@gettersethya/mira 0.1.0-alpha.2 → 0.1.0-alpha.21

package/dist/src/cache/cached-collection.js

@@ -1,6 +1,7 @@
 import { Effect, Layer, Option } from "effect";
 import { CollectionService, makeCollectionServiceLayer } from "../collection-service/collection-service.js";
 import { CollectionCache, makeCollectionCacheLayer } from "./collection-cache.js";
+import { buildCtxCacheTag } from "./ctx-key.js";
 function serializeFilterNode(node) {
     switch (node.op) {
         case "eq":
@@ -69,7 +70,8 @@ export function makeCachedCollectionServiceLayer(allCollections, config = defaul
         const cache = yield* CollectionCache;
         return CollectionService.of({
             list: (collection, cursor, perPage, ctx, filter, sort, select, expand) => {
-                const key = `${collection.name}:${stableListKey(cursor, perPage, filter, sort, select, expand)}`;
+                const ctxTag = buildCtxCacheTag(collection, "list", ctx);
+                const key = `${collection.name}:${stableListKey(cursor, perPage, filter, sort, select, expand)}::${ctxTag}`;
                 return Effect.gen(function* () {
                     const cached = yield* cache.getList(key);
                     yield* Effect.currentSpan.pipe(Effect.tap((span) => Effect.sync(() => span.attribute("cache.hit", Option.isSome(cached)))), Effect.ignore);
@@ -84,7 +86,8 @@ export function makeCachedCollectionServiceLayer(allCollections, config = defaul
                 }));
             },
             view: (collection, id, ctx, select, expand) => {
-                const key = stableViewKey(collection.name, id, select, expand);
+                const ctxTag = buildCtxCacheTag(collection, "view", ctx);
+                const key = `${stableViewKey(collection.name, id, select, expand)}::${ctxTag}`;
                 return Effect.gen(function* () {
                     const cached = yield* cache.getRecord(key);
                     yield* Effect.currentSpan.pipe(Effect.tap((span) => Effect.sync(() => span.attribute("cache.hit", Option.isSome(cached)))), Effect.ignore);
@@ -98,9 +101,9 @@ export function makeCachedCollectionServiceLayer(allCollections, config = defaul
                     attributes: { collection: collection.name },
                 }));
             },
-            create: (collection, data, ctx) => svc.create(collection, data, ctx).pipe(Effect.tap(() => cache.nukeListsFor(collection.name))),
-            update: (collection, id, data, ctx) => svc.update(collection, id, data, ctx).pipe(Effect.tap(() => Effect.all([cache.invalidateRecord(collection.name, id), cache.nukeListsFor(collection.name)], { concurrency: "unbounded" }))),
-            delete: (collection, id, ctx) => svc.delete(collection, id, ctx).pipe(Effect.tap(() => Effect.all([cache.invalidateRecord(collection.name, id), cache.nukeListsFor(collection.name)], { concurrency: "unbounded" }))),
+            create: (collection, data, ctx) => svc.create(collection, data, ctx).pipe(Effect.tap(() => cache.nukeListsFor(collection.name)), Effect.withSpan("cache.create", { kind: "internal", attributes: { collection: collection.name } })),
+            update: (collection, id, data, ctx) => svc.update(collection, id, data, ctx).pipe(Effect.tap(() => Effect.all([cache.invalidateRecord(collection.name, id), cache.nukeListsFor(collection.name)], { concurrency: "unbounded" })), Effect.withSpan("cache.update", { kind: "internal", attributes: { collection: collection.name } })),
+            delete: (collection, id, ctx) => svc.delete(collection, id, ctx).pipe(Effect.tap(() => Effect.all([cache.invalidateRecord(collection.name, id), cache.nukeListsFor(collection.name)], { concurrency: "unbounded" })), Effect.withSpan("cache.delete", { kind: "internal", attributes: { collection: collection.name } })),
         });
     })).pipe(Layer.provide(Layer.merge(makeCollectionServiceLayer(allCollections), makeCollectionCacheLayer(config))));
 }

package/dist/src/cache/cached-collection.js.map

@@ -1 +1 @@
-{"version":3,"file":"cached-collection.js","sourceRoot":"","sources":["../../../src/cache/cached-collection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAA;AAKtD,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AAE1G,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAGjF,SAAS,mBAAmB,CAAC,IAAgB;IAC3C,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAA;QAC1D,KAAK,IAAI;YACP,OAAO,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAA;QACnE,KAAK,MAAM;YACT,OAAO,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAA;QAC5C,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,CAAA;QACpC,KAAK,KAAK,CAAC;QACX,KAAK,IAAI;YACP,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAA;QAC3F,KAAK,KAAK;YACR,OAAO,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IACnD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,GAAW,EACX,EAAU,EACV,MAAgD,EAChD,MAAgD;IAEhD,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,OAAO,GAAG,GAAG,IAAI,EAAE,IAAI,UAAU,IAAI,UAAU,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,aAAa,CACpB,MAAqB,EACrB,OAAe,EACf,MAA8B,EAC9B,IAA2B,EAC3B,MAAgD,EAChD,MAAgD;IAEhD,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,OAAO,IAAI,UAAU,IAAI,QAAQ,IAAI,UAAU,IAAI,UAAU,EAAE,CAAA;AAC3F,CAAC;AAED,MAAM,aAAa,GAAgC;IACjD,WAAW,EAAE,MAAM;IACnB,SAAS,EAAE,MAAM;IACjB,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,KAAK;CAChB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,cAA+C,EAC/C,SAAsC,aAAa;IAEnD,OAAO,KAAK,CAAC,MAAM,CACjB,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAA;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAA;QAEpC,OAAO,iBAAiB,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACvE,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;gBAChG,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACxC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAiB,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CACtE,EACD,MAAM,CAAC,MAAM,CACd,CAAA;oBACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;wBAAE,OAAO,MAAM,CAAC,KAAK,CAAA;oBAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;oBAC5F,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;oBAC/B,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;oBAC5B,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;iBAC5C,CAAC,CACH,CAAA;YACH,CAAC;YAED,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;gBAC9D,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;oBAC1C,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAiB,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CACtE,EACD,MAAM,CAAC,MAAM,CACd,CAAA;oBACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;wBAAE,OAAO,MAAM,CAAC,KAAK,CAAA;oBAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;oBACnE,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;oBACnC,OAAO,MAAM,CAAA;gBACf,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;oBAC5B,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;iBAC5C,CAAC,CACH,CAAA;YACH,CAAC;YAED,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAChC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CACtD;YAEH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CACpC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAClF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CACF,CACF;YAEH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAClF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CACF,CACF;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAC1F,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"cached-collection.js","sourceRoot":"","sources":["../../../src/cache/cached-collection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAG9C,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AAO1G,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG/C,SAAS,mBAAmB,CAAC,IAAgB;IAC3C,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAA;QAC1D,KAAK,IAAI;YACP,OAAO,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAA;QACnE,KAAK,MAAM;YACT,OAAO,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAA;QAC5C,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,CAAA;QACpC,KAAK,KAAK,CAAC;QACX,KAAK,IAAI;YACP,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAA;QAC3F,KAAK,KAAK;YACR,OAAO,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IACnD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,GAAW,EACX,EAAU,EACV,MAAgD,EAChD,MAAgD;IAEhD,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,OAAO,GAAG,GAAG,IAAI,EAAE,IAAI,UAAU,IAAI,UAAU,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,aAAa,CACpB,MAAqB,EACrB,OAAe,EACf,MAA8B,EAC9B,IAA2B,EAC3B,MAAgD,EAChD,MAAgD;IAEhD,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,OAAO,IAAI,UAAU,IAAI,QAAQ,IAAI,UAAU,IAAI,UAAU,EAAE,CAAA;AAC3F,CAAC;AAED,MAAM,aAAa,GAAgC;IACjD,WAAW,EAAE,MAAM;IACnB,SAAS,EAAE,MAAM;IACjB,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,KAAK;CAChB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,cAA+C,EAC/C,SAAsC,aAAa;IAEnD,OAAO,KAAK,CAAC,MAAM,CACjB,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAA;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAA;QAEpC,OAAO,iBAAiB,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACvE,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;gBACxD,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,EAAE,CAAA;gBAC3G,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACxC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAiB,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CACtE,EACD,MAAM,CAAC,MAAM,CACd,CAAA;oBACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;wBAAE,OAAO,MAAM,CAAC,KAAK,CAAA;oBAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;oBAC5F,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;oBAC/B,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;oBAC5B,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;iBAC5C,CAAC,CACH,CAAA;YACH,CAAC;YAED,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;gBACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,EAAE,CAAA;gBAC9E,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;oBAC1C,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAiB,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CACtE,EACD,MAAM,CAAC,MAAM,CACd,CAAA;oBACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;wBAAE,OAAO,MAAM,CAAC,KAAK,CAAA;oBAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;oBACnE,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;oBACnC,OAAO,MAAM,CAAA;gBACf,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;oBAC5B,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;iBAC5C,CAAC,CACH,CAAA;YACH,CAAC;YAED,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAChC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EACrD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CACnG;YAEH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CACpC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAClF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CACnG;YAEH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAClF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CACnG;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAC1F,CACF,CAAA;AACH,CAAC"}

package/dist/src/cache/collection-cache.d.ts

@@ -2,7 +2,7 @@ import { Context, Effect, Layer, Option } from "effect";
 import type { CursorPage } from "../collection-service/context.js";
 import type { RepoRecord } from "../repository/types.js";
 import type { CollectionCacheConfigValues } from "./types.js";
-declare const CollectionCache_base: Context.TagClass<CollectionCache, "CollectionCache", {
+declare const CollectionCache_base: Context.ServiceClass<CollectionCache, "CollectionCache", {
     getRecord(key: string): Effect.Effect<Option.Option<RepoRecord>>;
     putRecord(key: string, v: RepoRecord): Effect.Effect<void>;
     invalidateRecord(col: string, id: string): Effect.Effect<void>;

package/dist/src/cache/collection-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection-cache.d.ts","sourceRoot":"","sources":["../../../src/cache/collection-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAO,MAAM,QAAQ,CAAA;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAc,2BAA2B,EAAE,MAAM,YAAY,CAAA;;mBAKtD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;mBACjD,MAAM,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;0BACpC,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;iBACjD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;iBACjD,MAAM,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;sBACtC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AARlD,qBAAa,eAAgB,SAAQ,oBAUlC;CAAG;AAoCN,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,2BAA2B,GAClC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CA4B9B"}
+{"version":3,"file":"collection-cache.d.ts","sourceRoot":"","sources":["../../../src/cache/collection-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAO,MAAM,QAAQ,CAAA;AAErE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,KAAK,EAAc,2BAA2B,EAAE,MAAM,YAAY,CAAA;;mBAKtD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;mBACjD,MAAM,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;0BACpC,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;iBACjD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;iBACjD,MAAM,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;sBACtC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AARlD,qBAAa,eAAgB,SAAQ,oBAUf;CAAG;AAoCzB,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,2BAA2B,GAClC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CA4B9B"}

package/dist/src/cache/collection-cache.js

@@ -1,5 +1,5 @@
 import { Context, Effect, HashMap, Layer, Option, Ref } from "effect";
-export class CollectionCache extends Context.Tag("CollectionCache")() {
+export class CollectionCache extends Context.Service()("CollectionCache") {
 }
 const get = (ref, key) => Ref.get(ref).pipe(Effect.map(HashMap.get(key)), Effect.map(Option.filter((e) => e.expiresAt > Date.now())), Effect.map(Option.map((e) => e.value)));
 const put = (ref, key, value, ttlMs, maxSize) => {

package/dist/src/cache/collection-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"collection-cache.js","sourceRoot":"","sources":["../../../src/cache/collection-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAKrE,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAUhE;CAAG;AAEN,MAAM,GAAG,GAAG,CACV,GAAoD,EACpD,GAAW,EACsB,EAAE,CACnC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CACf,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACvC,CAAA;AAEH,MAAM,GAAG,GAAG,CACV,GAAoD,EACpD,GAAW,EACX,KAAQ,EACR,KAAa,EACb,OAAe,EACM,EAAE;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,KAAK,GAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,EAAE,CAAA;IAC/E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO;YAAE,OAAO,QAAQ,CAAA;QACtD,IAAI,SAA6B,CAAA;QACjC,IAAI,UAAU,GAAG,QAAQ,CAAA;QACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBAC9B,UAAU,GAAG,CAAC,CAAC,UAAU,CAAA;gBACzB,SAAS,GAAG,CAAC,CAAA;YACf,CAAC;QACH,CAAC;QACD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAmC;IAEnC,OAAO,KAAK,CAAC,MAAM,CACjB,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAkC,CAAC,CAAA;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAkC,CAAC,CAAA;QAEhF,OAAO,eAAe,CAAC,EAAE,CAAC;YACxB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;YAEvC,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;YAEpF,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAC5B,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAClE;YAEH,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;YAEnC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;YAE5E,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CACpB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC1B,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAC5D;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"collection-cache.js","sourceRoot":"","sources":["../../../src/cache/collection-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAOrE,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,OAAO,EAUjD,CAAC,iBAAiB,CAAC;CAAG;AAEzB,MAAM,GAAG,GAAG,CACV,GAAoD,EACpD,GAAW,EACsB,EAAE,CACnC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CACf,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACvC,CAAA;AAEH,MAAM,GAAG,GAAG,CACV,GAAoD,EACpD,GAAW,EACX,KAAQ,EACR,KAAa,EACb,OAAe,EACM,EAAE;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,KAAK,GAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,EAAE,CAAA;IAC/E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO;YAAE,OAAO,QAAQ,CAAA;QACtD,IAAI,SAA6B,CAAA;QACjC,IAAI,UAAU,GAAG,QAAQ,CAAA;QACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBAC9B,UAAU,GAAG,CAAC,CAAC,UAAU,CAAA;gBACzB,SAAS,GAAG,CAAC,CAAA;YACf,CAAC;QACH,CAAC;QACD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAmC;IAEnC,OAAO,KAAK,CAAC,MAAM,CACjB,eAAe,EACf,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAkC,CAAC,CAAA;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAkC,CAAC,CAAA;QAEhF,OAAO,eAAe,CAAC,EAAE,CAAC;YACxB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;YAEvC,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;YAEpF,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAC5B,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAClE;YAEH,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;YAEnC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;YAE5E,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CACpB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC1B,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAC5D;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/src/cache/ctx-key.d.ts

@@ -0,0 +1,15 @@
+import type { AnyCollectionDef } from "@gettersethya/mira-client";
+import type { RequestCtx } from "../collection-service/context.js";
+/**
+ * Derives the portion of a cache key that captures everything a collection's
+ * row-level access rule for `action` could depend on in `ctx`: the admin flag,
+ * the authenticated identity, and only the specific request query/header keys
+ * the compiled rule actually references.
+ *
+ * Two requests that produce the same tag are guaranteed to be authorized
+ * identically by the rule — so caching by `recordKey::ctxTag` cannot let one
+ * requester's cached result leak to a requester the rule would otherwise deny
+ * or show a different field set to.
+ */
+export declare function buildCtxCacheTag(collection: AnyCollectionDef, action: "view" | "list", ctx: RequestCtx): string;
+//# sourceMappingURL=ctx-key.d.ts.map

package/dist/src/cache/ctx-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctx-key.d.ts","sourceRoot":"","sources":["../../../src/cache/ctx-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAIjE;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,GAAG,EAAE,UAAU,GACd,MAAM,CA+BR"}

package/dist/src/cache/ctx-key.js

@@ -0,0 +1,37 @@
+import { extractCtxRefs } from "../collection-service/where.js";
+import { enforcerForAction } from "../rule/enforcer.js";
+/**
+ * Derives the portion of a cache key that captures everything a collection's
+ * row-level access rule for `action` could depend on in `ctx`: the admin flag,
+ * the authenticated identity, and only the specific request query/header keys
+ * the compiled rule actually references.
+ *
+ * Two requests that produce the same tag are guaranteed to be authorized
+ * identically by the rule — so caching by `recordKey::ctxTag` cannot let one
+ * requester's cached result leak to a requester the rule would otherwise deny
+ * or show a different field set to.
+ */
+export function buildCtxCacheTag(collection, action, ctx) {
+    if (ctx.admin === true)
+        return "admin";
+    const compiled = enforcerForAction(collection.schema, action);
+    if (compiled === null)
+        return "denied";
+    const refs = extractCtxRefs(compiled.sql);
+    const authPart = refs.authFields.length > 0
+        ? `auth:${refs.authFields
+            .map((field) => field === "collection"
+            ? `collection=${ctx.auth?.collection ?? ""}`
+            : `${field}=${String(ctx.auth?.record[field] ?? "")}`)
+            .join(",")}`
+        : "";
+    const queryPart = refs.queryKeys.length > 0
+        ? `q:${refs.queryKeys.map((key) => `${key}=${String(ctx.query[key] ?? "")}`).join(",")}`
+        : "";
+    const headerPart = refs.headerKeys.length > 0
+        ? `h:${refs.headerKeys.map((key) => `${key}=${String(ctx.headers[key] ?? "")}`).join(",")}`
+        : "";
+    const parts = [authPart, queryPart, headerPart].filter((p) => p.length > 0);
+    return parts.length > 0 ? parts.join("|") : "public";
+}
+//# sourceMappingURL=ctx-key.js.map

package/dist/src/cache/ctx-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctx-key.js","sourceRoot":"","sources":["../../../src/cache/ctx-key.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA4B,EAC5B,MAAuB,EACvB,GAAe;IAEf,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IAEtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAA;IAEtC,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAEzC,MAAM,QAAQ,GACZ,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,QAAQ,IAAI,CAAC,UAAU;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,KAAK,KAAK,YAAY;YACpB,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE;YAC5C,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CACxD;aACA,IAAI,CAAC,GAAG,CAAC,EAAE;QAChB,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACxF,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC3F,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3E,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACtD,CAAC"}

package/dist/src/cache/index.d.ts

@@ -1,4 +1,5 @@
-export { CollectionCache, makeCollectionCacheLayer } from "./collection-cache.js";
 export { makeCachedCollectionServiceLayer } from "./cached-collection.js";
+export { CollectionCache, makeCollectionCacheLayer } from "./collection-cache.js";
+export { buildCtxCacheTag } from "./ctx-key.js";
 export type { CacheEntry, CollectionCacheConfigValues } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/cache/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAA;AACzE,YAAY,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA"}

package/dist/src/cache/index.js

@@ -1,3 +1,4 @@
-export { CollectionCache, makeCollectionCacheLayer } from "./collection-cache.js";
 export { makeCachedCollectionServiceLayer } from "./cached-collection.js";
+export { CollectionCache, makeCollectionCacheLayer } from "./collection-cache.js";
+export { buildCtxCacheTag } from "./ctx-key.js";
 //# sourceMappingURL=index.js.map

package/dist/src/cache/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA"}

package/dist/src/collection-service/collection-service.d.ts

@@ -1,13 +1,15 @@
-import { SqlClient } from "@effect/sql";
-import { Context, Effect, Layer } from "effect";
 import type { AnyCollectionDef } from "@gettersethya/mira-client";
 import type { FilterNode } from "@gettersethya/mira-client";
+import { Context, Effect, Layer } from "effect";
+import { SqlClient } from "effect/sql";
+import { Dialect } from "../dialect/dialect.js";
+import { AuthService } from "../http/auth.js";
 import { Repository } from "../repository/repository.js";
 import type { RepoRecord, SortOrder } from "../repository/types.js";
 import { FileStorage } from "../storage/storage.js";
 import type { CursorPage, RequestCtx } from "./context.js";
 import type { CollectionError } from "./errors.js";
-declare const CollectionService_base: Context.TagClass<CollectionService, "CollectionService", {
+declare const CollectionService_base: Context.ServiceClass<CollectionService, "CollectionService", {
     list(collection: AnyCollectionDef, cursor: number | null, perPage: number, ctx: RequestCtx, filter?: FilterNode, sort?: SortOrder, select?: ReadonlyArray<string> | null, expand?: ReadonlyArray<string> | null): Effect.Effect<CursorPage, CollectionError>;
     view(collection: AnyCollectionDef, id: string, ctx: RequestCtx, select?: ReadonlyArray<string> | null, expand?: ReadonlyArray<string> | null): Effect.Effect<RepoRecord, CollectionError>;
     create(collection: AnyCollectionDef, data: RepoRecord, ctx: RequestCtx): Effect.Effect<RepoRecord, CollectionError>;
@@ -55,8 +57,8 @@ export declare class CollectionService extends CollectionService_base {
  * @see CollectionService — the service tag
  * @see makeCachedCollectionServiceLayer — wrapping layer that adds caching
  */
-export declare function makeCollectionServiceLayer(allCollections: ReadonlyArray<AnyCollectionDef>): Layer.Layer<CollectionService, never, Repository | SqlClient.SqlClient | FileStorage>;
+export declare function makeCollectionServiceLayer(allCollections: ReadonlyArray<AnyCollectionDef>): Layer.Layer<CollectionService, never, Repository | SqlClient.SqlClient | FileStorage | Dialect | AuthService>;
 /** @deprecated Use makeCollectionServiceLayer(allCollections) */
-export declare const CollectionServiceLive: Layer.Layer<CollectionService, never, FileStorage | SqlClient.SqlClient | Repository>;
+export declare const CollectionServiceLive: Layer.Layer<CollectionService, never, Dialect | AuthService | FileStorage | SqlClient.SqlClient | Repository>;
 export {};
 //# sourceMappingURL=collection-service.d.ts.map

package/dist/src/collection-service/collection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection-service.d.ts","sourceRoot":"","sources":["../../../src/collection-service/collection-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,2BAA2B,CAAA;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,KAAK,EAAa,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGlD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;;qBAgChC,gBAAgB,UACpB,MAAM,GAAG,IAAI,WACZ,MAAM,OACV,UAAU,WACN,UAAU,SACZ,SAAS,WACP,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,WAC5B,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,GACpC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;qBAG/B,gBAAgB,MACxB,MAAM,OACL,UAAU,WACN,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,WAC5B,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,GACpC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;uBAE1B,gBAAgB,QAAQ,UAAU,OAAO,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;uBAGrG,gBAAgB,MACxB,MAAM,QACJ,UAAU,OACX,UAAU,GACd,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;uBAE1B,gBAAgB,MAAM,MAAM,OAAO,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC;;AAtD3G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,iBAAkB,SAAQ,sBAiCpC;CAAG;AAqGN;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAC9C,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC,SAAS,GAAG,WAAW,CAAC,CAyOvF;AAED,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,uFAAiC,CAAA"}
+{"version":3,"file":"collection-service.d.ts","sourceRoot":"","sources":["../../../src/collection-service/collection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,2BAA2B,CAAA;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAGtC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,KAAK,EAAa,UAAU,EAAE,SAAS,EAAe,MAAM,uBAAuB,CAAA;AAE1F,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;;qBAgChC,gBAAgB,UACpB,MAAM,GAAG,IAAI,WACZ,MAAM,OACV,UAAU,WACN,UAAU,SACZ,SAAS,WACP,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,WAC5B,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,GACpC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;qBAG/B,gBAAgB,MACxB,MAAM,OACL,UAAU,WACN,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,WAC5B,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,GACpC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;uBAE1B,gBAAgB,QAAQ,UAAU,OAAO,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;uBAGrG,gBAAgB,MACxB,MAAM,QACJ,UAAU,OACX,UAAU,GACd,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;uBAE1B,gBAAgB,MAAM,MAAM,OAAO,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC;;AAtD3G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,iBAAkB,SAAQ,sBAiCf;CAAG;AAwG3B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAC9C,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,WAAW,CAAC,CAub/G;AAED,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,+GAAiC,CAAA"}

package/dist/src/collection-service/collection-service.js

@@ -1,11 +1,13 @@
-import { SqlClient } from "@effect/sql";
-import { unsafeFragment } from "@effect/sql/Statement";
-import { Context, Effect, Layer, Option, Schema } from "effect";
 import { filterNodeToWhereClause } from "@gettersethya/mira-client";
-import { enforcerForAction } from "../rule/enforcer.js";
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { literal } from "effect/sql/Statement";
+import { Dialect } from "../dialect/dialect.js";
+import { AuthService } from "../http/auth.js";
 import { Repository } from "../repository/repository.js";
+import { enforcerForAction } from "../rule/enforcer.js";
 import { FileStorage } from "../storage/storage.js";
-import { makeRowDecoder } from "./decode.js";
+import { makeRowDecoder, makeRowEncoder } from "./decode.js";
 import { ForbiddenError, NotFoundError, ReadOnlyError, ValidationError } from "./errors.js";
 import { buildInputSchemas, parseErrToValidationError } from "./input-schema.js";
 import { andWhere, cursorClause, idClause, resolveCtxPlaceholders, resolveFieldRefs } from "./where.js";
@@ -32,17 +34,17 @@ import { andWhere, cursorClause, idClause, resolveCtxPlaceholders, resolveFieldR
  * @see makeCollectionServiceLayer — factory function
  * @see Repository — the underlying data access layer
  */
-export class CollectionService extends Context.Tag("CollectionService")() {
+export class CollectionService extends Context.Service()("CollectionService") {
 }
-function resolveFields(schema, userSelect) {
+function resolveFields(schema, userSelect, admin = false) {
     const nonHidden = Object.entries(schema.properties)
-        .filter(([, p]) => !p["x-hidden"])
+        .filter(([, p]) => admin || !p["x-hidden"])
         .map(([k]) => k);
     if (userSelect === null)
         return nonHidden;
-    // Intersect with non-hidden fields
+    // Intersect with non-hidden fields (admin bypasses hidden filter)
     const nonHiddenSet = new Set(nonHidden);
-    const selected = userSelect.filter((f) => nonHiddenSet.has(f));
+    const selected = userSelect.filter((f) => admin || nonHiddenSet.has(f));
     // Always include core system fields needed for the response
     const always = new Set(["id", "created", "updated"]);
     for (const a of always) {
@@ -71,8 +73,11 @@ function resolveExpand(schema, expandFieldNames, allCollections) {
     }
     return result;
 }
+// These fields are auto-generated by the system and must never be accepted from user input.
+// Detected via the `x-generated` schema annotation rather than a hardcoded name list,
+// so auth fields (email/password) and future additions stay user-writable.
 function rejectSystemFields(data, schema, collectionName) {
-    const sysKeys = Object.keys(data).filter((k) => schema.properties[k]?.["x-system"] === true);
+    const sysKeys = Object.keys(data).filter((k) => schema.properties[k]?.["x-generated"] === true);
     if (sysKeys.length === 0)
         return Effect.void;
     return Effect.fail(new ValidationError({
@@ -126,26 +131,148 @@ export function makeCollectionServiceLayer(allCollections) {
         const repo = yield* Repository;
         const sql = yield* SqlClient.SqlClient;
         const fileStorage = yield* FileStorage;
-        const decoderMap = new Map(allCollections.map((c) => [c.name, makeRowDecoder(c.schema)]));
+        const dialect = yield* Dialect;
+        const authService = yield* AuthService;
+        // Passwords on auth collections are hashed here, at the single write
+        // chokepoint, so every caller (HTTP router, dashboard, plugins) stores a
+        // hash rather than a plaintext value. On update, an empty password is
+        // dropped from the patch entirely so an edit form that leaves the field
+        // blank does not overwrite the stored hash.
+        const hashAuthPassword = (collection, data, dropEmpty) => Effect.gen(function* () {
+            if (collection.schema["x-collection-kind"] !== "auth")
+                return data;
+            if (!("password" in data))
+                return data;
+            const raw = data["password"];
+            if (typeof raw !== "string" || raw.length === 0) {
+                if (!dropEmpty)
+                    return data;
+                const withoutPassword = { ...data };
+                delete withoutPassword["password"];
+                return withoutPassword;
+            }
+            const hash = yield* authService.hashPassword(raw);
+            return { ...data, password: hash };
+        });
+        const decoderMap = new Map(allCollections.map((c) => [c.name, makeRowDecoder(c.schema, dialect.storesBooleanAsInteger)]));
+        const encoderMap = new Map(allCollections.map((c) => [c.name, makeRowEncoder(c.schema, dialect.storesBooleanAsInteger)]));
         const inputSchemaMap = new Map(allCollections.map((c) => [c.name, buildInputSchemas(c)]));
         const getInputSchemas = (col) => inputSchemaMap.get(col.name) ?? buildInputSchemas(col);
         const decodeRow = (collection, record) => (decoderMap.get(collection.name) ?? Effect.succeed)(record);
+        const getEncoder = (collection) => encoderMap.get(collection.name) ?? ((r) => r);
+        // create/update return the stored row directly (no `resolveFields` pass), so
+        // hidden fields (auth password, seqId) must be stripped here for non-admin
+        // callers — matching the list/view response contract.
+        const stripHidden = (collection, record, admin) => {
+            if (admin)
+                return record;
+            const out = {};
+            for (const [k, v] of Object.entries(record)) {
+                if (collection.schema.properties[k]?.["x-hidden"] === true)
+                    continue;
+                out[k] = v;
+            }
+            return out;
+        };
+        const isAuthCollection = (collection) => collection.schema["x-collection-kind"] === "auth";
+        const asString = (value) => (typeof value === "string" ? value : undefined);
+        // canManage = admin OR (auth + authenticated + manage rule matches). Evaluated
+        // against the incoming payload for create (emailVerified forced false so the
+        // rule can't be gamed by the field it guards) and against the stored record for
+        // update. Additive: the base create/update rule still gates access — manage only
+        // escalates privileges (email, emailVerified, password without oldPassword).
+        const canManagePayload = (collection, payload, ctx) => Effect.gen(function* () {
+            if (ctx.admin === true)
+                return true;
+            if (!isAuthCollection(collection) || ctx.auth === undefined)
+                return false;
+            const rule = enforcerForAction(collection.schema, "manage");
+            if (rule === null)
+                return false;
+            const resolved = yield* resolveCtxPlaceholders(rule, ctx, collection.name, "manage");
+            const bound = resolveFieldRefs(resolved, { ...payload, emailVerified: false });
+            const where = literal(bound.sql, bound.params);
+            const check = yield* sql `SELECT 1 AS ok WHERE ${where}`;
+            return check.length > 0;
+        });
+        const canManageRecord = (collection, id, ctx) => Effect.gen(function* () {
+            if (ctx.admin === true)
+                return true;
+            if (!isAuthCollection(collection) || ctx.auth === undefined)
+                return false;
+            const rule = enforcerForAction(collection.schema, "manage");
+            if (rule === null)
+                return false;
+            const resolved = yield* resolveCtxPlaceholders(rule, ctx, collection.name, "manage");
+            const allowed = yield* repo.viewFilter(collection.name, {
+                where: andWhere(resolved, idClause(id))
+            });
+            return allowed.length > 0;
+        });
+        const credentialError = (collection, issue) => new ValidationError({ collection: collection.name, issues: [issue] });
+        const verifyOldPassword = (collection, raw, existing) => Effect.gen(function* () {
+            const oldPassword = asString(raw["oldPassword"]);
+            if (oldPassword === undefined || oldPassword.length === 0) {
+                return yield* Effect.fail(credentialError(collection, "oldPassword is required"));
+            }
+            const stored = asString(existing["password"]);
+            const ok = stored !== undefined
+                ? yield* authService.verifyPassword(oldPassword, stored).pipe(Effect.orElseSucceed(() => false))
+                : false;
+            if (!ok) {
+                return yield* Effect.fail(credentialError(collection, "Missing or invalid old password"));
+            }
+        });
+        const enforceCreateCredentials = (collection, raw, cleaned, canManage, ctx) => Effect.gen(function* () {
+            if (!isAuthCollection(collection) || ctx.admin === true)
+                return;
+            const password = asString(cleaned["password"]) ?? asString(raw["password"]) ?? "";
+            if (password.length > 0) {
+                const confirm = asString(raw["passwordConfirm"]);
+                if (confirm === undefined || confirm !== password) {
+                    return yield* Effect.fail(credentialError(collection, "passwordConfirm must match password"));
+                }
+            }
+            if (!canManage && cleaned["emailVerified"] === true) {
+                return yield* Effect.fail(credentialError(collection, "emailVerified cannot be set"));
+            }
+        });
+        const enforceUpdateCredentials = (collection, raw, cleaned, existing, canManage, ctx) => Effect.gen(function* () {
+            if (!isAuthCollection(collection) || ctx.admin === true)
+                return;
+            const newPassword = asString(cleaned["password"]);
+            const passwordChanging = newPassword !== undefined && newPassword.length > 0;
+            const emailChanging = "email" in cleaned && cleaned["email"] !== existing["email"];
+            const verifiedChanging = "emailVerified" in cleaned && Boolean(cleaned["emailVerified"]) !== Boolean(existing["emailVerified"]);
+            if (passwordChanging) {
+                const confirm = asString(raw["passwordConfirm"]);
+                if (confirm === undefined || confirm !== newPassword) {
+                    return yield* Effect.fail(credentialError(collection, "passwordConfirm must match password"));
+                }
+            }
+            if (!canManage && (passwordChanging || emailChanging)) {
+                yield* verifyOldPassword(collection, raw, existing);
+            }
+            if (!canManage && verifiedChanging) {
+                return yield* Effect.fail(credentialError(collection, "emailVerified cannot be changed"));
+            }
+        });
         const list = (collection, cursor, perPage, ctx, filter, sort, select, expand) => Effect.gen(function* () {
-            const ruleWhere = yield* compileRule(collection, "list", ctx);
+            const ruleWhere = ctx.admin ? null : yield* compileRule(collection, "list", ctx);
             const userFilter = filter !== undefined ? yield* filterNodeToWhereClause(filter, collection.schema, collection.name) : null;
-            const where = userFilter !== null ? andWhere(ruleWhere, userFilter) : ruleWhere;
-            const combined = cursor !== null ? andWhere(where, cursorClause(cursor)) : where;
-            const fields = resolveFields(collection.schema, select ?? null);
+            const where = ruleWhere !== null && userFilter !== null ? andWhere(ruleWhere, userFilter) : (userFilter ?? ruleWhere);
+            const combined = cursor !== null && where !== null ? andWhere(where, cursorClause(cursor)) : where;
+            const fields = resolveFields(collection.schema, select ?? null, ctx.admin === true);
             const expandDefs = resolveExpand(collection.schema, expand ?? null, allCollections);
             const fieldsWithExpand = [...new Set([...fields, ...expandDefs.map((e) => e.localField)])];
             // seqId is x-hidden but must be fetched for cursor-based pagination
             const fieldsForQuery = fieldsWithExpand.includes("seqId") ? fieldsWithExpand : [...fieldsWithExpand, "seqId"];
-            const rows = yield* repo.list(collection.name, perPage, {
-                where: combined,
+            const listOpts = {
                 sort: sort ?? { field: "seqId", direction: "asc" },
                 fields: fieldsForQuery,
                 expand: expandDefs
-            });
+            };
+            const rows = yield* repo.list(collection.name, perPage, combined !== null ? { ...listOpts, where: combined } : listOpts);
             const lastRow = rows.items.at(-1);
             const rawSeqId = lastRow?.["seqId"];
             const lastSeqId = typeof rawSeqId === "number" ? rawSeqId : null;
@@ -162,9 +289,9 @@ export function makeCollectionServiceLayer(allCollections) {
             attributes: { collection: collection.name }
         }));
         const view = (collection, id, ctx, select, expand) => Effect.gen(function* () {
-            const ruleWhere = yield* compileRule(collection, "view", ctx);
-            const combined = andWhere(ruleWhere, idClause(id));
-            const fields = resolveFields(collection.schema, select ?? null);
+            const ruleWhere = ctx.admin ? null : yield* compileRule(collection, "view", ctx);
+            const combined = ruleWhere !== null ? andWhere(ruleWhere, idClause(id)) : idClause(id);
+            const fields = resolveFields(collection.schema, select ?? null, ctx.admin === true);
             const expandDefs = resolveExpand(collection.schema, expand ?? null, allCollections);
             const fieldsWithExpand = [...new Set([...fields, ...expandDefs.map((e) => e.localField)])];
             const rows = yield* repo.viewFilter(collection.name, {
@@ -186,17 +313,21 @@ export function makeCollectionServiceLayer(allCollections) {
             }
             yield* rejectSystemFields(data, collection.schema, collection.name);
             const schemas = getInputSchemas(collection);
-            const cleaned = yield* Schema.decodeUnknown(schemas.create)(data).pipe(Effect.mapError(parseErrToValidationError(collection.name)));
-            const ruleWhere = yield* compileRule(collection, "create", ctx);
-            // Pre-check: evaluate the create rule against the payload (no table needed).
-            const payloadBound = resolveFieldRefs(ruleWhere, cleaned);
-            const where = unsafeFragment(payloadBound.sql, payloadBound.params);
-            const check = yield* sql `SELECT 1 AS ok WHERE ${where}`;
-            if (check.length === 0) {
-                return yield* new ForbiddenError({ collection: collection.name, action: "create" });
+            const cleaned = yield* Schema.decodeUnknownEffect(schemas.create)(data).pipe(Effect.mapError(parseErrToValidationError(collection.name)));
+            if (!ctx.admin) {
+                const ruleWhere = yield* compileRule(collection, "create", ctx);
+                // Pre-check: evaluate the create rule against the payload (no table needed).
+                const payloadBound = resolveFieldRefs(ruleWhere, cleaned);
+                const where = literal(payloadBound.sql, payloadBound.params);
+                const check = yield* sql `SELECT 1 AS ok WHERE ${where}`;
+                if (check.length === 0) {
+                    return yield* new ForbiddenError({ collection: collection.name, action: "create" });
+                }
             }
-            const row = yield* repo.create(collection.name, cleaned);
-            return yield* decodeRow(collection, row);
+            const canManage = yield* canManagePayload(collection, cleaned, ctx);
+            yield* enforceCreateCredentials(collection, data, cleaned, canManage, ctx);
+            const row = yield* repo.create(collection.name, getEncoder(collection)(yield* hashAuthPassword(collection, cleaned, false)));
+            return stripHidden(collection, yield* decodeRow(collection, row), ctx.admin === true);
         }).pipe(Effect.withSpan("collection.create", {
             kind: "internal",
             attributes: { collection: collection.name }
@@ -207,28 +338,38 @@ export function makeCollectionServiceLayer(allCollections) {
             }
             yield* rejectSystemFields(data, collection.schema, collection.name);
             const schemas = getInputSchemas(collection);
-            const cleaned = yield* Schema.decodeUnknown(schemas.update)(data).pipe(Effect.mapError(parseErrToValidationError(collection.name)));
-            const ruleWhere = yield* compileRule(collection, "update", ctx);
-            // Existence check first — distinguish NotFound from Forbidden
+            const cleaned = yield* Schema.decodeUnknownEffect(schemas.update)(data).pipe(Effect.mapError(parseErrToValidationError(collection.name)));
+            // If the collection has no rules at all, deny immediately (don't leak existence)
+            if (!ctx.admin) {
+                const enforcerResult = enforcerForAction(collection.schema, "update");
+                if (enforcerResult === null) {
+                    return yield* new ForbiddenError({ collection: collection.name, action: "update" });
+                }
+            }
             const existing = yield* repo.view(collection.name, id);
             if (Option.isNone(existing)) {
                 return yield* new NotFoundError({ collection: collection.name, id });
             }
-            // Rule check against this specific row
-            const combined = andWhere(ruleWhere, idClause(id));
-            const allowed = yield* repo.viewFilter(collection.name, { where: combined });
-            if (allowed.length === 0) {
-                return yield* new ForbiddenError({ collection: collection.name, action: "update" });
+            if (!ctx.admin) {
+                const ruleWhere = yield* compileRule(collection, "update", ctx);
+                // Rule check against this specific row
+                const combined = andWhere(ruleWhere, idClause(id));
+                const allowed = yield* repo.viewFilter(collection.name, { where: combined });
+                if (allowed.length === 0) {
+                    return yield* new ForbiddenError({ collection: collection.name, action: "update" });
+                }
             }
-            const updated = yield* repo.update(collection.name, id, cleaned);
+            const canManage = yield* canManageRecord(collection, id, ctx);
+            yield* enforceUpdateCredentials(collection, data, cleaned, existing.value, canManage, ctx);
+            const updated = yield* repo.update(collection.name, id, getEncoder(collection)(yield* hashAuthPassword(collection, cleaned, true)));
             // Best-effort: delete old files and their thumbnails for any replaced file fields.
             const oldKeys = extractReplacedFileKeys(existing.value, cleaned, collection.schema);
             yield* Effect.forEach(oldKeys, (key) => Effect.gen(function* () {
-                yield* fileStorage.delete(key).pipe(Effect.orElse(() => Effect.void));
+                yield* fileStorage.delete(key).pipe(Effect.catch(() => Effect.void));
                 const thumbKeys = yield* fileStorage.list(`_thumbs/${key}/`).pipe(Effect.orElseSucceed(() => []));
-                yield* Effect.forEach(thumbKeys, (tk) => fileStorage.delete(tk).pipe(Effect.orElse(() => Effect.void)), { concurrency: "unbounded" });
+                yield* Effect.forEach(thumbKeys, (tk) => fileStorage.delete(tk).pipe(Effect.catch(() => Effect.void)), { concurrency: "unbounded" });
             }), { concurrency: "unbounded" });
-            return yield* decodeRow(collection, Option.getOrElse(updated, () => existing.value));
+            return stripHidden(collection, yield* decodeRow(collection, Option.getOrElse(updated, () => existing.value)), ctx.admin === true);
         }).pipe(Effect.withSpan("collection.update", {
             kind: "internal",
             attributes: { collection: collection.name }
@@ -237,23 +378,32 @@ export function makeCollectionServiceLayer(allCollections) {
             if (collection.schema["x-collection-kind"] === "view") {
                 return yield* new ReadOnlyError({ collection: collection.name });
             }
-            const ruleWhere = yield* compileRule(collection, "delete", ctx);
+            // If the collection has no rules at all, deny immediately (don't leak existence)
+            if (!ctx.admin) {
+                const enforcerResult = enforcerForAction(collection.schema, "delete");
+                if (enforcerResult === null) {
+                    return yield* new ForbiddenError({ collection: collection.name, action: "delete" });
+                }
+            }
             const existing = yield* repo.view(collection.name, id);
             if (Option.isNone(existing)) {
                 return yield* new NotFoundError({ collection: collection.name, id });
             }
-            const combined = andWhere(ruleWhere, idClause(id));
-            const allowed = yield* repo.viewFilter(collection.name, { where: combined });
-            if (allowed.length === 0) {
-                return yield* new ForbiddenError({ collection: collection.name, action: "delete" });
+            if (!ctx.admin) {
+                const ruleWhere = yield* compileRule(collection, "delete", ctx);
+                const combined = andWhere(ruleWhere, idClause(id));
+                const allowed = yield* repo.viewFilter(collection.name, { where: combined });
+                if (allowed.length === 0) {
+                    return yield* new ForbiddenError({ collection: collection.name, action: "delete" });
+                }
             }
             yield* repo.delete(collection.name, id);
             // Best-effort: delete files and their thumbnails after the record is gone.
             const keys = extractFileKeys(existing.value, collection.schema);
             yield* Effect.forEach(keys, (key) => Effect.gen(function* () {
-                yield* fileStorage.delete(key).pipe(Effect.orElse(() => Effect.void));
+                yield* fileStorage.delete(key).pipe(Effect.catch(() => Effect.void));
                 const thumbKeys = yield* fileStorage.list(`_thumbs/${key}/`).pipe(Effect.orElseSucceed(() => []));
-                yield* Effect.forEach(thumbKeys, (tk) => fileStorage.delete(tk).pipe(Effect.orElse(() => Effect.void)), { concurrency: "unbounded" });
+                yield* Effect.forEach(thumbKeys, (tk) => fileStorage.delete(tk).pipe(Effect.catch(() => Effect.void)), { concurrency: "unbounded" });
             }), { concurrency: "unbounded" });
         }).pipe(Effect.withSpan("collection.delete", {
             kind: "internal",