@cosmicdrift/kumiko-framework 0.328.0 → 0.329.0

package/src/pipeline/dispatcher-utils.ts

@@ -1,199 +0,0 @@
-import { parseQn, qn } from "../engine/qualified-name";
-import type {
-  HandlerRef,
-  LifecycleResult,
-  Registry,
-  SessionUser,
-  WriteResult,
-} from "../engine/types";
-import {
-  type FieldIssue,
-  type KumikoError,
-  toKumikoError,
-  VersionConflictError,
-  type WriteErrorInfo,
-} from "../errors";
-import { VersionConflictError as EventStoreVersionConflictError } from "../event-store/errors";
-
-export type FailedWriteResult = Extract<WriteResult, { isSuccess: false }>;
-
-export function isFailedWriteResult(result: unknown): result is FailedWriteResult {
-  return (
-    !!result && typeof result === "object" && "isSuccess" in result && result.isSuccess === false
-  );
-}
-
-export function isLifecycleResult(data: unknown): data is LifecycleResult {
-  return !!data && typeof data === "object" && "kind" in data;
-}
-
-export function isWriteResultShape(result: unknown): boolean {
-  return (
-    !!result &&
-    typeof result === "object" &&
-    "isSuccess" in result &&
-    typeof result.isSuccess === "boolean"
-  );
-}
-
-export function describeShape(result: unknown): string {
-  if (result === null) return "null";
-  if (result === undefined) return "undefined";
-  if (typeof result !== "object") return typeof result;
-  return `object with keys [${Object.keys(result).slice(0, 6).join(", ")}]`;
-}
-
-export function dispatcherSpanAttributes(
-  type: string,
-  operation: "query" | "write" | "stream",
-  user: SessionUser,
-  feature: string | undefined,
-) {
-  const attrs: Record<string, string | number | boolean> = {
-    "kumiko.handler": type,
-    "kumiko.operation": operation,
-    "kumiko.user_id": user.id,
-    "kumiko.tenant_id": user.tenantId,
-  };
-  if (feature) attrs["kumiko.feature"] = feature;
-  if (user.origin) attrs["kumiko.user_origin"] = user.origin;
-  return attrs;
-}
-
-export type AfterCommitHook = () => Promise<void>;
-
-export type NestedSpec = {
-  readonly key: string;
-  readonly subType: string;
-  readonly foreignKey: string;
-  readonly items: readonly unknown[];
-};
-
-export type NestedTypeIssue = {
-  readonly path: string;
-  readonly code: string;
-  readonly i18nKey: string;
-};
-
-export function extractNestedSpecs(
-  parentType: string,
-  payload: unknown,
-  registry: Registry,
-): {
-  cleanPayload: Record<string, unknown>;
-  specs: readonly NestedSpec[];
-  typeIssues: readonly NestedTypeIssue[];
-} | null {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
-
-  let parsed: ReturnType<typeof parseQn>;
-  try {
-    parsed = parseQn(parentType);
-  } catch {
-    return null;
-  }
-  // v1 scope: only create. Update/delete-nested are explicit future work —
-  // they'd need different sub-types and id-handling semantics.
-  if (!parsed.name.endsWith(":create")) return null;
-
-  const entityName = registry.getHandlerEntity(parentType);
-  if (!entityName) return null;
-
-  const relations = registry.getRelations(entityName);
-  const source = payload as Record<string, unknown>; // @cast-boundary engine-payload — generic dispatch über alle Entity-Types
-  const clean: Record<string, unknown> = { ...source };
-  const specs: NestedSpec[] = [];
-  const typeIssues: NestedTypeIssue[] = [];
-
-  for (const [relKey, rel] of Object.entries(relations)) {
-    if (rel.type !== "hasMany" || !rel.nestedWrite) continue;
-    if (!(relKey in source)) continue;
-    const value = source[relKey];
-
-    // Non-array under a nested-write key is a client shape error. Silent
-    // strip (via default zod stripping) would hide it — a client sending
-    // `tasks: "bogus"` or `tasks: null` has to know the field was ignored,
-    // or they'll wonder why their data never showed up. Fail loud.
-    if (!Array.isArray(value)) {
-      typeIssues.push({
-        path: relKey,
-        code: "invalid_type",
-        i18nKey: "errors.validation.invalid_type",
-      });
-      // Still strip from clean payload — we're not letting the parent handler
-      // see a malformed value either.
-      delete clean[relKey];
-      continue;
-    }
-
-    // Strip the relation key from the clean payload — the parent handler
-    // only sees columns it actually owns.
-    delete clean[relKey];
-
-    // Sub-type composition: derive scope + operation from the parent qn,
-    // swap the entity segment. "feat:write:project:create" → "feat:write:task:create".
-    // Assumes target entity has a `:create` handler in the SAME feature scope
-    // as the parent. Cross-feature nested-writes are out of scope for v1;
-    // when needed, the registry would have to carry a back-pointer from
-    // entity → defining feature.
-    const subType = qn(parsed.scope, parsed.type, `${rel.target}:create`);
-
-    specs.push({
-      key: relKey,
-      subType,
-      foreignKey: rel.foreignKey,
-      items: value,
-    });
-  }
-
-  if (specs.length === 0 && typeIssues.length === 0) return null;
-  return { cleanPayload: clean, specs, typeIssues };
-}
-
-export function prefixValidationPath(info: WriteErrorInfo, prefix: string): WriteErrorInfo {
-  if (info.code !== "validation_error") return info;
-  const details = info.details as // @cast-boundary error-details
-    | {
-        fields?: readonly FieldIssue[];
-      }
-    | undefined;
-  const fields = details?.fields;
-  if (!fields) return info;
-  return {
-    ...info,
-    details: {
-      ...details,
-      fields: fields.map((f) => ({ ...f, path: `${prefix}.${f.path}` })),
-    },
-  };
-}
-
-export class BatchRollback extends Error {
-  constructor(
-    readonly failedIndex: number,
-    readonly failureError: WriteErrorInfo,
-  ) {
-    super(`batch rollback at command ${failedIndex}: ${failureError.code}`);
-    this.name = "BatchRollback";
-  }
-}
-
-export type HandlerType = string | HandlerRef;
-
-export function resolveType(type: HandlerType): string {
-  return typeof type === "string" ? type : type.name;
-}
-
-// A custom write losing an append race (ctx.appendEvent, stream.append) is a
-// retryable 409 like the CRUD executor's, not an internal error. Mapped here
-// because errors/ is client code and must not import the event store.
-// currentVersion -1 is the executor's "not looked up" sentinel.
-export function wrapToKumiko(e: unknown): KumikoError {
-  if (e instanceof EventStoreVersionConflictError) {
-    return new VersionConflictError(
-      { entityId: e.aggregateId, expectedVersion: e.expectedVersion, currentVersion: -1 },
-      { cause: e },
-    );
-  }
-  return toKumikoError(e);
-}

package/src/pipeline/dispatcher.ts

@@ -1,278 +0,0 @@
-import type { WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
-import { runWithWriteOrigin } from "../api/request-context";
-import type { SseBroker } from "../api/sse-broker";
-import type { buildEntityTable } from "../db/table-builder";
-import {
-  DEPRECATED_CROSS_TENANT_SIGNAL,
-  isDeprecatedCrossTenantHandler,
-} from "../engine/entity-handlers";
-import { TENANT_MEMBERSHIPS_QUERY } from "../engine/extension-names";
-import type { defineTransitions } from "../engine/state-machine";
-import type { EffectiveFeaturesResolver } from "../engine/tier-resolver-extension";
-import type {
-  ActiveMembershipResult,
-  AppContext,
-  DispatchWriteRef,
-  JobRunnerRef,
-  MemberReader,
-  Registry,
-  SessionUser,
-  WriteResult,
-} from "../engine/types";
-import type { TenantId } from "../engine/types/identifiers";
-import { InternalError, reraiseAsKumikoError } from "../errors";
-import { getFallbackMeter, getFallbackTracer, registerStandardMetrics } from "../observability";
-import { createEscapeHatchReportWindow } from "../observability/escape-hatch-report";
-import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership";
-import { runBatch, unwrapSingle } from "./dispatch-batch";
-import { executeQuery } from "./dispatch-query";
-import type { BatchCommand, BatchResult, DispatchContext } from "./dispatch-shared";
-import { resolveAuthClaimsFn } from "./dispatch-shared";
-import { executeStream } from "./dispatch-stream";
-import { type HandlerType, resolveType } from "./dispatcher-utils";
-import type { IdempotencyGuard } from "./idempotency";
-import type { LifecycleHooks } from "./lifecycle-pipeline";
-import { createMemberReaderFn } from "./member-reader";
-import { createTenantTimezoneCache } from "./tenant-timezone-cache";
-import { effectiveWriteOrigin, isPersonalDataGated, rootWriteOrigin } from "./write-origin";
-
-// Re-export for callers that reach for dispatcher-adjacent types (tests,
-// HTTP-layer stubs) — dispatch consumes these, grouping the type-surface
-// here keeps imports single-source.
-export type { WriteResult } from "../engine/types";
-export type { BatchCommand, BatchResult } from "./dispatch-shared";
-
-export type DispatcherOptions = {
-  idempotency?: IdempotencyGuard;
-  lifecycle?: LifecycleHooks;
-  jobRunner?: JobRunnerRef;
-  // Qualified name of the membership-list query handler consulted by
-  // dispatcher.resolveActiveMembership. Defaults to TENANT_MEMBERSHIPS_QUERY.
-  membershipQuery?: string;
-  // Resolves the effective-feature set per tenant — the dispatcher uses
-  // it to gate calls to handlers of disabled features (403 feature_disabled)
-  // and to populate ctx.hasFeature. Absent = all features treated as
-  // always-on (no feature-toggles or tier-engine feature loaded). The
-  // resolver must be fast and synchronous per call; implementations cache
-  // tenant-keyed sets and refresh on tier-assignment / toggle events.
-  //
-  // **System-context convention:** when called with SYSTEM_TENANT_ID, the
-  // resolver should return the union/superset of all tier-features. Two
-  // contexts call with this sentinel:
-  //   1. event-dispatcher async-pass (consumers tagged with feature X
-  //      should not silently skip events from a tenant where X is off —
-  //      events are immutable, async work runs through).
-  //   2. operator-tooling queries (e.g. feature-toggles:registered) where
-  //      a SystemAdmin needs to see platform-truth, not their own
-  //      tier-cut.
-  // Returning a non-superset for SYSTEM_TENANT_ID will cause silent
-  // event-skips and a confusing operator-UI — the framework cannot
-  // enforce this contract, but the recipe-test pins the convention.
-  effectiveFeatures?: EffectiveFeaturesResolver;
-  // In-memory SSE broker — dispatch-stream.ts subscribes to a stream's
-  // user-scoped access-invalidation channel on it. Absent in setups without
-  // SSE wired up (dispatch-stream then just skips the subscription).
-  sseBroker?: SseBroker;
-};
-
-export type Dispatcher = {
-  write(
-    type: HandlerType,
-    payload: unknown,
-    user: SessionUser,
-    requestId?: string,
-  ): Promise<WriteResult>;
-  query(type: HandlerType, payload: unknown, user: SessionUser): Promise<unknown>;
-  // AsyncGenerator, not Promise — gates (feature/rate-limit/access/
-  // validation) fire on the consumer's first `.next()` pull, not on this
-  // call, since they live inside the underlying async function*.
-  stream(type: HandlerType, payload: unknown, user: SessionUser): AsyncGenerator<unknown>;
-  command(type: HandlerType, payload: unknown, user: SessionUser): Promise<void>;
-  // Atomic multi-command write: all commands run in a single DB transaction.
-  // On any failure, the transaction rolls back and afterCommit hooks do NOT fire.
-  // On success, afterCommit hooks of every command are fired sequentially after commit.
-  //
-  // requestId enables idempotent retries (for the Savable-Dispatcher): a repeated
-  // batch with the same requestId returns the cached result without re-executing.
-  batch(
-    commands: readonly BatchCommand[],
-    user: SessionUser,
-    requestId?: string,
-  ): Promise<BatchResult>;
-  // Run every registered r.authClaims() hook against `user` and merge their
-  // returns under the "<featureName>:<key>" auto-prefix. Used at login and
-  // switch-tenant to populate SessionUser.claims before signing the JWT.
-  // This is the single resolve implementation — ctx.resolveAuthClaims is a
-  // thin pass-through so both entry points can't drift.
-  resolveAuthClaims(user: SessionUser): Promise<Record<string, unknown>>;
-  // Membership check for interactive sign-in paths (login, MFA completion,
-  // tenant switch) — single resolve implementation so callers can't independently drift.
-  resolveActiveMembership(userId: string, tenantId: TenantId): Promise<ActiveMembershipResult>;
-  // Trusted server surface, ungated like resolveActiveMembership.
-  // Handler/hook ctx.queryAsMember uses buildHandlerContext's own gated reader instead.
-  createMemberReader(tenantId: TenantId): MemberReader;
-};
-
-// Kept off the public Dispatcher type: only a job may pass an inherited origin.
-type DispatcherInternals = {
-  writeWithOrigin: (
-    type: string,
-    payload: unknown,
-    user: SessionUser,
-    inheritedOrigin: WriteOrigin,
-  ) => Promise<WriteResult>;
-  queryWithOrigin: (
-    type: string,
-    payload: unknown,
-    user: SessionUser,
-    inheritedOrigin: WriteOrigin,
-  ) => Promise<unknown>;
-};
-
-const dispatcherInternals = new WeakMap<Dispatcher, DispatcherInternals>();
-
-// Adapts Dispatcher's (type, payload, user) call shape to DispatchWriteRef's
-// (user, qn, payload) — JobRunner.attachDispatcher needs the latter.
-export function dispatcherToWriteRef(dispatcher: Dispatcher): DispatchWriteRef {
-  const internals = dispatcherInternals.get(dispatcher);
-  return {
-    write: (user, qn, payload, inheritedOrigin) => {
-      if (inheritedOrigin && isPersonalDataGated(inheritedOrigin)) {
-        if (!internals) {
-          throw new InternalError({
-            message:
-              `JobContext.write("${qn}") carries a gated origin but this dispatcher has no ` +
-              "registered origin-aware internals — refusing to fall open to the ungated path.",
-          });
-        }
-        return internals.writeWithOrigin(qn, payload, user, inheritedOrigin);
-      }
-      return dispatcher.write(qn, payload, user);
-    },
-    queryAs: (user, qn, payload, inheritedOrigin) => {
-      if (inheritedOrigin && isPersonalDataGated(inheritedOrigin)) {
-        if (!internals) {
-          throw new InternalError({
-            message:
-              `JobContext.queryAs("${qn}") carries a gated origin but this dispatcher has no ` +
-              "registered origin-aware internals — refusing to fall open to the ungated path.",
-          });
-        }
-        return internals.queryWithOrigin(qn, payload, user, inheritedOrigin);
-      }
-      return dispatcher.query(qn, payload, user);
-    },
-    createMemberReader: (tenantId) => dispatcher.createMemberReader(tenantId),
-  };
-}
-
-export function createDispatcher(
-  registry: Registry,
-  context: AppContext,
-  options: DispatcherOptions = {},
-): Dispatcher {
-  const { idempotency, lifecycle, jobRunner, effectiveFeatures, sseBroker } = options;
-  const membershipQuery = options.membershipQuery ?? TENANT_MEMBERSHIPS_QUERY;
-
-  // Pre-build tables and transition maps for auto-guard (avoid per-request allocation)
-  const tableCache = new Map<string, ReturnType<typeof buildEntityTable>>();
-  const transitionCache = new Map<string, ReturnType<typeof defineTransitions>>();
-  // One per dispatcher instance (not a module-level singleton) so caches
-  // never leak across separately-booted apps or test stacks.
-  const tenantTimezoneCache = createTenantTimezoneCache();
-  const escapeHatchReportWindow = createEscapeHatchReportWindow();
-
-  const dispatcherTracer = context.tracer ?? getFallbackTracer();
-  const dispatcherMeter = context.meter ?? getFallbackMeter();
-  // Ensure standard metrics exist on whatever meter we ended up with.
-  // Idempotent: buildServer may have registered them already.
-  registerStandardMetrics(dispatcherMeter);
-
-  for (const def of [
-    ...registry.getAllWriteHandlers().values(),
-    ...registry.getAllQueryHandlers().values(),
-  ]) {
-    if (isDeprecatedCrossTenantHandler(def.handler)) {
-      context.log?.warn(DEPRECATED_CROSS_TENANT_SIGNAL, {
-        handler: def.name,
-        migration:
-          'replace crossTenant: true with escapeHatch: { reason: "<why this operator handler reads/writes every tenant>" } (bun scripts/codemod/migrate-cross-tenant.ts)',
-      });
-    }
-  }
-
-  const ctx: DispatchContext = {
-    registry,
-    appContext: context,
-    idempotency,
-    lifecycle,
-    jobRunner,
-    effectiveFeatures,
-    sseBroker,
-    tableCache,
-    transitionCache,
-    tenantTimezoneCache,
-    escapeHatchReportWindow,
-    tracer: dispatcherTracer,
-    meter: dispatcherMeter,
-    membershipQuery,
-  };
-
-  const dispatcher: Dispatcher = {
-    async write(typeOrRef, payload, user, requestId?) {
-      const type = resolveType(typeOrRef);
-      // Idempotency handled inside runBatch (caches BatchResult under requestId).
-      const batchResult = await runBatch(ctx, [{ type, payload }], user, requestId);
-      return unwrapSingle(batchResult);
-    },
-
-    batch: (commands, user, requestId?) => runBatch(ctx, commands, user, requestId),
-
-    query: (typeOrRef, payload, user) => {
-      const type = resolveType(typeOrRef);
-      const origin = rootWriteOrigin(registry, type, user);
-      return runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin));
-    },
-
-    stream: (typeOrRef, payload, user) => {
-      const type = resolveType(typeOrRef);
-      return executeStream(ctx, type, payload, user, rootWriteOrigin(registry, type, user));
-    },
-
-    async command(typeOrRef, payload, user) {
-      const type = resolveType(typeOrRef);
-      const batchResult = await runBatch(ctx, [{ type, payload }], user);
-      const result = unwrapSingle(batchResult);
-
-      if (!result.isSuccess) {
-        throw reraiseAsKumikoError(result.error);
-      }
-    },
-
-    resolveAuthClaims: (user) => resolveAuthClaimsFn(ctx, user),
-
-    resolveActiveMembership: (userId, tenantId) =>
-      resolveActiveMembershipFn(ctx, userId, tenantId, INTERACTIVE_SIGN_IN_POLICY),
-
-    createMemberReader: (tenantId) => createMemberReaderFn(ctx, tenantId),
-  };
-
-  dispatcherInternals.set(dispatcher, {
-    writeWithOrigin: async (type, payload, user, inheritedOrigin) => {
-      const batchResult = await runBatch(
-        ctx,
-        [{ type, payload }],
-        user,
-        undefined,
-        inheritedOrigin,
-      );
-      return unwrapSingle(batchResult);
-    },
-    queryWithOrigin: (type, payload, user, inheritedOrigin) => {
-      const origin = effectiveWriteOrigin(rootWriteOrigin(registry, type, user), inheritedOrigin);
-      return runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin));
-    },
-  });
-
-  return dispatcher;
-}

package/src/pipeline/distributed-lock.ts

@@ -1,66 +0,0 @@
-import type Redis from "ioredis";
-import { generateId } from "../utils";
-import { RedisKeys } from "./redis-keys";
-
-export type DistributedLock = {
-  acquire(key: string, options?: { ttlSeconds?: number }): Promise<string | null>;
-  release(key: string, token: string): Promise<boolean>;
-  /** Extends the TTL of a lock this caller still holds (token matches).
-   *  Returns false when the token doesn't match — expired and re-claimed
-   *  by someone else, or never held — the caller must treat that as
-   *  "no longer the owner" and stop renewing, not retry. */
-  renew(key: string, token: string, ttlSeconds: number): Promise<boolean>;
-};
-
-export function createDistributedLock(
-  redis: Redis,
-  prefix: string = RedisKeys.lock,
-): DistributedLock {
-  // Lua script for atomic check-and-delete (safe Redis server-side eval, not JS eval)
-  const releaseScript = `
-    if redis.call("get", KEYS[1]) == ARGV[1] then
-      return redis.call("del", KEYS[1])
-    else
-      return 0
-    end
-  `;
-
-  // Lua script for atomic check-and-extend — same ownership check as release,
-  // but resets the TTL instead of deleting the key.
-  const renewScript = `
-    if redis.call("get", KEYS[1]) == ARGV[1] then
-      return redis.call("expire", KEYS[1], ARGV[2])
-    else
-      return 0
-    end
-  `;
-
-  return {
-    async acquire(key, options = {}) {
-      const ttl = options.ttlSeconds ?? 30;
-      const token = generateId();
-      const result = await redis.set(`${prefix}${key}`, token, "EX", ttl, "NX");
-      return result === "OK" ? token : null;
-    },
-
-    async release(key, token) {
-      // Atomic: only release if we own the lock (compare token via Lua)
-      const result = (await redis.eval(releaseScript, 1, `${prefix}${key}`, token)) as number; // @cast-boundary db-operator
-      return result === 1;
-    },
-
-    async renew(key, token, ttlSeconds) {
-      // EXPIRE with 0/negative deletes the key but still returns 1 — reject
-      // before we claim ownership while releasing the lock.
-      if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1) return false;
-      const result = (await redis.eval(
-        renewScript,
-        1,
-        `${prefix}${key}`,
-        token,
-        String(ttlSeconds),
-      )) as number; // @cast-boundary db-operator
-      return result === 1;
-    },
-  };
-}

package/src/pipeline/entity-cache.ts

@@ -1,82 +0,0 @@
-import type { EntityCache } from "@cosmicdrift/kumiko-types/entity-cache";
-import type Redis from "ioredis";
-import type { EntityId, TenantId } from "../engine/types/identifiers";
-import { RedisKeys } from "./redis-keys";
-
-// JSON.stringify turns Date into an ISO string, but DB reads return Date
-// objects. Without a reviver the cache path would yield strings where the
-// DB path yields Dates — consumers would silently see a type mismatch.
-const ISO_DATE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})$/;
-
-function dateReviver(_key: string, value: unknown): unknown {
-  if (typeof value === "string" && ISO_DATE.test(value)) {
-    const d = new Date(value);
-    if (!Number.isNaN(d.getTime())) return d;
-  }
-  return value;
-}
-
-function parseCached(raw: string): Record<string, unknown> | null {
-  try {
-    return JSON.parse(raw, dateReviver) as Record<string, unknown> | null; // @cast-boundary engine-payload
-  } catch {
-    return null;
-  }
-}
-
-export type { EntityCache } from "@cosmicdrift/kumiko-types/entity-cache";
-
-export type EntityCacheOptions = {
-  ttlSeconds?: number;
-};
-
-export function createEntityCache(redis: Redis, options: EntityCacheOptions = {}): EntityCache {
-  const ttl = options.ttlSeconds ?? 300;
-  const prefix = RedisKeys.entityCache;
-
-  function cacheKey(tenantId: TenantId, entityName: string, id: EntityId): string {
-    return `${prefix}${tenantId}:${entityName}:${id}`;
-  }
-
-  return {
-    async get(tenantId, entityName, id) {
-      const raw = await redis.get(cacheKey(tenantId, entityName, id));
-      if (!raw) return null;
-      return parseCached(raw);
-    },
-
-    async mget(tenantId, entityName, ids) {
-      if (ids.length === 0) return new Map();
-      const keys = ids.map((id) => cacheKey(tenantId, entityName, id));
-      const values = await redis.mget(...keys);
-
-      const result = new Map<EntityId, Record<string, unknown>>();
-      for (let i = 0; i < ids.length; i++) {
-        const raw = values[i];
-        if (raw) {
-          const parsed = parseCached(raw);
-          if (parsed) result.set(ids[i] as EntityId, parsed); // @cast-boundary engine-payload
-        }
-      }
-      return result;
-    },
-
-    async set(tenantId, entityName, id, data) {
-      await redis.set(cacheKey(tenantId, entityName, id), JSON.stringify(data), "EX", ttl);
-    },
-
-    async mset(tenantId, entityName, entries) {
-      // skip: empty batch, nothing to cache
-      if (entries.length === 0) return;
-      const pipe = redis.pipeline();
-      for (const entry of entries) {
-        pipe.set(cacheKey(tenantId, entityName, entry.id), JSON.stringify(entry.data), "EX", ttl);
-      }
-      await pipe.exec();
-    },
-
-    async del(tenantId, entityName, id) {
-      await redis.del(cacheKey(tenantId, entityName, id));
-    },
-  };
-}