@entifix/redis 0.1.0-0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 r10c Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/adapters/redis-lock-service.d.ts

@@ -0,0 +1,17 @@
+import { type LockService, LockServiceTag } from '@entifix/transactions';
+import { Layer } from 'effect';
+import type { Redis } from 'ioredis';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/** How long a held lock survives without renewal — bounds a crashed holder. */
+export declare const LOCK_TTL_MS = 5000;
+/** Bounded retry budget so contention fails fast rather than hanging. */
+export declare const LOCK_RETRIES = 20;
+export declare const LOCK_RETRY_DELAY_MS = 100;
+/**
+ * Redis-backed {@link LockService}: `SET key token NX PX ttl` with bounded
+ * retry. The `NX` flag makes acquisition atomic across instances.
+ */
+export declare const makeRedisLockService: (redis: Redis) => LockService;
+/** Provides {@link LockServiceTag} from a {@link RedisTag} connection. */
+export declare const RedisLockServiceLayer: Layer.Layer<LockServiceTag, never, RedisTag>;
+//# sourceMappingURL=redis-lock-service.d.ts.map

package/dist/adapters/redis-lock-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-lock-service.d.ts","sourceRoot":"","sources":["../../src/adapters/redis-lock-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAoB,KAAK,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AAEnE,+EAA+E;AAC/E,eAAO,MAAM,WAAW,OAAQ,CAAC;AACjC,yEAAyE;AACzE,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,mBAAmB,MAAM,CAAC;AASvC;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,KAAK,KAAG,WA8BlD,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,8CAGjC,CAAC"}

package/dist/adapters/redis-lock-service.js

@@ -0,0 +1,48 @@
+import { randomUUID } from 'node:crypto';
+import { EntifixConnError, EntifixLockError } from '@entifix/core';
+import { LockServiceTag } from '@entifix/transactions';
+import { Duration, Effect, Layer } from 'effect';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/** How long a held lock survives without renewal — bounds a crashed holder. */ export const LOCK_TTL_MS = 5000;
+/** Bounded retry budget so contention fails fast rather than hanging. */ export const LOCK_RETRIES = 20;
+export const LOCK_RETRY_DELAY_MS = 100;
+/**
+ * Compare-and-delete so a release only frees the caller's own lock — never one
+ * a later holder acquired after this one's TTL lapsed.
+ */ const RELEASE_SCRIPT = 'if redis.call("get", KEYS[1]) == ARGV[1] then return redis.call("del", KEYS[1]) else return 0 end';
+/**
+ * Redis-backed {@link LockService}: `SET key token NX PX ttl` with bounded
+ * retry. The `NX` flag makes acquisition atomic across instances.
+ */ export const makeRedisLockService = (redis)=>({
+        acquire: (key)=>Effect.gen(function*() {
+                const token = randomUUID();
+                for(let attempt = 0; attempt < LOCK_RETRIES; attempt += 1){
+                    const result = yield* Effect.tryPromise({
+                        try: ()=>redis.set(key, token, 'PX', LOCK_TTL_MS, 'NX'),
+                        catch: (error)=>new EntifixLockError('Redis SET NX failed', error, {
+                                key
+                            })
+                    });
+                    if (result === 'OK') {
+                        return {
+                            key,
+                            token
+                        };
+                    }
+                    yield* Effect.sleep(Duration.millis(LOCK_RETRY_DELAY_MS));
+                }
+                return yield* Effect.fail(new EntifixLockError(`Could not acquire lock "${key}"`, undefined, {
+                    key,
+                    retries: LOCK_RETRIES
+                }));
+            }),
+        release: (handle)=>Effect.tryPromise({
+                try: ()=>redis.eval(RELEASE_SCRIPT, 1, handle.key, handle.token),
+                catch: (error)=>new EntifixConnError('Redis lock release failed', error, {
+                        key: handle.key
+                    })
+            }).pipe(Effect.asVoid)
+    });
+/** Provides {@link LockServiceTag} from a {@link RedisTag} connection. */ export const RedisLockServiceLayer = Layer.effect(LockServiceTag, Effect.map(RedisTag, makeRedisLockService));
+
+//# sourceMappingURL=redis-lock-service.js.map

package/dist/adapters/redis-lock-service.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/redis-lock-service.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport { EntifixConnError, EntifixLockError } from '@entifix/core';\nimport { type LockService, LockServiceTag } from '@entifix/transactions';\nimport { Duration, Effect, Layer } from 'effect';\nimport type { Redis } from 'ioredis';\n\nimport { RedisTag } from '../redis-connection/redis-connection.js';\n\n/** How long a held lock survives without renewal — bounds a crashed holder. */\nexport const LOCK_TTL_MS = 5_000;\n/** Bounded retry budget so contention fails fast rather than hanging. */\nexport const LOCK_RETRIES = 20;\nexport const LOCK_RETRY_DELAY_MS = 100;\n\n/**\n * Compare-and-delete so a release only frees the caller's own lock — never one\n * a later holder acquired after this one's TTL lapsed.\n */\nconst RELEASE_SCRIPT =\n  'if redis.call(\"get\", KEYS[1]) == ARGV[1] then return redis.call(\"del\", KEYS[1]) else return 0 end';\n\n/**\n * Redis-backed {@link LockService}: `SET key token NX PX ttl` with bounded\n * retry. The `NX` flag makes acquisition atomic across instances.\n */\nexport const makeRedisLockService = (redis: Redis): LockService => ({\n  acquire: key =>\n    Effect.gen(function* () {\n      const token = randomUUID();\n      for (let attempt = 0; attempt < LOCK_RETRIES; attempt += 1) {\n        const result = yield* Effect.tryPromise({\n          try: () => redis.set(key, token, 'PX', LOCK_TTL_MS, 'NX'),\n          catch: error =>\n            new EntifixLockError('Redis SET NX failed', error, { key }),\n        });\n        if (result === 'OK') {\n          return { key, token };\n        }\n        yield* Effect.sleep(Duration.millis(LOCK_RETRY_DELAY_MS));\n      }\n      return yield* Effect.fail(\n        new EntifixLockError(`Could not acquire lock \"${key}\"`, undefined, {\n          key,\n          retries: LOCK_RETRIES,\n        }),\n      );\n    }),\n  release: handle =>\n    Effect.tryPromise({\n      try: () => redis.eval(RELEASE_SCRIPT, 1, handle.key, handle.token),\n      catch: error =>\n        new EntifixConnError('Redis lock release failed', error, {\n          key: handle.key,\n        }),\n    }).pipe(Effect.asVoid),\n});\n\n/** Provides {@link LockServiceTag} from a {@link RedisTag} connection. */\nexport const RedisLockServiceLayer = Layer.effect(\n  LockServiceTag,\n  Effect.map(RedisTag, makeRedisLockService),\n);\n"],"names":["randomUUID","EntifixConnError","EntifixLockError","LockServiceTag","Duration","Effect","Layer","RedisTag","LOCK_TTL_MS","LOCK_RETRIES","LOCK_RETRY_DELAY_MS","RELEASE_SCRIPT","makeRedisLockService","redis","acquire","key","gen","token","attempt","result","tryPromise","try","set","catch","error","sleep","millis","fail","undefined","retries","release","handle","eval","pipe","asVoid","RedisLockServiceLayer","effect","map"],"mappings":"AAAA,SAASA,UAAU,QAAQ,cAAc;AAEzC,SAASC,gBAAgB,EAAEC,gBAAgB,QAAQ,gBAAgB;AACnE,SAA2BC,cAAc,QAAQ,wBAAwB;AACzE,SAASC,QAAQ,EAAEC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAGjD,SAASC,QAAQ,QAAQ,0CAA0C;AAEnE,6EAA6E,GAC7E,OAAO,MAAMC,cAAc,KAAM;AACjC,uEAAuE,GACvE,OAAO,MAAMC,eAAe,GAAG;AAC/B,OAAO,MAAMC,sBAAsB,IAAI;AAEvC;;;CAGC,GACD,MAAMC,iBACJ;AAEF;;;CAGC,GACD,OAAO,MAAMC,uBAAuB,CAACC,QAA+B,CAAA;QAClEC,SAASC,CAAAA,MACPV,OAAOW,GAAG,CAAC;gBACT,MAAMC,QAAQjB;gBACd,IAAK,IAAIkB,UAAU,GAAGA,UAAUT,cAAcS,WAAW,EAAG;oBAC1D,MAAMC,SAAS,OAAOd,OAAOe,UAAU,CAAC;wBACtCC,KAAK,IAAMR,MAAMS,GAAG,CAACP,KAAKE,OAAO,MAAMT,aAAa;wBACpDe,OAAOC,CAAAA,QACL,IAAItB,iBAAiB,uBAAuBsB,OAAO;gCAAET;4BAAI;oBAC7D;oBACA,IAAII,WAAW,MAAM;wBACnB,OAAO;4BAAEJ;4BAAKE;wBAAM;oBACtB;oBACA,OAAOZ,OAAOoB,KAAK,CAACrB,SAASsB,MAAM,CAAChB;gBACtC;gBACA,OAAO,OAAOL,OAAOsB,IAAI,CACvB,IAAIzB,iBAAiB,CAAC,wBAAwB,EAAEa,IAAI,CAAC,CAAC,EAAEa,WAAW;oBACjEb;oBACAc,SAASpB;gBACX;YAEJ;QACFqB,SAASC,CAAAA,SACP1B,OAAOe,UAAU,CAAC;gBAChBC,KAAK,IAAMR,MAAMmB,IAAI,CAACrB,gBAAgB,GAAGoB,OAAOhB,GAAG,EAAEgB,OAAOd,KAAK;gBACjEM,OAAOC,CAAAA,QACL,IAAIvB,iBAAiB,6BAA6BuB,OAAO;wBACvDT,KAAKgB,OAAOhB,GAAG;oBACjB;YACJ,GAAGkB,IAAI,CAAC5B,OAAO6B,MAAM;IACzB,CAAA,EAAG;AAEH,wEAAwE,GACxE,OAAO,MAAMC,wBAAwB7B,MAAM8B,MAAM,CAC/CjC,gBACAE,OAAOgC,GAAG,CAAC9B,UAAUK,uBACrB"}

package/dist/adapters/redis-one-time-token-store.d.ts

@@ -0,0 +1,19 @@
+import { type OneTimeTokenStore, OneTimeTokenStoreTag } from '@entifix/business';
+import { Layer } from 'effect';
+import type { Redis } from 'ioredis';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/** Default key prefix; every key this adapter writes lives under it. */
+export declare const DEFAULT_TOKEN_NAMESPACE = "ott";
+export interface RedisOneTimeTokenStoreOptions {
+    readonly namespace?: string;
+}
+/**
+ * Redis-backed {@link OneTimeTokenStore}. The subject is stored under
+ * `{ns}:{purpose}:{hash}` with the TTL enforced by Redis, and `consume` uses
+ * `GETDEL` so redemption is atomic — two requests racing the same link cannot
+ * both succeed.
+ */
+export declare const makeRedisOneTimeTokenStore: (redis: Redis, options?: RedisOneTimeTokenStoreOptions) => OneTimeTokenStore;
+/** Provides {@link OneTimeTokenStoreTag} from a {@link RedisTag} connection. */
+export declare const RedisOneTimeTokenStoreLayer: (options?: RedisOneTimeTokenStoreOptions) => Layer.Layer<OneTimeTokenStoreTag, never, RedisTag>;
+//# sourceMappingURL=redis-one-time-token-store.d.ts.map

package/dist/adapters/redis-one-time-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-one-time-token-store.d.ts","sourceRoot":"","sources":["../../src/adapters/redis-one-time-token-store.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,iBAAiB,EACtB,oBAAoB,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AAEnE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAeD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACrC,OAAO,KAAK,EACZ,UAAS,6BAAkC,KAC1C,iBAqCF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,GACtC,UAAS,6BAAkC,uDAK1C,CAAC"}

package/dist/adapters/redis-one-time-token-store.js

@@ -0,0 +1,48 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { OneTimeTokenStoreTag } from '@entifix/business';
+import { EntifixConnError, EntifixLogicError } from '@entifix/core';
+import { Effect, Layer } from 'effect';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/** Default key prefix; every key this adapter writes lives under it. */ export const DEFAULT_TOKEN_NAMESPACE = 'ott';
+/** 256 bits of randomness — not guessable inside any realistic TTL. */ const mintToken = ()=>randomBytes(32).toString('base64url');
+/**
+ * SHA-256 of the token.
+ *
+ * Fast hashing is right here and wrong for passwords: the input already has 256
+ * bits of entropy, so there is nothing to brute-force and no salt to add. What
+ * this buys is that a dump of Redis contains no redeemable token.
+ */ const digest = (token)=>createHash('sha256').update(token).digest('hex');
+/**
+ * Redis-backed {@link OneTimeTokenStore}. The subject is stored under
+ * `{ns}:{purpose}:{hash}` with the TTL enforced by Redis, and `consume` uses
+ * `GETDEL` so redemption is atomic — two requests racing the same link cannot
+ * both succeed.
+ */ export const makeRedisOneTimeTokenStore = (redis, options = {})=>{
+    var _options_namespace;
+    const namespace = (_options_namespace = options.namespace) != null ? _options_namespace : DEFAULT_TOKEN_NAMESPACE;
+    const key = (purpose, token)=>`${namespace}:${purpose}:${digest(token)}`;
+    const attempt = (what, run)=>Effect.tryPromise({
+            try: run,
+            catch: (error)=>new EntifixConnError(what, error)
+        });
+    return {
+        issue: (purpose, subject, ttlSeconds)=>Effect.gen(function*() {
+                const token = mintToken();
+                yield* attempt('Redis token issue failed', ()=>redis.set(key(purpose, token), subject, 'EX', ttlSeconds));
+                return token;
+            }),
+        consume: (purpose, token)=>Effect.gen(function*() {
+                // Atomic read-and-delete: without it, two clicks on the same emailed
+                // link could each read the subject before either deleted it, and a
+                // single-use token would quietly be reusable.
+                const subject = yield* attempt('Redis token consume failed', ()=>redis.getdel(key(purpose, token)));
+                if (subject === null) {
+                    return yield* Effect.fail(new EntifixLogicError('Token is unknown, expired or already used'));
+                }
+                return subject;
+            })
+    };
+};
+/** Provides {@link OneTimeTokenStoreTag} from a {@link RedisTag} connection. */ export const RedisOneTimeTokenStoreLayer = (options = {})=>Layer.effect(OneTimeTokenStoreTag, Effect.map(RedisTag, (redis)=>makeRedisOneTimeTokenStore(redis, options)));
+
+//# sourceMappingURL=redis-one-time-token-store.js.map

package/dist/adapters/redis-one-time-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/redis-one-time-token-store.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\n\nimport {\n  type OneTimeTokenStore,\n  OneTimeTokenStoreTag,\n  type TokenPurpose,\n} from '@entifix/business';\nimport { EntifixConnError, EntifixLogicError } from '@entifix/core';\nimport { Effect, Layer } from 'effect';\nimport type { Redis } from 'ioredis';\n\nimport { RedisTag } from '../redis-connection/redis-connection.js';\n\n/** Default key prefix; every key this adapter writes lives under it. */\nexport const DEFAULT_TOKEN_NAMESPACE = 'ott';\n\nexport interface RedisOneTimeTokenStoreOptions {\n  readonly namespace?: string;\n}\n\n/** 256 bits of randomness — not guessable inside any realistic TTL. */\nconst mintToken = (): string => randomBytes(32).toString('base64url');\n\n/**\n * SHA-256 of the token.\n *\n * Fast hashing is right here and wrong for passwords: the input already has 256\n * bits of entropy, so there is nothing to brute-force and no salt to add. What\n * this buys is that a dump of Redis contains no redeemable token.\n */\nconst digest = (token: string): string =>\n  createHash('sha256').update(token).digest('hex');\n\n/**\n * Redis-backed {@link OneTimeTokenStore}. The subject is stored under\n * `{ns}:{purpose}:{hash}` with the TTL enforced by Redis, and `consume` uses\n * `GETDEL` so redemption is atomic — two requests racing the same link cannot\n * both succeed.\n */\nexport const makeRedisOneTimeTokenStore = (\n  redis: Redis,\n  options: RedisOneTimeTokenStoreOptions = {},\n): OneTimeTokenStore => {\n  const namespace = options.namespace ?? DEFAULT_TOKEN_NAMESPACE;\n  const key = (purpose: TokenPurpose, token: string): string =>\n    `${namespace}:${purpose}:${digest(token)}`;\n\n  const attempt = <T>(what: string, run: () => Promise<T>) =>\n    Effect.tryPromise({\n      try: run,\n      catch: error => new EntifixConnError(what, error),\n    });\n\n  return {\n    issue: (purpose: TokenPurpose, subject: string, ttlSeconds: number) =>\n      Effect.gen(function* () {\n        const token = mintToken();\n        yield* attempt('Redis token issue failed', () =>\n          redis.set(key(purpose, token), subject, 'EX', ttlSeconds),\n        );\n        return token;\n      }),\n\n    consume: (purpose: TokenPurpose, token: string) =>\n      Effect.gen(function* () {\n        // Atomic read-and-delete: without it, two clicks on the same emailed\n        // link could each read the subject before either deleted it, and a\n        // single-use token would quietly be reusable.\n        const subject = yield* attempt('Redis token consume failed', () =>\n          redis.getdel(key(purpose, token)),\n        );\n        if (subject === null) {\n          return yield* Effect.fail(\n            new EntifixLogicError('Token is unknown, expired or already used'),\n          );\n        }\n        return subject;\n      }),\n  };\n};\n\n/** Provides {@link OneTimeTokenStoreTag} from a {@link RedisTag} connection. */\nexport const RedisOneTimeTokenStoreLayer = (\n  options: RedisOneTimeTokenStoreOptions = {},\n) =>\n  Layer.effect(\n    OneTimeTokenStoreTag,\n    Effect.map(RedisTag, redis => makeRedisOneTimeTokenStore(redis, options)),\n  );\n"],"names":["createHash","randomBytes","OneTimeTokenStoreTag","EntifixConnError","EntifixLogicError","Effect","Layer","RedisTag","DEFAULT_TOKEN_NAMESPACE","mintToken","toString","digest","token","update","makeRedisOneTimeTokenStore","redis","options","namespace","key","purpose","attempt","what","run","tryPromise","try","catch","error","issue","subject","ttlSeconds","gen","set","consume","getdel","fail","RedisOneTimeTokenStoreLayer","effect","map"],"mappings":"AAAA,SAASA,UAAU,EAAEC,WAAW,QAAQ,cAAc;AAEtD,SAEEC,oBAAoB,QAEf,oBAAoB;AAC3B,SAASC,gBAAgB,EAAEC,iBAAiB,QAAQ,gBAAgB;AACpE,SAASC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAGvC,SAASC,QAAQ,QAAQ,0CAA0C;AAEnE,sEAAsE,GACtE,OAAO,MAAMC,0BAA0B,MAAM;AAM7C,qEAAqE,GACrE,MAAMC,YAAY,IAAcR,YAAY,IAAIS,QAAQ,CAAC;AAEzD;;;;;;CAMC,GACD,MAAMC,SAAS,CAACC,QACdZ,WAAW,UAAUa,MAAM,CAACD,OAAOD,MAAM,CAAC;AAE5C;;;;;CAKC,GACD,OAAO,MAAMG,6BAA6B,CACxCC,OACAC,UAAyC,CAAC,CAAC;QAEzBA;IAAlB,MAAMC,aAAYD,qBAAAA,QAAQC,SAAS,YAAjBD,qBAAqBR;IACvC,MAAMU,MAAM,CAACC,SAAuBP,QAClC,GAAGK,UAAU,CAAC,EAAEE,QAAQ,CAAC,EAAER,OAAOC,QAAQ;IAE5C,MAAMQ,UAAU,CAAIC,MAAcC,MAChCjB,OAAOkB,UAAU,CAAC;YAChBC,KAAKF;YACLG,OAAOC,CAAAA,QAAS,IAAIvB,iBAAiBkB,MAAMK;QAC7C;IAEF,OAAO;QACLC,OAAO,CAACR,SAAuBS,SAAiBC,aAC9CxB,OAAOyB,GAAG,CAAC;gBACT,MAAMlB,QAAQH;gBACd,OAAOW,QAAQ,4BAA4B,IACzCL,MAAMgB,GAAG,CAACb,IAAIC,SAASP,QAAQgB,SAAS,MAAMC;gBAEhD,OAAOjB;YACT;QAEFoB,SAAS,CAACb,SAAuBP,QAC/BP,OAAOyB,GAAG,CAAC;gBACT,qEAAqE;gBACrE,mEAAmE;gBACnE,8CAA8C;gBAC9C,MAAMF,UAAU,OAAOR,QAAQ,8BAA8B,IAC3DL,MAAMkB,MAAM,CAACf,IAAIC,SAASP;gBAE5B,IAAIgB,YAAY,MAAM;oBACpB,OAAO,OAAOvB,OAAO6B,IAAI,CACvB,IAAI9B,kBAAkB;gBAE1B;gBACA,OAAOwB;YACT;IACJ;AACF,EAAE;AAEF,8EAA8E,GAC9E,OAAO,MAAMO,8BAA8B,CACzCnB,UAAyC,CAAC,CAAC,GAE3CV,MAAM8B,MAAM,CACVlC,sBACAG,OAAOgC,GAAG,CAAC9B,UAAUQ,CAAAA,QAASD,2BAA2BC,OAAOC,WAChE"}

package/dist/adapters/redis-sequence-service.d.ts

@@ -0,0 +1,13 @@
+import { type SequenceService, SequenceServiceTag } from '@entifix/transactions';
+import { Layer } from 'effect';
+import type { Redis } from 'ioredis';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/**
+ * Redis-backed {@link SequenceService}. `INCR` is atomic, so concurrent
+ * commands across every service instance draw strictly distinct values — the
+ * uniqueness guarantee behind incremental codes.
+ */
+export declare const makeRedisSequenceService: (redis: Redis) => SequenceService;
+/** Provides {@link SequenceServiceTag} from a {@link RedisTag} connection. */
+export declare const RedisSequenceServiceLayer: Layer.Layer<SequenceServiceTag, never, RedisTag>;
+//# sourceMappingURL=redis-sequence-service.d.ts.map

package/dist/adapters/redis-sequence-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-sequence-service.d.ts","sourceRoot":"","sources":["../../src/adapters/redis-sequence-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,eAAe,EACpB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AAKnE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,KAAK,KAAG,eAOtD,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,kDAGrC,CAAC"}

package/dist/adapters/redis-sequence-service.js

@@ -0,0 +1,20 @@
+import { EntifixConnError } from '@entifix/core';
+import { SequenceServiceTag } from '@entifix/transactions';
+import { Effect, Layer } from 'effect';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/** Namespace so sequence keys never collide with lock keys. */ const SEQ_PREFIX = 'seq:';
+/**
+ * Redis-backed {@link SequenceService}. `INCR` is atomic, so concurrent
+ * commands across every service instance draw strictly distinct values — the
+ * uniqueness guarantee behind incremental codes.
+ */ export const makeRedisSequenceService = (redis)=>({
+        next: (name)=>Effect.tryPromise({
+                try: ()=>redis.incr(`${SEQ_PREFIX}${name}`),
+                catch: (error)=>new EntifixConnError('Redis INCR failed', error, {
+                        name
+                    })
+            })
+    });
+/** Provides {@link SequenceServiceTag} from a {@link RedisTag} connection. */ export const RedisSequenceServiceLayer = Layer.effect(SequenceServiceTag, Effect.map(RedisTag, makeRedisSequenceService));
+
+//# sourceMappingURL=redis-sequence-service.js.map

package/dist/adapters/redis-sequence-service.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/redis-sequence-service.ts"],"sourcesContent":["import { EntifixConnError } from '@entifix/core';\nimport {\n  type SequenceService,\n  SequenceServiceTag,\n} from '@entifix/transactions';\nimport { Effect, Layer } from 'effect';\nimport type { Redis } from 'ioredis';\n\nimport { RedisTag } from '../redis-connection/redis-connection.js';\n\n/** Namespace so sequence keys never collide with lock keys. */\nconst SEQ_PREFIX = 'seq:';\n\n/**\n * Redis-backed {@link SequenceService}. `INCR` is atomic, so concurrent\n * commands across every service instance draw strictly distinct values — the\n * uniqueness guarantee behind incremental codes.\n */\nexport const makeRedisSequenceService = (redis: Redis): SequenceService => ({\n  next: name =>\n    Effect.tryPromise({\n      try: () => redis.incr(`${SEQ_PREFIX}${name}`),\n      catch: error =>\n        new EntifixConnError('Redis INCR failed', error, { name }),\n    }),\n});\n\n/** Provides {@link SequenceServiceTag} from a {@link RedisTag} connection. */\nexport const RedisSequenceServiceLayer = Layer.effect(\n  SequenceServiceTag,\n  Effect.map(RedisTag, makeRedisSequenceService),\n);\n"],"names":["EntifixConnError","SequenceServiceTag","Effect","Layer","RedisTag","SEQ_PREFIX","makeRedisSequenceService","redis","next","name","tryPromise","try","incr","catch","error","RedisSequenceServiceLayer","effect","map"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,gBAAgB;AACjD,SAEEC,kBAAkB,QACb,wBAAwB;AAC/B,SAASC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAGvC,SAASC,QAAQ,QAAQ,0CAA0C;AAEnE,6DAA6D,GAC7D,MAAMC,aAAa;AAEnB;;;;CAIC,GACD,OAAO,MAAMC,2BAA2B,CAACC,QAAmC,CAAA;QAC1EC,MAAMC,CAAAA,OACJP,OAAOQ,UAAU,CAAC;gBAChBC,KAAK,IAAMJ,MAAMK,IAAI,CAAC,GAAGP,aAAaI,MAAM;gBAC5CI,OAAOC,CAAAA,QACL,IAAId,iBAAiB,qBAAqBc,OAAO;wBAAEL;oBAAK;YAC5D;IACJ,CAAA,EAAG;AAEH,4EAA4E,GAC5E,OAAO,MAAMM,4BAA4BZ,MAAMa,MAAM,CACnDf,oBACAC,OAAOe,GAAG,CAACb,UAAUE,2BACrB"}

package/dist/adapters/redis-session-store.d.ts

@@ -0,0 +1,29 @@
+import { type SessionStore, SessionStoreTag } from '@entifix/business';
+import { Layer } from 'effect';
+import type { Redis } from 'ioredis';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/** Default key prefix; every key this adapter writes lives under it. */
+export declare const DEFAULT_SESSION_NAMESPACE = "session";
+export interface RedisSessionStoreOptions {
+    /** Key prefix, so several stores can share one Redis without colliding. */
+    readonly namespace?: string;
+}
+/**
+ * Redis-backed {@link SessionStore}. The session record is a JSON string under
+ * `{ns}:{sid}` with the TTL enforced by Redis (`EX`), so an abandoned session
+ * expires on its own; `touch` re-`EXPIRE`s it for a sliding window. A parallel
+ * `{ns}:user:{userId}` SET indexes a user's live session ids so every one can
+ * be revoked at once (password change, admin kick).
+ *
+ * The sliding window is bounded: `create` stamps an `absoluteExpiresAt` that
+ * `touch` clamps every renewal to, so the Redis TTL can only ever shrink toward
+ * that ceiling. This is what keeps "slides while you use it" from degrading
+ * into "never expires".
+ *
+ * Closures over the `redis` client give each method `R = never`, so the result
+ * is assignable to {@link SessionStoreTag} without leaking a dependency.
+ */
+export declare const makeRedisSessionStore: (redis: Redis, options?: RedisSessionStoreOptions) => SessionStore;
+/** Provides {@link SessionStoreTag} from a {@link RedisTag} connection. */
+export declare const RedisSessionStoreLayer: (options?: RedisSessionStoreOptions) => Layer.Layer<SessionStoreTag, never, RedisTag>;
+//# sourceMappingURL=redis-session-store.d.ts.map

package/dist/adapters/redis-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-session-store.d.ts","sourceRoot":"","sources":["../../src/adapters/redis-session-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,YAAY,EACjB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AAEnE,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,KAAK,EACZ,UAAS,wBAA6B,KACrC,YA6NF,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,GACjC,UAAS,wBAA6B,kDAKrC,CAAC"}

package/dist/adapters/redis-session-store.js

@@ -0,0 +1,154 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { randomBytes } from 'node:crypto';
+import { SessionStoreTag } from '@entifix/business';
+import { EntifixConnError, EntifixLogicError } from '@entifix/core';
+import { Effect, Layer } from 'effect';
+import { RedisTag } from '../redis-connection/redis-connection.js';
+/** Default key prefix; every key this adapter writes lives under it. */ export const DEFAULT_SESSION_NAMESPACE = 'session';
+/** Mint an unguessable opaque session id (256 bits, url-safe). */ const mintSessionId = ()=>randomBytes(32).toString('base64url');
+/**
+ * Redis-backed {@link SessionStore}. The session record is a JSON string under
+ * `{ns}:{sid}` with the TTL enforced by Redis (`EX`), so an abandoned session
+ * expires on its own; `touch` re-`EXPIRE`s it for a sliding window. A parallel
+ * `{ns}:user:{userId}` SET indexes a user's live session ids so every one can
+ * be revoked at once (password change, admin kick).
+ *
+ * The sliding window is bounded: `create` stamps an `absoluteExpiresAt` that
+ * `touch` clamps every renewal to, so the Redis TTL can only ever shrink toward
+ * that ceiling. This is what keeps "slides while you use it" from degrading
+ * into "never expires".
+ *
+ * Closures over the `redis` client give each method `R = never`, so the result
+ * is assignable to {@link SessionStoreTag} without leaking a dependency.
+ */ export const makeRedisSessionStore = (redis, options = {})=>{
+    var _options_namespace;
+    const namespace = (_options_namespace = options.namespace) != null ? _options_namespace : DEFAULT_SESSION_NAMESPACE;
+    const sessionKey = (sessionId)=>`${namespace}:${sessionId}`;
+    const userKey = (userId)=>`${namespace}:user:${String(userId)}`;
+    const attempt = (what, run)=>Effect.tryPromise({
+            try: run,
+            catch: (error)=>new EntifixConnError(what, error)
+        });
+    /**
+   * Read a record back, giving one written before `absoluteExpiresAt` existed a
+   * ceiling instead of leaving it undefined.
+   *
+   * Sessions outlive a deploy. Without this, the first `touch` of an existing
+   * session parsed `undefined` into `NaN`, sailed past the `<= 0` check, and
+   * asked Redis to `EX NaN` — so everyone signed in at deploy time got a `500`
+   * on their next refresh.
+   *
+   * The record's own `expiresAt` is the right fallback: under the previous
+   * policy it was stamped at creation and never moved, so it already *is* the
+   * bound that session was created with. Rewriting the record on touch means
+   * each one self-heals the first time it is renewed.
+   */ const parseRecord = (raw)=>{
+        var _record_absoluteExpiresAt;
+        const record = JSON.parse(raw);
+        return Number.isNaN(Date.parse((_record_absoluteExpiresAt = record.absoluteExpiresAt) != null ? _record_absoluteExpiresAt : '')) ? _extends({}, record, {
+            absoluteExpiresAt: record.expiresAt
+        }) : record;
+    };
+    return {
+        create: (data, lifetime)=>Effect.gen(function*() {
+                const sessionId = mintSessionId();
+                const createdAt = new Date();
+                // The first window never exceeds the ceiling either — a lifetime whose
+                // idle TTL is the longer of the two would otherwise outlive its own cap.
+                const ttlSeconds = Math.min(lifetime.idleTtlSeconds, lifetime.absoluteTtlSeconds);
+                const expiresAt = new Date(createdAt.getTime() + ttlSeconds * 1000);
+                const absoluteExpiresAt = new Date(createdAt.getTime() + lifetime.absoluteTtlSeconds * 1000);
+                const record = _extends({}, data, {
+                    sessionId,
+                    createdAt: createdAt.toISOString(),
+                    expiresAt: expiresAt.toISOString(),
+                    absoluteExpiresAt: absoluteExpiresAt.toISOString()
+                });
+                yield* attempt('Redis session create failed', ()=>redis.set(sessionKey(sessionId), JSON.stringify(record), 'EX', ttlSeconds));
+                yield* attempt('Redis session index failed', ()=>redis.sadd(userKey(data.userId), sessionId));
+                // The index outlives any single session so a later one is still
+                // revocable through it.
+                yield* attempt('Redis session index ttl failed', ()=>redis.expire(userKey(data.userId), lifetime.absoluteTtlSeconds));
+                return sessionId;
+            }),
+        read: (sessionId)=>Effect.gen(function*() {
+                const raw = yield* attempt('Redis session read failed', ()=>redis.get(sessionKey(sessionId)));
+                if (raw === null) {
+                    return yield* Effect.fail(new EntifixLogicError('Session not found or expired', undefined, {
+                        sessionId
+                    }));
+                }
+                return parseRecord(raw);
+            }),
+        touch: (sessionId, idleTtlSeconds)=>Effect.gen(function*() {
+                const raw = yield* attempt('Redis session touch read failed', ()=>redis.get(sessionKey(sessionId)));
+                if (raw === null) {
+                    return yield* Effect.fail(new EntifixLogicError('Session not found or expired', undefined, {
+                        sessionId
+                    }));
+                }
+                const record = parseRecord(raw);
+                const now = Date.now();
+                const secondsToCeiling = Math.floor((Date.parse(record.absoluteExpiresAt) - now) / 1000);
+                // Past the ceiling the session is over regardless of how active it has
+                // been. Dropping the key here rather than waiting for Redis keeps the
+                // user index from listing a session that can no longer be renewed.
+                if (secondsToCeiling <= 0) {
+                    yield* attempt('Redis session capped delete failed', ()=>redis.del(sessionKey(sessionId)));
+                    yield* attempt('Redis session index cleanup failed', ()=>redis.srem(userKey(record.userId), sessionId));
+                    return yield* Effect.fail(new EntifixLogicError('Session reached its absolute lifetime', undefined, {
+                        sessionId,
+                        absoluteExpiresAt: record.absoluteExpiresAt
+                    }));
+                }
+                const ttlSeconds = Math.min(idleTtlSeconds, secondsToCeiling);
+                const renewed = _extends({}, record, {
+                    expiresAt: new Date(now + ttlSeconds * 1000).toISOString()
+                });
+                yield* attempt('Redis session touch failed', ()=>redis.set(sessionKey(sessionId), JSON.stringify(renewed), 'EX', ttlSeconds));
+            }),
+        listForUser: (userId)=>Effect.gen(function*() {
+                const sessionIds = yield* attempt('Redis session index scan failed', ()=>redis.smembers(userKey(userId)));
+                const records = [];
+                const stale = [];
+                for (const sessionId of sessionIds){
+                    const raw = yield* attempt('Redis session list read failed', ()=>redis.get(sessionKey(sessionId)));
+                    // The index has no way to learn that Redis expired a record on its
+                    // own, so it accumulates ids pointing at nothing. Pruning them here
+                    // keeps a session list from showing rows that are already gone.
+                    if (raw === null) stale.push(sessionId);
+                    else records.push(parseRecord(raw));
+                }
+                for (const sessionId of stale){
+                    yield* attempt('Redis session index prune failed', ()=>redis.srem(userKey(userId), sessionId));
+                }
+                return records;
+            }),
+        revoke: (sessionId)=>Effect.gen(function*() {
+                const raw = yield* attempt('Redis session revoke read failed', ()=>redis.get(sessionKey(sessionId)));
+                yield* attempt('Redis session revoke failed', ()=>redis.del(sessionKey(sessionId)));
+                if (raw !== null) {
+                    const record = parseRecord(raw);
+                    yield* attempt('Redis session index cleanup failed', ()=>redis.srem(userKey(record.userId), sessionId));
+                }
+            }),
+        revokeAllForUser: (userId)=>Effect.gen(function*() {
+                const sessionIds = yield* attempt('Redis session index scan failed', ()=>redis.smembers(userKey(userId)));
+                for (const sessionId of sessionIds){
+                    yield* attempt('Redis session bulk revoke failed', ()=>redis.del(sessionKey(sessionId)));
+                }
+                yield* attempt('Redis session index drop failed', ()=>redis.del(userKey(userId)));
+            }),
+        revokeAllForUserExcept: (userId, keepSessionId)=>Effect.gen(function*() {
+                const sessionIds = yield* attempt('Redis session index scan failed', ()=>redis.smembers(userKey(userId)));
+                for (const sessionId of sessionIds){
+                    if (sessionId === keepSessionId) continue;
+                    yield* attempt('Redis session bulk revoke failed', ()=>redis.del(sessionKey(sessionId)));
+                    yield* attempt('Redis session index cleanup failed', ()=>redis.srem(userKey(userId), sessionId));
+                }
+            })
+    };
+};
+/** Provides {@link SessionStoreTag} from a {@link RedisTag} connection. */ export const RedisSessionStoreLayer = (options = {})=>Layer.effect(SessionStoreTag, Effect.map(RedisTag, (redis)=>makeRedisSessionStore(redis, options)));
+
+//# sourceMappingURL=redis-session-store.js.map

package/dist/adapters/redis-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/redis-session-store.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\n\nimport {\n  type SessionData,\n  type SessionLifetimeSeconds,\n  type SessionRecord,\n  type SessionStore,\n  SessionStoreTag,\n} from '@entifix/business';\nimport {\n  EntifixConnError,\n  EntifixLogicError,\n  type EntityId,\n} from '@entifix/core';\nimport { Effect, Layer } from 'effect';\nimport type { Redis } from 'ioredis';\n\nimport { RedisTag } from '../redis-connection/redis-connection.js';\n\n/** Default key prefix; every key this adapter writes lives under it. */\nexport const DEFAULT_SESSION_NAMESPACE = 'session';\n\nexport interface RedisSessionStoreOptions {\n  /** Key prefix, so several stores can share one Redis without colliding. */\n  readonly namespace?: string;\n}\n\n/** Mint an unguessable opaque session id (256 bits, url-safe). */\nconst mintSessionId = (): string => randomBytes(32).toString('base64url');\n\n/**\n * Redis-backed {@link SessionStore}. The session record is a JSON string under\n * `{ns}:{sid}` with the TTL enforced by Redis (`EX`), so an abandoned session\n * expires on its own; `touch` re-`EXPIRE`s it for a sliding window. A parallel\n * `{ns}:user:{userId}` SET indexes a user's live session ids so every one can\n * be revoked at once (password change, admin kick).\n *\n * The sliding window is bounded: `create` stamps an `absoluteExpiresAt` that\n * `touch` clamps every renewal to, so the Redis TTL can only ever shrink toward\n * that ceiling. This is what keeps \"slides while you use it\" from degrading\n * into \"never expires\".\n *\n * Closures over the `redis` client give each method `R = never`, so the result\n * is assignable to {@link SessionStoreTag} without leaking a dependency.\n */\nexport const makeRedisSessionStore = (\n  redis: Redis,\n  options: RedisSessionStoreOptions = {},\n): SessionStore => {\n  const namespace = options.namespace ?? DEFAULT_SESSION_NAMESPACE;\n  const sessionKey = (sessionId: string): string => `${namespace}:${sessionId}`;\n  const userKey = (userId: EntityId): string =>\n    `${namespace}:user:${String(userId)}`;\n\n  const attempt = <T>(what: string, run: () => Promise<T>) =>\n    Effect.tryPromise({\n      try: run,\n      catch: error => new EntifixConnError(what, error),\n    });\n\n  /**\n   * Read a record back, giving one written before `absoluteExpiresAt` existed a\n   * ceiling instead of leaving it undefined.\n   *\n   * Sessions outlive a deploy. Without this, the first `touch` of an existing\n   * session parsed `undefined` into `NaN`, sailed past the `<= 0` check, and\n   * asked Redis to `EX NaN` — so everyone signed in at deploy time got a `500`\n   * on their next refresh.\n   *\n   * The record's own `expiresAt` is the right fallback: under the previous\n   * policy it was stamped at creation and never moved, so it already *is* the\n   * bound that session was created with. Rewriting the record on touch means\n   * each one self-heals the first time it is renewed.\n   */\n  const parseRecord = (raw: string): SessionRecord => {\n    const record = JSON.parse(raw) as SessionRecord;\n    return Number.isNaN(Date.parse(record.absoluteExpiresAt ?? ''))\n      ? { ...record, absoluteExpiresAt: record.expiresAt }\n      : record;\n  };\n\n  return {\n    create: (data: SessionData, lifetime: SessionLifetimeSeconds) =>\n      Effect.gen(function* () {\n        const sessionId = mintSessionId();\n        const createdAt = new Date();\n        // The first window never exceeds the ceiling either — a lifetime whose\n        // idle TTL is the longer of the two would otherwise outlive its own cap.\n        const ttlSeconds = Math.min(\n          lifetime.idleTtlSeconds,\n          lifetime.absoluteTtlSeconds,\n        );\n        const expiresAt = new Date(createdAt.getTime() + ttlSeconds * 1000);\n        const absoluteExpiresAt = new Date(\n          createdAt.getTime() + lifetime.absoluteTtlSeconds * 1000,\n        );\n        const record: SessionRecord = {\n          ...data,\n          sessionId,\n          createdAt: createdAt.toISOString(),\n          expiresAt: expiresAt.toISOString(),\n          absoluteExpiresAt: absoluteExpiresAt.toISOString(),\n        };\n        yield* attempt('Redis session create failed', () =>\n          redis.set(\n            sessionKey(sessionId),\n            JSON.stringify(record),\n            'EX',\n            ttlSeconds,\n          ),\n        );\n        yield* attempt('Redis session index failed', () =>\n          redis.sadd(userKey(data.userId), sessionId),\n        );\n        // The index outlives any single session so a later one is still\n        // revocable through it.\n        yield* attempt('Redis session index ttl failed', () =>\n          redis.expire(userKey(data.userId), lifetime.absoluteTtlSeconds),\n        );\n        return sessionId;\n      }),\n\n    read: (sessionId: string) =>\n      Effect.gen(function* () {\n        const raw = yield* attempt('Redis session read failed', () =>\n          redis.get(sessionKey(sessionId)),\n        );\n        if (raw === null) {\n          return yield* Effect.fail(\n            new EntifixLogicError('Session not found or expired', undefined, {\n              sessionId,\n            }),\n          );\n        }\n        return parseRecord(raw);\n      }),\n\n    touch: (sessionId: string, idleTtlSeconds: number) =>\n      Effect.gen(function* () {\n        const raw = yield* attempt('Redis session touch read failed', () =>\n          redis.get(sessionKey(sessionId)),\n        );\n        if (raw === null) {\n          return yield* Effect.fail(\n            new EntifixLogicError('Session not found or expired', undefined, {\n              sessionId,\n            }),\n          );\n        }\n\n        const record = parseRecord(raw);\n        const now = Date.now();\n        const secondsToCeiling = Math.floor(\n          (Date.parse(record.absoluteExpiresAt) - now) / 1000,\n        );\n        // Past the ceiling the session is over regardless of how active it has\n        // been. Dropping the key here rather than waiting for Redis keeps the\n        // user index from listing a session that can no longer be renewed.\n        if (secondsToCeiling <= 0) {\n          yield* attempt('Redis session capped delete failed', () =>\n            redis.del(sessionKey(sessionId)),\n          );\n          yield* attempt('Redis session index cleanup failed', () =>\n            redis.srem(userKey(record.userId), sessionId),\n          );\n          return yield* Effect.fail(\n            new EntifixLogicError(\n              'Session reached its absolute lifetime',\n              undefined,\n              {\n                sessionId,\n                absoluteExpiresAt: record.absoluteExpiresAt,\n              },\n            ),\n          );\n        }\n\n        const ttlSeconds = Math.min(idleTtlSeconds, secondsToCeiling);\n        const renewed: SessionRecord = {\n          ...record,\n          expiresAt: new Date(now + ttlSeconds * 1000).toISOString(),\n        };\n        yield* attempt('Redis session touch failed', () =>\n          redis.set(\n            sessionKey(sessionId),\n            JSON.stringify(renewed),\n            'EX',\n            ttlSeconds,\n          ),\n        );\n      }),\n\n    listForUser: (userId: EntityId) =>\n      Effect.gen(function* () {\n        const sessionIds = yield* attempt(\n          'Redis session index scan failed',\n          () => redis.smembers(userKey(userId)),\n        );\n\n        const records: SessionRecord[] = [];\n        const stale: string[] = [];\n        for (const sessionId of sessionIds) {\n          const raw = yield* attempt('Redis session list read failed', () =>\n            redis.get(sessionKey(sessionId)),\n          );\n          // The index has no way to learn that Redis expired a record on its\n          // own, so it accumulates ids pointing at nothing. Pruning them here\n          // keeps a session list from showing rows that are already gone.\n          if (raw === null) stale.push(sessionId);\n          else records.push(parseRecord(raw));\n        }\n        for (const sessionId of stale) {\n          yield* attempt('Redis session index prune failed', () =>\n            redis.srem(userKey(userId), sessionId),\n          );\n        }\n\n        return records;\n      }),\n\n    revoke: (sessionId: string) =>\n      Effect.gen(function* () {\n        const raw = yield* attempt('Redis session revoke read failed', () =>\n          redis.get(sessionKey(sessionId)),\n        );\n        yield* attempt('Redis session revoke failed', () =>\n          redis.del(sessionKey(sessionId)),\n        );\n        if (raw !== null) {\n          const record = parseRecord(raw);\n          yield* attempt('Redis session index cleanup failed', () =>\n            redis.srem(userKey(record.userId), sessionId),\n          );\n        }\n      }),\n\n    revokeAllForUser: (userId: EntityId) =>\n      Effect.gen(function* () {\n        const sessionIds = yield* attempt(\n          'Redis session index scan failed',\n          () => redis.smembers(userKey(userId)),\n        );\n        for (const sessionId of sessionIds) {\n          yield* attempt('Redis session bulk revoke failed', () =>\n            redis.del(sessionKey(sessionId)),\n          );\n        }\n        yield* attempt('Redis session index drop failed', () =>\n          redis.del(userKey(userId)),\n        );\n      }),\n\n    revokeAllForUserExcept: (userId: EntityId, keepSessionId: string) =>\n      Effect.gen(function* () {\n        const sessionIds = yield* attempt(\n          'Redis session index scan failed',\n          () => redis.smembers(userKey(userId)),\n        );\n        for (const sessionId of sessionIds) {\n          if (sessionId === keepSessionId) continue;\n          yield* attempt('Redis session bulk revoke failed', () =>\n            redis.del(sessionKey(sessionId)),\n          );\n          yield* attempt('Redis session index cleanup failed', () =>\n            redis.srem(userKey(userId), sessionId),\n          );\n        }\n      }),\n  };\n};\n\n/** Provides {@link SessionStoreTag} from a {@link RedisTag} connection. */\nexport const RedisSessionStoreLayer = (\n  options: RedisSessionStoreOptions = {},\n) =>\n  Layer.effect(\n    SessionStoreTag,\n    Effect.map(RedisTag, redis => makeRedisSessionStore(redis, options)),\n  );\n"],"names":["randomBytes","SessionStoreTag","EntifixConnError","EntifixLogicError","Effect","Layer","RedisTag","DEFAULT_SESSION_NAMESPACE","mintSessionId","toString","makeRedisSessionStore","redis","options","namespace","sessionKey","sessionId","userKey","userId","String","attempt","what","run","tryPromise","try","catch","error","parseRecord","raw","record","JSON","parse","Number","isNaN","Date","absoluteExpiresAt","expiresAt","create","data","lifetime","gen","createdAt","ttlSeconds","Math","min","idleTtlSeconds","absoluteTtlSeconds","getTime","toISOString","set","stringify","sadd","expire","read","get","fail","undefined","touch","now","secondsToCeiling","floor","del","srem","renewed","listForUser","sessionIds","smembers","records","stale","push","revoke","revokeAllForUser","revokeAllForUserExcept","keepSessionId","RedisSessionStoreLayer","effect","map"],"mappings":";AAAA,SAASA,WAAW,QAAQ,cAAc;AAE1C,SAKEC,eAAe,QACV,oBAAoB;AAC3B,SACEC,gBAAgB,EAChBC,iBAAiB,QAEZ,gBAAgB;AACvB,SAASC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAGvC,SAASC,QAAQ,QAAQ,0CAA0C;AAEnE,sEAAsE,GACtE,OAAO,MAAMC,4BAA4B,UAAU;AAOnD,gEAAgE,GAChE,MAAMC,gBAAgB,IAAcR,YAAY,IAAIS,QAAQ,CAAC;AAE7D;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,OACAC,UAAoC,CAAC,CAAC;QAEpBA;IAAlB,MAAMC,aAAYD,qBAAAA,QAAQC,SAAS,YAAjBD,qBAAqBL;IACvC,MAAMO,aAAa,CAACC,YAA8B,GAAGF,UAAU,CAAC,EAAEE,WAAW;IAC7E,MAAMC,UAAU,CAACC,SACf,GAAGJ,UAAU,MAAM,EAAEK,OAAOD,SAAS;IAEvC,MAAME,UAAU,CAAIC,MAAcC,MAChCjB,OAAOkB,UAAU,CAAC;YAChBC,KAAKF;YACLG,OAAOC,CAAAA,QAAS,IAAIvB,iBAAiBkB,MAAMK;QAC7C;IAEF;;;;;;;;;;;;;GAaC,GACD,MAAMC,cAAc,CAACC;YAEYC;QAD/B,MAAMA,SAASC,KAAKC,KAAK,CAACH;QAC1B,OAAOI,OAAOC,KAAK,CAACC,KAAKH,KAAK,EAACF,4BAAAA,OAAOM,iBAAiB,YAAxBN,4BAA4B,OACvD,aAAKA;YAAQM,mBAAmBN,OAAOO,SAAS;aAChDP;IACN;IAEA,OAAO;QACLQ,QAAQ,CAACC,MAAmBC,WAC1BlC,OAAOmC,GAAG,CAAC;gBACT,MAAMxB,YAAYP;gBAClB,MAAMgC,YAAY,IAAIP;gBACtB,uEAAuE;gBACvE,yEAAyE;gBACzE,MAAMQ,aAAaC,KAAKC,GAAG,CACzBL,SAASM,cAAc,EACvBN,SAASO,kBAAkB;gBAE7B,MAAMV,YAAY,IAAIF,KAAKO,UAAUM,OAAO,KAAKL,aAAa;gBAC9D,MAAMP,oBAAoB,IAAID,KAC5BO,UAAUM,OAAO,KAAKR,SAASO,kBAAkB,GAAG;gBAEtD,MAAMjB,SAAwB,aACzBS;oBACHtB;oBACAyB,WAAWA,UAAUO,WAAW;oBAChCZ,WAAWA,UAAUY,WAAW;oBAChCb,mBAAmBA,kBAAkBa,WAAW;;gBAElD,OAAO5B,QAAQ,+BAA+B,IAC5CR,MAAMqC,GAAG,CACPlC,WAAWC,YACXc,KAAKoB,SAAS,CAACrB,SACf,MACAa;gBAGJ,OAAOtB,QAAQ,8BAA8B,IAC3CR,MAAMuC,IAAI,CAAClC,QAAQqB,KAAKpB,MAAM,GAAGF;gBAEnC,gEAAgE;gBAChE,wBAAwB;gBACxB,OAAOI,QAAQ,kCAAkC,IAC/CR,MAAMwC,MAAM,CAACnC,QAAQqB,KAAKpB,MAAM,GAAGqB,SAASO,kBAAkB;gBAEhE,OAAO9B;YACT;QAEFqC,MAAM,CAACrC,YACLX,OAAOmC,GAAG,CAAC;gBACT,MAAMZ,MAAM,OAAOR,QAAQ,6BAA6B,IACtDR,MAAM0C,GAAG,CAACvC,WAAWC;gBAEvB,IAAIY,QAAQ,MAAM;oBAChB,OAAO,OAAOvB,OAAOkD,IAAI,CACvB,IAAInD,kBAAkB,gCAAgCoD,WAAW;wBAC/DxC;oBACF;gBAEJ;gBACA,OAAOW,YAAYC;YACrB;QAEF6B,OAAO,CAACzC,WAAmB6B,iBACzBxC,OAAOmC,GAAG,CAAC;gBACT,MAAMZ,MAAM,OAAOR,QAAQ,mCAAmC,IAC5DR,MAAM0C,GAAG,CAACvC,WAAWC;gBAEvB,IAAIY,QAAQ,MAAM;oBAChB,OAAO,OAAOvB,OAAOkD,IAAI,CACvB,IAAInD,kBAAkB,gCAAgCoD,WAAW;wBAC/DxC;oBACF;gBAEJ;gBAEA,MAAMa,SAASF,YAAYC;gBAC3B,MAAM8B,MAAMxB,KAAKwB,GAAG;gBACpB,MAAMC,mBAAmBhB,KAAKiB,KAAK,CACjC,AAAC1B,CAAAA,KAAKH,KAAK,CAACF,OAAOM,iBAAiB,IAAIuB,GAAE,IAAK;gBAEjD,uEAAuE;gBACvE,sEAAsE;gBACtE,mEAAmE;gBACnE,IAAIC,oBAAoB,GAAG;oBACzB,OAAOvC,QAAQ,sCAAsC,IACnDR,MAAMiD,GAAG,CAAC9C,WAAWC;oBAEvB,OAAOI,QAAQ,sCAAsC,IACnDR,MAAMkD,IAAI,CAAC7C,QAAQY,OAAOX,MAAM,GAAGF;oBAErC,OAAO,OAAOX,OAAOkD,IAAI,CACvB,IAAInD,kBACF,yCACAoD,WACA;wBACExC;wBACAmB,mBAAmBN,OAAOM,iBAAiB;oBAC7C;gBAGN;gBAEA,MAAMO,aAAaC,KAAKC,GAAG,CAACC,gBAAgBc;gBAC5C,MAAMI,UAAyB,aAC1BlC;oBACHO,WAAW,IAAIF,KAAKwB,MAAMhB,aAAa,MAAMM,WAAW;;gBAE1D,OAAO5B,QAAQ,8BAA8B,IAC3CR,MAAMqC,GAAG,CACPlC,WAAWC,YACXc,KAAKoB,SAAS,CAACa,UACf,MACArB;YAGN;QAEFsB,aAAa,CAAC9C,SACZb,OAAOmC,GAAG,CAAC;gBACT,MAAMyB,aAAa,OAAO7C,QACxB,mCACA,IAAMR,MAAMsD,QAAQ,CAACjD,QAAQC;gBAG/B,MAAMiD,UAA2B,EAAE;gBACnC,MAAMC,QAAkB,EAAE;gBAC1B,KAAK,MAAMpD,aAAaiD,WAAY;oBAClC,MAAMrC,MAAM,OAAOR,QAAQ,kCAAkC,IAC3DR,MAAM0C,GAAG,CAACvC,WAAWC;oBAEvB,mEAAmE;oBACnE,oEAAoE;oBACpE,gEAAgE;oBAChE,IAAIY,QAAQ,MAAMwC,MAAMC,IAAI,CAACrD;yBACxBmD,QAAQE,IAAI,CAAC1C,YAAYC;gBAChC;gBACA,KAAK,MAAMZ,aAAaoD,MAAO;oBAC7B,OAAOhD,QAAQ,oCAAoC,IACjDR,MAAMkD,IAAI,CAAC7C,QAAQC,SAASF;gBAEhC;gBAEA,OAAOmD;YACT;QAEFG,QAAQ,CAACtD,YACPX,OAAOmC,GAAG,CAAC;gBACT,MAAMZ,MAAM,OAAOR,QAAQ,oCAAoC,IAC7DR,MAAM0C,GAAG,CAACvC,WAAWC;gBAEvB,OAAOI,QAAQ,+BAA+B,IAC5CR,MAAMiD,GAAG,CAAC9C,WAAWC;gBAEvB,IAAIY,QAAQ,MAAM;oBAChB,MAAMC,SAASF,YAAYC;oBAC3B,OAAOR,QAAQ,sCAAsC,IACnDR,MAAMkD,IAAI,CAAC7C,QAAQY,OAAOX,MAAM,GAAGF;gBAEvC;YACF;QAEFuD,kBAAkB,CAACrD,SACjBb,OAAOmC,GAAG,CAAC;gBACT,MAAMyB,aAAa,OAAO7C,QACxB,mCACA,IAAMR,MAAMsD,QAAQ,CAACjD,QAAQC;gBAE/B,KAAK,MAAMF,aAAaiD,WAAY;oBAClC,OAAO7C,QAAQ,oCAAoC,IACjDR,MAAMiD,GAAG,CAAC9C,WAAWC;gBAEzB;gBACA,OAAOI,QAAQ,mCAAmC,IAChDR,MAAMiD,GAAG,CAAC5C,QAAQC;YAEtB;QAEFsD,wBAAwB,CAACtD,QAAkBuD,gBACzCpE,OAAOmC,GAAG,CAAC;gBACT,MAAMyB,aAAa,OAAO7C,QACxB,mCACA,IAAMR,MAAMsD,QAAQ,CAACjD,QAAQC;gBAE/B,KAAK,MAAMF,aAAaiD,WAAY;oBAClC,IAAIjD,cAAcyD,eAAe;oBACjC,OAAOrD,QAAQ,oCAAoC,IACjDR,MAAMiD,GAAG,CAAC9C,WAAWC;oBAEvB,OAAOI,QAAQ,sCAAsC,IACnDR,MAAMkD,IAAI,CAAC7C,QAAQC,SAASF;gBAEhC;YACF;IACJ;AACF,EAAE;AAEF,yEAAyE,GACzE,OAAO,MAAM0D,yBAAyB,CACpC7D,UAAoC,CAAC,CAAC,GAEtCP,MAAMqE,MAAM,CACVzE,iBACAG,OAAOuE,GAAG,CAACrE,UAAUK,CAAAA,QAASD,sBAAsBC,OAAOC,WAC3D"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './adapters/redis-one-time-token-store.js';
+export * from './adapters/redis-session-store.js';
+export * from './redis-connection/redis-connection.js';
+export * from './redis-connection/redis-health-probe.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0CAA0C,CAAC;AACzD,cAAc,mCAAmC,CAAC;AAClD,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from './adapters/redis-one-time-token-store.js';
+export * from './adapters/redis-session-store.js';
+export * from './redis-connection/redis-connection.js';
+export * from './redis-connection/redis-health-probe.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './adapters/redis-one-time-token-store.js';\nexport * from './adapters/redis-session-store.js';\nexport * from './redis-connection/redis-connection.js';\nexport * from './redis-connection/redis-health-probe.js';\n"],"names":[],"mappings":"AAAA,cAAc,2CAA2C;AACzD,cAAc,oCAAoC;AAClD,cAAc,yCAAyC;AACvD,cAAc,2CAA2C"}

package/dist/redis-connection/redis-connection.d.ts

@@ -0,0 +1,29 @@
+import { EntifixConnError } from '@entifix/core';
+import { Context, Layer } from 'effect';
+import { Redis } from 'ioredis';
+declare const RedisTag_base: Context.TagClass<RedisTag, "RedisTag", Redis<"legacy">>;
+/** DI tag carrying a connected ioredis client. */
+export declare class RedisTag extends RedisTag_base {
+}
+export interface RedisSettings {
+    readonly uri: string;
+}
+/**
+ * A scoped {@link Layer} that opens an ioredis connection on acquire and quits
+ * it on release, mirroring `MongoDatabaseLayer`. `lazyConnect` + an explicit
+ * `connect()` surfaces a bad URI/credentials at boot instead of on first command.
+ *
+ * The reconnect policy is spelled out rather than left to defaults, because two
+ * defaults are actively wrong for a service with a readiness endpoint:
+ *
+ * - **`enableOfflineQueue: false`** — the default queues commands while the
+ *   connection is down, so a health probe *hangs* instead of failing. Readiness
+ *   has to answer fastest exactly when a datastore is gone.
+ * - **an explicit `retryStrategy`** — so a connection that drops (Redis
+ *   restarted, pod rescheduled) is re-established for the lifetime of the
+ *   process. Without it the client can settle into a terminal state and the
+ *   service stays degraded until someone restarts it, even after Redis is back.
+ */
+export declare const RedisLayer: (settings: RedisSettings) => Layer.Layer<RedisTag, EntifixConnError>;
+export {};
+//# sourceMappingURL=redis-connection.d.ts.map

package/dist/redis-connection/redis-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-connection.d.ts","sourceRoot":"","sources":["../../src/redis-connection/redis-connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,OAAO,EAAU,KAAK,EAAY,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;;AAEhC,kDAAkD;AAClD,qBAAa,QAAS,SAAQ,aAA0C;CAAG;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,UAAU,GACrB,UAAU,aAAa,KACtB,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAgCtC,CAAC"}

package/dist/redis-connection/redis-connection.js

@@ -0,0 +1,43 @@
+import { EntifixConnError } from '@entifix/core';
+import { Context, Effect, Layer, Schedule } from 'effect';
+import { Redis } from 'ioredis';
+/** DI tag carrying a connected ioredis client. */ export class RedisTag extends Context.Tag('RedisTag')() {
+}
+/**
+ * How long the initial connect keeps trying before the service gives up.
+ *
+ * Boot order is not guaranteed: a service can start while Redis is still
+ * rolling out (`ensure-infra` brought the cluster up moments earlier), and
+ * dying on the first refused connection turns a five-second wait into a dead
+ * process that nothing restarts.
+ */ const CONNECT_RETRY_WINDOW = '30 seconds';
+/**
+ * A scoped {@link Layer} that opens an ioredis connection on acquire and quits
+ * it on release, mirroring `MongoDatabaseLayer`. `lazyConnect` + an explicit
+ * `connect()` surfaces a bad URI/credentials at boot instead of on first command.
+ *
+ * The reconnect policy is spelled out rather than left to defaults, because two
+ * defaults are actively wrong for a service with a readiness endpoint:
+ *
+ * - **`enableOfflineQueue: false`** — the default queues commands while the
+ *   connection is down, so a health probe *hangs* instead of failing. Readiness
+ *   has to answer fastest exactly when a datastore is gone.
+ * - **an explicit `retryStrategy`** — so a connection that drops (Redis
+ *   restarted, pod rescheduled) is re-established for the lifetime of the
+ *   process. Without it the client can settle into a terminal state and the
+ *   service stays degraded until someone restarts it, even after Redis is back.
+ */ export const RedisLayer = (settings)=>Layer.scoped(RedisTag, Effect.acquireRelease(Effect.tryPromise({
+        try: async ()=>{
+            const redis = new Redis(settings.uri, {
+                lazyConnect: true,
+                maxRetriesPerRequest: 1,
+                enableOfflineQueue: false,
+                retryStrategy: (times)=>Math.min(times * 200, 5000)
+            });
+            await redis.connect();
+            return redis;
+        },
+        catch: (error)=>new EntifixConnError('Failed to connect to Redis', error)
+    }).pipe(Effect.retry(Schedule.exponential('250 millis').pipe(Schedule.upTo(CONNECT_RETRY_WINDOW)))), (redis)=>Effect.promise(()=>redis.quit().then(()=>undefined).catch(()=>undefined))));
+
+//# sourceMappingURL=redis-connection.js.map

package/dist/redis-connection/redis-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/redis-connection/redis-connection.ts"],"sourcesContent":["import { EntifixConnError } from '@entifix/core';\nimport { Context, Effect, Layer, Schedule } from 'effect';\nimport { Redis } from 'ioredis';\n\n/** DI tag carrying a connected ioredis client. */\nexport class RedisTag extends Context.Tag('RedisTag')<RedisTag, Redis>() {}\n\nexport interface RedisSettings {\n  readonly uri: string;\n}\n\n/**\n * How long the initial connect keeps trying before the service gives up.\n *\n * Boot order is not guaranteed: a service can start while Redis is still\n * rolling out (`ensure-infra` brought the cluster up moments earlier), and\n * dying on the first refused connection turns a five-second wait into a dead\n * process that nothing restarts.\n */\nconst CONNECT_RETRY_WINDOW = '30 seconds';\n\n/**\n * A scoped {@link Layer} that opens an ioredis connection on acquire and quits\n * it on release, mirroring `MongoDatabaseLayer`. `lazyConnect` + an explicit\n * `connect()` surfaces a bad URI/credentials at boot instead of on first command.\n *\n * The reconnect policy is spelled out rather than left to defaults, because two\n * defaults are actively wrong for a service with a readiness endpoint:\n *\n * - **`enableOfflineQueue: false`** — the default queues commands while the\n *   connection is down, so a health probe *hangs* instead of failing. Readiness\n *   has to answer fastest exactly when a datastore is gone.\n * - **an explicit `retryStrategy`** — so a connection that drops (Redis\n *   restarted, pod rescheduled) is re-established for the lifetime of the\n *   process. Without it the client can settle into a terminal state and the\n *   service stays degraded until someone restarts it, even after Redis is back.\n */\nexport const RedisLayer = (\n  settings: RedisSettings,\n): Layer.Layer<RedisTag, EntifixConnError> =>\n  Layer.scoped(\n    RedisTag,\n    Effect.acquireRelease(\n      Effect.tryPromise({\n        try: async () => {\n          const redis = new Redis(settings.uri, {\n            lazyConnect: true,\n            maxRetriesPerRequest: 1,\n            enableOfflineQueue: false,\n            retryStrategy: times => Math.min(times * 200, 5_000),\n          });\n          await redis.connect();\n          return redis;\n        },\n        catch: error =>\n          new EntifixConnError('Failed to connect to Redis', error),\n      }).pipe(\n        Effect.retry(\n          Schedule.exponential('250 millis').pipe(\n            Schedule.upTo(CONNECT_RETRY_WINDOW),\n          ),\n        ),\n      ),\n      redis =>\n        Effect.promise(() =>\n          redis\n            .quit()\n            .then(() => undefined)\n            .catch(() => undefined),\n        ),\n    ),\n  );\n"],"names":["EntifixConnError","Context","Effect","Layer","Schedule","Redis","RedisTag","Tag","CONNECT_RETRY_WINDOW","RedisLayer","settings","scoped","acquireRelease","tryPromise","try","redis","uri","lazyConnect","maxRetriesPerRequest","enableOfflineQueue","retryStrategy","times","Math","min","connect","catch","error","pipe","retry","exponential","upTo","promise","quit","then","undefined"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,gBAAgB;AACjD,SAASC,OAAO,EAAEC,MAAM,EAAEC,KAAK,EAAEC,QAAQ,QAAQ,SAAS;AAC1D,SAASC,KAAK,QAAQ,UAAU;AAEhC,gDAAgD,GAChD,OAAO,MAAMC,iBAAiBL,QAAQM,GAAG,CAAC;AAAgC;AAM1E;;;;;;;CAOC,GACD,MAAMC,uBAAuB;AAE7B;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,aAAa,CACxBC,WAEAP,MAAMQ,MAAM,CACVL,UACAJ,OAAOU,cAAc,CACnBV,OAAOW,UAAU,CAAC;QAChBC,KAAK;YACH,MAAMC,QAAQ,IAAIV,MAAMK,SAASM,GAAG,EAAE;gBACpCC,aAAa;gBACbC,sBAAsB;gBACtBC,oBAAoB;gBACpBC,eAAeC,CAAAA,QAASC,KAAKC,GAAG,CAACF,QAAQ,KAAK;YAChD;YACA,MAAMN,MAAMS,OAAO;YACnB,OAAOT;QACT;QACAU,OAAOC,CAAAA,QACL,IAAI1B,iBAAiB,8BAA8B0B;IACvD,GAAGC,IAAI,CACLzB,OAAO0B,KAAK,CACVxB,SAASyB,WAAW,CAAC,cAAcF,IAAI,CACrCvB,SAAS0B,IAAI,CAACtB,0BAIpBO,CAAAA,QACEb,OAAO6B,OAAO,CAAC,IACbhB,MACGiB,IAAI,GACJC,IAAI,CAAC,IAAMC,WACXT,KAAK,CAAC,IAAMS,cAGrB"}

package/dist/redis-connection/redis-health-probe.d.ts

@@ -0,0 +1,19 @@
+import { HealthRegistryTag } from '@entifix/business';
+import { Layer } from 'effect';
+import { RedisTag } from './redis-connection.js';
+/** Probe name reported by `/api/health/ready` when Redis is unreachable. */
+export declare const REDIS_PROBE_NAME = "redis";
+/**
+ * Registers a readiness probe for the Redis connection: `PING`.
+ *
+ * Sessions live here, so a service that cannot reach Redis can still answer
+ * liveness (its process is fine) while readiness reports the truth — which is
+ * exactly the split Kubernetes acts on: drain traffic, do not restart.
+ *
+ * `stores` names the Stores this connection backs, by their register name in
+ * `tools/slices/` — `['session']`, `['saga-coordination']`. See
+ * {@link MongoHealthProbeLayer} for why the composition root supplies it
+ * (ADR 0031).
+ */
+export declare const RedisHealthProbeLayer: (stores: readonly string[]) => Layer.Layer<never, never, RedisTag | HealthRegistryTag>;
+//# sourceMappingURL=redis-health-probe.d.ts.map

package/dist/redis-connection/redis-health-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-health-probe.d.ts","sourceRoot":"","sources":["../../src/redis-connection/redis-health-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GAChC,QAAQ,SAAS,MAAM,EAAE,KACxB,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,GAAG,iBAAiB,CAgBtD,CAAC"}

package/dist/redis-connection/redis-health-probe.js

@@ -0,0 +1,27 @@
+import { HealthRegistryTag } from '@entifix/business';
+import { Effect, Layer } from 'effect';
+import { RedisTag } from './redis-connection.js';
+/** Probe name reported by `/api/health/ready` when Redis is unreachable. */ export const REDIS_PROBE_NAME = 'redis';
+/**
+ * Registers a readiness probe for the Redis connection: `PING`.
+ *
+ * Sessions live here, so a service that cannot reach Redis can still answer
+ * liveness (its process is fine) while readiness reports the truth — which is
+ * exactly the split Kubernetes acts on: drain traffic, do not restart.
+ *
+ * `stores` names the Stores this connection backs, by their register name in
+ * `tools/slices/` — `['session']`, `['saga-coordination']`. See
+ * {@link MongoHealthProbeLayer} for why the composition root supplies it
+ * (ADR 0031).
+ */ export const RedisHealthProbeLayer = (stores)=>Layer.effectDiscard(Effect.gen(function*() {
+        const redis = yield* RedisTag;
+        const registry = yield* HealthRegistryTag;
+        yield* registry.register({
+            name: REDIS_PROBE_NAME,
+            kind: 'datastore',
+            targets: stores,
+            check: Effect.tryPromise(()=>redis.ping()).pipe(Effect.map((reply)=>reply === 'PONG'), Effect.catchAll(()=>Effect.succeed(false)))
+        });
+    }));
+
+//# sourceMappingURL=redis-health-probe.js.map

package/dist/redis-connection/redis-health-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/redis-connection/redis-health-probe.ts"],"sourcesContent":["import { HealthRegistryTag } from '@entifix/business';\nimport { Effect, Layer } from 'effect';\n\nimport { RedisTag } from './redis-connection.js';\n\n/** Probe name reported by `/api/health/ready` when Redis is unreachable. */\nexport const REDIS_PROBE_NAME = 'redis';\n\n/**\n * Registers a readiness probe for the Redis connection: `PING`.\n *\n * Sessions live here, so a service that cannot reach Redis can still answer\n * liveness (its process is fine) while readiness reports the truth — which is\n * exactly the split Kubernetes acts on: drain traffic, do not restart.\n *\n * `stores` names the Stores this connection backs, by their register name in\n * `tools/slices/` — `['session']`, `['saga-coordination']`. See\n * {@link MongoHealthProbeLayer} for why the composition root supplies it\n * (ADR 0031).\n */\nexport const RedisHealthProbeLayer = (\n  stores: readonly string[],\n): Layer.Layer<never, never, RedisTag | HealthRegistryTag> =>\n  Layer.effectDiscard(\n    Effect.gen(function* () {\n      const redis = yield* RedisTag;\n      const registry = yield* HealthRegistryTag;\n\n      yield* registry.register({\n        name: REDIS_PROBE_NAME,\n        kind: 'datastore',\n        targets: stores,\n        check: Effect.tryPromise(() => redis.ping()).pipe(\n          Effect.map(reply => reply === 'PONG'),\n          Effect.catchAll(() => Effect.succeed(false)),\n        ),\n      });\n    }),\n  );\n"],"names":["HealthRegistryTag","Effect","Layer","RedisTag","REDIS_PROBE_NAME","RedisHealthProbeLayer","stores","effectDiscard","gen","redis","registry","register","name","kind","targets","check","tryPromise","ping","pipe","map","reply","catchAll","succeed"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,oBAAoB;AACtD,SAASC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAEvC,SAASC,QAAQ,QAAQ,wBAAwB;AAEjD,0EAA0E,GAC1E,OAAO,MAAMC,mBAAmB,QAAQ;AAExC;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,SAEAJ,MAAMK,aAAa,CACjBN,OAAOO,GAAG,CAAC;QACT,MAAMC,QAAQ,OAAON;QACrB,MAAMO,WAAW,OAAOV;QAExB,OAAOU,SAASC,QAAQ,CAAC;YACvBC,MAAMR;YACNS,MAAM;YACNC,SAASR;YACTS,OAAOd,OAAOe,UAAU,CAAC,IAAMP,MAAMQ,IAAI,IAAIC,IAAI,CAC/CjB,OAAOkB,GAAG,CAACC,CAAAA,QAASA,UAAU,SAC9BnB,OAAOoB,QAAQ,CAAC,IAAMpB,OAAOqB,OAAO,CAAC;QAEzC;IACF,IACA"}

package/dist/transactions/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The half of this package that needs `@entifix/transactions`: the `LockService`
+ * and `SequenceService` implementations.
+ *
+ * Behind a subpath so a session store or a one-time-token store — neither of
+ * which knows anything about a saga — can be taken on its own. What keeps it
+ * optional is the `peerDependenciesMeta.optional` entry in the manifest.
+ */
+export * from '../adapters/redis-lock-service.js';
+export * from '../adapters/redis-sequence-service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/transactions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transactions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC"}

package/dist/transactions/index.js

@@ -0,0 +1,11 @@
+/**
+ * The half of this package that needs `@entifix/transactions`: the `LockService`
+ * and `SequenceService` implementations.
+ *
+ * Behind a subpath so a session store or a one-time-token store — neither of
+ * which knows anything about a saga — can be taken on its own. What keeps it
+ * optional is the `peerDependenciesMeta.optional` entry in the manifest.
+ */ export * from '../adapters/redis-lock-service.js';
+export * from '../adapters/redis-sequence-service.js';
+
+//# sourceMappingURL=index.js.map

package/dist/transactions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/transactions/index.ts"],"sourcesContent":["/**\n * The half of this package that needs `@entifix/transactions`: the `LockService`\n * and `SequenceService` implementations.\n *\n * Behind a subpath so a session store or a one-time-token store — neither of\n * which knows anything about a saga — can be taken on its own. What keeps it\n * optional is the `peerDependenciesMeta.optional` entry in the manifest.\n */\nexport * from '../adapters/redis-lock-service.js';\nexport * from '../adapters/redis-sequence-service.js';\n"],"names":[],"mappings":"AAAA;;;;;;;CAOC,GACD,cAAc,oCAAoC;AAClD,cAAc,wCAAwC"}

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "@entifix/redis",
+  "version": "0.1.0-0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/r10c-technologies/entifix.git",
+    "directory": "packages/ts/redis-client"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "@entifix/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./transactions": {
+      "@entifix/source": "./src/transactions/index.ts",
+      "types": "./dist/transactions/index.d.ts",
+      "import": "./dist/transactions/index.js",
+      "default": "./dist/transactions/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!**/*.tsbuildinfo",
+    "LICENSE"
+  ],
+  "nx": {
+    "tags": [
+      "layer:entifix",
+      "scope:shared",
+      "entifix:client",
+      "runtime:datastore",
+      "tier:2"
+    ],
+    "sourceRoot": "packages/ts/redis-client/src",
+    "targets": {
+      "build": {
+        "executor": "@nx/js:swc",
+        "outputs": [
+          "{options.outputPath}"
+        ],
+        "options": {
+          "outputPath": "packages/ts/redis-client/dist",
+          "main": "packages/ts/redis-client/src/index.ts",
+          "tsConfig": "packages/ts/redis-client/tsconfig.lib.json",
+          "skipTypeCheck": true,
+          "stripLeadingPaths": true
+        }
+      }
+    }
+  },
+  "dependencies": {
+    "@swc/helpers": "0.5.23",
+    "ioredis": "6.0.0",
+    "@entifix/business": "0.1.0-0",
+    "@entifix/core": "0.1.0-0"
+  },
+  "devDependencies": {
+    "effect": "3.22.1",
+    "@entifix/transactions": "0.1.0-0",
+    "@entifix/testing-unit": "0.1.0-0"
+  },
+  "peerDependencies": {
+    "effect": ">=3.22 <4",
+    "@entifix/transactions": "0.1.0-0"
+  },
+  "peerDependenciesMeta": {
+    "@entifix/transactions": {
+      "optional": true
+    }
+  }
+}