Safe query objects: statically typed objects as remotely executable queries