[tim-smart]

GraphQLResolver ran every batch with the first lookup's context. A middleware that reads a per-call service, such as a CurrentUser token, sent the whole batch under the first user's credentials, so lookups from two tenants in one batch leaked across.

ordered and findById now take a batchKey: (context: Context<GraphQL.Services<Op>>) => unknown. It's required when GraphQL.Services<Op> isn't never and rejected when it is. When given, the resolver is built with RequestResolver.makeGrouped, so each batch holds lookups with keys that are equal under Equal, and the first entry's context is correct for the whole batch. Without services, there's still one global batch.

The JSDoc explains why you shouldn't key on the whole context (it holds the caller's span). It also notes the hole that's left: a middleware reading a Context.Reference with a default value doesn't show up in Services. The generator README batching section, ai-docs/src/52_graphql/30_batching.ts and the graphql-client changeset are updated.

Dependency

Builds on #9041 ("Fix grouped RequestResolver batch key retention"), which feat/graphql now includes. Without it, makeGrouped would keep every per-tenant key forever.

Tests

• Runtime: lookups for tenants a, b, a make two calls, Bearer a with R_1 and R_3, and Bearer b with R_2.
• Types: with middleware requires, ordered and findById without batchKey don't compile. Without services, batchKey isn't accepted.

Validation

pnpm check, pnpm lint, pnpm jsdocs --check, pnpm test --run for packages/effect/test/graphql/, packages/effect/test/RequestResolver.test.ts and packages/tools/graphql-generator/test/, pnpm test-types graphql, and pnpm doctest --run for GraphQLResolver.ts and RequestResolver.ts all pass.

Closes EFF-2004

[changeset-bot]

⚠️ No Changeset found

Latest commit: cdeabd2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes changesets to release 33 packages

Name	Type
effect	Patch
@effect/opentelemetry	Patch
@effect/vitest	Patch
@effect/ai-anthropic	Patch
@effect/ai-cloudflare	Patch
@effect/ai-openai-compat	Patch
@effect/ai-openai	Patch
@effect/ai-openrouter	Patch
@effect/ai-typesafe	Patch
@effect/atom-react	Patch
@effect/atom-solid	Patch
@effect/atom-vue	Patch
@effect/platform-browser	Patch
@effect/platform-bun	Patch
@effect/platform-deno	Patch
@effect/platform-node-shared	Patch
@effect/platform-node	Patch
@effect/sql-clickhouse	Patch
@effect/sql-d1	Patch
@effect/sql-libsql	Patch
@effect/sql-mssql	Patch
@effect/sql-mysql2	Patch
@effect/sql-pg	Patch
@effect/sql-pglite	Patch
@effect/sql-sqlite-bun	Patch
@effect/sql-sqlite-do	Patch
@effect/sql-sqlite-node	Patch
@effect/sql-sqlite-react-native	Patch
@effect/sql-sqlite-wasm	Patch
@effect/docgen	Patch
@effect/doctest	Patch
@effect/graphql-generator	Patch
@effect/openapi-generator	Patch

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR