@ionite/redis-core 0.0.23-beta.20260812.6 → 0.0.23-beta.20260820.2

package/dist/index.d.ts

@@ -25,7 +25,7 @@ interface RedisAdapter {
 	srem(key: string, ...members: string[]): Promise<void>;
 	smembers(key: string): Promise<string[]>;
 	mget(keys: string[]): Promise<(string | null)[]>;
-	/** Optional Redis Pub/Sub publisher used by distributed LFV callback transports. */
+	/** Optional Redis Pub/Sub publisher used by reactive Redis integrations. */
 	publish?(channel: string, message: string): Promise<void>;
 	/**
 	* Optional Redis Pub/Sub subscription. Implementations MUST use a dedicated subscriber connection
@@ -33,9 +33,8 @@ interface RedisAdapter {
 	*/
 	subscribeChannel?(channel: string, listener: (message: string) => void): Promise<() => void | Promise<void>>;
 	/**
-	* Optional: atomically get a key's value and delete it (Redis `GETDEL`, 6.2+). When implemented,
-	* the magic-link store uses it for a truly atomic single-use consume; otherwise it falls back to
-	* a best-effort get-then-del.
+	* Optional: atomically get a key's value and delete it (Redis `GETDEL`, 6.2+). Required by the LFV
+	* OTP mailbox and used by the magic-link store for truly atomic single-use consumption.
 	*/
 	getdel?(key: string): Promise<string | null>;
 	/**
@@ -151,22 +150,14 @@ declare class RedisAccessCatalogStore implements AccessCatalogStore {
 * already live there; use this store only when Redis IS the app's resource storage).
 *
 * `set`/`delete` emit the `changed` signal after the durable write lands, driving the SDK's
-* adjacency-cache invalidation, targeted reconcile, and incremental OAA projection. Provide
-* `deriveEntitlements`/`resolveEntitlement` to expose resource-derived entitlement Groups.
+* adjacency-cache invalidation, targeted reconcile, and incremental OAA projection.
 */
 declare class RedisResourceStore implements ResourceProvider {
 	private readonly redis;
 	private readonly prefix;
 	private readonly log;
 	private readonly listeners;
-	entitlements?: (resource: Resource) => Group[];
-	entitlement?: (id: string) => Promise<Group | undefined>;
-	constructor(options: RedisStoreOptions & {
-		/** Pure derivation of a resource's requestable entitlement Groups (see {@link ResourceProvider.entitlements}). */
-		deriveEntitlements?: (resource: Resource) => Group[];
-		/** Reverse resolution of a resource-derived entitlement id (see {@link ResourceProvider.entitlement}). */
-		resolveEntitlement?: (id: string, get: (resourceId: string) => Promise<Resource | undefined>) => Promise<Group | undefined>;
-	});
+	constructor(options: RedisStoreOptions);
 	private key;
 	private entityKey;
 	private idsSetKey;
@@ -329,31 +320,6 @@ declare function createEvalshaRunner(client: {
 	eval(script: string, keys: string[], args: string[]): Promise<unknown>;
 	evalsha(sha: string, keys: string[], args: string[]): Promise<unknown>;
 }): (script: string, keys: string[], args: string[]) => Promise<unknown>;
-import { IamDeltaIdMapKey, IamDeltaIdMapStore } from "@ionite/core";
-type RedisIamDeltaIdMapStoreOptions = RedisStoreOptions & {
-	/**
-	* TTL (seconds) applied to each id-map entry so abandoned externalId mappings (deleted resources,
-	* decommissioned destinations) self-evict instead of accumulating forever (§6.7). Each `set`
-	* refreshes the TTL, so actively-used mappings persist. Pass `0` to disable expiry.
-	*/
-	idMapTtlSeconds?: number;
-};
-/**
-* Redis-backed {@link IamDeltaIdMapStore}. Durable externalId -> destination provider-id cache for
-* IAM delta `'patch'` egress, shared across app instances and surviving restarts so the patch
-* adapter resolves each resource once and reuses the id thereafter (self-healing on stale ids is
-* handled by the adapter via `delete` + re-resolve).
-*/
-declare class RedisIamDeltaIdMapStore implements IamDeltaIdMapStore {
-	private readonly redis;
-	private readonly prefix;
-	private readonly ttlSeconds;
-	constructor(options: RedisIamDeltaIdMapStoreOptions);
-	private key;
-	get(key: IamDeltaIdMapKey): Promise<string | undefined>;
-	set(key: IamDeltaIdMapKey, providerId: string): Promise<void>;
-	delete(key: IamDeltaIdMapKey): Promise<void>;
-}
 import { Logger as Logger2, SecretsOperationOptions, SecretsSubscriptionOptions } from "@ionite/core";
 /**
 * Options shared by the client-specific `ionRedis(...)` factories in `@ionite/redis` and
@@ -387,8 +353,9 @@ type RedisLfvTransportOptions = {
 	logger?: Logger3;
 };
 /**
-* Distributes original signed LFV callback envelopes through Redis Pub/Sub. Redis is a transport,
-* never a trust anchor: every receiving LFV source verifies the envelope against its own JWKS.
+* Parks signed LFV OTP callback envelopes in Redis for single-consume retrieval by the process that
+* initiated the request. Redis is a transport, never a trust anchor: the consumer verifies the
+* envelope against its own JWKS. Values always carry a bounded TTL.
 */
 declare function createRedisLfvTransport(adapter: RedisAdapter, options?: RedisLfvTransportOptions): LfvCallbackTransport;
 /** Default page size applied to a paginated `list()` when the caller omits `limit` (§7.3). */
@@ -433,6 +400,12 @@ type ReactiveRedisOptions<TSecret> = {
 	endpointOf?: (secret: Secret<TSecret>) => string;
 };
 type ReactiveRedisAdapter = RedisAdapter & {
+	/**
+	* Always present on the reactive adapter (verified against the live client at call time), so
+	* synchronous capability checks such as `createRedisLfvTransport`'s pass at module scope.
+	*/
+	publish(channel: string, message: string): Promise<void>;
+	subscribeChannel(channel: string, listener: (message: string) => void): Promise<() => void | Promise<void>>;
 	ready(timeout?: number): Promise<void>;
 	isReady(): boolean;
 	close(): Promise<void>;
@@ -481,7 +454,9 @@ declare class RedisUserStore<TExtended = Record<string, never>> implements UserS
 	private entityKey;
 	private idsSetKey;
 	private nameIndexKey;
+	private externalIdIndexKey;
 	get(sub: string): Promise<BaseUser2<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseUser2<TExtended> | undefined>;
 	lookup(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended> | undefined>;
 	upsert(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended>>;
 	delete(sub: string): Promise<number>;
@@ -522,4 +497,4 @@ declare class RedisWorkloadTokenStore<TExtended = object> implements WorkloadTok
 	isValid(workload_id: string): Promise<boolean>;
 	cleanup(): Promise<void>;
 }
-export { supportsRunScript, splitIonRedisSecret, scriptSha1, prefixedKey, getLogger, getKeyPrefix, encodeKeyId, createRedisLfvTransport, createReactiveRedis, createEvalshaRunner, chunkedMget, atomicCreate, atomicCompareAndSet, RedisWorkloadTokenStore, RedisWorkloadIdentityStoreOptions, RedisWorkloadIdentityStore, RedisUserStoreOptions, RedisUserStore, RedisTxn, RedisTenantStoreOptions, RedisTenantStore, RedisStoreOptions, RedisSessionStore, RedisResourceStore, RedisMagicLinkStore, RedisLfvTransportOptions, RedisIamDeltaIdMapStoreOptions, RedisIamDeltaIdMapStore, RedisCustomerStoreOptions, RedisCustomerStore, RedisAdapter, RedisAccessIndex, RedisAccessCatalogStore, RedisAccessAssignmentStore, ReactiveRedisOptions, ReactiveRedisClient, ReactiveRedisAdapter, MAX_LIST_LIMIT, IonRedisOptions, DEFAULT_MGET_CHUNK_SIZE, DEFAULT_LIST_LIMIT, AtomicCreateResult, AtomicCompareAndSetResult };
+export { supportsRunScript, splitIonRedisSecret, scriptSha1, prefixedKey, getLogger, getKeyPrefix, encodeKeyId, createRedisLfvTransport, createReactiveRedis, createEvalshaRunner, chunkedMget, atomicCreate, atomicCompareAndSet, RedisWorkloadTokenStore, RedisWorkloadIdentityStoreOptions, RedisWorkloadIdentityStore, RedisUserStoreOptions, RedisUserStore, RedisTxn, RedisTenantStoreOptions, RedisTenantStore, RedisStoreOptions, RedisSessionStore, RedisResourceStore, RedisMagicLinkStore, RedisLfvTransportOptions, RedisCustomerStoreOptions, RedisCustomerStore, RedisAdapter, RedisAccessIndex, RedisAccessCatalogStore, RedisAccessAssignmentStore, ReactiveRedisOptions, ReactiveRedisClient, ReactiveRedisAdapter, MAX_LIST_LIMIT, IonRedisOptions, DEFAULT_MGET_CHUNK_SIZE, DEFAULT_LIST_LIMIT, AtomicCreateResult, AtomicCompareAndSetResult };