feat(effect-app,infra): run jitM at the store boundary as JSON → JSON

[patroza]

Supersedes #894 and #895 — both will be closed. This is the same design rebuilt directly on main, with nothing lenient.

The bug

Since #874 ("native Date/Map/Set Encoded"), the document stores decode every stored document with the full schema at the store boundary, and the repository applied jitM (mapFrom) only afterwards. So a legacy document that jitM exists to migrate could not be read at all:

SchemaError: Missing key
  at ["vatRate"]

on every find / filter / all / validateSample. Found via macs-holding/configurator, where all 7 DB Validation jobs fail against real production data: Shop.vatRate missing on every shop, User.permissions on most users, Configurator.conditionGroups[].conditions[].rules[].groupId on legacy rules. Read-only prod inspection confirmed these are genuinely missing keys — there are no nulls involved.

jitM was also mistyped: (pm: Encoded) => Encoded promised native Date/Map/Set, while every jitM is written against the document as stored.

The pipeline

store: raw JSON -> merge defaultValues -> jitM (JSON -> JSON) -> decode toCodecJson(toEncoded(schema)) => Encoded
repo:  Encoded -> decode schema => domain type

// effect-app/Store
export type JsonRecord = { readonly [key: string]: Schema.Json }
interface StoreConfig<E> {
  defaultValues?: Partial<E>               // unchanged: Encoded, lowered by the adapters
  jitM?: (json: JsonRecord) => JsonRecord  // new
}
// effect-app/Model/Repository — RepositoryOptions
jitM?: (json: JsonRecord) => JsonRecord    // was (pm: Encoded) => Encoded

makeRepo forwards jitM into the store config; makeRepoInternal loses its mapFrom parameter and mapReverse only splits _etag; validateSample decodes the store's output directly. New infra helper makeStoredDecode(codec, jitM) holds the read boundary in one place, splitting _etag off first so jitM never sees infrastructure metadata. Wired in Cosmos, SQL, Pg, Memory and Disk (Disk at the file-read boundary, exactly once, since jitMs are not guaranteed idempotent). Never on the write path.

Everything stays strict. makeJsonDocumentCodec is unchanged from main in both directions, and packages/infra/src/Store/utils.ts is byte-identical to main. A document jitM does not repair fails loudly — pinned by a test, with a comment telling future readers not to "fix" it into a lenient decode.

defaultValues keep their Partial<Encoded> type and their existing lowering via json.toJson(...); they still fill only absent keys, so an explicitly stored null reaches jitM — which is the point: null is a value, not a missing key, and only jitM can decide what to do with it.

Breaking changes for consumers

1. jitM is (json: JsonRecord) => JsonRecord, no longer generic over Encoded.
2. Values arrive as JSON: Date → ISO string, ReadonlySet → array, ReadonlyMap → array of [k, v] pairs. Returning a Date/Map/Set is now wrong.
3. Index-signature access (json["x"]); "x" in json still works.
4. _etag is not part of the document passed to jitM.
5. ValidationError.jitMResult is @deprecated and equals rawData — the repository can no longer observe a pre-jitM document. Kept rather than removed to avoid breaking consumers; happy to delete it instead.

// add a missing key — before → after
jitM: (pm: typeof Shop.Encoded) => "vatRate" in pm ? pm : { ...pm, vatRate: 19 }
jitM: (json) => "vatRate" in json ? json : { ...json, vatRate: 19 }

// a Date field — before → after (ISO strings both sides; fresh: new Date().toISOString())
jitM: (pm) => pm.updatedAt ? pm : { ...pm, updatedAt: pm.createdAt }
jitM: (json) => json["updatedAt"] ? json : { ...json, updatedAt: json["createdAt"] }

Verification

• Root pnpm check (tsgo): clean, no casts added to paper over the mapFrom removal.
• packages/infra: 282 passed / 26 skipped. packages/effect-app: 185 passed. Lint clean.
• 15 tests across repository-legacy-document.test.ts (new) and validateSample.test.ts: missing-key repair through find/all/validateSample; explicit null repair; jitM sees JSON (ISO string, Set-as-array, Map-as-pairs, no _etag); defaultValues fill only absent keys with a stored null reaching jitM; an unrepaired document failing loudly; _etag invisible to jitM and preserved.

Notes

• MemoryStoreLive cannot seed a legacy-shaped document (its seed path strictly encodes the whole document), so the legacy-document test uses a schemaless Memory harness with the real read boundary on top. Worth deciding separately whether writes should fail loudly or lower leniently.
• Projections/select and Cosmos queryRaw bypass the document decode and therefore do not run jitM. Pre-existing, unchanged.
• defaultValues on read remain inconsistent across adapters (Cosmos/SQL merge on every read; Memory at seed time; Disk before its inner store). Left alone deliberately.
• A strict store decode surfaces as a defect, because makeJsonDocumentCodec.decode is sync and throws. Turning that into a typed SchemaError failure needs the read paths effectified (Store.find/all/filter channels widened, per-document decode returning Result, adapters' maps lifted) — planned as a separate PR.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[pkg-pr-new]

Open in StackBlitz

@effect-app/cli

npm i https://pkg.pr.new/effect-app/libs/@effect-app/cli@896

effect-app

npm i https://pkg.pr.new/effect-app/libs/effect-app@896

@effect-app/eslint-codegen-model

npm i https://pkg.pr.new/effect-app/libs/@effect-app/eslint-codegen-model@896

@effect-app/eslint-shared-config

npm i https://pkg.pr.new/effect-app/libs/@effect-app/eslint-shared-config@896

@effect-app/infra

npm i https://pkg.pr.new/effect-app/libs/@effect-app/infra@896

@effect-app/vue

npm i https://pkg.pr.new/effect-app/libs/@effect-app/vue@896

@effect-app/vue-components

npm i https://pkg.pr.new/effect-app/libs/@effect-app/vue-components@896

commit: 74b3133