@ionite/redis-core 0.0.21

package/README.md

@@ -0,0 +1,139 @@
+# @ionite/redis-core
+
+Redis-backed store implementations for ionite: **UserStore**, **SessionStore**, **MagicLinkStore**, **WorkloadTokenStore**, **AccessCatalogStore** (group/role/permission/resource definitions), **AccessAssignmentStore** (granted roots), **AccessIndex** (derived closure for fast `has*` checks), and **TenantStore**. Drop-in replacements for the in-memory stores from `@ionite/server`, suitable for production when you need persistence and/or multi-instance sharing.
+
+This package provides the **stores**, the **RedisAdapter interface**, and the **driver-agnostic reactive helper** used by the package-specific `ionRedis(...)` wrappers. It does **not** include adapters for specific Redis clients.
+
+## When to use this package
+
+- **Custom adapter:** You implement the `RedisAdapter` interface yourself (e.g. for Bun.redis, Upstash, or a custom wrapper). Install `@ionite/redis-core` and pass your adapter to the store constructors.
+- **Custom reactive adapter:** You want the same secret-driven reconnect behavior as `@ionite/redis` / `@ionite/ioredis`, but for your own Redis client. Use `createReactiveRedis(...)` from this package.
+- **Pre-built client:** Use one of the adapter packages instead so you get the adapter and stores from a single import. You do **not** need to install `@ionite/redis-core`:
+  - **node-redis (v5 or v4)** → `@ionite/redis` (includes adapter and stores)
+  - **ioredis** → `@ionite/ioredis`
+
+## Installation (custom adapter only)
+
+```bash
+bun add @ionite/redis-core
+```
+
+## Adapter interface
+
+Stores accept a **RedisAdapter**. Implement this interface for your Redis client:
+
+- **Required:** `get`, `set`, `setex`, `del`, `sadd`, `srem`, `smembers`, `mget`
+- **List ordering:** `list()` returns records in a **stable, deterministic order** (ids sorted lexicographically via `SMEMBERS` + `MGET`), so offset pagination is coherent across pages. No sorted-set support is required; UI-style sorting is the caller's concern.
+- **Optional (atomic consume):** `getdel(key)` — when present, the magic-link store consumes a link atomically (Redis `GETDEL`, **Redis 6.2+**) so concurrent consumes yield exactly one winner; otherwise it falls back to a best-effort get-then-del. The bundled `@ionite/redis` and `@ionite/ioredis` adapters implement it natively, and `ionRedis(...)` forwards it from the active client.
+- **Optional (intra-store atomicity):** `runScript(script, keys, args)` — runs a server-side Lua script (the Redis `EVAL` command; **not** the JavaScript `eval()` sink — nothing is dynamically executed in your process). When present, the stores run create-if-absent, unique-index claim-or-fail, multi-key writes, and session compare-and-set read-modify-write as one all-or-nothing unit (§5.9, §8.2). When absent, the stores fall back to best-effort sequenced writes that still perform all checks before any write (fail-fast + idempotent replay); only write isolation differs. A genuine create/uniqueness collision throws a typed `StoreConflictError` (from `@ionite/core`); an identical replay is treated as success. Script bodies are static SDK-authored text and all dynamic values are passed via `keys`/`args` (referenced as `KEYS[i]`/`ARGV[j]`), so there is no Lua-injection vector. `ionRedis(...)` forwards `runScript` from the active client, so the atomic paths apply over secret-backed reactive connections too.
+- **Session updates (§8.2):** `SessionStore.update(...)` reads the record, shallow-merges the patch in JS (exact `JSON.stringify` semantics — arrays and large values of untouched fields are left byte-for-byte, no `cjson` round-trip), then compare-and-sets, retrying on contention before a final best-effort write. Concurrent partial updates cannot clobber each other. The session key TTL is derived from `session.expiresAt`: `create` uses `SET ... EX`, and `update`'s compare-and-set carries `EX` (or `KEEPTTL` when the merged record has no `expiresAt`), so expired and refresh-rotation-grace records are physically reaped by Redis with no read-path bookkeeping. The optional adapter `ttl(key)` method exposes the remaining TTL for diagnostics/validation.
+
+## Reactive helper
+
+`createReactiveRedis(...)` creates one stable `RedisAdapter` object that can swap its underlying connected client when a secret version changes. The package-specific `ionRedis(...)` wrappers use this helper internally.
+
+Use it when:
+
+- your Redis client is not node-redis or ioredis
+- the Redis connection details come from `ion.secrets`
+- you want one stable adapter that can be constructed before secrets arrive
+
+Your custom client factory returns `{ adapter, dispose? }`, and the helper handles source-bound async get-then-watch secret subscription, reconnect dedupe by secret version, source-handle swaps during a config change, operation-level waiting until the first client is ready, and `ready()` when you want an explicit startup barrier. Subscriptions default to fail-fast, so missing Redis secrets reject `ready()` and store operations instead of waiting silently forever; pass `subscription: { mode: 'wait', timeout?: number }` only when waiting for the secret to appear is intentional.
+
+## Options
+
+All store constructors take **RedisStoreOptions**:
+
+- **`redis`** (required): A `RedisAdapter` instance.
+- **`keyPrefix`** (**required**): Key prefix for all keys. There is no implicit default. In multi-tenant deployments each tenant MUST use a distinct prefix (e.g. `es:t:<tenantId>:`) so the global index sets (`user:ids`, `tenant:ids`, …) auto-namespace and never collide across tenants. An empty or missing prefix throws.
+- **`logger`** (optional): `Logger` from `@ionite/core` (default `defaultLogger`).
+
+`RedisTenantStore` also accepts:
+
+- **`ionCache`** (optional): an app-owned `TenantIonCache` (`{ fetch(id), delete(id) }`, structurally compatible with `LRUCache<string, Ionite>`). `getIon(id)` delegates to `ionCache.fetch(id)`; calling `getIon(...)` without an `ionCache` throws. `upsert`/`delete` call `ionCache.delete(id)` so a changed/removed record invalidates (and, via the cache's `dispose`, closes) the stale runtime. The SDK never caches tenant runtimes itself — the tenant *record* is a plain, non-sensitive Redis lookup; only the runtime (which reads sensitive RemoteConfig from the vault) is cached, and that cache is yours.
+- **Tenant config persistence:** Redis tenant stores persist tenant metadata, including an optional narrow `TenantConfigLocator` (`{ source?, path, ttl? }`) stored at `tenant.configLocator`. In your cache's `fetchMethod`, call `tenantConfigSource(tenant.configLocator, es)` (passing the root `es`) to materialize the runtime `ConfigSource` when a locator is present, and wire `dispose: (es) => ion.close()` so evicted runtimes are released. See the "Tenant runtime cache" section of the root README for the canonical `lru-cache` pattern.
+- **Cross-node staleness:** each node's `ionCache` is independent, so a record change on one node is visible on another only when that node's cache entry expires (TTL) or it mutates the tenant itself. Size the cache `ttl` to your acceptable record-staleness window; config *content* changes still propagate live via the ConfigSource subscription.
+- **Directory note:** the SDK no longer ships tenant-directory methods (`findTenants`/`findUserTenants`) or `/mine`/`/discovery` endpoints. If your app needs a "which tenants can this user switch to" surface, build it in app code (e.g. a SQL join plus the kept `discoverSessionRecords`) with your own auth and rate limiting.
+
+## Example (custom adapter)
+
+```ts
+import type { RedisAdapter } from '@ionite/redis-core';
+import {
+  RedisAccessIndex,
+  RedisAccessAssignmentStore,
+  RedisAccessCatalogStore,
+  RedisUserStore,
+  RedisSessionStore,
+} from '@ionite/redis-core';
+
+const myAdapter: RedisAdapter = {
+  async get(key) { /* ... */ return null; },
+  async set(key, value) { /* ... */ },
+  async setex(key, seconds, value) { /* ... */ },
+  async del(key) { /* ... */ },
+  async sadd(key, ...members) { /* ... */ },
+  async srem(key, ...members) { /* ... */ },
+  async smembers(key) { /* ... */ return []; },
+  async mget(keys) { /* ... */ return keys.map(() => null); },
+};
+
+const keyPrefix = 'es:t:acme:'; // required, distinct per tenant
+const userStore = new RedisUserStore({ redis: myAdapter, keyPrefix });
+const sessionStore = new RedisSessionStore({ redis: myAdapter, keyPrefix });
+const accessStore = new RedisAccessAssignmentStore({ redis: myAdapter, keyPrefix });
+const accessIndex = new RedisAccessIndex({ redis: myAdapter, keyPrefix });
+const catalogStore = new RedisAccessCatalogStore({ redis: myAdapter, keyPrefix });
+```
+
+## Key layout
+
+Keys are prefixed with the required `keyPrefix` (examples below use `es:`):
+
+- **User:** `es:user:{id}`, indexes, set `es:user:ids`.
+- **Session:** `es:session:{sid}` (with TTL derived from `session.expiresAt`). Opaque auth sessions are looked up by `sid` alone within a configured `SessionStore`; tenant identity and claims are stored in the session value, not in a tenant-specific session key namespace.
+- **Magic link:** `es:magic:{token}` (with TTL).
+- **Workload token:** `es:workload:token:{workload_id}` (with TTL).
+- **Group:** `es:group:{id}`, indexes, set `es:group:ids`.
+- **Authz Catalog:** `es:authz:{group|role|permission}:{id}` plus per-kind `ids` sets. `RedisAccessCatalogStore` stores SCIM/IAM-sourced groups, roles, and permissions for SCIM Groups aggregation and OAA full sync (code-authored definitions belong in the code-declared catalog — `defineCatalog(...)` -> `FrameworkConfig.authz.catalog` — and are never seeded here). `set(entity)` returns a ready-aware catalog entry synchronously and performs the Redis write in the background; `entry.ready()` resolves once the write lands (and re-surfaces a failed write) while `entry.isReady()` reports its status.
+- **Resources:** `es:authz:resource:{id}` plus an `ids` set. `RedisResourceStore` is a Redis-backed writable `ResourceProvider` (`FrameworkStores.resources`) for apps without their own resource tables: `set(resource)` / `delete(id)` persist and emit the `changed` signal, and the optional `deriveEntitlements`/`resolveEntitlement` pair derives requestable per-resource entitlement Groups on demand.
+- **Access roots:** `es:access:{id}` (id = `accessRootId`, scope-aware), subject/target indexes, set `es:access:ids`. `RedisAccessAssignmentStore` stores granted `AccessChange` roots (with provenance, status, and resource scope) for SCIM grant/revoke routing and OAA full sync.
+- **Access index (derived closure):** `es:idx:*` presence keys (`idx:has`, `idx:any`) for `MGET` checks, edge-roots sets (`idx:er`), triple sets (`idx:tr`), per-root/per-subject descriptor sets (`idx:root`, `idx:subj`), and a subject-disabled marker (`idx:disabled:{subject}`) that makes every `has*` deny with `metadata.reason: 'subject_disabled'` while it is set (independent of edge materialization, so `clear`/reconcile never wipes it). `RedisAccessIndex` stores root-attributed effective edges so `removeByRoot` is efficient and diamond grants survive partial revokes.
+- **Tenant:** `es:tenant:{id}` (record, id encoded per §10.2) plus the `es:tenant:ids` index set. There is no separate company index; `companyId` is a field on the tenant record, not a key namespace.
+
+## Key encoding (external ids)
+
+Externally-sourced id segments (SCIM `id`/`externalId`, `userName`, subject/target/resource ids, client ids, magic-link tokens, session ids, the IAM-delta id-map parts) are **encoded** before they are joined into a key (§10.2), so an id can never split a key on a stray `:` or collide with a structural index segment (a user whose id is literally `ids` cannot clobber the `user:ids` set). SDK-authored literal segments (`idx:has`, `user:ids`, `authz`, …) stay raw. The encoding is total, injective, and length-bounded:
+
+- **Safe, short ids** (`^[A-Za-z0-9_.@|-]{1,64}$`) → `=<id>` verbatim (readable: `es:user:=alice`).
+- **Everything else** (any `:`/`#`/control char, or length > 64) → `#<sha256(id) truncated to 128 bits, base64url>` (fixed length, collision-resistant).
+
+`#` and `=` never appear in a structural segment and neither branch emits a `:`, so the data and structural key namespaces are provably disjoint. `encodeKeyId(id)` is exported for Ops debugging (compute the stored key form of an id). This is a **greenfield** scheme with no migration from any prior key layout.
+
+## Redis access checks
+
+Fast authorization checks read the **`RedisAccessIndex`** (the derived closure), not the `RedisAccessAssignmentStore` roots. The index is materialized from roots + the catalog by the SDK SCIM orchestration (or `expandRoot` + `materialize`), so unlike a raw edge store these checks already account for group -> role -> permission expansion, nested groups/roles, and `applyToSubResources` sub-resource inheritance:
+
+- **`RedisAccessAssignmentStore`** — direct grants only (for example `alice → role:editor` and `alice → role:reviewer` are two roots).
+- **`RedisAccessIndex`** — effective access after expansion (both roles **and** every permission they confer; overlapping permissions such as `read` from both roles are stored with separate `rootId` attribution so revoking one role does not remove access still justified by the other).
+
+```ts
+await accessIndex.has(userId, 'permission', permissionId);
+await accessIndex.hasGroup(userId, groupId);
+await accessIndex.hasRole(userId, roleId);
+await accessIndex.hasPermission(userId, permissionId, resourceId /* optional scope */);
+await accessIndex.hasAny(userId, [
+  { targetType: 'role', target: 'admin' },
+  { targetType: 'permission', target: 'invoice:read' },
+]);
+await accessIndex.hasAll(userId, [
+  { targetType: 'role', target: 'finance' },
+  { targetType: 'permission', target: 'invoice:approve' },
+]);
+```
+
+Single checks read presence keys directly; resource-scoped checks also accept an application-wide grant. Bounded `hasAny(...)` and `hasAll(...)` issue per-target reads and log a warning when the requested target set is large. All checks return the shared `AuthzDecision` (`{ allow, matched? }`).
+
+## List ordering
+
+`list()` returns records in a **stable, deterministic order**: ids are read via `SMEMBERS` and sorted lexicographically before `MGET`, so offset pages (`start`/`limit`) are disjoint and complete across calls for an unchanged dataset. There is no caller-specified sort and no sorted-set requirement; UI-style sorting is the application's concern.

package/dist/index.d.ts

@@ -0,0 +1,507 @@
+import { AccessAssignmentStore, AccessChange, ListOptions, ListResult } from "@ionite/core";
+import { Logger } from "@ionite/core";
+/**
+* Minimal Redis adapter interface for @ionite/redis-core stores.
+*
+* Implement this interface to use ioredis, node-redis, or a custom Redis wrapper.
+* `list()` returns records in a stable (lexicographic id) order via SMEMBERS + MGET; no sorted-set
+* support is required.
+*/
+/**
+* Required Redis operations used by all stores.
+*/
+interface RedisAdapter {
+	get(key: string): Promise<string | null>;
+	set(key: string, value: string): Promise<void>;
+	setex(key: string, seconds: number, value: string): Promise<void>;
+	del(key: string): Promise<void>;
+	/**
+	* Optional: return a key's remaining TTL in seconds (Redis `TTL`): `-1` = no expiry, `-2` = the key
+	* does not exist. Purely diagnostic for the SDK (session TTLs are set via `setex`/`SET EX`); exposed
+	* so validation/tests can assert a session record carries a bounded TTL.
+	*/
+	ttl?(key: string): Promise<number>;
+	sadd(key: string, ...members: string[]): Promise<void>;
+	srem(key: string, ...members: string[]): Promise<void>;
+	smembers(key: string): Promise<string[]>;
+	mget(keys: string[]): Promise<(string | null)[]>;
+	/**
+	* Optional: atomically get a key's value and delete it (Redis `GETDEL`, 6.2+). When implemented,
+	* the magic-link store uses it for a truly atomic single-use consume; otherwise it falls back to
+	* a best-effort get-then-del.
+	*/
+	getdel?(key: string): Promise<string | null>;
+	/**
+	* Optional: run a server-side Lua script atomically (the Redis `EVAL` command — this is NOT the
+	* JavaScript `eval()` sink; nothing in our process is dynamically executed). When implemented, the
+	* stores use it for intra-store atomicity (§5.9) — create-if-absent, unique-index claim-or-fail,
+	* multi-key writes as one all-or-nothing unit, and session read-modify-write — so a single op never
+	* half-lands. Scripts are written checks-first: a failed check returns before any write, so a
+	* conflict leaves zero writes. When this is absent the stores fall back to best-effort sequenced
+	* writes + fail-fast and rely on the caller replaying the (idempotent) push; correctness is
+	* preserved, but the writes are not isolated.
+	*
+	* SECURITY: script bodies are static SDK-authored text; every dynamic value (keys, members, scores,
+	* serialized records, TTLs) is passed out-of-band via `keys`/`args` and referenced as
+	* `KEYS[i]`/`ARGV[j]` — data is never concatenated into the script source, so there is no Lua
+	* injection vector (the same posture as parameterized SQL).
+	*
+	* @param script Lua source (static, SDK-authored).
+	* @param keys `KEYS[1..n]`.
+	* @param args `ARGV[1..n]`.
+	* @returns the script's reply (commonly a status string the caller normalizes).
+	*/
+	runScript?(script: string, keys: string[], args: string[]): Promise<unknown>;
+}
+/**
+* Type guard: adapter can run server-side Lua scripts (Redis `EVAL`) for intra-store atomicity (§5.9).
+*/
+declare function supportsRunScript(adapter: RedisAdapter): adapter is RedisAdapter & {
+	runScript: NonNullable<RedisAdapter["runScript"]>;
+};
+/**
+* Shared options for all Redis store constructors.
+*/
+interface RedisStoreOptions {
+	/** Redis adapter (from createIoredisAdapter, createRedisAdapter, or custom). */
+	redis: RedisAdapter;
+	/**
+	* Key prefix for all keys. REQUIRED: there is no implicit default. In multi-tenant deployments
+	* each tenant MUST use a distinct prefix (e.g. `es:t:<tenantId>:`) so the global index sets
+	* (`user:ids`, `tenant:ids`, etc.) auto-namespace and never collide across tenants.
+	*/
+	keyPrefix: string;
+	/** Logger for version warnings (default defaultLogger from core). */
+	logger?: Logger;
+}
+/**
+* Validate the required `keyPrefix` and warn (at most once per fingerprint) when the same
+* `(storeKind, keyPrefix)` is constructed more than once in a process. A duplicate almost always
+* means two tenants share a Redis namespace; distinct tenants MUST use distinct prefixes (e.g.
+* `es:t:<tenantId>:`). This is a warning, not a throw, because legitimate re-initialization (same
+* tenant, same process — notably an LRU evict→recreate cycle) can reconstruct a store; the once-per
+* -fingerprint dedup keeps that from becoming recurring false-positive noise while still surfacing an
+* accidental shared keyspace loudly the first time.
+*/
+declare function getKeyPrefix(options: RedisStoreOptions, storeKind?: string): string;
+declare function getLogger(options: RedisStoreOptions): Logger;
+declare function prefixedKey(prefix: string, ...parts: string[]): string;
+/**
+* Encode an externally-sourced id into a collision-free key segment (AUDIT_HISTORY.md v2 §10.2).
+*
+* External ids (SCIM `externalId`, `userName`, subject/target/resource ids, client ids) are joined
+* into Redis keys with `:`. Left raw, an id containing `:` could shift key segments and read/write
+* another principal's slot, and an id that equals a structural token (e.g. a user whose id is
+* `ids`) could clobber an index key (`user:ids`). Both are privilege/integrity bugs, not cosmetic.
+*
+* The encoding is total and injective, and every output carries a leading sentinel that structural
+* tokens never use, so the "data" and "structural" key namespaces are provably disjoint:
+*  - safe, short ids -> `=<id>` verbatim (readable for the common case: uuids, ulids, numeric ids);
+*  - everything else (any `:`/`#`/control char, or length > 64) -> `#<sha256(id) truncated to
+*    128 bits, base64url>` — fixed length (bounded keys) and collision-resistant.
+*
+* `#` and `=` never appear in a structural segment, and neither branch can emit a `:`, so a data
+* segment can neither impersonate a structural token nor split the key. Exported so Ops can compute
+* the key form of an id when debugging.
+*/
+declare function encodeKeyId(id: string): string;
+/**
+* Redis-backed store of granted access **roots** (source of truth). Roots are keyed by their
+* deterministic id (`accessRootId`, scope-aware) and carry provenance + status. Fast `has*`
+* checks live on the derived `RedisAccessIndex`, not here.
+*/
+declare class RedisAccessAssignmentStore implements AccessAssignmentStore<AccessChange> {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisStoreOptions);
+	private key;
+	private idsSetKey;
+	private accessStorageKey;
+	private subjectIndexKey;
+	private targetIndexKey;
+	grant(change: AccessChange): Promise<void>;
+	revoke(change: AccessChange): Promise<void>;
+	get(id: string): Promise<AccessChange | undefined>;
+	list(options?: ListOptions): Promise<ListResult<AccessChange>>;
+	listByTarget(targetType: AccessChange["targetType"], target: string, options?: ListOptions): Promise<ListResult<AccessChange>>;
+	listBySubject(subject: string, subjectType?: AccessChange["subjectType"], options?: ListOptions): Promise<ListResult<AccessChange>>;
+	private listInMemory;
+	private listFromIds;
+}
+import { AccessCatalogStore, CatalogChangeListener, EntityStore, Group, ListOptions as ListOptions2, ListResult as ListResult2, Permission, Resource, ResourceChangeListener, ResourceProvider, Role } from "@ionite/core";
+declare class RedisAccessCatalogStore implements AccessCatalogStore {
+	readonly groups: EntityStore<Group>;
+	readonly roles: EntityStore<Role>;
+	readonly permissions: EntityStore<Permission>;
+	private readonly listeners;
+	constructor(options: RedisStoreOptions);
+	afterChange(listener: CatalogChangeListener): () => void;
+}
+/**
+* Writable, Redis-backed {@link ResourceProvider} for apps that have no resource table of their own
+* (the common case is implementing `ResourceProvider` directly over the app's database — resources
+* already live there; use this store only when Redis IS the app's resource storage).
+*
+* `set`/`delete` emit the `changed` signal after the durable write lands, driving the SDK's
+* adjacency-cache invalidation, targeted reconcile, and incremental OAA projection. Provide
+* `deriveEntitlements`/`resolveEntitlement` to expose resource-derived entitlement Groups.
+*/
+declare class RedisResourceStore implements ResourceProvider {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	private readonly listeners;
+	entitlements?: (resource: Resource) => Group[];
+	entitlement?: (id: string) => Promise<Group | undefined>;
+	constructor(options: RedisStoreOptions & {
+		/** Pure derivation of a resource's requestable entitlement Groups (see {@link ResourceProvider.entitlements}). */
+		deriveEntitlements?: (resource: Resource) => Group[];
+		/** Reverse resolution of a resource-derived entitlement id (see {@link ResourceProvider.entitlement}). */
+		resolveEntitlement?: (id: string, get: (resourceId: string) => Promise<Resource | undefined>) => Promise<Group | undefined>;
+	});
+	private key;
+	private entityKey;
+	private idsSetKey;
+	get(id: string): Promise<Resource | undefined>;
+	list(options?: ListOptions2): Promise<ListResult2<Resource>>;
+	children(id: string): Promise<Resource[]>;
+	changed(listener: ResourceChangeListener): () => void;
+	/** Upsert a resource; resolves after the durable write lands and the `changed` signal is emitted. */
+	set(resource: Resource): Promise<void>;
+	/** Delete a resource; resolves after the durable delete lands and the `changed` signal is emitted. */
+	delete(id: string): Promise<void>;
+	private emitChange;
+}
+import { AccessCheckTarget, AccessIndex, AccessRef, AuthzDecision, BaseUser, EffectiveEdge, Group as Group2, OaaAccessTargetType, Permission as Permission2, Resource as Resource2, Role as Role2, SubjectRef, SubjectType } from "@ionite/core";
+/**
+* Redis-backed derived closure index. Edges are root-attributed: an edge-roots SET tracks which
+* roots justify each `(subject, targetType, target, resource)` edge, so `removeByRoot` only drops
+* an edge once no roots remain. Existence checks read presence keys via `MGET`.
+*
+* Rebuildable from AccessAssignmentStore roots + the catalog.
+*/
+declare class RedisAccessIndex implements AccessIndex {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisStoreOptions);
+	private key;
+	private subjectKeyPart;
+	private hasKey;
+	private anyKey;
+	private edgeRootsKey;
+	private tripleKey;
+	private rootKey;
+	private subjectKey;
+	private subjectsKey;
+	/**
+	* Subject-disabled marker (plain presence key so it batches into the existing `MGET` reads).
+	* Deliberately independent of edge materialization: `materialize`/`removeByRoot`/`clear` and
+	* reconcile never touch it, so a rebuild cannot silently re-enable a SCIM-deactivated subject. The
+	* subject segment is encoded (§10.2) so the Batch 1 veto can never be aliased or evaded via a
+	* crafted subject id.
+	*/
+	private disabledKey;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group2 | Role2 | Permission2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
+	/**
+	* Evaluate many targets for one subject with a single batched `MGET` (§7.4) instead of a per-target
+	* round trip. Each target contributes 1 (resource-agnostic) or 2 (resource + app-wide) presence
+	* keys to one flat read; decisions are reconstructed in the original order.
+	*/
+	private evaluateTargets;
+	/** The five derived keys for an edge, in the fixed [edgeRoots, has, triple, any, subject] order. */
+	private edgeKeys;
+	/**
+	* Re-materialize a root's closure as a DIFF against its currently-stored descriptors: only edges
+	* that appear/disappear are written/torn down, so unchanged edges are never touched (closes the
+	* §5.3 deny window and the teardown-vs-materialize race). One atomic script when `runScript` is
+	* available; otherwise a sequential fallback applying the same diff (documented: not isolated).
+	*/
+	materialize(rootId: string, edges: EffectiveEdge[]): Promise<void>;
+	removeByRoot(rootId: string): Promise<void>;
+	listSubjects(): Promise<SubjectRef[]>;
+	setSubjectDisabled(subject: string, subjectType: SubjectType, disabled: boolean): Promise<void>;
+	isSubjectDisabled(subject: string, subjectType?: SubjectType): Promise<boolean>;
+	clear(subject?: string, subjectType?: SubjectType): Promise<void>;
+	private clearSubject;
+	private dropRootFromEdge;
+	private allow;
+	private warnLargeCheck;
+}
+/**
+* Default MGET batch size (§7.3). Large id sets must not be loaded as one giant `MGET` command —
+* adapters chunk the keys so a single round trip can't build an unbounded command/response.
+*/
+declare const DEFAULT_MGET_CHUNK_SIZE = 512;
+/**
+* Fetch many keys via a chunked `MGET`, preserving input order and normalizing missing values to
+* `null`. `fetch` is the adapter's native multi-get over a bounded slice of keys.
+*/
+declare function chunkedMget(keys: string[], fetch: (chunk: string[]) => Promise<(string | null | undefined)[]>, chunkSize?: number): Promise<(string | null)[]>;
+/** Result of an atomic create-if-absent. */
+type AtomicCreateResult = "created" | "exists_identical" | "conflict";
+/**
+* Atomically create a key only if absent. A byte-identical existing value reads back as
+* `exists_identical` (replay-safe); a different value is a `conflict` (fail-fast). With `ttlSeconds`
+* the write carries an expiry (`SET ... EX`).
+*/
+declare function atomicCreate(adapter: RedisAdapter, key: string, value: string, opts?: {
+	ttlSeconds?: number;
+}): Promise<AtomicCreateResult>;
+/** Result of an atomic compare-and-set (§8.2). */
+type AtomicCompareAndSetResult = "ok" | "missing" | "retry";
+/**
+* Atomic compare-and-set (§8.2). Writes `newRaw` only when the key currently holds exactly
+* `expectedRaw` (byte comparison); returns `'missing'` when absent and `'retry'` when the stored
+* value has changed since the caller read it. The read-modify itself happens in the caller (a plain
+* JS merge with exact `JSON.stringify` semantics), so this Lua does no `cjson` decode/encode — the
+* old `cjson` round-trip silently corrupted sessions (empty arrays became `{}`, large integers lost
+* precision). Returns `'unsupported'` when the adapter has no `runScript` so the caller can fall back
+* to a best-effort get-modify-set.
+*
+* `newTtlSeconds` controls the key's expiry on the write (AUDIT_HISTORY.md §1.3): a positive value writes with
+* `EX` so a refreshed session record keeps a bounded TTL; when omitted the existing TTL is preserved
+* (`KEEPTTL`) so an incidental update never accidentally makes a TTL'd key immortal.
+*/
+declare function atomicCompareAndSet(adapter: RedisAdapter, key: string, expectedRaw: string, newRaw: string, newTtlSeconds?: number): Promise<AtomicCompareAndSetResult | "unsupported">;
+/**
+* Builds an ordered set of unique-index claims (checks) + writes and executes them as one unit:
+* a single Lua script (checks-first) when the adapter supports `EVAL`, else a best-effort sequenced
+* fallback that still performs all checks before any write. `exec` returns `'conflict'` (and writes
+* nothing) when any claimed unique index is already owned by a different id.
+*/
+declare class RedisTxn {
+	private readonly claims;
+	private readonly writes;
+	/** Claim a unique secondary index: conflict unless `indexKey` is absent or already == `ownerId`. */
+	claimUnique(indexKey: string, ownerId: string): this;
+	set(key: string, value: string): this;
+	setex(key: string, ttl: number, value: string): this;
+	del(key: string): this;
+	sadd(key: string, ...members: string[]): this;
+	srem(key: string, ...members: string[]): this;
+	exec(adapter: RedisAdapter): Promise<"ok" | "conflict">;
+	private execLua;
+	private execSequential;
+}
+import { BaseCustomer, CustomerStore, ListOptions as ListOptions3, ListResult as ListResult3 } from "@ionite/core";
+type RedisCustomerStoreOptions = RedisStoreOptions;
+declare class RedisCustomerStore<TExtended = Record<string, never>> implements CustomerStore<TExtended> {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisCustomerStoreOptions);
+	private key;
+	private entityKey;
+	private idsSetKey;
+	private nameIndexKey;
+	get(sub: string): Promise<BaseCustomer<TExtended> | undefined>;
+	lookup(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended> | undefined>;
+	upsert(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended>>;
+	delete(sub: string): Promise<number>;
+	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
+}
+/** SHA1 of a Lua script body — the id Redis caches scripts under for `EVALSHA`. */
+declare function scriptSha1(script: string): string;
+/**
+* Wrap a client's `EVAL`/`EVALSHA` into a `runScript` that memoizes each unique script body's SHA1
+* and prefers `EVALSHA`, falling back to `EVAL` once on `NOSCRIPT` (the server evicted/never cached
+* the script) and priming the cache for next time. Because every SDK script body is static text, the
+* memo stays tiny and steady-state calls ship only the 40-byte sha, not the full source — this is what
+* keeps a hot grant/materialize path from re-transmitting (and the server from re-compiling) the same
+* script on every request.
+*/
+declare function createEvalshaRunner(client: {
+	eval(script: string, keys: string[], args: string[]): Promise<unknown>;
+	evalsha(sha: string, keys: string[], args: string[]): Promise<unknown>;
+}): (script: string, keys: string[], args: string[]) => Promise<unknown>;
+import { IamDeltaIdMapKey, IamDeltaIdMapStore } from "@ionite/core";
+type RedisIamDeltaIdMapStoreOptions = RedisStoreOptions & {
+	/**
+	* TTL (seconds) applied to each id-map entry so abandoned externalId mappings (deleted resources,
+	* decommissioned destinations) self-evict instead of accumulating forever (§6.7). Each `set`
+	* refreshes the TTL, so actively-used mappings persist. Pass `0` to disable expiry.
+	*/
+	idMapTtlSeconds?: number;
+};
+/**
+* Redis-backed {@link IamDeltaIdMapStore}. Durable externalId -> destination provider-id cache for
+* IAM delta `'patch'` egress, shared across app instances and surviving restarts so the patch
+* adapter resolves each resource once and reuses the id thereafter (self-healing on stale ids is
+* handled by the adapter via `delete` + re-resolve).
+*/
+declare class RedisIamDeltaIdMapStore implements IamDeltaIdMapStore {
+	private readonly redis;
+	private readonly prefix;
+	private readonly ttlSeconds;
+	constructor(options: RedisIamDeltaIdMapStoreOptions);
+	private key;
+	get(key: IamDeltaIdMapKey): Promise<string | undefined>;
+	set(key: IamDeltaIdMapKey, providerId: string): Promise<void>;
+	delete(key: IamDeltaIdMapKey): Promise<void>;
+}
+import { Logger as Logger2, SecretsOperationOptions, SecretsSubscriptionOptions } from "@ionite/core";
+/**
+* Options shared by the client-specific `ionRedis(...)` factories in `@ionite/redis` and
+* `@ionite/ioredis`. Each package extends `createReactiveRedis` with only its client glue
+* (client construction, connect/close, endpoint signature); everything below is identical, so it lives
+* here to keep the two adapters in lockstep.
+*/
+type IonRedisOptions = {
+	sourceName?: string;
+	logger?: Logger2;
+	secretOptions?: SecretsOperationOptions;
+	subscription?: SecretsSubscriptionOptions;
+};
+/**
+* Split a reactive-redis secret into its connection URL and the remaining client options. Both adapters
+* accept the same secret envelope: either a nested `clientOptions` object or the client options spread at
+* the top level, plus an optional `redisUrl`. The `redisUrl`/`clientOptions` envelope keys are stripped
+* from the returned options so they are never forwarded to the underlying client constructor. Callers
+* apply the URL in their client-specific way (node-redis sets `url`; ioredis passes it positionally).
+*/
+declare function splitIonRedisSecret(secret: {
+	redisUrl?: string;
+	clientOptions?: unknown;
+}): {
+	redisUrl?: string;
+	clientOptions: Record<string, unknown>;
+};
+/** Default page size applied to a paginated `list()` when the caller omits `limit` (§7.3). */
+declare const DEFAULT_LIST_LIMIT = 100;
+/**
+* Hard ceiling on a single `list()` page (§7.3). Must stay >= the `listGenerator` page size (1000) so
+* internal full-enumeration loops that page at that size are never silently truncated.
+*/
+declare const MAX_LIST_LIMIT = 1e3;
+import { BaseCustomer as BaseCustomer2, MagicLink, MagicLinkStore } from "@ionite/core";
+declare class RedisMagicLinkStore<TExtended = object> implements MagicLinkStore<TExtended> {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisStoreOptions);
+	private key;
+	create(token: string, customer: BaseCustomer2, expiresAt: Date): Promise<void>;
+	get(token: string): Promise<MagicLink<TExtended> | null>;
+	getAndDelete(token: string): Promise<MagicLink<TExtended> | null>;
+	delete(token: string): Promise<void>;
+}
+import { Logger as Logger3, Secret, SecretsOperationOptions as SecretsOperationOptions2, SecretsSource, SecretsSubscriptionOptions as SecretsSubscriptionOptions2 } from "@ionite/core";
+type MaybePromise<T> = Promise<T> | T;
+type ReactiveRedisClient = {
+	adapter: RedisAdapter;
+	dispose?: () => MaybePromise<void>;
+};
+type ReactiveRedisOptions<TSecret> = {
+	path: string;
+	sourceName?: string;
+	source: SecretsSource;
+	logger?: Logger3;
+	secretOptions?: SecretsOperationOptions2;
+	subscription?: SecretsSubscriptionOptions2;
+	createClient: (secret: Secret<TSecret>) => MaybePromise<ReactiveRedisClient>;
+	/**
+	* Optional stable endpoint signature (e.g. `redis://host:port`) derived from a secret (§5.8). When
+	* provided, a rotation whose endpoint differs from the live one is rejected (fail-fast) instead of
+	* silently repointing mid-flight: credentials may rotate, but the host must not change under an
+	* active adapter. Return an empty string when the endpoint is unknown (the guard is then skipped).
+	*/
+	endpointOf?: (secret: Secret<TSecret>) => string;
+};
+type ReactiveRedisAdapter = RedisAdapter & {
+	ready(timeout?: number): Promise<void>;
+	isReady(): boolean;
+	close(): Promise<void>;
+};
+declare function createReactiveRedis<TSecret>(options: ReactiveRedisOptions<TSecret>): ReactiveRedisAdapter;
+import { Session, SessionStore } from "@ionite/core";
+declare class RedisSessionStore<TExtended = object> implements SessionStore<TExtended> {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisStoreOptions);
+	private key;
+	create(session: Session<TExtended>): Promise<void>;
+	get(sid: string): Promise<Session<TExtended> | null>;
+	update(sid: string, data: Partial<Session<TExtended>>): Promise<void>;
+	delete(sid: string): Promise<void>;
+}
+import { BaseTenant, Ionite, ListOptions as ListOptions5, ListResult as ListResult5, TenantIonCache, TenantStore } from "@ionite/core";
+type RedisTenantStoreOptions = RedisStoreOptions & {
+	/**
+	* App-owned cache of per-tenant `Ionite` instances (see `TenantIonCache`). Required to
+	* use {@link RedisTenantStore.getIon}; the store never constructs runtimes itself. Tenant *records*
+	* are plain, non-sensitive Redis lookups; only the runtime (which reads sensitive RemoteConfig from
+	* the vault) is cached.
+	*/
+	ionCache?: TenantIonCache;
+};
+declare class RedisTenantStore<TTenant extends BaseTenant = BaseTenant> implements TenantStore<TTenant> {
+	private readonly store;
+	private readonly ionCache?;
+	constructor(options: RedisTenantStoreOptions);
+	get(id: string): Promise<TTenant | undefined>;
+	upsert(tenant: TTenant): Promise<TTenant>;
+	list(options?: ListOptions5): Promise<ListResult5<TTenant>>;
+	delete(id: string): Promise<number>;
+	getIon(id: string): Promise<Ionite | undefined>;
+}
+import { BaseUser as BaseUser2, ListOptions as ListOptions6, ListResult as ListResult6, UserStore } from "@ionite/core";
+type RedisUserStoreOptions<_TExtended = Record<string, never>> = RedisStoreOptions;
+declare class RedisUserStore<TExtended = Record<string, never>> implements UserStore<TExtended> {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisUserStoreOptions<TExtended>);
+	private key;
+	private entityKey;
+	private idsSetKey;
+	private nameIndexKey;
+	get(sub: string): Promise<BaseUser2<TExtended> | undefined>;
+	lookup(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended> | undefined>;
+	upsert(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended>>;
+	delete(sub: string): Promise<number>;
+	list(options?: ListOptions6): Promise<ListResult6<BaseUser2<TExtended>>>;
+}
+import { BaseWorkloadIdentity, ListOptions as ListOptions7, ListResult as ListResult7, WorkloadIdentityStore } from "@ionite/core";
+type RedisWorkloadIdentityStoreOptions = RedisStoreOptions;
+/**
+* Redis-backed {@link WorkloadIdentityStore}. Mirrors the user/customer store layout: a JSON record
+* per identity, an id set for enumeration, a `clientId -> id` index, and optional sorted sets for
+* efficient date-ordered pagination.
+*/
+declare class RedisWorkloadIdentityStore<TExtended = Record<string, never>> implements WorkloadIdentityStore<TExtended> {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisWorkloadIdentityStoreOptions);
+	private key;
+	private entityKey;
+	private idsSetKey;
+	private clientIndexKey;
+	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
+	delete(id: string): Promise<number>;
+	list(options?: ListOptions7): Promise<ListResult7<BaseWorkloadIdentity<TExtended>>>;
+}
+import { CachedWorkloadToken, WorkloadTokenStore } from "@ionite/core";
+declare class RedisWorkloadTokenStore<TExtended = object> implements WorkloadTokenStore<TExtended> {
+	private readonly redis;
+	private readonly prefix;
+	private readonly log;
+	constructor(options: RedisStoreOptions);
+	private key;
+	set(token: CachedWorkloadToken<TExtended>): Promise<void>;
+	get(workload_id: string): Promise<CachedWorkloadToken<TExtended> | null>;
+	delete(workload_id: string): Promise<void>;
+	isValid(workload_id: string): Promise<boolean>;
+	cleanup(): Promise<void>;
+}
+export { supportsRunScript, splitIonRedisSecret, scriptSha1, prefixedKey, getLogger, getKeyPrefix, encodeKeyId, createReactiveRedis, createEvalshaRunner, chunkedMget, atomicCreate, atomicCompareAndSet, RedisWorkloadTokenStore, RedisWorkloadIdentityStoreOptions, RedisWorkloadIdentityStore, RedisUserStoreOptions, RedisUserStore, RedisTxn, RedisTenantStoreOptions, RedisTenantStore, RedisStoreOptions, RedisSessionStore, RedisResourceStore, RedisMagicLinkStore, RedisIamDeltaIdMapStoreOptions, RedisIamDeltaIdMapStore, RedisCustomerStoreOptions, RedisCustomerStore, RedisAdapter, RedisAccessIndex, RedisAccessCatalogStore, RedisAccessAssignmentStore, ReactiveRedisOptions, ReactiveRedisClient, ReactiveRedisAdapter, MAX_LIST_LIMIT, IonRedisOptions, DEFAULT_MGET_CHUNK_SIZE, DEFAULT_LIST_LIMIT, AtomicCreateResult, AtomicCompareAndSetResult };

package/dist/index.js

@@ -0,0 +1,139 @@
+import{accessRefId as u,accessRootId as kZ,list as $Z}from"@ionite/core";function A(Z){return typeof Z.runScript==="function"}async function T(Z,$,Q,W){let Y=W?.ttlSeconds;if(A(Z)){let q=`local cur=redis.call('GET',KEYS[1])
+if cur then if cur==ARGV[1] then return 'exists_identical' else return 'conflict' end end
+${Y!=null?"redis.call('SET',KEYS[1],ARGV[1],'EX',ARGV[2])":"redis.call('SET',KEYS[1],ARGV[1])"}
+return 'created'`,B=Y!=null?[Q,String(Math.max(1,Math.floor(Y)))]:[Q],J=String(await Z.runScript(q,[$],B));return J==="exists_identical"||J==="conflict"?J:"created"}let V=await Z.get($);if(V!=null)return V===Q?"exists_identical":"conflict";if(Y!=null)await Z.setex($,Math.max(1,Math.floor(Y)),Q);else await Z.set($,Q);return"created"}async function g(Z,$,Q,W,Y){if(!A(Z))return"unsupported";let V=Y!=null&&Y>0?Math.max(1,Math.floor(Y)):void 0,q=`local cur=redis.call('GET',KEYS[1])
+if not cur then return 'missing' end
+if cur~=ARGV[1] then return 'retry' end
+${V!=null?"redis.call('SET',KEYS[1],ARGV[2],'EX',ARGV[3])":"redis.call('SET',KEYS[1],ARGV[2],'KEEPTTL')"}
+return 'ok'`,B=V!=null?[Q,W,String(V)]:[Q,W],J=String(await Z.runScript(q,[$],B));if(J==="missing"||J==="retry")return J;return"ok"}var y=500,hZ=`local ki=1
+local ai=1
+local C=tonumber(ARGV[ai]);ai=ai+1
+for i=1,C do
+  local k=KEYS[ki];ki=ki+1
+  local owner=ARGV[ai];ai=ai+1
+  local v=redis.call('GET',k)
+  if v and v~=owner then return 'conflict' end
+end
+local W=tonumber(ARGV[ai]);ai=ai+1
+for i=1,W do
+  local op=ARGV[ai];ai=ai+1
+  if op=='set' then
+    local k=KEYS[ki];ki=ki+1
+    local val=ARGV[ai];ai=ai+1
+    redis.call('SET',k,val)
+  elseif op=='setex' then
+    local k=KEYS[ki];ki=ki+1
+    local ttl=ARGV[ai];ai=ai+1
+    local val=ARGV[ai];ai=ai+1
+    redis.call('SETEX',k,ttl,val)
+  elseif op=='del' then
+    local k=KEYS[ki];ki=ki+1
+    redis.call('DEL',k)
+  elseif op=='sadd' then
+    local k=KEYS[ki];ki=ki+1
+    local m=tonumber(ARGV[ai]);ai=ai+1
+    local members={}
+    for j=1,m do members[j]=ARGV[ai];ai=ai+1 end
+    redis.call('SADD',k,unpack(members))
+  elseif op=='srem' then
+    local k=KEYS[ki];ki=ki+1
+    local m=tonumber(ARGV[ai]);ai=ai+1
+    local members={}
+    for j=1,m do members[j]=ARGV[ai];ai=ai+1 end
+    redis.call('SREM',k,unpack(members))
+  end
+end
+return 'ok'`;class L{claims=[];writes=[];claimUnique(Z,$){return this.claims.push({key:Z,owner:$}),this}set(Z,$){return this.writes.push({op:"set",key:Z,value:$}),this}setex(Z,$,Q){return this.writes.push({op:"setex",key:Z,ttl:Math.max(1,Math.floor($)),value:Q}),this}del(Z){return this.writes.push({op:"del",key:Z}),this}sadd(Z,...$){if($.length>0)this.writes.push({op:"sadd",key:Z,members:$});return this}srem(Z,...$){if($.length>0)this.writes.push({op:"srem",key:Z,members:$});return this}async exec(Z){if(A(Z))return this.execLua(Z);return this.execSequential(Z)}async execLua(Z){if(this.claims.length>0||this.writes.length<=y)return o(Z,this.claims,this.writes);for(let $=0;$<this.writes.length;$+=y)await o(Z,[],this.writes.slice($,$+y));return"ok"}async execSequential(Z){for(let $ of this.claims){let Q=await Z.get($.key);if(Q!=null&&Q!==$.owner)return"conflict"}for(let $ of this.writes)switch($.op){case"set":await Z.set($.key,$.value);break;case"setex":await Z.setex($.key,$.ttl,$.value);break;case"del":await Z.del($.key);break;case"sadd":await Z.sadd($.key,...$.members);break;case"srem":await Z.srem($.key,...$.members);break}return"ok"}}async function o(Z,$,Q){let W=[],Y=[String($.length)];for(let G of $)W.push(G.key),Y.push(G.owner);Y.push(String(Q.length));for(let G of Q)switch(G.op){case"set":Y.push("set"),W.push(G.key),Y.push(G.value);break;case"setex":Y.push("setex"),W.push(G.key),Y.push(String(G.ttl),G.value);break;case"del":Y.push("del"),W.push(G.key);break;case"sadd":Y.push("sadd"),W.push(G.key),Y.push(String(G.members.length),...G.members);break;case"srem":Y.push("srem"),W.push(G.key),Y.push(String(G.members.length),...G.members);break}return String(await Z.runScript(hZ,W,Y))==="conflict"?"conflict":"ok"}import{list as jZ}from"@ionite/core";var r=100,s=1000;function R(Z){let $=Z?.limit,Q=$==null||!Number.isFinite($)||$<=0?r:Math.min(Math.floor($),s);return{...Z,limit:Q}}function _(Z,$,Q=(W,Y)=>W[Y]){let W=Math.max(0,$?.start??0),Y=$?.limit,V=$?.filter?.requestable,G=Z;if(V!==void 0)G=Z.filter((O)=>Boolean(Q(O,"requestable"))===V);let q=G.length,B=Y!=null?W+Y:void 0,J=G.slice(W,B);return jZ(q,J,W,Y)}import{defaultLogger as TZ}from"@ionite/core";function C(Z,$){let Q=$.log??TZ,W={"ion.operation":"redis.revive","ion.outcome":"corrupt",store:$.store,...$.key?{key:$.key}:{}},Y;try{Y=JSON.parse(Z)}catch{Q.warn("Redis store: discarded corrupt JSON payload (failed to parse)",W);return}if(Y===null||typeof Y!=="object"||Array.isArray(Y)){Q.warn("Redis store: discarded JSON payload that is not a record object",W);return}return Y}import{createHash as vZ}from"node:crypto";import{defaultLogger as wZ}from"@ionite/core";var IZ=4096,t=new Set,e=new Set;function ZZ(Z,$){Z.delete($),Z.add($);while(Z.size>IZ){let Q=Z.values().next().value;if(Q===void 0)break;Z.delete(Q)}}function F(Z,$){let Q=Z.keyPrefix;if(typeof Q!=="string"||Q.length===0)throw Error('Redis store keyPrefix is required and must be a non-empty string. Pass an explicit per-tenant prefix (e.g. "es:t:<tenantId>:") so tenant keyspaces never collide.');if($){let W=`${$}\x00${Q}`;if(t.has(W)&&!e.has(W))D(Z).warn(`Redis ${$} constructed twice with the same keyPrefix "${Q}". Each tenant MUST use a distinct keyPrefix (e.g. "es:t:<tenantId>:") so tenant keyspaces never collide; sharing a prefix across tenants lets them read/write each other's data.`),ZZ(e,W);ZZ(t,W)}return Q}function D(Z){return Z.logger??wZ}function X(Z,...$){return Z+$.join(":")}var mZ=/^[A-Za-z0-9_.@|-]{1,64}$/;function H(Z){if(mZ.test(Z))return`=${Z}`;return`#${vZ("sha256").update(Z,"utf8").digest("base64url").slice(0,22)}`}var bZ="access:ids",yZ="access:subject:",gZ="access:target:";function lZ(Z){return JSON.stringify({...Z,createdAt:Z.createdAt.toISOString(),updatedAt:Z.updatedAt.toISOString()})}function l(Z,$){let Q=C(Z,{store:"access",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt),updatedAt:new Date(Q.updatedAt)}}function QZ(Z){return{id:Z.id,subject:Z.subject,subjectType:Z.subjectType,targetType:Z.targetType,target:Z.target,resources:Z.resources,applyToApplication:Z.applyToApplication,provenance:Z.provenance,status:Z.status,metadata:Z.metadata}}function WZ(Z){let $=u(Z.subject),Q=u(Z.target);if(!$)throw Error("Access change subject must resolve to a non-empty id.");if(!Z.targetType)throw Error("Access change targetType is required.");if(!Q)throw Error("Access change target must resolve to a non-empty id.");return{id:Z.id??kZ(Z),subjectId:$,targetId:Q}}class YZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"access-assignment-store"),this.log=D(Z)}key(...Z){return X(this.prefix,...Z)}idsSetKey(){return this.key(bZ)}accessStorageKey(Z){return this.key("access",H(Z))}subjectIndexKey(Z,$){return this.key(`${yZ}${$??"user"}:${H(Z)}`)}targetIndexKey(Z,$){return this.key(gZ+Z,H($))}async grant(Z){let $=WZ(Z),Q=this.accessStorageKey($.id),W=await this.redis.get(Q),Y=W?l(W,this.log):void 0,V=new Date,G={...Z,id:$.id,status:Z.status??"active",subjectId:$.subjectId,targetId:$.targetId,createdAt:Y?.createdAt??V,updatedAt:V},q=new L;q.set(Q,lZ(G)),q.sadd(this.idsSetKey(),$.id),q.sadd(this.subjectIndexKey($.subjectId,Z.subjectType),$.id),q.sadd(this.targetIndexKey(Z.targetType,$.targetId),$.id),await q.exec(this.redis)}async revoke(Z){let $=WZ(Z);if(await this.redis.get(this.accessStorageKey($.id))==null)return;let W=new L;W.del(this.accessStorageKey($.id)),W.srem(this.idsSetKey(),$.id),W.srem(this.subjectIndexKey($.subjectId,Z.subjectType),$.id),W.srem(this.targetIndexKey(Z.targetType,$.targetId),$.id),await W.exec(this.redis)}async get(Z){let $=await this.redis.get(this.accessStorageKey(Z));if($==null)return;let Q=l($,this.log);return Q?QZ(Q):void 0}async list(Z){return this.listInMemory(R(Z))}async listByTarget(Z,$,Q){let W=await this.redis.smembers(this.targetIndexKey(Z,$.trim()));return this.listFromIds(W,Q)}async listBySubject(Z,$,Q){let W=u(Z);if(!W)return $Z(0,[],Q?.start??0,Q?.limit);let Y=await this.redis.smembers(this.subjectIndexKey(W,$));return this.listFromIds(Y,Q)}async listInMemory(Z){let $=await this.redis.smembers(this.idsSetKey());return this.listFromIds($,Z)}async listFromIds(Z,$){if(Z.length===0)return $Z(0,[],$?.start??0,$?.limit);let W=[...Z].sort().map((q)=>this.accessStorageKey(q)),V=(await this.redis.mget(W)).filter((q)=>q!=null).map((q)=>l(q,this.log)).filter((q)=>q!=null).filter((q)=>(q.status??"active")==="active"),G=_(V,$);return{...G,items:G.items.map(QZ)}}}import{readyCatalogEntry as uZ}from"@ionite/core";class GZ{groups;roles;permissions;listeners=new Set;constructor(Z){let $=Z.redis,Q=F(Z,"access-catalog-store"),W=D(Z),Y=(V)=>{for(let G of this.listeners)G(V)};this.groups=new I($,Q,"group",Y,W),this.roles=new I($,Q,"role",Y,W),this.permissions=new I($,Q,"permission",Y,W)}afterChange(Z){return this.listeners.add(Z),()=>{this.listeners.delete(Z)}}}class VZ{redis;prefix;log;listeners=new Set;entitlements;entitlement;constructor(Z){if(this.redis=Z.redis,this.prefix=F(Z,"resource-store"),this.log=D(Z),Z.deriveEntitlements){let{deriveEntitlements:$,resolveEntitlement:Q}=Z;if(!Q)throw Error("RedisResourceStore: resolveEntitlement must be provided with deriveEntitlements.");this.entitlements=(W)=>$(W),this.entitlement=(W)=>Q(W,(Y)=>this.get(Y))}}key(...Z){return X(this.prefix,"authz","resource",...Z)}entityKey(Z){return this.key(H(Z))}idsSetKey(){return this.key("ids")}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;let Q=C($,{store:"authz:resource",key:Z,log:this.log});return Q===void 0?void 0:Q}async list(Z){let $=await this.redis.smembers(this.idsSetKey());if($.length===0)return _([],Z);let W=(await this.redis.mget($.map((Y)=>this.entityKey(Y)))).filter((Y)=>Y!=null).map((Y)=>C(Y,{store:"authz:resource",log:this.log})).filter((Y)=>Y!==void 0).map((Y)=>Y);return _(W,Z)}async children(Z){return(await this.list()).items.filter((Q)=>{return(typeof Q.parent==="string"?Q.parent:Q.parent?.id)===Z})}changed(Z){return this.listeners.add(Z),()=>{this.listeners.delete(Z)}}async set(Z){await new L().set(this.entityKey(Z.id),JSON.stringify(Z)).sadd(this.idsSetKey(),Z.id).exec(this.redis),this.emitChange({id:Z.id})}async delete(Z){await new L().del(this.entityKey(Z)).srem(this.idsSetKey(),Z).exec(this.redis),this.emitChange({id:Z,deleted:!0})}emitChange(Z){for(let $ of this.listeners)$(Z)}}class I{redis;prefix;kind;emit;log;constructor(Z,$,Q,W,Y){this.redis=Z;this.prefix=$;this.kind=Q;this.emit=W;this.log=Y}key(...Z){return X(this.prefix,"authz",this.kind,...Z)}idsSetKey(){return this.key("ids")}entityKey(Z){return this.key(H(Z))}externalIdKey(Z){return this.key("byExternalId",H(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;let Q=C($,{store:`authz:${this.kind}`,key:Z,log:this.log});return Q===void 0?void 0:Q}async getByExternalId(Z){let $=await this.redis.get(this.externalIdKey(Z));if($==null)return;return this.get($)}set(Z){let $=(async()=>{let Q=await this.get(Z.id),W=new L;if(W.set(this.entityKey(Z.id),JSON.stringify(Z)),W.sadd(this.idsSetKey(),Z.id),Q?.externalId&&Q.externalId!==Z.externalId)W.del(this.externalIdKey(Q.externalId));if(Z.externalId)W.set(this.externalIdKey(Z.externalId),Z.id);await W.exec(this.redis)})();return $.then(()=>this.emit({op:"set",kind:this.kind,entity:Z}),(Q)=>{this.log?.warn("authz catalog store: background persist failed",{"ion.operation":`authz.catalog.${this.kind}.set`,"ion.outcome":"error",id:Z.id,error:Q instanceof Error?Q.message:String(Q)})}),uZ(Z,$)}async delete(Z){let $=await this.get(Z),Q=new L;if(Q.del(this.entityKey(Z)),Q.srem(this.idsSetKey(),Z),$?.externalId)Q.del(this.externalIdKey($.externalId));await Q.exec(this.redis),this.emit({op:"delete",kind:this.kind,id:Z})}async list(Z){let $=await this.redis.smembers(this.idsSetKey());if($.length===0)return _([],Z);let W=(await this.redis.mget($.map((Y)=>this.entityKey(Y)))).filter((Y)=>Y!=null).map((Y)=>C(Y,{store:`authz:${this.kind}`,log:this.log})).filter((Y)=>Y!==void 0).map((Y)=>Y);return _(W,Z)}}import{accessRefId as P}from"@ionite/core";var m="__app__",qZ=100;function pZ(Z){if(!Array.isArray(Z))return[];return Z.map(($)=>$==null?"":String($)).filter(($)=>$.length>0)}var cZ=`local rootId=ARGV[1]
+local A=tonumber(ARGV[2])
+local R=tonumber(ARGV[3])
+local rootKey=KEYS[1]
+local subjectsKey=KEYS[2]
+for i=0,A-1 do
+  local kb=2+i*5
+  local er=KEYS[kb+1]
+  local hk=KEYS[kb+2]
+  local tk=KEYS[kb+3]
+  local ak=KEYS[kb+4]
+  local sk=KEYS[kb+5]
+  local ab=3+i*3
+  local descriptor=ARGV[ab+1]
+  local rToken=ARGV[ab+2]
+  local subjectMember=ARGV[ab+3]
+  redis.call('SADD',er,rootId)
+  redis.call('SET',hk,'1')
+  redis.call('SADD',tk,rToken)
+  redis.call('SET',ak,'1')
+  redis.call('SADD',rootKey,descriptor)
+  redis.call('SADD',sk,descriptor)
+  redis.call('SADD',subjectsKey,subjectMember)
+end
+local rkb=2+A*5
+local rab=3+A*3
+for i=0,R-1 do
+  local kb=rkb+i*5
+  local er=KEYS[kb+1]
+  local hk=KEYS[kb+2]
+  local tk=KEYS[kb+3]
+  local ak=KEYS[kb+4]
+  local sk=KEYS[kb+5]
+  local ab=rab+i*2
+  local descriptor=ARGV[ab+1]
+  local rToken=ARGV[ab+2]
+  redis.call('SREM',er,rootId)
+  if redis.call('SCARD',er)==0 then
+    redis.call('DEL',er)
+    redis.call('DEL',hk)
+    redis.call('SREM',sk,descriptor)
+    redis.call('SREM',tk,rToken)
+    if redis.call('SCARD',tk)==0 then
+      redis.call('DEL',tk)
+      redis.call('DEL',ak)
+    end
+  end
+  redis.call('SREM',rootKey,descriptor)
+end
+return 'ok'`,dZ=`local rootId=ARGV[1]
+local n=tonumber(ARGV[2])
+for i=0,n-1 do
+  local kb=1+i*5
+  local er=KEYS[kb+1]
+  local hk=KEYS[kb+2]
+  local tk=KEYS[kb+3]
+  local ak=KEYS[kb+4]
+  local sk=KEYS[kb+5]
+  local descriptor=ARGV[3+i*2]
+  local rToken=ARGV[4+i*2]
+  redis.call('SREM',er,rootId)
+  if redis.call('SCARD',er)==0 then
+    redis.call('DEL',er)
+    redis.call('DEL',hk)
+    redis.call('SREM',sk,descriptor)
+    redis.call('SREM',tk,rToken)
+    if redis.call('SCARD',tk)==0 then
+      redis.call('DEL',tk)
+      redis.call('DEL',ak)
+    end
+  end
+end
+redis.call('DEL',KEYS[1])
+return 'ok'`,nZ=`local n=tonumber(ARGV[1])
+local roots={}
+local seen={}
+for i=0,n-1 do
+  local kb=1+i*4
+  local er=KEYS[kb+1]
+  local hk=KEYS[kb+2]
+  local tk=KEYS[kb+3]
+  local ak=KEYS[kb+4]
+  local members=redis.call('SMEMBERS',er)
+  for _,r in ipairs(members) do
+    if not seen[r] then seen[r]=true roots[#roots+1]=r end
+  end
+  redis.call('DEL',er)
+  redis.call('DEL',hk)
+  redis.call('DEL',tk)
+  redis.call('DEL',ak)
+end
+redis.call('DEL',KEYS[1])
+return roots`,iZ=`for i=1,#KEYS do redis.call('DEL',KEYS[i]) end
+return 'ok'`;function S(Z,$){return`${$}:${Z}`}function p(Z){return Z&&Z.length>0?Z:m}function BZ(Z){return JSON.stringify([Z.subject,Z.targetType,Z.target,Z.rToken])}function v(Z){let $;try{$=JSON.parse(Z)}catch{$=[]}let[Q,W,Y,V]=Array.isArray($)?$:[];return{subject:Q??"",targetType:W??"permission",target:Y??"",rToken:V??m}}class UZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"access-index"),this.log=D(Z)}key(...Z){return X(this.prefix,...Z)}subjectKeyPart(Z){let $=Z.indexOf(":");if($<=0)return H(Z);return`${Z.slice(0,$)}:${H(Z.slice($+1))}`}hasKey(Z,$,Q,W){return this.key("idx:has",this.subjectKeyPart(Z),$,H(Q),H(W))}anyKey(Z,$,Q){return this.key("idx:any",this.subjectKeyPart(Z),$,H(Q))}edgeRootsKey(Z,$,Q,W){return this.key("idx:er",this.subjectKeyPart(Z),$,H(Q),H(W))}tripleKey(Z,$,Q){return this.key("idx:tr",this.subjectKeyPart(Z),$,H(Q))}rootKey(Z){return this.key("idx:root",H(Z))}subjectKey(Z){return this.key("idx:subj",this.subjectKeyPart(Z))}subjectsKey(){return this.key("idx:subjects")}disabledKey(Z){return this.key("idx:disabled",this.subjectKeyPart(Z))}async has(Z,$,Q,W,Y="user"){let V=P(Z),G=P(Q);if(!V||!G)return{allow:!1};let q=S(V,Y);if(W===void 0){let[O,N]=await this.redis.mget([this.disabledKey(q),this.anyKey(q,$,G)]);if(O!=null)return{allow:!1,metadata:{reason:"subject_disabled"}};return N!=null?this.allow(V,$,G,void 0):{allow:!1}}let B=P(W),J=await this.redis.mget([this.disabledKey(q),this.hasKey(q,$,G,p(B)),this.hasKey(q,$,G,m)]);if(J[0]!=null)return{allow:!1,metadata:{reason:"subject_disabled"}};if(J[1]!=null)return this.allow(V,$,G,B);if(J[2]!=null)return this.allow(V,$,G,void 0);return{allow:!1}}async hasGroup(Z,$,Q,W="user"){return this.has(Z,"group",$,Q,W)}async hasRole(Z,$,Q,W="user"){return this.has(Z,"role",$,Q,W)}async hasPermission(Z,$,Q,W="user"){return this.has(Z,"permission",$,Q,W)}async hasAny(Z,$,Q="user"){if($.length===0)return{allow:!1};this.warnLargeCheck("redis.access_index.has_any",$.length);let W=await this.evaluateTargets(Z,$,Q);for(let Y of W)if(Y.allow)return Y;return{allow:!1}}async hasAll(Z,$,Q="user"){if($.length===0){let V=P(Z);if(V){if(await this.redis.get(this.disabledKey(S(V,Q)))!=null)return{allow:!1,metadata:{reason:"subject_disabled"}}}return{allow:!0}}this.warnLargeCheck("redis.access_index.has_all",$.length);let W=await this.evaluateTargets(Z,$,Q),Y=[];for(let V of W){if(!V.allow)return{allow:!1,matched:Y};if(V.matched)Y.push(...V.matched)}return{allow:!0,matched:Y}}async evaluateTargets(Z,$,Q){let W=P(Z);if(!W)return $.map(()=>({allow:!1}));let Y=S(W,Q),V=[this.disabledKey(Y)],G=$.map((B)=>{let J=P(B.target);if(!J)return{kind:"invalid"};if(B.resource===void 0){let f=V.push(this.anyKey(Y,B.targetType,J))-1;return{kind:"any",targetType:B.targetType,targetId:J,idx:f}}let O=P(B.resource),N=V.push(this.hasKey(Y,B.targetType,J,p(O)))-1,E=V.push(this.hasKey(Y,B.targetType,J,m))-1;return{kind:"resource",targetType:B.targetType,targetId:J,resourceId:O,idxResource:N,idxApp:E}}),q=await this.redis.mget(V);if(q[0]!=null)return $.map(()=>({allow:!1,metadata:{reason:"subject_disabled"}}));return G.map((B)=>{if(B.kind==="invalid")return{allow:!1};if(B.kind==="any")return q[B.idx]!=null?this.allow(W,B.targetType,B.targetId,void 0):{allow:!1};if(q[B.idxResource]!=null)return this.allow(W,B.targetType,B.targetId,B.resourceId);if(q[B.idxApp]!=null)return this.allow(W,B.targetType,B.targetId,void 0);return{allow:!1}})}edgeKeys(Z){return[this.edgeRootsKey(Z.subject,Z.targetType,Z.target,Z.rToken),this.hasKey(Z.subject,Z.targetType,Z.target,Z.rToken),this.tripleKey(Z.subject,Z.targetType,Z.target),this.anyKey(Z.subject,Z.targetType,Z.target),this.subjectKey(Z.subject)]}async materialize(Z,$){let Q=new Map;for(let G of $){let q=P(G.subject),B=P(G.target);if(!q||!B)continue;let J=S(q,G.subjectType??"user"),O=p(G.resource),N={subject:J,targetType:G.targetType,target:B,rToken:O};Q.set(BZ(N),N)}let W=new Set(await this.redis.smembers(this.rootKey(Z))),Y=[];for(let[G,q]of Q)if(!W.has(G))Y.push({encoded:G,d:q});let V=[];for(let G of W)if(!Q.has(G))V.push({encoded:G,d:v(G)});if(Y.length===0&&V.length===0)return;if(A(this.redis)){let G=[this.rootKey(Z),this.subjectsKey()],q=[Z,String(Y.length),String(V.length)];for(let{encoded:B,d:J}of Y)G.push(...this.edgeKeys(J)),q.push(B,J.rToken,J.subject);for(let{encoded:B,d:J}of V)G.push(...this.edgeKeys(J)),q.push(B,J.rToken);await this.redis.runScript(cZ,G,q);return}for(let{encoded:G,d:q}of Y)await this.redis.sadd(this.edgeRootsKey(q.subject,q.targetType,q.target,q.rToken),Z),await this.redis.set(this.hasKey(q.subject,q.targetType,q.target,q.rToken),"1"),await this.redis.sadd(this.tripleKey(q.subject,q.targetType,q.target),q.rToken),await this.redis.set(this.anyKey(q.subject,q.targetType,q.target),"1"),await this.redis.sadd(this.rootKey(Z),G),await this.redis.sadd(this.subjectKey(q.subject),G),await this.redis.sadd(this.subjectsKey(),q.subject);for(let{encoded:G,d:q}of V)await this.dropRootFromEdge(Z,q.subject,q.targetType,q.target,q.rToken),await this.redis.srem(this.rootKey(Z),G)}async removeByRoot(Z){let $=this.rootKey(Z),Q=await this.redis.smembers($);if(Q.length===0){await this.redis.del($);return}if(A(this.redis)){let W=[$],Y=[Z,String(Q.length)];for(let V of Q){let G=v(V);W.push(...this.edgeKeys(G)),Y.push(V,G.rToken)}await this.redis.runScript(dZ,W,Y);return}for(let W of Q){let{subject:Y,targetType:V,target:G,rToken:q}=v(W);await this.dropRootFromEdge(Z,Y,V,G,q)}await this.redis.del($)}async listSubjects(){let Z=await this.redis.smembers(this.subjectsKey()),$=[];for(let Q of Z){let W=Q.indexOf(":");if(W<=0){$.push({subject:Q});continue}$.push({subjectType:Q.slice(0,W),subject:Q.slice(W+1)})}return $}async setSubjectDisabled(Z,$,Q){let W=P(Z);if(!W)return;let Y=this.disabledKey(S(W,$));if(Q)await this.redis.set(Y,"1");else await this.redis.del(Y)}async isSubjectDisabled(Z,$="user"){let Q=P(Z);if(!Q)return!1;return await this.redis.get(this.disabledKey(S(Q,$)))!=null}async clear(Z,$="user"){if(Z===void 0){let Y=await this.redis.smembers(this.subjectsKey());for(let V of Y)await this.clearSubject(V);await this.redis.del(this.subjectsKey());return}let Q=P(Z);if(!Q)return;let W=S(Q,$);await this.clearSubject(W),await this.redis.srem(this.subjectsKey(),W)}async clearSubject(Z){let $=this.subjectKey(Z),Q=await this.redis.smembers($);if(Q.length===0){await this.redis.del($);return}if(A(this.redis)){let W=[$];for(let V of Q){let{targetType:G,target:q,rToken:B}=v(V);W.push(this.edgeRootsKey(Z,G,q,B),this.hasKey(Z,G,q,B),this.tripleKey(Z,G,q),this.anyKey(Z,G,q))}let Y=pZ(await this.redis.runScript(nZ,W,[String(Q.length)]));if(Y.length>0)await this.redis.runScript(iZ,Y.map((V)=>this.rootKey(V)),[]);return}for(let W of Q){let{targetType:Y,target:V,rToken:G}=v(W),q=this.edgeRootsKey(Z,Y,V,G),B=await this.redis.smembers(q);for(let O of B)await this.redis.srem(this.rootKey(O),W);if(await this.redis.del(q),await this.redis.del(this.hasKey(Z,Y,V,G)),await this.redis.srem(this.tripleKey(Z,Y,V),G),(await this.redis.smembers(this.tripleKey(Z,Y,V))).length===0)await this.redis.del(this.tripleKey(Z,Y,V)),await this.redis.del(this.anyKey(Z,Y,V))}await this.redis.del($)}async dropRootFromEdge(Z,$,Q,W,Y){let V=this.edgeRootsKey($,Q,W,Y);if(await this.redis.srem(V,Z),(await this.redis.smembers(V)).length>0)return;await this.redis.del(V),await this.redis.del(this.hasKey($,Q,W,Y));let q=BZ({subject:$,targetType:Q,target:W,rToken:Y});if(await this.redis.srem(this.subjectKey($),q),await this.redis.srem(this.tripleKey($,Q,W),Y),(await this.redis.smembers(this.tripleKey($,Q,W))).length===0)await this.redis.del(this.tripleKey($,Q,W)),await this.redis.del(this.anyKey($,Q,W))}allow(Z,$,Q,W){return{allow:!0,matched:[{subject:Z,targetType:$,target:Q,resources:W?[W]:void 0}]}}warnLargeCheck(Z,$){if($<=qZ)return;this.log.warn("Redis access index check received a large bounded target set; issuing per-target reads.",{"ion.operation":Z,"ion.outcome":"degraded",count:$,threshold:qZ})}}var aZ=512;async function oZ(Z,$,Q=512){if(Z.length===0)return[];let W=Q>0?Q:512,Y=[];for(let V=0;V<Z.length;V+=W){let G=await $(Z.slice(V,V+W));for(let q of G)Y.push(q??null)}return Y}import{list as rZ,StoreConflictError as sZ}from"@ionite/core";var tZ="customer:ids",eZ="customer:name:";function Z$(Z){let $=Z.createdAt??new Date,Q=Z.updatedAt??$,W={...Z,createdAt:$.toISOString(),updatedAt:Q.toISOString()};if(W.ciam&&typeof W.ciam==="object"&&W.ciam!==null){let Y=W.ciam;if(Y.expires instanceof Date)Y.expires=Y.expires.toISOString()}return JSON.stringify(W)}function c(Z,$){let Q=C(Z,{store:"customer",log:$});if(Q===void 0)return;if(Q.ciam&&typeof Q.ciam==="object"&&Q.ciam!==null){let W=Q.ciam;if(typeof W.expires==="string")W.expires=new Date(W.expires)}return{...Q,createdAt:typeof Q.createdAt==="string"?new Date(Q.createdAt):void 0,updatedAt:typeof Q.updatedAt==="string"?new Date(Q.updatedAt):void 0}}class HZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"customer-store"),this.log=D(Z)}key(...Z){return X(this.prefix,...Z)}entityKey(Z){return this.key("customer",H(Z))}idsSetKey(){return this.key(tZ)}nameIndexKey(Z){return this.key(eZ+H(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return c($,this.log)}async lookup(Z){if(Z.id){let $=await this.get(Z.id);if($)return $}if(Z.userName){let $=await this.redis.get(this.nameIndexKey(Z.userName.toLowerCase()));if($!=null)return this.get($)}return}async upsert(Z){let $=Z.id?.trim()||crypto.randomUUID(),Q={...Z,id:$},W=this.entityKey($),Y=await this.redis.get(W),V=Y!=null?c(Y,this.log)??null:null,G=Q.userName?.toLowerCase(),q=V?.userName?.toLowerCase(),B=new L;if(G)B.claimUnique(this.nameIndexKey(G),$);if(q&&q!==G)B.del(this.nameIndexKey(q));if(B.set(W,Z$(Q)),G)B.set(this.nameIndexKey(G),$);if(B.sadd(this.idsSetKey(),$),await B.exec(this.redis)==="conflict")throw new sZ(`userName "${Q.userName}" is already in use`,"unique_violation","userName");return Q}async delete(Z){let $=await this.get(Z);if($==null)return 0;let Q=new L;if(Q.del(this.entityKey(Z)),$.userName)Q.del(this.nameIndexKey($.userName.toLowerCase()));return Q.srem(this.idsSetKey(),Z),await Q.exec(this.redis),1}async list(Z){let $=R(Z),Q=(await this.redis.smembers(this.idsSetKey())).sort();if(Q.length===0)return rZ(0,[],$.start??0,$.limit);let W=Q.map((G)=>this.entityKey(G)),V=(await this.redis.mget(W)).filter((G)=>G!=null).map((G)=>c(G,this.log)).filter((G)=>G!=null);return _(V,$)}}import{createHash as $$}from"node:crypto";function JZ(Z){return $$("sha1").update(Z,"utf8").digest("hex")}function Q$(Z){return(Z instanceof Error?Z.message:String(Z)).includes("NOSCRIPT")}function W$(Z){let $=new Map;return async(Q,W,Y)=>{let V=$.get(Q);if(!V)V=JZ(Q),$.set(Q,V);try{return await Z.evalsha(V,W,Y)}catch(G){if(Q$(G))return Z.eval(Q,W,Y);throw G}}}var Y$=7776000;class MZ{redis;prefix;ttlSeconds;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"iam-delta-id-map-store");let $=Z.idMapTtlSeconds;this.ttlSeconds=$==null?Y$:Math.max(0,Math.floor($))}key(Z){return X(this.prefix,"iam","delta","idmap",H(Z.tenantId??"_"),H(Z.resourceType),H(Z.destination),H(Z.externalId))}async get(Z){return await this.redis.get(this.key(Z))??void 0}async set(Z,$){if(this.ttlSeconds>0)await this.redis.setex(this.key(Z),this.ttlSeconds,$);else await this.redis.set(this.key(Z),$)}async delete(Z){await this.redis.del(this.key(Z))}}function FZ(Z){return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)}function G$(Z){let $=FZ(Z.clientOptions)?{...Z.clientOptions}:FZ(Z)?{...Z}:{};return delete $.redisUrl,delete $.clientOptions,{redisUrl:(typeof Z.redisUrl==="string"?Z.redisUrl.trim():"")||void 0,clientOptions:$}}import{StoreConflictError as V$}from"@ionite/core";function q$(Z){return JSON.stringify({token:Z.token,customer:Z.customer,createdAt:Z.createdAt.toISOString(),expiresAt:Z.expiresAt.toISOString()})}function XZ(Z,$){let Q=C(Z,{store:"magic-link",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt),expiresAt:new Date(Q.expiresAt)}}class OZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"magic-link-store"),this.log=D(Z)}key(Z){return X(this.prefix,"magic",H(Z))}async create(Z,$,Q){let W=this.key(Z),Y={token:Z,customer:$,createdAt:new Date,expiresAt:Q},V=Math.max(1,Math.floor((Q.getTime()-Date.now())/1000));if(await T(this.redis,W,q$(Y),{ttlSeconds:V})==="conflict")throw new V$(`Magic link with token ${Z} already exists`,"already_exists","token")}async get(Z){let $=await this.redis.get(this.key(Z));if($==null)return null;return XZ($,this.log)??null}async getAndDelete(Z){let $=this.key(Z),Q;if(typeof this.redis.getdel==="function")Q=await this.redis.getdel($);else if(Q=await this.redis.get($),Q!=null)await this.redis.del($);if(Q==null)return null;let W=XZ(Q,this.log);if(W==null)return null;if(Date.now()>W.expiresAt.getTime())return null;return W}async delete(Z){await this.redis.del(this.key(Z))}}import{defaultLogger as B$}from"@ionite/core";function U$(Z,$){if(typeof $!=="number"||$<=0)return Z;return new Promise((Q,W)=>{let Y=setTimeout(()=>{W(Error(`Reactive Redis adapter did not become ready within ${$}ms`))},$);Z.then(()=>{clearTimeout(Y),Q()},(V)=>{clearTimeout(Y),W(V)})})}function H$(){let Z,$;return{promise:new Promise((W,Y)=>{Z=W,$=Y}),resolve:Z,reject:$}}function zZ(Z){return typeof Z==="function"}function J$(Z){let $=Z.logger??B$,Q=Z.sourceName?.trim()||"redis",W=Z.path.trim(),Y,V,G=!1,q,B,J,O=!1,N=!1,E=!1,f=Promise.resolve(),x=H$();x.promise.catch(()=>{});let j={async get(U){return K((M)=>M.get(U))},async set(U,M){await K((z)=>z.set(U,M))},async setex(U,M,z){await K((h)=>h.setex(U,M,z))},async del(U){await K((M)=>M.del(U))},async sadd(U,...M){await K((z)=>z.sadd(U,...M))},async srem(U,...M){await K((z)=>z.srem(U,...M))},async smembers(U){return K((M)=>M.smembers(U))},async mget(U){return K((M)=>M.mget(U))},ready(U){return U$(x.promise,U)},isReady(){return Y!==void 0},async close(){if(O=!0,a(),!G)G=!0,x.reject(Error(`Reactive Redis adapter for source "${Q}" at path "${W}" was closed before becoming ready.`));await f.catch(()=>{}),await k(Y),Y=void 0,b()}};function i(U){f=f.then(U).catch((M)=>{if(!G)G=!0,x.reject(M);$.warn("Reactive Redis adapter update failed",{"ion.operation":"redis.adapter.update","ion.outcome":"degraded",sourceName:Q,path:W,error:M instanceof Error?M.message:String(M)})})}async function SZ(){if(O)throw Error(`Reactive Redis adapter for source "${Q}" at path "${W}" is closed.`);let U=Y?.adapter;if(U)return U;if(await f.catch(()=>{}),O)throw Error(`Reactive Redis adapter for source "${Q}" at path "${W}" is closed.`);let M=Y?.adapter;if(M)return M;if(await x.promise,O)throw Error(`Reactive Redis adapter for source "${Q}" at path "${W}" is closed.`);let z=Y?.adapter;if(!z)throw Error(`Reactive Redis adapter for source "${Q}" at path "${W}" did not become ready.`);return z}async function K(U){let M=await SZ();return U(M)}function a(){V?.(),V=void 0}async function fZ(U){a(),V=await U.subscribe(W,(M)=>{i(async()=>{if(O)return;await xZ(M)})},Z.subscription??Z.secretOptions)}async function xZ(U){if(O)return;let M=`${Q}:${W}:${U.metadata.version}`;if(Y!==void 0&&B===M&&q===U.metadata.version)return;let z=Z.endpointOf?.(U);if(Y!==void 0&&z!=null&&z!==""&&J!=null&&J!==""&&z!==J)throw Error(`Reactive Redis adapter for source "${Q}" at path "${W}" rejected a rotation that changed the endpoint (${J} -> ${z}); only credentials may rotate under an active adapter.`);let h=await Z.createClient(U);if(O){await k(h);return}let w=Y;if(Y=h,B=M,q=U.metadata.version,z!=null&&z!=="")J=z;if(b(),!G)G=!0,x.resolve();await k(w)}async function k(U){if(!U?.dispose)return;await U.dispose()}function b(){let U=Y?.adapter;if(U?.runScript&&zZ(U.runScript))j.runScript=async(M,z,h)=>{return K(async(w)=>{if(!w.runScript)throw Error("Active Redis adapter does not support runScript");return w.runScript(M,z,h)})};else if(delete j.runScript,U!==void 0&&!N)N=!0,$.warn("Active Redis adapter does not support runScript (EVAL); stores fall back to non-isolated writes.",{"ion.operation":"redis.adapter.capabilities","ion.outcome":"degraded",sourceName:Q,path:W,capability:"runScript"});if(U?.getdel&&zZ(U.getdel))j.getdel=async(M)=>{return K(async(z)=>{if(!z.getdel)return null;return z.getdel(M)})};else if(delete j.getdel,U!==void 0&&!E)E=!0,$.warn("Active Redis adapter does not support getdel (GETDEL); single-use consume falls back to get+del.",{"ion.operation":"redis.adapter.capabilities","ion.outcome":"degraded",sourceName:Q,path:W,capability:"getdel"})}return b(),i(async()=>{if(O)return;await fZ(Z.source)}),j}import{StoreConflictError as M$}from"@ionite/core";var F$=5;function X$(Z,$){let Q;try{Q=JSON.parse(Z)}catch{return}if(Q==null||typeof Q!=="object"||Array.isArray(Q))return;return JSON.stringify({...Q,...$})}function DZ(Z){return JSON.stringify({...Z,createdAt:Z.createdAt.toISOString()})}function LZ(Z,$){let Q=C(Z,{store:"session",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt)}}function CZ(Z){if(!Z)return;let $=Z instanceof Date?Z.getTime():new Date(Z).getTime();if(Number.isNaN($))return;let Q=Math.ceil(($-Date.now())/1000);return Q>0?Q:1}class _Z{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"session-store"),this.log=D(Z)}key(Z){return X(this.prefix,"session",H(Z))}async create(Z){let $=this.key(Z.sid),Q=CZ(Z.expiresAt);if(await T(this.redis,$,DZ(Z),{ttlSeconds:Q})==="conflict")throw new M$(`Session with sid ${Z.sid} already exists`,"already_exists","sid")}async get(Z){let $=await this.redis.get(this.key(Z));if($==null)return null;return LZ($,this.log)??null}async update(Z,$){let Q=this.key(Z),W=JSON.parse(JSON.stringify($)),Y="expiresAt"in W?CZ(W.expiresAt):void 0;if(A(this.redis))for(let J=0;J<F$;J++){let O=await this.redis.get(Q);if(O==null)throw Error(`Session with sid ${Z} not found`);let N=X$(O,W);if(N===void 0)throw Error(`Session with sid ${Z} not found`);let E=await g(this.redis,Q,O,N,Y);if(E==="ok")return;if(E==="missing")throw Error(`Session with sid ${Z} not found`)}let V=await this.redis.get(Q);if(V==null)throw Error(`Session with sid ${Z} not found`);let G=LZ(V,this.log);if(G==null)throw Error(`Session with sid ${Z} not found`);let q={...G,...$},B=DZ(q);if(Y!=null&&Y>0)await this.redis.setex(Q,Math.max(1,Math.floor(Y)),B);else await this.redis.set(Q,B)}async delete(Z){await this.redis.del(this.key(Z))}}var O$="tenant:ids";function z$(Z){return JSON.stringify({...Z,createdAt:Z.createdAt.toISOString(),updatedAt:Z.updatedAt.toISOString()})}function NZ(Z,$){let Q=C(Z,{store:"tenant",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt),updatedAt:new Date(Q.updatedAt)}}class PZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"tenant-store"),this.log=D(Z)}key(...Z){return X(this.prefix,...Z)}entityKey(Z){return this.key("tenant",H(Z))}idsSetKey(){return this.key(O$)}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return NZ($,this.log)}async upsert(Z){return await new L().set(this.entityKey(Z.id),z$(Z)).sadd(this.idsSetKey(),Z.id).exec(this.redis),Z}async list(Z){let $=await this.redis.smembers(this.idsSetKey());if($.length===0)return _([],Z);let Q=$.map((V)=>this.entityKey(V)),Y=(await this.redis.mget(Q)).map((V)=>V!=null?NZ(V,this.log):void 0).filter((V)=>V!=null);return _(Y,Z)}async delete(Z){let $=await this.get(Z);return await new L().srem(this.idsSetKey(),Z).del(this.entityKey(Z)).exec(this.redis),$?1:0}}class AZ{store;ionCache;constructor(Z){this.ionCache=Z.ionCache,this.store=new PZ(Z)}async get(Z){return this.store.get(Z)}async upsert(Z){let $=await this.store.upsert(Z);return this.ionCache?.delete(Z.id),$}async list(Z){return this.store.list(Z)}async delete(Z){let $=await this.store.delete(Z);return this.ionCache?.delete(Z),$}async getIon(Z){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(Z)}}import{list as D$,StoreConflictError as L$}from"@ionite/core";var C$="user:ids",_$="user:name:";function N$(Z){let $=Z.createdAt??new Date,Q=Z.updatedAt??$,W={...Z,createdAt:$.toISOString(),updatedAt:Q.toISOString()};if(W.sso&&typeof W.sso==="object"&&W.sso!==null){let Y=W.sso;if(Y.expires instanceof Date)Y.expires=Y.expires.toISOString()}return JSON.stringify(W)}function d(Z,$){let Q=C(Z,{store:"user",log:$});if(Q===void 0)return;if(Q.sso&&typeof Q.sso==="object"&&Q.sso!==null){let W=Q.sso;if(typeof W.expires==="string")W.expires=new Date(W.expires)}return{...Q,createdAt:typeof Q.createdAt==="string"?new Date(Q.createdAt):void 0,updatedAt:typeof Q.updatedAt==="string"?new Date(Q.updatedAt):void 0}}class KZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"user-store"),this.log=D(Z)}key(...Z){return X(this.prefix,...Z)}entityKey(Z){return this.key("user",H(Z))}idsSetKey(){return this.key(C$)}nameIndexKey(Z){return this.key(_$+H(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return d($,this.log)}async lookup(Z){return this.get(Z.id??"")}async upsert(Z){let $=Z.id?.trim()||crypto.randomUUID(),Q={...Z,id:$},W=this.entityKey($),Y=await this.redis.get(W),V=Y!=null?d(Y,this.log)??null:null,G=Q.userName?.toLowerCase(),q=V?.userName?.toLowerCase(),B=new L;if(G)B.claimUnique(this.nameIndexKey(G),$);if(q&&q!==G)B.del(this.nameIndexKey(q));if(B.set(W,N$(Q)),G)B.set(this.nameIndexKey(G),$);if(B.sadd(this.idsSetKey(),$),await B.exec(this.redis)==="conflict")throw new L$(`userName "${Q.userName}" is already in use`,"unique_violation","userName");return Q}async delete(Z){let $=await this.get(Z);if($==null)return 0;let Q=new L;if(Q.del(this.entityKey(Z)),$.userName)Q.del(this.nameIndexKey($.userName.toLowerCase()));return Q.srem(this.idsSetKey(),Z),await Q.exec(this.redis),1}async list(Z){let $=R(Z),Q=(await this.redis.smembers(this.idsSetKey())).sort();if(Q.length===0)return D$(0,[],$.start??0,$.limit);let W=Q.map((G)=>this.entityKey(G)),V=(await this.redis.mget(W)).filter((G)=>G!=null).map((G)=>d(G,this.log)).filter((G)=>G!=null);return _(V,$)}}import{list as P$,StoreConflictError as A$}from"@ionite/core";var K$="workload-identity:ids",R$="workload-identity:client:";function E$(Z){let $=Z.createdAt??new Date,Q=Z.updatedAt??$;return JSON.stringify({...Z,createdAt:$.toISOString(),updatedAt:Q.toISOString()})}function n(Z,$){let Q=C(Z,{store:"workload-identity",log:$});if(Q===void 0)return;return{...Q,createdAt:typeof Q.createdAt==="string"?new Date(Q.createdAt):void 0,updatedAt:typeof Q.updatedAt==="string"?new Date(Q.updatedAt):void 0}}class RZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"workload-identity-store"),this.log=D(Z)}key(...Z){return X(this.prefix,...Z)}entityKey(Z){return this.key("workload-identity",H(Z))}idsSetKey(){return this.key(K$)}clientIndexKey(Z){return this.key(R$+H(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return n($,this.log)}async lookup(Z){if(Z.id){let $=await this.get(Z.id);if($)return $}if(Z.clientId){let $=await this.redis.get(this.clientIndexKey(Z.clientId));if($!=null)return this.get($)}return}async upsert(Z){let $=Z.id?.trim()||crypto.randomUUID(),Q=this.entityKey($),W=await this.redis.get(Q),Y=null;if(W!=null)Y=n(W,this.log)??null;let V=new Date,G={...Z,id:$,createdAt:Y?.createdAt??Z.createdAt??V,updatedAt:V},q=new L;if(G.clientId)q.claimUnique(this.clientIndexKey(G.clientId),$);if(Y?.clientId&&Y.clientId!==G.clientId)q.del(this.clientIndexKey(Y.clientId));if(q.set(Q,E$(G)),G.clientId)q.set(this.clientIndexKey(G.clientId),$);if(q.sadd(this.idsSetKey(),$),await q.exec(this.redis)==="conflict")throw new A$(`clientId "${G.clientId}" is already in use`,"unique_violation","clientId");return G}async delete(Z){let $=await this.get(Z);if($==null)return 0;let Q=new L;if(Q.del(this.entityKey(Z)),$.clientId)Q.del(this.clientIndexKey($.clientId));return Q.srem(this.idsSetKey(),Z),await Q.exec(this.redis),1}async list(Z){let $=R(Z),Q=(await this.redis.smembers(this.idsSetKey())).sort();if(Q.length===0)return P$(0,[],$.start??0,$.limit);let W=Q.map((G)=>this.entityKey(G)),V=(await this.redis.mget(W)).filter((G)=>G!=null).map((G)=>n(G,this.log)).filter((G)=>G!=null);return _(V,$)}}function S$(Z){return JSON.stringify({...Z,expires_at:Z.expires_at.toISOString(),created_at:Z.created_at.toISOString()})}function f$(Z,$){let Q=C(Z,{store:"workload-token",log:$});if(Q===void 0)return;return{...Q,expires_at:new Date(Q.expires_at),created_at:new Date(Q.created_at)}}class EZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=F(Z,"workload-token-store"),this.log=D(Z)}key(Z){return X(this.prefix,"workload","token",H(Z))}async set(Z){let $=this.key(Z.workload_id),Q=Math.max(1,Math.floor((Z.expires_at.getTime()-Date.now())/1000));await this.redis.setex($,Q,S$(Z))}async get(Z){let $=await this.redis.get(this.key(Z));if($==null)return null;let Q=f$($,this.log);if(Q==null)return null;if(Date.now()>Q.expires_at.getTime())return await this.redis.del(this.key(Z)),null;return Q}async delete(Z){await this.redis.del(this.key(Z))}async isValid(Z){return await this.get(Z)!==null}async cleanup(){}}export{A as supportsRunScript,G$ as splitIonRedisSecret,JZ as scriptSha1,X as prefixedKey,D as getLogger,F as getKeyPrefix,H as encodeKeyId,J$ as createReactiveRedis,W$ as createEvalshaRunner,oZ as chunkedMget,T as atomicCreate,g as atomicCompareAndSet,EZ as RedisWorkloadTokenStore,RZ as RedisWorkloadIdentityStore,KZ as RedisUserStore,L as RedisTxn,AZ as RedisTenantStore,_Z as RedisSessionStore,VZ as RedisResourceStore,OZ as RedisMagicLinkStore,MZ as RedisIamDeltaIdMapStore,HZ as RedisCustomerStore,UZ as RedisAccessIndex,GZ as RedisAccessCatalogStore,YZ as RedisAccessAssignmentStore,s as MAX_LIST_LIMIT,aZ as DEFAULT_MGET_CHUNK_SIZE,r as DEFAULT_LIST_LIMIT};

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@ionite/redis-core",
+  "version": "0.0.21",
+  "description": "Redis adapter interface and store implementations for ionite. Use with @ionite/redis (node-redis), @ionite/ioredis, or a custom RedisAdapter.",
+  "private": false,
+  "author": "ionite",
+  "license": "proprietary",
+  "type": "module",
+  "engines": {
+    "node": ">=20.6"
+  },
+  "files": [
+    "dist"
+  ],
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@ionite/core": "^0.0.21"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0"
+  }
+}