBAAgB,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,YAAY,CAAC,CAAC,CAAM,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CA2B9H;AACD,MAAM,WAAW,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AACD,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1G,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EACvD,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,EAC3C,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GACjE,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC"}

package/dist/client/resultState.js

@@ -4,6 +4,7 @@ import * as AsyncResult from "effect/reactivity/AsyncResult";
 import { useContext, useEffect, useState } from "react";
 import { queryCoalesceWindow } from "@shivaedev/contract/queryCoalesceWindow.ts";
 import { acceptLoaderQuery } from "#internal/queryHandoff.ts";
+import { usePermissionFailure } from "#internal/usePermissionFailure.ts";
 import { useQueryNotice } from "#internal/useQueryNotice.ts";
 import { useActionSource } from "./actionCompletion.js";
 import { useSessionRecheck } from "./sessionBoundary.js";
@@ -51,7 +52,9 @@ export function useQuery(atom, options = {}) {
     }
     useRecheckOnUnauthorized(result);
     useQueryNotice(result, Option.isSome(data), options.notice);
-    return { ...state(result, data), refresh: useAtomRefresh(atom) };
+    const refresh = useAtomRefresh(atom);
+    usePermissionFailure(AsyncResult.cause(result));
+    return { ...state(result, data), refresh };
 }
 export function useAction(source, run, options = {}) {
     const atom = useActionSource(source, run, options);

package/dist/client/resultState.js.map

@@ -1 +1 @@
-{"version":3,"file":"resultState.js","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,KAAK,EAA8B,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAsB,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AASzD,SAAS,KAAK,CAAO,MAAqC,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO;QACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACjD,MAAM;KACN,CAAC;AACH,CAAC;AACD,MAAM,UAAU,cAAc,CAAI,KAAqB;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;AAC1I,CAAC;AACD,SAAS,wBAAwB,CAAO,MAAqC,EAAE,OAAO,GAAG,IAAI;IAC5F,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAiBD,MAAM,UAAU,QAAQ,CAAO,IAA8C,EAAE,OAAO,GAAoB,EAAE;IAC3G,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAkB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvI,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAK,CAAC;IAC3H,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC7F,kGAAkG;IAClG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC9H,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAClE,CAAC;AAUD,MAAM,UAAU,SAAS,CACxB,MAA4E,EAC5E,GAA6D,EAC7D,OAAO,GAAmC,EAAE;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,wBAAwB,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"resultState.js","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,KAAK,EAA8B,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAsB,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AASzD,SAAS,KAAK,CAAO,MAAqC,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO;QACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACjD,MAAM;KACN,CAAC;AACH,CAAC;AACD,MAAM,UAAU,cAAc,CAAI,KAAqB;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;AAC1I,CAAC;AACD,SAAS,wBAAwB,CAAO,MAAqC,EAAE,OAAO,GAAG,IAAI;IAC5F,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAiBD,MAAM,UAAU,QAAQ,CAAO,IAA8C,EAAE,OAAO,GAAoB,EAAE;IAC3G,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAkB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvI,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAK,CAAC;IAC3H,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC7F,kGAAkG;IAClG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC9H,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,oBAAoB,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC;AAUD,MAAM,UAAU,SAAS,CACxB,MAA4E,EAC5E,GAA6D,EAC7D,OAAO,GAAmC,EAAE;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,wBAAwB,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/client/sessionBoundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionBoundary.d.ts","sourceRoot":"","sources":["../../src/client/sessionBoundary.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,YAAY,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAA0C,KAAK,SAAS,EAAmC,MAAM,OAAO,CAAC;AAKhH,MAAM,WAAW,oBAAoB,CAAC,QAAQ,EAAE,OAAO;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,YAAY,KAAK,OAAO,CAAC;IACtF,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,IAAI,MAAM,IAAI,CAE9C;AAoED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAClD,OAAO,EACP,kBAAkB,EAClB,QAAQ,EACR,OAAO,EACP,OAAO,EACP,SAAS,EACT,QAAQ,GACR,EAAE,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,SAAS,CAUrD"}
+{"version":3,"file":"sessionBoundary.d.ts","sourceRoot":"","sources":["../../src/client/sessionBoundary.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,YAAY,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAA0C,KAAK,SAAS,EAAmC,MAAM,OAAO,CAAC;AAMhH,MAAM,WAAW,oBAAoB,CAAC,QAAQ,EAAE,OAAO;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,YAAY,KAAK,OAAO,CAAC;IACtF,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,IAAI,MAAM,IAAI,CAE9C;AAqED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAClD,OAAO,EACP,kBAAkB,EAClB,QAAQ,EACR,OAAO,EACP,OAAO,EACP,SAAS,EACT,QAAQ,GACR,EAAE,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,SAAS,CAUrD"}

package/dist/client/sessionBoundary.js

@@ -3,6 +3,7 @@ import * as AtomRegistry from "effect/reactivity/AtomRegistry";
 import { createContext, createElement, Fragment, useContext, useEffect, useState } from "react";
 import { DraftSessionContext } from "@shivaedev/form/client/react.ts";
 import { registerSessionRecheck } from "#internal/sessionRecheck.ts";
+import { useLatestCallback } from "#internal/useLatestCallback.ts";
 import { mountLive } from "./mountLive.js";
 import { useDraftOwner } from "./useDraftOwner.js";
 const RecheckContext = createContext(() => undefined);
@@ -40,9 +41,10 @@ function hidden(connect) {
     return owned;
 }
 function Generation({ session, connect, recheck, children, liveCoalesceWindow }) {
+    const recheckLatest = useLatestCallback(recheck);
     const [open] = useState(() => (registry) => connect(session, registry));
     const [owned, own] = useState(() => owning(open));
-    useEffect(() => registerSessionRecheck(owned.registry, recheck), [owned, recheck]);
+    useEffect(() => registerSessionRecheck(owned.registry, recheckLatest), [owned, recheckLatest]);
     useEffect(() => {
         owned.mounted += 1;
         const stopLive = mountLive(owned.registry, owned.client, liveCoalesceWindow);
@@ -58,7 +60,7 @@ function Generation({ session, connect, recheck, children, liveCoalesceWindow })
             });
         };
     }, [owned, liveCoalesceWindow, open]);
-    return createElement(RecheckContext.Provider, { value: recheck }, createElement(RegistryContext.Provider, { value: owned.registry }, children(owned.client)));
+    return createElement(RecheckContext.Provider, { value: recheckLatest }, createElement(RegistryContext.Provider, { value: owned.registry }, children(owned.client)));
 }
 export function SessionBoundary({ session, liveCoalesceWindow, identify, connect, recheck, signedOut, children, }) {
     const id = session === undefined ? undefined : identify(session);

package/dist/client/sessionBoundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionBoundary.js","sourceRoot":"","sources":["../../src/client/sessionBoundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,YAAY,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAkB,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUnD,MAAM,cAAc,GAAG,aAAa,CAAa,GAAS,EAAE,CAAC,SAAS,CAAC,CAAC;AACxE,MAAM,UAAU,iBAAiB;IAChC,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,CAAC;AAMD,SAAS,MAAM,CAAU,OAAyD;IACjF,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,IAAI,MAA+C,CAAC;IACpD,OAAO;QACN,IAAI,MAAM;YACT,MAAM,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,CAAC;QACV,QAAQ;KACR,CAAC;AACH,CAAC;AACD,uHAAuH;AACvH,SAAS,MAAM,CAAU,OAAyD;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,GAAG,EAAE;QACjC,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO;QACR,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,UAAU,CAAC,GAAG,EAAE;YACf,OAAO,GAAG,KAAK,CAAC;YAChB,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;QACF,CAAC,EAAE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,OAAO,KAAK,CAAC;AACd,CAAC;AAQD,SAAS,UAAU,CAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAsC;IACrI,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,QAAmC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,SAAS,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,SAAS,CAAC,GAAG,EAAE;QACd,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC7E,OAAO,GAAG,EAAE;YACX,QAAQ,EAAE,CAAC;YACX,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,cAAc,CAAC,GAAG,EAAE;gBACnB,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO;gBACR,CAAC;gBACD,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,OAAO,aAAa,CACnB,cAAc,CAAC,QAAQ,EACvB,EAAE,KAAK,EAAE,OAAO,EAAE,EAClB,aAAa,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC1F,CAAC;AACH,CAAC;AACD,MAAM,UAAU,eAAe,CAAoB,EAClD,OAAO,EACP,kBAAkB,EAClB,QAAQ,EACR,OAAO,EACP,OAAO,EACP,SAAS,EACT,QAAQ,GACiC;IACzC,MAAM,EAAE,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;QAC1C,CAAC,CAAC,aAAa,CACb,mBAAmB,CAAC,QAAQ,EAC5B,EAAE,KAAK,EAAE,OAAO,EAAE,EAClB,aAAa,CAAC,UAA6B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAClH,CAAC;AACL,CAAC"}
+{"version":3,"file":"sessionBoundary.js","sourceRoot":"","sources":["../../src/client/sessionBoundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,YAAY,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAkB,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUnD,MAAM,cAAc,GAAG,aAAa,CAAa,GAAS,EAAE,CAAC,SAAS,CAAC,CAAC;AACxE,MAAM,UAAU,iBAAiB;IAChC,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,CAAC;AAMD,SAAS,MAAM,CAAU,OAAyD;IACjF,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,IAAI,MAA+C,CAAC;IACpD,OAAO;QACN,IAAI,MAAM;YACT,MAAM,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,CAAC;QACV,QAAQ;KACR,CAAC;AACH,CAAC;AACD,uHAAuH;AACvH,SAAS,MAAM,CAAU,OAAyD;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,GAAG,EAAE;QACjC,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO;QACR,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,UAAU,CAAC,GAAG,EAAE;YACf,OAAO,GAAG,KAAK,CAAC;YAChB,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;QACF,CAAC,EAAE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,OAAO,KAAK,CAAC;AACd,CAAC;AAQD,SAAS,UAAU,CAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAsC;IACrI,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,QAAmC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,SAAS,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAC/F,SAAS,CAAC,GAAG,EAAE;QACd,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC7E,OAAO,GAAG,EAAE;YACX,QAAQ,EAAE,CAAC;YACX,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,cAAc,CAAC,GAAG,EAAE;gBACnB,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO;gBACR,CAAC;gBACD,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,OAAO,aAAa,CACnB,cAAc,CAAC,QAAQ,EACvB,EAAE,KAAK,EAAE,aAAa,EAAE,EACxB,aAAa,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC1F,CAAC;AACH,CAAC;AACD,MAAM,UAAU,eAAe,CAAoB,EAClD,OAAO,EACP,kBAAkB,EAClB,QAAQ,EACR,OAAO,EACP,OAAO,EACP,SAAS,EACT,QAAQ,GACiC;IACzC,MAAM,EAAE,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;QAC1C,CAAC,CAAC,aAAa,CACb,mBAAmB,CAAC,QAAQ,EAC5B,EAAE,KAAK,EAAE,OAAO,EAAE,EAClB,aAAa,CAAC,UAA6B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAClH,CAAC;AACL,CAAC"}

package/dist/client/useNow.d.ts

@@ -0,0 +1,5 @@
+import * as Atom from "effect/reactivity/Atom";
+type ClockRuntime = Pick<Atom.AtomRuntime<never, unknown>, "atom">;
+export declare function useNow(interval: number, runtime?: ClockRuntime): number;
+export {};
+//# sourceMappingURL=useNow.d.ts.map

package/dist/client/useNow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useNow.d.ts","sourceRoot":"","sources":["../../src/client/useNow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAI/C,KAAK,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AAgBnE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,YAA6B,GAAG,MAAM,CAEvF"}

package/dist/client/useNow.js

@@ -0,0 +1,20 @@
+import { useAtomSuspense } from "@effect/atom-react";
+import { Clock, Effect, Layer } from "effect";
+import * as AsyncResult from "effect/reactivity/AsyncResult";
+import * as Atom from "effect/reactivity/Atom";
+const defaultRuntime = Atom.runtime(Layer.empty);
+function ticking(runtime, interval) {
+    return runtime.atom((get) => Effect.gen(function* () {
+        const update = Effect.gen(function* () {
+            const time = yield* Clock.currentTimeMillis;
+            get.setSelf(AsyncResult.success(time));
+        });
+        yield* Effect.forkScoped(Effect.forever(Effect.sleep(interval).pipe(Effect.andThen(update))));
+        return yield* Clock.currentTimeMillis;
+    }));
+}
+const nowAtom = Atom.family((runtime) => Atom.family((interval) => ticking(runtime, interval)));
+export function useNow(interval, runtime = defaultRuntime) {
+    return useAtomSuspense(nowAtom(runtime)(interval)).value;
+}
+//# sourceMappingURL=useNow.js.map

package/dist/client/useNow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useNow.js","sourceRoot":"","sources":["../../src/client/useNow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAE/C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAIjD,SAAS,OAAO,CAAO,OAA6C,EAAE,QAAgB;IACrF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC5C,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACvC,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,OAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAEtH,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,OAAO,GAAiB,cAAc;IAC9E,OAAO,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC"}

package/dist/client/useSignOut.d.ts

@@ -0,0 +1,18 @@
+import * as AsyncResult from "effect/reactivity/AsyncResult";
+import type * as Atom from "effect/reactivity/Atom";
+declare module "@tanstack/react-router" {
+    interface HistoryState {
+        readonly __platformSignOut?: boolean;
+    }
+}
+export declare function useSignOut<A, E>(action: Atom.AtomResultFn<void, A, E>, options: {
+    readonly signIn: string;
+}): {
+    cause: import("effect/Option").Option<import("effect/Cause").Cause<E>>;
+    data: import("effect/Option").Option<A>;
+    pending: boolean;
+    refreshing: boolean;
+    result: AsyncResult.AsyncResult<A, E>;
+    dispatch: () => void;
+};
+//# sourceMappingURL=useSignOut.d.ts.map

package/dist/client/useSignOut.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSignOut.d.ts","sourceRoot":"","sources":["../../src/client/useSignOut.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAIpD,OAAO,QAAQ,wBAAwB,CAAC;IACvC,UAAU,YAAY;QACrB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;KACrC;CACD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;;;;;;;EAoB3G"}

package/dist/client/useSignOut.js

@@ -0,0 +1,26 @@
+import { useRouter } from "@tanstack/react-router";
+import * as AsyncResult from "effect/reactivity/AsyncResult";
+import { useEffect } from "react";
+import { useAction } from "./resultState.js";
+export function useSignOut(action, options) {
+    const router = useRouter({ warn: false });
+    const state = useAction(action);
+    useEffect(() => {
+        if (router && AsyncResult.isSuccess(state.result) && !state.pending) {
+            void router.navigate({ replace: true, state: { __platformSignOut: true }, to: options.signIn });
+        }
+        if (router && AsyncResult.isFailure(state.result) && !state.pending) {
+            router.history.replace(router.history.location.href, { ...router.history.location.state, __platformSignOut: false });
+        }
+    }, [router, state.result, state.pending, options.signIn]);
+    return {
+        ...state,
+        dispatch: () => {
+            if (router) {
+                router.history.replace(router.history.location.href, { ...router.history.location.state, __platformSignOut: true });
+            }
+            state.dispatch();
+        },
+    };
+}
+//# sourceMappingURL=useSignOut.js.map

package/dist/client/useSignOut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSignOut.js","sourceRoot":"","sources":["../../src/client/useSignOut.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQ7C,MAAM,UAAU,UAAU,CAAO,MAAqC,EAAE,OAAoC;IAC3G,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACrE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACrE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACtH,CAAC;IACF,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO;QACN,GAAG,KAAK;QACR,QAAQ,EAAE,GAAG,EAAE;YACd,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACrH,CAAC;YACD,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/internal/PermissionContext.d.ts

@@ -0,0 +1,7 @@
+import { type ReactNode } from "react";
+import type { PermissionSession } from "#permissions.ts";
+export declare const PermissionContext: import("react").Context<{
+    readonly fallback: ReactNode;
+    readonly session: PermissionSession | null | undefined;
+} | undefined>;
+//# sourceMappingURL=PermissionContext.d.ts.map

package/dist/internal/PermissionContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContext.d.ts","sourceRoot":"","sources":["../../src/internal/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,eAAO,MAAM,iBAAiB;uBAAsC,SAAS;sBAAoB,iBAAiB,GAAG,IAAI,GAAG,SAAS;cAEpI,CAAC"}

package/dist/internal/PermissionContext.js

@@ -0,0 +1,3 @@
+import { createContext } from "react";
+export const PermissionContext = createContext(undefined);
+//# sourceMappingURL=PermissionContext.js.map

package/dist/internal/PermissionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContext.js","sourceRoot":"","sources":["../../src/internal/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,OAAO,CAAC;AAGtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAC7C,SAAS,CACT,CAAC"}

package/dist/internal/useLatestCallback.d.ts

@@ -0,0 +1,2 @@
+export declare function useLatestCallback(callback: () => void): () => void;
+//# sourceMappingURL=useLatestCallback.d.ts.map

package/dist/internal/useLatestCallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useLatestCallback.d.ts","sourceRoot":"","sources":["../../src/internal/useLatestCallback.ts"],"names":[],"mappings":"AAEA,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAMlE"}

package/dist/internal/useLatestCallback.js

@@ -0,0 +1,9 @@
+import { useCallback, useLayoutEffect, useRef } from "react";
+export function useLatestCallback(callback) {
+    const latestRef = useRef(callback);
+    useLayoutEffect(() => {
+        latestRef.current = callback;
+    }, [callback]);
+    return useCallback(() => latestRef.current(), []);
+}
+//# sourceMappingURL=useLatestCallback.js.map

package/dist/internal/useLatestCallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useLatestCallback.js","sourceRoot":"","sources":["../../src/internal/useLatestCallback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAE7D,MAAM,UAAU,iBAAiB,CAAC,QAAoB;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,eAAe,CAAC,GAAG,EAAE;QACpB,SAAS,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC9B,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACf,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/internal/usePermissionFailure.d.ts

@@ -0,0 +1,3 @@
+import { Cause, Option } from "effect";
+export declare function usePermissionFailure<E>(cause: Option.Option<Cause.Cause<E>>): void;
+//# sourceMappingURL=usePermissionFailure.d.ts.map

package/dist/internal/usePermissionFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePermissionFailure.d.ts","sourceRoot":"","sources":["../../src/internal/usePermissionFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAa,MAAM,QAAQ,CAAC;AAIlD,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAQlF"}

package/dist/internal/usePermissionFailure.js

@@ -0,0 +1,13 @@
+import { Cause, Option, Predicate } from "effect";
+import { useContext } from "react";
+import { PermissionContext } from "./PermissionContext.js";
+export function usePermissionFailure(cause) {
+    const context = useContext(PermissionContext);
+    if (context !== undefined) {
+        const failure = Option.flatMap(cause, Cause.findErrorOption);
+        if (Option.isSome(failure) && Predicate.isTagged(failure.value, "Forbidden")) {
+            throw failure.value;
+        }
+    }
+}
+//# sourceMappingURL=usePermissionFailure.js.map

package/dist/internal/usePermissionFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePermissionFailure.js","sourceRoot":"","sources":["../../src/internal/usePermissionFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,UAAU,oBAAoB,CAAI,KAAoC;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAC9E,MAAM,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/permissionGuard.d.ts

@@ -0,0 +1,22 @@
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { type PermissionSession } from "./permissions.ts";
+import { type SignInLocation } from "./signInSearch.ts";
+declare module "@tanstack/react-router" {
+    interface StaticDataRouteOption {
+        readonly permission?: Permission;
+    }
+}
+export interface PermissionGuardOptions {
+    readonly session: () => PermissionSession | null | undefined;
+    readonly signIn: string;
+}
+export interface PermissionGuardContext {
+    readonly location: SignInLocation;
+    readonly matches: readonly {
+        readonly staticData: {
+            readonly permission?: Permission;
+        };
+    }[];
+}
+export declare function permissionGuard({ session, signIn }: PermissionGuardOptions): (context: PermissionGuardContext) => void;
+//# sourceMappingURL=permissionGuard.d.ts.map

package/dist/permissionGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionGuard.d.ts","sourceRoot":"","sources":["../src/permissionGuard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAO,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,mBAAmB,CAAC;AAEtE,OAAO,QAAQ,wBAAwB,CAAC;IACvC,UAAU,qBAAqB;QAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;KACjC;CACD;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,iBAAiB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE;YAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;CAC3F;AAED,wBAAgB,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,sBAAsB,GAAG,CAAC,OAAO,EAAE,sBAAsB,KAAK,IAAI,CAgBtH"}

package/dist/permissionGuard.js

@@ -0,0 +1,22 @@
+import { redirect } from "@tanstack/react-router";
+import { Forbidden } from "@shivaedev/errors/taxonomy.ts";
+import { can } from "./permissions.js";
+import { signInSearch } from "./signInSearch.js";
+export function permissionGuard({ session, signIn }) {
+    return ({ matches, location }) => {
+        const required = matches.flatMap((match) => (match.staticData.permission === undefined ? [] : [match.staticData.permission]));
+        if (required.length === 0) {
+            return;
+        }
+        const current = session();
+        if (current === null || current === undefined) {
+            throw redirect({ search: signInSearch(location), to: signIn });
+        }
+        for (const permission of required) {
+            if (!can(current, permission)) {
+                throw new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` });
+            }
+        }
+    };
+}
+//# sourceMappingURL=permissionGuard.js.map

package/dist/permissionGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionGuard.js","sourceRoot":"","sources":["../src/permissionGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,GAAG,EAA0B,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAuB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAkBtE,MAAM,UAAU,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAA0B;IAC1E,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YACtG,CAAC;QACF,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/permissions.d.ts

@@ -0,0 +1,8 @@
+import type { Permission } from "@shivaedev/access/permission.ts";
+export interface PermissionSession {
+    readonly user: {
+        readonly permissions?: readonly Permission[];
+    };
+}
+export declare function can(session: PermissionSession | null | undefined, permission: Permission): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE;QACd,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;KAC7C,CAAC;CACF;AAED,wBAAgB,GAAG,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAElG"}

package/dist/permissions.js

@@ -0,0 +1,4 @@
+export function can(session, permission) {
+    return session?.user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,GAAG,CAAC,OAA6C,EAAE,UAAsB;IACxF,OAAO,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AACtI,CAAC"}

package/dist/signInSearch.d.ts

@@ -0,0 +1,8 @@
+export interface SignInLocation {
+    readonly href: string;
+    readonly state?: object | undefined;
+}
+export declare function signInSearch(location: SignInLocation): {
+    readonly returnTo?: string;
+};
+//# sourceMappingURL=signInSearch.d.ts.map

package/dist/signInSearch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInSearch.d.ts","sourceRoot":"","sources":["../src/signInSearch.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,cAAc,GAAG;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAGrF"}

package/dist/signInSearch.js

@@ -0,0 +1,5 @@
+export function signInSearch(location) {
+    const state = location.state;
+    return state !== undefined && "__platformSignOut" in state && state.__platformSignOut === true ? {} : { returnTo: location.href };
+}
+//# sourceMappingURL=signInSearch.js.map

package/dist/signInSearch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInSearch.js","sourceRoot":"","sources":["../src/signInSearch.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,YAAY,CAAC,QAAwB;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,OAAO,KAAK,KAAK,SAAS,IAAI,mBAAmB,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AACnI,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/react",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "React query, action, editor and session hooks for native Effect atoms",
   "keywords": [
     "effect"
@@ -46,7 +46,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@shivaedev/contract": "0.17.0",
+    "@shivaedev/access": "0.1.1",
+    "@shivaedev/contract": "0.19.0",
+    "@shivaedev/errors": "0.1.0",
     "@shivaedev/form": "0.7.0",
     "@shivaedev/test": "0.10.0"
   },
@@ -55,21 +57,22 @@
     "@effect/platform-node": "4.0.5",
     "@effect/sql-pg": "4.0.5",
     "@effect/sql-sqlite-node": "4.0.5",
-    "@shivaedev/identity": "0.1.0",
-    "@shivaedev/jobs": "0.20.0",
+    "@shivaedev/changes": "0.5.0",
+    "@shivaedev/identity": "0.3.0",
+    "@shivaedev/jobs": "0.22.0",
     "@shivaedev/local-postgres": "0.7.0",
-    "@shivaedev/quality": "0.42.0",
-    "@shivaedev/server": "0.1.0",
+    "@shivaedev/quality": "0.43.0",
+    "@shivaedev/server": "0.3.0",
     "@shivaedev/service": "0.5.0",
-    "@shivaedev/sql": "0.22.0",
-    "@shivaedev/test-sql": "0.10.0",
-    "@shivaedev/test-story": "0.21.0",
+    "@shivaedev/sql": "0.24.0",
+    "@shivaedev/test-sql": "0.10.2",
+    "@shivaedev/test-story": "0.22.0",
     "@tanstack/react-router": "1.170.45",
     "@types/node": "24.19.2",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "effect": "4.0.5",
-    "happy-dom": "21.0.3",
+    "happy-dom": "21.0.4",
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "typescript": "7.0.2",

package/src/client/authQuery.ts

@@ -0,0 +1,17 @@
+import { Effect } from "effect";
+import type * as AsyncResult from "effect/reactivity/AsyncResult";
+import * as Atom from "effect/reactivity/Atom";
+import { type AuthActionResult, AuthActionUnavailable } from "./authAction.ts";
+
+export function authQuery<TInput, A, E extends object = never>(
+	run: (input: TInput, signal: AbortSignal) => Promise<AuthActionResult<A, E>>,
+): (input: TInput) => Atom.Atom<AsyncResult.AsyncResult<A, E | AuthActionUnavailable>> {
+	return Atom.family((input: TInput) =>
+		Atom.make(
+			Effect.tryPromise({
+				catch: (cause) => new AuthActionUnavailable({ cause }),
+				try: (signal) => run(input, signal),
+			}).pipe(Effect.flatMap((result) => (result.error === null ? Effect.succeed(result.data) : Effect.fail(result.error)))),
+		),
+	);
+}

package/src/client/permissionBoundary.ts

@@ -0,0 +1,33 @@
+import { CatchBoundary } from "@tanstack/react-router";
+import { Predicate } from "effect";
+import { createElement, type ReactNode, useContext } from "react";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { PermissionContext } from "#internal/PermissionContext.ts";
+import { can, type PermissionSession } from "#permissions.ts";
+
+export interface PermissionBoundaryProps {
+	readonly children: ReactNode;
+	readonly fallback: ReactNode;
+	readonly session: PermissionSession | null | undefined;
+}
+
+export function useCan(): (permission: Permission) => boolean {
+	const context = useContext(PermissionContext);
+	return (permission) => can(context?.session, permission);
+}
+
+function PermissionFailure({ error }: { readonly error: unknown }): ReactNode {
+	const context = useContext(PermissionContext);
+	if (!Predicate.isTagged(error, "Forbidden")) {
+		throw error;
+	}
+	return context?.fallback;
+}
+
+export function PermissionBoundary({ children, fallback, session }: PermissionBoundaryProps): ReactNode {
+	return createElement(
+		PermissionContext.Provider,
+		{ value: { fallback, session } },
+		createElement(CatchBoundary, { children, errorComponent: PermissionFailure, getResetKey: () => "permission" }),
+	);
+}

package/src/client/resultState.ts

@@ -7,6 +7,7 @@ import { useContext, useEffect, useState } from "react";
 import { queryCoalesceWindow } from "@shivaedev/contract/queryCoalesceWindow.ts";
 import type { AtomServices } from "#fieldRejection.ts";
 import { acceptLoaderQuery } from "#internal/queryHandoff.ts";
+import { usePermissionFailure } from "#internal/usePermissionFailure.ts";
 import { useQueryNotice } from "#internal/useQueryNotice.ts";
 import type { NoticeDescriptor } from "#notices.ts";
 import { type ActionOptions, useActionSource } from "./actionCompletion.ts";
@@ -79,7 +80,9 @@ export function useQuery<A, E>(atom: Atom.Atom<AsyncResult.AsyncResult<A, E>>, o
 	}
 	useRecheckOnUnauthorized(result);
 	useQueryNotice(result, Option.isSome(data), options.notice);
-	return { ...state(result, data), refresh: useAtomRefresh(atom) };
+	const refresh = useAtomRefresh(atom);
+	usePermissionFailure(AsyncResult.cause(result));
+	return { ...state(result, data), refresh };
 }
 export interface ActionState<TInput, A, E> extends ResultState<A, E> {
 	readonly dispatch: (input: TInput) => void;

package/src/client/sessionBoundary.ts

@@ -4,6 +4,7 @@ import * as AtomRegistry from "effect/reactivity/AtomRegistry";
 import { createContext, createElement, Fragment, type ReactNode, useContext, useEffect, useState } from "react";
 import { DraftSessionContext } from "@shivaedev/form/client/react.ts";
 import { registerSessionRecheck } from "#internal/sessionRecheck.ts";
+import { useLatestCallback } from "#internal/useLatestCallback.ts";
 import { mountLive } from "./mountLive.ts";
 import { useDraftOwner } from "./useDraftOwner.ts";
 export interface SessionBoundaryProps<TSession, TClient> {
@@ -62,9 +63,10 @@ interface GenerationProps<TSession, TClient> {
 	readonly session: TSession;
 }
 function Generation<TSession, TClient>({ session, connect, recheck, children, liveCoalesceWindow }: GenerationProps<TSession, TClient>): ReactNode {
+	const recheckLatest = useLatestCallback(recheck);
 	const [open] = useState(() => (registry: AtomRegistry.AtomRegistry) => connect(session, registry));
 	const [owned, own] = useState(() => owning(open));
-	useEffect(() => registerSessionRecheck(owned.registry, recheck), [owned, recheck]);
+	useEffect(() => registerSessionRecheck(owned.registry, recheckLatest), [owned, recheckLatest]);
 	useEffect(() => {
 		owned.mounted += 1;
 		const stopLive = mountLive(owned.registry, owned.client, liveCoalesceWindow);
@@ -82,7 +84,7 @@ function Generation<TSession, TClient>({ session, connect, recheck, children, li
 	}, [owned, liveCoalesceWindow, open]);
 	return createElement(
 		RecheckContext.Provider,
-		{ value: recheck },
+		{ value: recheckLatest },
 		createElement(RegistryContext.Provider, { value: owned.registry }, children(owned.client)),
 	);
 }

package/src/client/useNow.ts

@@ -0,0 +1,26 @@
+import { useAtomSuspense } from "@effect/atom-react";
+import { Clock, Effect, Layer } from "effect";
+import * as AsyncResult from "effect/reactivity/AsyncResult";
+import * as Atom from "effect/reactivity/Atom";
+
+const defaultRuntime = Atom.runtime(Layer.empty);
+
+type ClockRuntime = Pick<Atom.AtomRuntime<never, unknown>, "atom">;
+
+function ticking<R, E>(runtime: Pick<Atom.AtomRuntime<R, E>, "atom">, interval: number) {
+	return runtime.atom((get) =>
+		Effect.gen(function* () {
+			const update = Effect.gen(function* () {
+				const time = yield* Clock.currentTimeMillis;
+				get.setSelf(AsyncResult.success(time));
+			});
+			yield* Effect.forkScoped(Effect.forever(Effect.sleep(interval).pipe(Effect.andThen(update))));
+			return yield* Clock.currentTimeMillis;
+		}),
+	);
+}
+const nowAtom = Atom.family((runtime: ClockRuntime) => Atom.family((interval: number) => ticking(runtime, interval)));
+
+export function useNow(interval: number, runtime: ClockRuntime = defaultRuntime): number {
+	return useAtomSuspense(nowAtom(runtime)(interval)).value;
+}

package/src/client/useSignOut.ts

@@ -0,0 +1,33 @@
+import { useRouter } from "@tanstack/react-router";
+import * as AsyncResult from "effect/reactivity/AsyncResult";
+import type * as Atom from "effect/reactivity/Atom";
+import { useEffect } from "react";
+import { useAction } from "./resultState.ts";
+
+declare module "@tanstack/react-router" {
+	interface HistoryState {
+		readonly __platformSignOut?: boolean;
+	}
+}
+
+export function useSignOut<A, E>(action: Atom.AtomResultFn<void, A, E>, options: { readonly signIn: string }) {
+	const router = useRouter({ warn: false });
+	const state = useAction(action);
+	useEffect(() => {
+		if (router && AsyncResult.isSuccess(state.result) && !state.pending) {
+			void router.navigate({ replace: true, state: { __platformSignOut: true }, to: options.signIn });
+		}
+		if (router && AsyncResult.isFailure(state.result) && !state.pending) {
+			router.history.replace(router.history.location.href, { ...router.history.location.state, __platformSignOut: false });
+		}
+	}, [router, state.result, state.pending, options.signIn]);
+	return {
+		...state,
+		dispatch: () => {
+			if (router) {
+				router.history.replace(router.history.location.href, { ...router.history.location.state, __platformSignOut: true });
+			}
+			state.dispatch();
+		},
+	};
+}

package/src/internal/PermissionContext.ts

@@ -0,0 +1,6 @@
+import { createContext, type ReactNode } from "react";
+import type { PermissionSession } from "#permissions.ts";
+
+export const PermissionContext = createContext<{ readonly fallback: ReactNode; readonly session: PermissionSession | null | undefined } | undefined>(
+	undefined,
+);

package/src/internal/useLatestCallback.ts

@@ -0,0 +1,9 @@
+import { useCallback, useLayoutEffect, useRef } from "react";
+
+export function useLatestCallback(callback: () => void): () => void {
+	const latestRef = useRef(callback);
+	useLayoutEffect(() => {
+		latestRef.current = callback;
+	}, [callback]);
+	return useCallback(() => latestRef.current(), []);
+}

package/src/internal/usePermissionFailure.ts

@@ -0,0 +1,13 @@
+import { Cause, Option, Predicate } from "effect";
+import { useContext } from "react";
+import { PermissionContext } from "./PermissionContext.ts";
+
+export function usePermissionFailure<E>(cause: Option.Option<Cause.Cause<E>>): void {
+	const context = useContext(PermissionContext);
+	if (context !== undefined) {
+		const failure = Option.flatMap(cause, Cause.findErrorOption);
+		if (Option.isSome(failure) && Predicate.isTagged(failure.value, "Forbidden")) {
+			throw failure.value;
+		}
+	}
+}

package/src/permissionGuard.ts

@@ -0,0 +1,39 @@
+import { redirect } from "@tanstack/react-router";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { Forbidden } from "@shivaedev/errors/taxonomy.ts";
+import { can, type PermissionSession } from "./permissions.ts";
+import { type SignInLocation, signInSearch } from "./signInSearch.ts";
+
+declare module "@tanstack/react-router" {
+	interface StaticDataRouteOption {
+		readonly permission?: Permission;
+	}
+}
+
+export interface PermissionGuardOptions {
+	readonly session: () => PermissionSession | null | undefined;
+	readonly signIn: string;
+}
+
+export interface PermissionGuardContext {
+	readonly location: SignInLocation;
+	readonly matches: readonly { readonly staticData: { readonly permission?: Permission } }[];
+}
+
+export function permissionGuard({ session, signIn }: PermissionGuardOptions): (context: PermissionGuardContext) => void {
+	return ({ matches, location }) => {
+		const required = matches.flatMap((match) => (match.staticData.permission === undefined ? [] : [match.staticData.permission]));
+		if (required.length === 0) {
+			return;
+		}
+		const current = session();
+		if (current === null || current === undefined) {
+			throw redirect({ search: signInSearch(location), to: signIn });
+		}
+		for (const permission of required) {
+			if (!can(current, permission)) {
+				throw new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` });
+			}
+		}
+	};
+}

package/src/permissions.ts

@@ -0,0 +1,11 @@
+import type { Permission } from "@shivaedev/access/permission.ts";
+
+export interface PermissionSession {
+	readonly user: {
+		readonly permissions?: readonly Permission[];
+	};
+}
+
+export function can(session: PermissionSession | null | undefined, permission: Permission): boolean {
+	return session?.user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}

package/src/signInSearch.ts

@@ -0,0 +1,9 @@
+export interface SignInLocation {
+	readonly href: string;
+	readonly state?: object | undefined;
+}
+
+export function signInSearch(location: SignInLocation): { readonly returnTo?: string } {
+	const state = location.state;
+	return state !== undefined && "__platformSignOut" in state && state.__platformSignOut === true ? {} : { returnTo: location.href };
+}