@ionite/redis-core 0.0.24-beta.20260907.2 → 0.0.24-beta.20260907.3

package/dist/index.js

@@ -1,11 +1,56 @@
-import{accessRefId as i,accessRootId as aZ,assertRequiredSubjectType as VZ,list as BZ}from"@ionite/core";function E(Z){return typeof Z.runScript==="function"}async function m(Z,$,Q,Y){let W=Y?.ttlSeconds;if(E(Z)){let B=`local cur=redis.call('GET',KEYS[1])
+// packages/redis-core/src/access-assignment-store.ts
+import {
+  accessRefId,
+  accessRootId,
+  assertRequiredSubjectType,
+  list as list2
+} from "@ionite/core";
+
+// packages/redis-core/src/adapter.types.ts
+function supportsRunScript(adapter) {
+  return typeof adapter.runScript === "function";
+}
+
+// packages/redis-core/src/atomic.ts
+async function atomicCreate(adapter, key, value, opts) {
+  const ttl = opts?.ttlSeconds;
+  if (supportsRunScript(adapter)) {
+    const setCmd = ttl != null ? "redis.call('SET',KEYS[1],ARGV[1],'EX',ARGV[2])" : "redis.call('SET',KEYS[1],ARGV[1])";
+    const script = `local cur=redis.call('GET',KEYS[1])
 if cur then if cur==ARGV[1] then return 'exists_identical' else return 'conflict' end end
-${W!=null?"redis.call('SET',KEYS[1],ARGV[1],'EX',ARGV[2])":"redis.call('SET',KEYS[1],ARGV[1])"}
-return 'created'`,U=W!=null?[Q,String(Math.max(1,Math.floor(W)))]:[Q],J=String(await Z.runScript(B,[$],U));return J==="exists_identical"||J==="conflict"?J:"created"}let V=await Z.get($);if(V!=null)return V===Q?"exists_identical":"conflict";if(W!=null)await Z.setex($,Math.max(1,Math.floor(W)),Q);else await Z.set($,Q);return"created"}async function c(Z,$,Q,Y,W){if(!E(Z))return"unsupported";let V=W!=null&&W>0?Math.max(1,Math.floor(W)):void 0,B=`local cur=redis.call('GET',KEYS[1])
+${setCmd}
+return 'created'`;
+    const args = ttl != null ? [value, String(Math.max(1, Math.floor(ttl)))] : [value];
+    const res = String(await adapter.runScript(script, [key], args));
+    return res === "exists_identical" || res === "conflict" ? res : "created";
+  }
+  const cur = await adapter.get(key);
+  if (cur != null)
+    return cur === value ? "exists_identical" : "conflict";
+  if (ttl != null)
+    await adapter.setex(key, Math.max(1, Math.floor(ttl)), value);
+  else
+    await adapter.set(key, value);
+  return "created";
+}
+async function atomicCompareAndSet(adapter, key, expectedRaw, newRaw, newTtlSeconds) {
+  if (!supportsRunScript(adapter))
+    return "unsupported";
+  const ttl = newTtlSeconds != null && newTtlSeconds > 0 ? Math.max(1, Math.floor(newTtlSeconds)) : undefined;
+  const setCmd = ttl != null ? "redis.call('SET',KEYS[1],ARGV[2],'EX',ARGV[3])" : "redis.call('SET',KEYS[1],ARGV[2],'KEEPTTL')";
+  const script = `local cur=redis.call('GET',KEYS[1])
 if not cur then return 'missing' end
 if cur~=ARGV[1] then return 'retry' end
-${V!=null?"redis.call('SET',KEYS[1],ARGV[2],'EX',ARGV[3])":"redis.call('SET',KEYS[1],ARGV[2],'KEEPTTL')"}
-return 'ok'`,U=V!=null?[Q,Y,String(V)]:[Q,Y],J=String(await Z.runScript(B,[$],U));if(J==="missing"||J==="retry")return J;return"ok"}var p=500,lZ=`local ki=1
+${setCmd}
+return 'ok'`;
+  const args = ttl != null ? [expectedRaw, newRaw, String(ttl)] : [expectedRaw, newRaw];
+  const res = String(await adapter.runScript(script, [key], args));
+  if (res === "missing" || res === "retry")
+    return res;
+  return "ok";
+}
+var TXN_WRITE_CHUNK = 500;
+var TXN_SCRIPT = `local ki=1
 local ai=1
 local C=tonumber(ARGV[ai]);ai=ai+1
 for i=1,C do
@@ -43,11 +88,600 @@ for i=1,W do
     redis.call('SREM',k,unpack(members))
   end
 end
-return 'ok'`;class D{claims=[];writes=[];claimUnique(Z,$){return this.claims.push({key:Z,owner:$}),this}set(Z,$){return this.writes.push({op:"set",key:Z,value:$}),this}setex(Z,$,Q){return this.writes.push({op:"setex",key:Z,ttl:Math.max(1,Math.floor($)),value:Q}),this}del(Z){return this.writes.push({op:"del",key:Z}),this}sadd(Z,...$){if($.length>0)this.writes.push({op:"sadd",key:Z,members:$});return this}srem(Z,...$){if($.length>0)this.writes.push({op:"srem",key:Z,members:$});return this}async exec(Z){if(E(Z))return this.execLua(Z);return this.execSequential(Z)}async execLua(Z){if(this.claims.length>0||this.writes.length<=p)return ZZ(Z,this.claims,this.writes);for(let $=0;$<this.writes.length;$+=p)await ZZ(Z,[],this.writes.slice($,$+p));return"ok"}async execSequential(Z){for(let $ of this.claims){let Q=await Z.get($.key);if(Q!=null&&Q!==$.owner)return"conflict"}for(let $ of this.writes)switch($.op){case"set":await Z.set($.key,$.value);break;case"setex":await Z.setex($.key,$.ttl,$.value);break;case"del":await Z.del($.key);break;case"sadd":await Z.sadd($.key,...$.members);break;case"srem":await Z.srem($.key,...$.members);break}return"ok"}}async function ZZ(Z,$,Q){let Y=[],W=[String($.length)];for(let G of $)Y.push(G.key),W.push(G.owner);W.push(String(Q.length));for(let G of Q)switch(G.op){case"set":W.push("set"),Y.push(G.key),W.push(G.value);break;case"setex":W.push("setex"),Y.push(G.key),W.push(String(G.ttl),G.value);break;case"del":W.push("del"),Y.push(G.key);break;case"sadd":W.push("sadd"),Y.push(G.key),W.push(String(G.members.length),...G.members);break;case"srem":W.push("srem"),Y.push(G.key),W.push(String(G.members.length),...G.members);break}return String(await Z.runScript(lZ,Y,W))==="conflict"?"conflict":"ok"}import{list as uZ,matchesListFilter as pZ}from"@ionite/core";var $Z=100,QZ=1000;function h(Z){let $=Z?.limit,Q=$==null||!Number.isFinite($)||$<=0?$Z:Math.min(Math.floor($),QZ);return{...Z,limit:Q}}function K(Z,$,Q=(Y,W)=>Y[W]){let Y=Math.max(0,$?.start??0),W=$?.limit,V=$?.filter?Z.filter((J)=>pZ({requestable:Q(J,"requestable"),userName:Q(J,"userName"),clientId:Q(J,"clientId"),externalId:Q(J,"externalId"),updatedAt:Q(J,"updatedAt")},$.filter)):Z,G=V.length,B=W!=null?Y+W:void 0,U=V.slice(Y,B);return uZ(G,U,Y,W)}import{defaultLogger as cZ}from"@ionite/core";function L(Z,$){let Q=$.log??cZ,Y={"ion.operation":"redis.revive","ion.outcome":"corrupt",store:$.store,...$.key?{key:$.key}:{}},W;try{W=JSON.parse(Z)}catch{Q.warn("Redis store: discarded corrupt JSON payload (failed to parse)",Y);return}if(W===null||typeof W!=="object"||Array.isArray(W)){Q.warn("Redis store: discarded JSON payload that is not a record object",Y);return}return W}import{createHash as dZ}from"node:crypto";import{defaultLogger as iZ}from"@ionite/core";var oZ=4096,YZ=new Set,WZ=new Set;function GZ(Z,$){Z.delete($),Z.add($);while(Z.size>oZ){let Q=Z.values().next().value;if(Q===void 0)break;Z.delete(Q)}}function _(Z,$){let Q=Z.keyPrefix;if(typeof Q!=="string"||Q.length===0)throw Error('Redis store keyPrefix is required and must be a non-empty string. Pass an explicit per-tenant prefix (e.g. "ion:t:<tenantId>:") so tenant keyspaces never collide.');if($){let Y=`${$}\x00${Q}`;if(YZ.has(Y)&&!WZ.has(Y))F(Z).warn(`Redis ${$} constructed twice with the same keyPrefix "${Q}". Each tenant MUST use a distinct keyPrefix (e.g. "ion:t:<tenantId>:") so tenant keyspaces never collide; sharing a prefix across tenants lets them read/write each other's data.`),GZ(WZ,Y);GZ(YZ,Y)}return Q}function F(Z){return Z.logger??iZ}function C(Z,...$){return Z+$.join(":")}var nZ=/^[A-Za-z0-9_.@|-]{1,64}$/;function X(Z){if(nZ.test(Z))return`=${Z}`;return`#${dZ("sha256").update(Z,"utf8").digest("base64url").slice(0,22)}`}var sZ="access:ids",rZ="access:subject:",tZ="access:target:";function eZ(Z){return JSON.stringify({...Z,createdAt:Z.createdAt.toISOString(),updatedAt:Z.updatedAt.toISOString()})}function d(Z,$){let Q=L(Z,{store:"access",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt),updatedAt:new Date(Q.updatedAt)}}function UZ(Z){return{id:Z.id,subject:Z.subject,subjectType:Z.subjectType,targetType:Z.targetType,target:Z.target,resources:Z.resources,applyToApplication:Z.applyToApplication,provenance:Z.provenance,status:Z.status,metadata:Z.metadata}}function HZ(Z){let $=i(Z.subject),Q=i(Z.target);if(!$)throw Error("Access change subject must resolve to a non-empty id.");if(!Z.targetType)throw Error("Access change targetType is required.");if(!Q)throw Error("Access change target must resolve to a non-empty id.");return{id:Z.id??aZ(Z),subjectId:$,targetId:Q}}class JZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"access-assignment-store"),this.log=F(Z)}key(...Z){return C(this.prefix,...Z)}idsSetKey(){return this.key(sZ)}accessStorageKey(Z){return this.key("access",X(Z))}subjectIndexKey(Z,$){return this.key(`${rZ}${$}:${X(Z)}`)}targetIndexKey(Z,$){return this.key(tZ+Z,X($))}async grant(Z){VZ(Z.subjectType,"Access change subjectType");let $=HZ(Z),Q=this.accessStorageKey($.id),Y=await this.redis.get(Q),W=Y?d(Y,this.log):void 0,V=new Date,G={...Z,id:$.id,status:Z.status??"active",subjectId:$.subjectId,targetId:$.targetId,createdAt:W?.createdAt??V,updatedAt:V},B=new D;B.set(Q,eZ(G)),B.sadd(this.idsSetKey(),$.id),B.sadd(this.subjectIndexKey($.subjectId,Z.subjectType),$.id),B.sadd(this.targetIndexKey(Z.targetType,$.targetId),$.id),await B.exec(this.redis)}async revoke(Z){let $=HZ(Z);if(await this.redis.get(this.accessStorageKey($.id))==null)return;let Y=new D;Y.del(this.accessStorageKey($.id)),Y.srem(this.idsSetKey(),$.id),Y.srem(this.subjectIndexKey($.subjectId,Z.subjectType),$.id),Y.srem(this.targetIndexKey(Z.targetType,$.targetId),$.id),await Y.exec(this.redis)}async get(Z){let $=await this.redis.get(this.accessStorageKey(Z));if($==null)return;let Q=d($,this.log);return Q?UZ(Q):void 0}async list(Z){return this.listInMemory(h(Z))}async listByTarget(Z,$,Q){let Y=await this.redis.smembers(this.targetIndexKey(Z,$.trim()));return this.listFromIds(Y,Q)}async listBySubject(Z,$,Q){VZ($);let Y=i(Z);if(!Y)return BZ(0,[],Q?.start??0,Q?.limit);let W=await this.redis.smembers(this.subjectIndexKey(Y,$));return this.listFromIds(W,Q)}async listInMemory(Z){let $=await this.redis.smembers(this.idsSetKey());return this.listFromIds($,Z)}async listFromIds(Z,$){if(Z.length===0)return BZ(0,[],$?.start??0,$?.limit);let Y=[...Z].sort().map((B)=>this.accessStorageKey(B)),V=(await this.redis.mget(Y)).filter((B)=>B!=null).map((B)=>d(B,this.log)).filter((B)=>B!=null).filter((B)=>(B.status??"active")==="active"),G=K(V,$);return{...G,items:G.items.map(UZ)}}}import{assertValidSubjectTypeScoping as MZ,deepEqualPlain as Z$,readyCatalogEntry as OZ}from"@ionite/core";class zZ{groups;roles;permissions;listeners=new Set;constructor(Z){let $=Z.redis,Q=_(Z,"access-catalog-store"),Y=F(Z),W=(V)=>{for(let G of this.listeners)G(V)};this.groups=new I($,Q,"group",W,Y),this.roles=new I($,Q,"role",W,Y),this.permissions=new I($,Q,"permission",W,Y)}afterChange(Z){return this.listeners.add(Z),()=>{this.listeners.delete(Z)}}}class XZ{redis;prefix;log;listeners=new Set;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"resource-store"),this.log=F(Z)}key(...Z){return C(this.prefix,"authz","resource",...Z)}entityKey(Z){return this.key(X(Z))}idsSetKey(){return this.key("ids")}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;let Q=L($,{store:"authz:resource",key:Z,log:this.log});return Q===void 0?void 0:Q}async list(Z){let $=await this.redis.smembers(this.idsSetKey());if($.length===0)return K([],Z);let Y=(await this.redis.mget($.map((W)=>this.entityKey(W)))).filter((W)=>W!=null).map((W)=>L(W,{store:"authz:resource",log:this.log})).filter((W)=>W!==void 0).map((W)=>W);return K(Y,Z)}async children(Z){return(await this.list()).items.filter((Q)=>{return(typeof Q.parent==="string"?Q.parent:Q.parent?.id)===Z})}changed(Z){return this.listeners.add(Z),()=>{this.listeners.delete(Z)}}async set(Z){await new D().set(this.entityKey(Z.id),JSON.stringify(Z)).sadd(this.idsSetKey(),Z.id).exec(this.redis),this.emitChange({id:Z.id})}async delete(Z){await new D().del(this.entityKey(Z)).srem(this.idsSetKey(),Z).exec(this.redis),this.emitChange({id:Z,deleted:!0})}emitChange(Z){for(let $ of this.listeners)$(Z)}}class I{redis;prefix;kind;emit;log;constructor(Z,$,Q,Y,W){this.redis=Z;this.prefix=$;this.kind=Q;this.emit=Y;this.log=W}key(...Z){return C(this.prefix,"authz",this.kind,...Z)}idsSetKey(){return this.key("ids")}entityKey(Z){return this.key(X(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;let Q=L($,{store:`authz:${this.kind}`,key:Z,log:this.log});return Q===void 0?void 0:Q}set(Z){MZ(Z);let $,Q=!0,Y=(async()=>{$=await this.get(Z.id),Q=!$||!Z$($,Z);let W=new D;W.set(this.entityKey(Z.id),JSON.stringify(Z)),W.sadd(this.idsSetKey(),Z.id),await W.exec(this.redis)})();return Y.then(()=>{if(!Q)return;this.emit({op:"set",kind:this.kind,entity:Z,previous:$})},(W)=>{this.log?.warn("authz catalog store: background persist failed",{"ion.operation":`authz.catalog.${this.kind}.set`,"ion.outcome":"error",id:Z.id,error:W instanceof Error?W.message:String(W)})}),OZ(Z,Y)}insertIfAbsent(Z){MZ(Z);let $={...Z},Q=!1,Y=(async()=>{if(!E(this.redis))throw Error("RedisAccessCatalogStore.insertIfAbsent requires a Redis adapter with runScript support.");let W=JSON.stringify(Z),V=await this.redis.runScript(`local cur=redis.call('GET',KEYS[1])
+return 'ok'`;
+
+class RedisTxn {
+  claims = [];
+  writes = [];
+  claimUnique(indexKey, ownerId) {
+    this.claims.push({ key: indexKey, owner: ownerId });
+    return this;
+  }
+  set(key, value) {
+    this.writes.push({ op: "set", key, value });
+    return this;
+  }
+  setex(key, ttl, value) {
+    this.writes.push({ op: "setex", key, ttl: Math.max(1, Math.floor(ttl)), value });
+    return this;
+  }
+  del(key) {
+    this.writes.push({ op: "del", key });
+    return this;
+  }
+  sadd(key, ...members) {
+    if (members.length > 0)
+      this.writes.push({ op: "sadd", key, members });
+    return this;
+  }
+  srem(key, ...members) {
+    if (members.length > 0)
+      this.writes.push({ op: "srem", key, members });
+    return this;
+  }
+  async exec(adapter) {
+    if (supportsRunScript(adapter))
+      return this.execLua(adapter);
+    return this.execSequential(adapter);
+  }
+  async execLua(adapter) {
+    if (this.claims.length > 0 || this.writes.length <= TXN_WRITE_CHUNK) {
+      return runTxnScript(adapter, this.claims, this.writes);
+    }
+    for (let i = 0;i < this.writes.length; i += TXN_WRITE_CHUNK) {
+      await runTxnScript(adapter, [], this.writes.slice(i, i + TXN_WRITE_CHUNK));
+    }
+    return "ok";
+  }
+  async execSequential(adapter) {
+    for (const claim of this.claims) {
+      const v = await adapter.get(claim.key);
+      if (v != null && v !== claim.owner)
+        return "conflict";
+    }
+    for (const w of this.writes) {
+      switch (w.op) {
+        case "set":
+          await adapter.set(w.key, w.value);
+          break;
+        case "setex":
+          await adapter.setex(w.key, w.ttl, w.value);
+          break;
+        case "del":
+          await adapter.del(w.key);
+          break;
+        case "sadd":
+          await adapter.sadd(w.key, ...w.members);
+          break;
+        case "srem":
+          await adapter.srem(w.key, ...w.members);
+          break;
+      }
+    }
+    return "ok";
+  }
+}
+async function runTxnScript(adapter, claims, writes) {
+  const keys = [];
+  const args = [String(claims.length)];
+  for (const claim of claims) {
+    keys.push(claim.key);
+    args.push(claim.owner);
+  }
+  args.push(String(writes.length));
+  for (const w of writes) {
+    switch (w.op) {
+      case "set":
+        args.push("set");
+        keys.push(w.key);
+        args.push(w.value);
+        break;
+      case "setex":
+        args.push("setex");
+        keys.push(w.key);
+        args.push(String(w.ttl), w.value);
+        break;
+      case "del":
+        args.push("del");
+        keys.push(w.key);
+        break;
+      case "sadd":
+        args.push("sadd");
+        keys.push(w.key);
+        args.push(String(w.members.length), ...w.members);
+        break;
+      case "srem":
+        args.push("srem");
+        keys.push(w.key);
+        args.push(String(w.members.length), ...w.members);
+        break;
+    }
+  }
+  const res = String(await adapter.runScript(TXN_SCRIPT, keys, args));
+  return res === "conflict" ? "conflict" : "ok";
+}
+
+// packages/redis-core/src/list-helpers.ts
+import { list, matchesListFilter } from "@ionite/core";
+var DEFAULT_LIST_LIMIT = 100;
+var MAX_LIST_LIMIT = 1000;
+function normalizeListLimit(options) {
+  const requested = options?.limit;
+  const limit = requested == null || !Number.isFinite(requested) || requested <= 0 ? DEFAULT_LIST_LIMIT : Math.min(Math.floor(requested), MAX_LIST_LIMIT);
+  return { ...options, limit };
+}
+function applyListOptions(arr, options, getField = (item, field) => item[field]) {
+  const start = Math.max(0, options?.start ?? 0);
+  const limit = options?.limit;
+  const filtered = options?.filter ? arr.filter((item) => matchesListFilter({
+    requestable: getField(item, "requestable"),
+    userName: getField(item, "userName"),
+    clientId: getField(item, "clientId"),
+    externalId: getField(item, "externalId"),
+    updatedAt: getField(item, "updatedAt")
+  }, options.filter)) : arr;
+  const total = filtered.length;
+  const sliceEnd = limit != null ? start + limit : undefined;
+  const items = filtered.slice(start, sliceEnd);
+  return list(total, items, start, limit);
+}
+
+// packages/redis-core/src/parse-helpers.ts
+import { defaultLogger } from "@ionite/core";
+function safeJsonParse(data, context) {
+  const log = context.log ?? defaultLogger;
+  const meta = {
+    "ion.operation": "redis.revive",
+    "ion.outcome": "corrupt",
+    store: context.store,
+    ...context.key ? { key: context.key } : {}
+  };
+  let parsed;
+  try {
+    parsed = JSON.parse(data);
+  } catch {
+    log.warn("Redis store: discarded corrupt JSON payload (failed to parse)", meta);
+    return;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    log.warn("Redis store: discarded JSON payload that is not a record object", meta);
+    return;
+  }
+  return parsed;
+}
+
+// packages/redis-core/src/redis-options.ts
+import { createHash } from "node:crypto";
+import { defaultLogger as defaultLogger2 } from "@ionite/core";
+var MAX_KEY_PREFIX_FINGERPRINTS = 4096;
+var constructedKeyPrefixes = new Set;
+var warnedKeyPrefixes = new Set;
+function rememberBounded(set, fingerprint) {
+  set.delete(fingerprint);
+  set.add(fingerprint);
+  while (set.size > MAX_KEY_PREFIX_FINGERPRINTS) {
+    const oldest = set.values().next().value;
+    if (oldest === undefined)
+      break;
+    set.delete(oldest);
+  }
+}
+function getKeyPrefix(options, storeKind) {
+  const keyPrefix = options.keyPrefix;
+  if (typeof keyPrefix !== "string" || keyPrefix.length === 0) {
+    throw new Error('Redis store keyPrefix is required and must be a non-empty string. Pass an explicit per-tenant prefix (e.g. "ion:t:<tenantId>:") so tenant keyspaces never collide.');
+  }
+  if (storeKind) {
+    const fingerprint = `${storeKind}\x00${keyPrefix}`;
+    if (constructedKeyPrefixes.has(fingerprint) && !warnedKeyPrefixes.has(fingerprint)) {
+      getLogger(options).warn(`Redis ${storeKind} constructed twice with the same keyPrefix "${keyPrefix}". Each tenant MUST use a distinct keyPrefix (e.g. "ion:t:<tenantId>:") so tenant keyspaces never collide; sharing a prefix across tenants lets them read/write each other's data.`);
+      rememberBounded(warnedKeyPrefixes, fingerprint);
+    }
+    rememberBounded(constructedKeyPrefixes, fingerprint);
+  }
+  return keyPrefix;
+}
+function getLogger(options) {
+  return options.logger ?? defaultLogger2;
+}
+function prefixedKey(prefix, ...parts) {
+  return prefix + parts.join(":");
+}
+var SAFE_KEY_SEGMENT = /^[A-Za-z0-9_.@|-]{1,64}$/;
+function encodeKeyId(id) {
+  if (SAFE_KEY_SEGMENT.test(id))
+    return `=${id}`;
+  return `#${createHash("sha256").update(id, "utf8").digest("base64url").slice(0, 22)}`;
+}
+
+// packages/redis-core/src/access-assignment-store.ts
+var IDS_SET = "access:ids";
+var SUBJECT_INDEX_PREFIX = "access:subject:";
+var TARGET_INDEX_PREFIX = "access:target:";
+function serializeAccess(change) {
+  return JSON.stringify({
+    ...change,
+    createdAt: change.createdAt.toISOString(),
+    updatedAt: change.updatedAt.toISOString()
+  });
+}
+function reviveAccess(data, log) {
+  const raw = safeJsonParse(data, { store: "access", log });
+  if (raw === undefined)
+    return;
+  return {
+    ...raw,
+    createdAt: new Date(raw.createdAt),
+    updatedAt: new Date(raw.updatedAt)
+  };
+}
+function toAccessChange(stored) {
+  return {
+    id: stored.id,
+    subject: stored.subject,
+    subjectType: stored.subjectType,
+    targetType: stored.targetType,
+    target: stored.target,
+    resources: stored.resources,
+    applyToApplication: stored.applyToApplication,
+    provenance: stored.provenance,
+    status: stored.status,
+    metadata: stored.metadata
+  };
+}
+function resolveAccess(change) {
+  const subjectId = accessRefId(change.subject);
+  const targetId = accessRefId(change.target);
+  if (!subjectId) {
+    throw new Error("Access change subject must resolve to a non-empty id.");
+  }
+  if (!change.targetType) {
+    throw new Error("Access change targetType is required.");
+  }
+  if (!targetId) {
+    throw new Error("Access change target must resolve to a non-empty id.");
+  }
+  return {
+    id: change.id ?? accessRootId(change),
+    subjectId,
+    targetId
+  };
+}
+
+class RedisAccessAssignmentStore {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "access-assignment-store");
+    this.log = getLogger(options);
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, ...parts);
+  }
+  idsSetKey() {
+    return this.key(IDS_SET);
+  }
+  accessStorageKey(id) {
+    return this.key("access", encodeKeyId(id));
+  }
+  subjectIndexKey(subjectId, subjectType) {
+    return this.key(`${SUBJECT_INDEX_PREFIX}${subjectType}:${encodeKeyId(subjectId)}`);
+  }
+  targetIndexKey(targetType, targetId) {
+    return this.key(TARGET_INDEX_PREFIX + targetType, encodeKeyId(targetId));
+  }
+  async grant(change) {
+    assertRequiredSubjectType(change.subjectType, "Access change subjectType");
+    const resolved = resolveAccess(change);
+    const key = this.accessStorageKey(resolved.id);
+    const existingRaw = await this.redis.get(key);
+    const existing = existingRaw ? reviveAccess(existingRaw, this.log) : undefined;
+    const now = new Date;
+    const stored = {
+      ...change,
+      id: resolved.id,
+      status: change.status ?? "active",
+      subjectId: resolved.subjectId,
+      targetId: resolved.targetId,
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now
+    };
+    const txn = new RedisTxn;
+    txn.set(key, serializeAccess(stored));
+    txn.sadd(this.idsSetKey(), resolved.id);
+    txn.sadd(this.subjectIndexKey(resolved.subjectId, change.subjectType), resolved.id);
+    txn.sadd(this.targetIndexKey(change.targetType, resolved.targetId), resolved.id);
+    await txn.exec(this.redis);
+  }
+  async revoke(change) {
+    const resolved = resolveAccess(change);
+    const existingRaw = await this.redis.get(this.accessStorageKey(resolved.id));
+    if (existingRaw == null)
+      return;
+    const txn = new RedisTxn;
+    txn.del(this.accessStorageKey(resolved.id));
+    txn.srem(this.idsSetKey(), resolved.id);
+    txn.srem(this.subjectIndexKey(resolved.subjectId, change.subjectType), resolved.id);
+    txn.srem(this.targetIndexKey(change.targetType, resolved.targetId), resolved.id);
+    await txn.exec(this.redis);
+  }
+  async get(id) {
+    const raw = await this.redis.get(this.accessStorageKey(id));
+    if (raw == null)
+      return;
+    const stored = reviveAccess(raw, this.log);
+    return stored ? toAccessChange(stored) : undefined;
+  }
+  async list(options) {
+    return this.listInMemory(normalizeListLimit(options));
+  }
+  async listByTarget(targetType, target, options) {
+    const ids = await this.redis.smembers(this.targetIndexKey(targetType, target.trim()));
+    return this.listFromIds(ids, options);
+  }
+  async listBySubject(subject, subjectType, options) {
+    assertRequiredSubjectType(subjectType);
+    const subjectId = accessRefId(subject);
+    if (!subjectId)
+      return list2(0, [], options?.start ?? 0, options?.limit);
+    const ids = await this.redis.smembers(this.subjectIndexKey(subjectId, subjectType));
+    return this.listFromIds(ids, options);
+  }
+  async listInMemory(options) {
+    const ids = await this.redis.smembers(this.idsSetKey());
+    return this.listFromIds(ids, options);
+  }
+  async listFromIds(ids, options) {
+    if (ids.length === 0)
+      return list2(0, [], options?.start ?? 0, options?.limit);
+    const sortedIds = [...ids].sort();
+    const keys = sortedIds.map((id) => this.accessStorageKey(id));
+    const values = await this.redis.mget(keys);
+    const arr = values.filter((v) => v != null).map((v) => reviveAccess(v, this.log)).filter((stored) => stored != null).filter((stored) => (stored.status ?? "active") === "active");
+    const result = applyListOptions(arr, options);
+    return {
+      ...result,
+      items: result.items.map(toAccessChange)
+    };
+  }
+}
+// packages/redis-core/src/access-catalog-store.ts
+import {
+  assertValidSubjectTypeScoping,
+  deepEqualPlain,
+  readyCatalogEntry
+} from "@ionite/core";
+class RedisAccessCatalogStore {
+  groups;
+  roles;
+  permissions;
+  listeners = new Set;
+  constructor(options) {
+    const redis = options.redis;
+    const prefix = getKeyPrefix(options, "access-catalog-store");
+    const log = getLogger(options);
+    const emit = (change) => {
+      for (const listener of this.listeners)
+        listener(change);
+    };
+    this.groups = new RedisCatalogEntityStore(redis, prefix, "group", emit, log);
+    this.roles = new RedisCatalogEntityStore(redis, prefix, "role", emit, log);
+    this.permissions = new RedisCatalogEntityStore(redis, prefix, "permission", emit, log);
+  }
+  afterChange(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+}
+
+class RedisResourceStore {
+  redis;
+  prefix;
+  log;
+  listeners = new Set;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "resource-store");
+    this.log = getLogger(options);
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, "authz", "resource", ...parts);
+  }
+  entityKey(id) {
+    return this.key(encodeKeyId(id));
+  }
+  idsSetKey() {
+    return this.key("ids");
+  }
+  async get(id) {
+    const raw = await this.redis.get(this.entityKey(id));
+    if (raw == null)
+      return;
+    const parsed = safeJsonParse(raw, { store: "authz:resource", key: id, log: this.log });
+    return parsed === undefined ? undefined : parsed;
+  }
+  async list(options) {
+    const ids = await this.redis.smembers(this.idsSetKey());
+    if (ids.length === 0)
+      return applyListOptions([], options);
+    const values = await this.redis.mget(ids.map((id) => this.entityKey(id)));
+    const items = values.filter((value) => value != null).map((value) => safeJsonParse(value, { store: "authz:resource", log: this.log })).filter((parsed) => parsed !== undefined).map((parsed) => parsed);
+    return applyListOptions(items, options);
+  }
+  async children(id) {
+    const all = await this.list();
+    return all.items.filter((resource) => {
+      const parent = typeof resource.parent === "string" ? resource.parent : resource.parent?.id;
+      return parent === id;
+    });
+  }
+  changed(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  async set(resource) {
+    await new RedisTxn().set(this.entityKey(resource.id), JSON.stringify(resource)).sadd(this.idsSetKey(), resource.id).exec(this.redis);
+    this.emitChange({ id: resource.id });
+  }
+  async delete(id) {
+    await new RedisTxn().del(this.entityKey(id)).srem(this.idsSetKey(), id).exec(this.redis);
+    this.emitChange({ id, deleted: true });
+  }
+  emitChange(change) {
+    for (const listener of this.listeners)
+      listener(change);
+  }
+}
+
+class RedisCatalogEntityStore {
+  redis;
+  prefix;
+  kind;
+  emit;
+  log;
+  constructor(redis, prefix, kind, emit, log) {
+    this.redis = redis;
+    this.prefix = prefix;
+    this.kind = kind;
+    this.emit = emit;
+    this.log = log;
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, "authz", this.kind, ...parts);
+  }
+  idsSetKey() {
+    return this.key("ids");
+  }
+  entityKey(id) {
+    return this.key(encodeKeyId(id));
+  }
+  async get(id) {
+    const raw = await this.redis.get(this.entityKey(id));
+    if (raw == null)
+      return;
+    const parsed = safeJsonParse(raw, { store: `authz:${this.kind}`, key: id, log: this.log });
+    return parsed === undefined ? undefined : parsed;
+  }
+  set(entity) {
+    assertValidSubjectTypeScoping(entity);
+    let previous;
+    let changed = true;
+    const write = (async () => {
+      previous = await this.get(entity.id);
+      changed = !previous || !deepEqualPlain(previous, entity);
+      const txn = new RedisTxn;
+      txn.set(this.entityKey(entity.id), JSON.stringify(entity));
+      txn.sadd(this.idsSetKey(), entity.id);
+      await txn.exec(this.redis);
+    })();
+    write.then(() => {
+      if (!changed)
+        return;
+      this.emit({
+        op: "set",
+        kind: this.kind,
+        entity,
+        previous
+      });
+    }, (error) => {
+      this.log?.warn("authz catalog store: background persist failed", {
+        "ion.operation": `authz.catalog.${this.kind}.set`,
+        "ion.outcome": "error",
+        id: entity.id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+    return readyCatalogEntry(entity, write);
+  }
+  insertIfAbsent(entity) {
+    assertValidSubjectTypeScoping(entity);
+    const winner = { ...entity };
+    let created = false;
+    const write = (async () => {
+      if (!supportsRunScript(this.redis)) {
+        throw new Error("RedisAccessCatalogStore.insertIfAbsent requires a Redis adapter with runScript support.");
+      }
+      const raw = JSON.stringify(entity);
+      const result = await this.redis.runScript(`local cur=redis.call('GET',KEYS[1])
 if cur then return {0,cur} end
 redis.call('SET',KEYS[1],ARGV[1])
 redis.call('SADD',KEYS[2],ARGV[2])
-return {1,ARGV[1]}`,[this.entityKey(Z.id),this.idsSetKey()],[W,Z.id]);if(!Array.isArray(V)||V.length<2)throw Error("RedisAccessCatalogStore.insertIfAbsent received an invalid Redis response.");Q=String(V[0])==="1";let G=String(V[1]),B=L(G,{store:`authz:${this.kind}`,key:Z.id,log:this.log});if(!B)throw Error("RedisAccessCatalogStore.insertIfAbsent could not parse the winning row.");let U=$;for(let J of Object.keys(U))delete U[J];Object.assign(U,B)})();return Y.then(()=>{if(!Q)return;this.emit({op:"set",kind:this.kind,entity:$,previous:void 0})},(W)=>{this.log?.warn("authz catalog store: atomic insert-if-absent failed",{"ion.operation":`authz.catalog.${this.kind}.insert_if_absent`,"ion.outcome":"error",id:Z.id,error:W instanceof Error?W.message:String(W)})}),OZ($,Y)}async delete(Z){let $=await this.get(Z),Q=new D;if(Q.del(this.entityKey(Z)),Q.srem(this.idsSetKey(),Z),await Q.exec(this.redis),!$)return;this.emit({op:"delete",kind:this.kind,entity:$})}async list(Z){let $=await this.redis.smembers(this.idsSetKey());if($.length===0)return K([],Z);let Y=(await this.redis.mget($.map((W)=>this.entityKey(W)))).filter((W)=>W!=null).map((W)=>L(W,{store:`authz:${this.kind}`,log:this.log})).filter((W)=>W!==void 0).map((W)=>W);return K(Y,Z)}}import{accessRefId as R,assertRequiredSubjectType as w}from"@ionite/core";var y="__app__",qZ=100;function $$(Z){if(!Array.isArray(Z))return[];return Z.map(($)=>$==null?"":String($)).filter(($)=>$.length>0)}var Q$=`local rootId=ARGV[1]
+return {1,ARGV[1]}`, [this.entityKey(entity.id), this.idsSetKey()], [raw, entity.id]);
+      if (!Array.isArray(result) || result.length < 2) {
+        throw new Error("RedisAccessCatalogStore.insertIfAbsent received an invalid Redis response.");
+      }
+      created = String(result[0]) === "1";
+      const persistedRaw = String(result[1]);
+      const parsed = safeJsonParse(persistedRaw, {
+        store: `authz:${this.kind}`,
+        key: entity.id,
+        log: this.log
+      });
+      if (!parsed)
+        throw new Error("RedisAccessCatalogStore.insertIfAbsent could not parse the winning row.");
+      const mutable = winner;
+      for (const key of Object.keys(mutable))
+        delete mutable[key];
+      Object.assign(mutable, parsed);
+    })();
+    write.then(() => {
+      if (!created)
+        return;
+      this.emit({
+        op: "set",
+        kind: this.kind,
+        entity: winner,
+        previous: undefined
+      });
+    }, (error) => {
+      this.log?.warn("authz catalog store: atomic insert-if-absent failed", {
+        "ion.operation": `authz.catalog.${this.kind}.insert_if_absent`,
+        "ion.outcome": "error",
+        id: entity.id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+    return readyCatalogEntry(winner, write);
+  }
+  async delete(id) {
+    const previous = await this.get(id);
+    const txn = new RedisTxn;
+    txn.del(this.entityKey(id));
+    txn.srem(this.idsSetKey(), id);
+    await txn.exec(this.redis);
+    if (!previous)
+      return;
+    this.emit({
+      op: "delete",
+      kind: this.kind,
+      entity: previous
+    });
+  }
+  async list(options) {
+    const ids = await this.redis.smembers(this.idsSetKey());
+    if (ids.length === 0)
+      return applyListOptions([], options);
+    const values = await this.redis.mget(ids.map((id) => this.entityKey(id)));
+    const items = values.filter((value) => value != null).map((value) => safeJsonParse(value, { store: `authz:${this.kind}`, log: this.log })).filter((parsed) => parsed !== undefined).map((parsed) => parsed);
+    return applyListOptions(items, options);
+  }
+}
+// packages/redis-core/src/access-index.ts
+import { accessRefId as accessRefId2, assertRequiredSubjectType as assertRequiredSubjectType2 } from "@ionite/core";
+var APP = "__app__";
+var CHECK_WARNING_THRESHOLD = 100;
+function normalizeStringArray(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.map((item) => item == null ? "" : String(item)).filter((item) => item.length > 0);
+}
+var MATERIALIZE_DIFF_SCRIPT = `local rootId=ARGV[1]
 local A=tonumber(ARGV[2])
 local R=tonumber(ARGV[3])
 local rootKey=KEYS[1]
@@ -96,7 +730,8 @@ for i=0,R-1 do
   end
   redis.call('SREM',rootKey,descriptor)
 end
-return 'ok'`,Y$=`local rootId=ARGV[1]
+return 'ok'`;
+var TEARDOWN_ROOT_SCRIPT = `local rootId=ARGV[1]
 local n=tonumber(ARGV[2])
 for i=0,n-1 do
   local kb=1+i*5
@@ -120,7 +755,8 @@ for i=0,n-1 do
   end
 end
 redis.call('DEL',KEYS[1])
-return 'ok'`,W$=`local n=tonumber(ARGV[1])
+return 'ok'`;
+var CLEAR_SUBJECT_SCRIPT = `local n=tonumber(ARGV[1])
 local roots={}
 local seen={}
 for i=0,n-1 do
@@ -139,8 +775,10 @@ for i=0,n-1 do
   redis.call('DEL',ak)
 end
 redis.call('DEL',KEYS[1])
-return roots`,G$=`for i=1,#KEYS do redis.call('DEL',KEYS[i]) end
-return 'ok'`,V$=`local subjectMember=ARGV[1]
+return roots`;
+var DEL_KEYS_SCRIPT = `for i=1,#KEYS do redis.call('DEL',KEYS[i]) end
+return 'ok'`;
+var REPLACE_SUBJECT_SCRIPT = `local subjectMember=ARGV[1]
 local C=tonumber(ARGV[2])
 local R=tonumber(ARGV[3])
 local D=tonumber(ARGV[4])
@@ -173,4 +811,1676 @@ if D==0 then
 else
   redis.call('SADD',KEYS[2],subjectMember)
 end
-return 'ok'`;function T(Z,$){return`${$}:${Z}`}function b(Z){return Z&&Z.length>0?Z:y}function o(Z){return JSON.stringify([Z.subject,Z.targetType,Z.target,Z.rToken])}function j(Z){let $;try{$=JSON.parse(Z)}catch{$=[]}let[Q,Y,W,V]=Array.isArray($)?$:[];return{subject:Q??"",targetType:Y??"permission",target:W??"",rToken:V??y}}class FZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"access-index"),this.log=F(Z)}key(...Z){return C(this.prefix,...Z)}subjectKeyPart(Z){let $=Z.indexOf(":");if($<=0)return X(Z);return`${Z.slice(0,$)}:${X(Z.slice($+1))}`}hasKey(Z,$,Q,Y){return this.key("idx:has",this.subjectKeyPart(Z),$,X(Q),X(Y))}anyKey(Z,$,Q){return this.key("idx:any",this.subjectKeyPart(Z),$,X(Q))}edgeRootsKey(Z,$,Q,Y){return this.key("idx:er",this.subjectKeyPart(Z),$,X(Q),X(Y))}tripleKey(Z,$,Q){return this.key("idx:tr",this.subjectKeyPart(Z),$,X(Q))}rootKey(Z){return this.key("idx:root",X(Z))}subjectKey(Z){return this.key("idx:subj",this.subjectKeyPart(Z))}subjectsKey(){return this.key("idx:subjects")}disabledKey(Z){return this.key("idx:disabled",this.subjectKeyPart(Z))}async has(Z,$,Q,Y,W){w(W);let V=R(Z),G=R(Q);if(!V||!G)return{allow:!1};let B=T(V,W);if(Y===void 0){let[O,A]=await this.redis.mget([this.disabledKey(B),this.anyKey(B,$,G)]);if(O!=null)return{allow:!1,metadata:{reason:"subject_disabled"}};return A!=null?this.allow(V,W,$,G,void 0):{allow:!1}}let U=R(Y),J=await this.redis.mget([this.disabledKey(B),this.hasKey(B,$,G,b(U)),this.hasKey(B,$,G,y)]);if(J[0]!=null)return{allow:!1,metadata:{reason:"subject_disabled"}};if(J[1]!=null)return this.allow(V,W,$,G,U);if(J[2]!=null)return this.allow(V,W,$,G,void 0);return{allow:!1}}async hasGroup(Z,$,Q,Y){return this.has(Z,"group",$,Q,Y)}async hasRole(Z,$,Q,Y){return this.has(Z,"role",$,Q,Y)}async hasPermission(Z,$,Q,Y){return this.has(Z,"permission",$,Q,Y)}async hasAny(Z,$,Q){if($.length===0)return{allow:!1};this.warnLargeCheck("redis.access_index.has_any",$.length);let Y=await this.evaluateTargets(Z,$,Q);for(let W of Y)if(W.allow)return W;return{allow:!1}}async hasAll(Z,$,Q){if($.length===0){let V=R(Z);if(V){if(await this.redis.get(this.disabledKey(T(V,Q)))!=null)return{allow:!1,metadata:{reason:"subject_disabled"}}}return{allow:!0}}this.warnLargeCheck("redis.access_index.has_all",$.length);let Y=await this.evaluateTargets(Z,$,Q),W=[];for(let V of Y){if(!V.allow)return{allow:!1,matched:W};if(V.matched)W.push(...V.matched)}return{allow:!0,matched:W}}async evaluateTargets(Z,$,Q){let Y=R(Z);if(!Y)return $.map(()=>({allow:!1}));let W=T(Y,Q),V=[this.disabledKey(W)],G=$.map((U)=>{let J=R(U.target);if(!J)return{kind:"invalid"};if(U.resource===void 0){let P=V.push(this.anyKey(W,U.targetType,J))-1;return{kind:"any",targetType:U.targetType,targetId:J,idx:P}}let O=R(U.resource),A=V.push(this.hasKey(W,U.targetType,J,b(O)))-1,q=V.push(this.hasKey(W,U.targetType,J,y))-1;return{kind:"resource",targetType:U.targetType,targetId:J,resourceId:O,idxResource:A,idxApp:q}}),B=await this.redis.mget(V);if(B[0]!=null)return $.map(()=>({allow:!1,metadata:{reason:"subject_disabled"}}));return G.map((U)=>{if(U.kind==="invalid")return{allow:!1};if(U.kind==="any")return B[U.idx]!=null?this.allow(Y,Q,U.targetType,U.targetId,void 0):{allow:!1};if(B[U.idxResource]!=null)return this.allow(Y,Q,U.targetType,U.targetId,U.resourceId);if(B[U.idxApp]!=null)return this.allow(Y,Q,U.targetType,U.targetId,void 0);return{allow:!1}})}edgeKeys(Z){return[this.edgeRootsKey(Z.subject,Z.targetType,Z.target,Z.rToken),this.hasKey(Z.subject,Z.targetType,Z.target,Z.rToken),this.tripleKey(Z.subject,Z.targetType,Z.target),this.anyKey(Z.subject,Z.targetType,Z.target),this.subjectKey(Z.subject)]}async materialize(Z,$){let Q=new Map;for(let G of $){let B=R(G.subject),U=R(G.target);if(!B||!U)continue;w(G.subjectType,"Effective edge subjectType");let J=T(B,G.subjectType),O=b(G.resource),A={subject:J,targetType:G.targetType,target:U,rToken:O};Q.set(o(A),A)}let Y=new Set(await this.redis.smembers(this.rootKey(Z))),W=[];for(let[G,B]of Q)if(!Y.has(G))W.push({encoded:G,d:B});let V=[];for(let G of Y)if(!Q.has(G))V.push({encoded:G,d:j(G)});if(W.length===0&&V.length===0)return;if(E(this.redis)){let G=[this.rootKey(Z),this.subjectsKey()],B=[Z,String(W.length),String(V.length)];for(let{encoded:U,d:J}of W)G.push(...this.edgeKeys(J)),B.push(U,J.rToken,J.subject);for(let{encoded:U,d:J}of V)G.push(...this.edgeKeys(J)),B.push(U,J.rToken);await this.redis.runScript(Q$,G,B);return}for(let{encoded:G,d:B}of W)await this.redis.sadd(this.edgeRootsKey(B.subject,B.targetType,B.target,B.rToken),Z),await this.redis.set(this.hasKey(B.subject,B.targetType,B.target,B.rToken),"1"),await this.redis.sadd(this.tripleKey(B.subject,B.targetType,B.target),B.rToken),await this.redis.set(this.anyKey(B.subject,B.targetType,B.target),"1"),await this.redis.sadd(this.rootKey(Z),G),await this.redis.sadd(this.subjectKey(B.subject),G),await this.redis.sadd(this.subjectsKey(),B.subject);for(let{encoded:G,d:B}of V)await this.dropRootFromEdge(Z,B.subject,B.targetType,B.target,B.rToken),await this.redis.srem(this.rootKey(Z),G)}async replaceSubject(Z,$,Q){if(!E(this.redis))throw Error("RedisAccessIndex.replaceSubject requires an adapter with atomic runScript support.");let Y=R(Z);if(!Y)return;let W=T(Y,$),V=[];for(let q of Q){let P=R(q.subject);w(q.subjectType,"Effective edge subjectType");let k=q.subjectType;if(P!==Y||k!==$)throw Error(`AccessIndex.replaceSubject received an edge for ${k}:${P}; expected ${W}.`);let f=R(q.target);if(!f)continue;let S={subject:W,targetType:q.targetType,target:f,rToken:b(q.resource)};V.push({rootId:q.rootId,encoded:o(S),d:S})}let B=(await this.redis.smembers(this.subjectKey(W))).map(j),U=await Promise.all(B.map((q)=>this.redis.smembers(this.edgeRootsKey(q.subject,q.targetType,q.target,q.rToken)))),J=[...new Set(U.flat())],O=[this.subjectKey(W),this.subjectsKey()];for(let q of B){let[P,k,f,S]=this.edgeKeys(q);O.push(P,k,f,S)}for(let q of J)O.push(this.rootKey(q));for(let q of V){let[P,k,f,S]=this.edgeKeys(q.d);O.push(this.rootKey(q.rootId),P,k,f,S)}let A=[W,String(B.length),String(J.length),String(V.length)];for(let q of V)A.push(q.rootId,q.encoded,q.d.rToken);await this.redis.runScript(V$,O,A)}async removeByRoot(Z){let $=this.rootKey(Z),Q=await this.redis.smembers($);if(Q.length===0){await this.redis.del($);return}if(E(this.redis)){let Y=[$],W=[Z,String(Q.length)];for(let V of Q){let G=j(V);Y.push(...this.edgeKeys(G)),W.push(V,G.rToken)}await this.redis.runScript(Y$,Y,W);return}for(let Y of Q){let{subject:W,targetType:V,target:G,rToken:B}=j(Y);await this.dropRootFromEdge(Z,W,V,G,B)}await this.redis.del($)}async listSubjects(){let Z=await this.redis.smembers(this.subjectsKey()),$=[];for(let Q of Z){let Y=Q.indexOf(":");if(Y<=0)throw Error(`AccessIndex subject key "${Q}" is missing a subjectType prefix.`);let W=Q.slice(0,Y);w(W,"AccessIndex subject key subjectType"),$.push({subjectType:W,subject:Q.slice(Y+1)})}return $}async setSubjectDisabled(Z,$,Q){let Y=R(Z);if(!Y)return;let W=this.disabledKey(T(Y,$));if(Q)await this.redis.set(W,"1");else await this.redis.del(W)}async isSubjectDisabled(Z,$){w($);let Q=R(Z);if(!Q)return!1;return await this.redis.get(this.disabledKey(T(Q,$)))!=null}async clear(Z,$){if(Z===void 0){let W=await this.redis.smembers(this.subjectsKey());for(let V of W)await this.clearSubject(V);await this.redis.del(this.subjectsKey());return}w($);let Q=R(Z);if(!Q)return;let Y=T(Q,$);await this.clearSubject(Y),await this.redis.srem(this.subjectsKey(),Y)}async clearSubject(Z){let $=this.subjectKey(Z),Q=await this.redis.smembers($);if(Q.length===0){await this.redis.del($);return}if(E(this.redis)){let Y=[$];for(let V of Q){let{targetType:G,target:B,rToken:U}=j(V);Y.push(this.edgeRootsKey(Z,G,B,U),this.hasKey(Z,G,B,U),this.tripleKey(Z,G,B),this.anyKey(Z,G,B))}let W=$$(await this.redis.runScript(W$,Y,[String(Q.length)]));if(W.length>0)await this.redis.runScript(G$,W.map((V)=>this.rootKey(V)),[]);return}for(let Y of Q){let{targetType:W,target:V,rToken:G}=j(Y),B=this.edgeRootsKey(Z,W,V,G),U=await this.redis.smembers(B);for(let O of U)await this.redis.srem(this.rootKey(O),Y);if(await this.redis.del(B),await this.redis.del(this.hasKey(Z,W,V,G)),await this.redis.srem(this.tripleKey(Z,W,V),G),(await this.redis.smembers(this.tripleKey(Z,W,V))).length===0)await this.redis.del(this.tripleKey(Z,W,V)),await this.redis.del(this.anyKey(Z,W,V))}await this.redis.del($)}async dropRootFromEdge(Z,$,Q,Y,W){let V=this.edgeRootsKey($,Q,Y,W);if(await this.redis.srem(V,Z),(await this.redis.smembers(V)).length>0)return;await this.redis.del(V),await this.redis.del(this.hasKey($,Q,Y,W));let B=o({subject:$,targetType:Q,target:Y,rToken:W});if(await this.redis.srem(this.subjectKey($),B),await this.redis.srem(this.tripleKey($,Q,Y),W),(await this.redis.smembers(this.tripleKey($,Q,Y))).length===0)await this.redis.del(this.tripleKey($,Q,Y)),await this.redis.del(this.anyKey($,Q,Y))}allow(Z,$,Q,Y,W){return{allow:!0,matched:[{subject:Z,subjectType:$,targetType:Q,target:Y,resources:W?[W]:void 0}]}}warnLargeCheck(Z,$){if($<=qZ)return;this.log.warn("Redis access index check received a large bounded target set; issuing per-target reads.",{"ion.operation":Z,"ion.outcome":"degraded",count:$,threshold:qZ})}}var B$=512;async function U$(Z,$,Q=512){if(Z.length===0)return[];let Y=Q>0?Q:512,W=[];for(let V=0;V<Z.length;V+=Y){let G=await $(Z.slice(V,V+Y));for(let B of G)W.push(B??null)}return W}import{list as H$,StoreConflictError as J$}from"@ionite/core";var M$="customer:ids",O$="customer:name:",z$="customer:external:";function X$(Z){let $=Z.createdAt??new Date,Q=Z.updatedAt??$,Y={...Z,createdAt:$.toISOString(),updatedAt:Q.toISOString()};if(Y.ciam&&typeof Y.ciam==="object"&&Y.ciam!==null){let W=Y.ciam;if(W.expires instanceof Date)W.expires=W.expires.toISOString()}return JSON.stringify(Y)}function n(Z,$){let Q=L(Z,{store:"customer",log:$});if(Q===void 0)return;if(Q.ciam&&typeof Q.ciam==="object"&&Q.ciam!==null){let Y=Q.ciam;if(typeof Y.expires==="string")Y.expires=new Date(Y.expires)}return{...Q,createdAt:typeof Q.createdAt==="string"?new Date(Q.createdAt):void 0,updatedAt:typeof Q.updatedAt==="string"?new Date(Q.updatedAt):void 0}}class DZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"customer-store"),this.log=F(Z)}key(...Z){return C(this.prefix,...Z)}entityKey(Z){return this.key("customer",X(Z))}idsSetKey(){return this.key(M$)}nameIndexKey(Z){return this.key(O$+X(Z))}externalIdIndexKey(Z){return this.key(z$+X(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return n($,this.log)}async lookup(Z){if(Z.id){let $=await this.get(Z.id);if($)return $}if(Z.userName){let $=await this.redis.get(this.nameIndexKey(Z.userName.toLowerCase()));if($!=null)return this.get($)}if(Z.externalId)return this.getByExternalId(Z.externalId);return}async getByExternalId(Z){let $=await this.redis.get(this.externalIdIndexKey(Z));if($==null)return;return this.get($)}async upsert(Z){let $=Z.id?.trim()||crypto.randomUUID(),Q={...Z,id:$},Y=this.entityKey($),W=await this.redis.get(Y),V=W!=null?n(W,this.log)??null:null,G=Q.userName?.toLowerCase(),B=V?.userName?.toLowerCase(),U=Q.externalId,J=V?.externalId,O=new D;if(G)O.claimUnique(this.nameIndexKey(G),$);if(U)O.claimUnique(this.externalIdIndexKey(U),$);if(B&&B!==G)O.del(this.nameIndexKey(B));if(J&&J!==U)O.del(this.externalIdIndexKey(J));if(O.set(Y,X$(Q)),G)O.set(this.nameIndexKey(G),$);if(U)O.set(this.externalIdIndexKey(U),$);if(O.sadd(this.idsSetKey(),$),await O.exec(this.redis)==="conflict")throw new J$(`userName "${Q.userName}" is already in use`,"unique_violation","userName");return Q}async delete(Z){let $=await this.get(Z);if($==null)return 0;let Q=new D;if(Q.del(this.entityKey(Z)),$.userName)Q.del(this.nameIndexKey($.userName.toLowerCase()));if($.externalId)Q.del(this.externalIdIndexKey($.externalId));return Q.srem(this.idsSetKey(),Z),await Q.exec(this.redis),1}async list(Z){let $=h(Z),Q=(await this.redis.smembers(this.idsSetKey())).sort();if(Q.length===0)return H$(0,[],$.start??0,$.limit);let Y=Q.map((G)=>this.entityKey(G)),V=(await this.redis.mget(Y)).filter((G)=>G!=null).map((G)=>n(G,this.log)).filter((G)=>G!=null);return K(V,$)}}import{createHash as q$}from"node:crypto";function LZ(Z){return q$("sha1").update(Z,"utf8").digest("hex")}function F$(Z){return(Z instanceof Error?Z.message:String(Z)).includes("NOSCRIPT")}function D$(Z){let $=new Map;return async(Q,Y,W)=>{let V=$.get(Q);if(!V)V=LZ(Q),$.set(Q,V);try{return await Z.evalsha(V,Y,W)}catch(G){if(F$(G))return Z.eval(Q,Y,W);throw G}}}function _Z(Z){return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)}function L$(Z){let $=_Z(Z.clientOptions)?{...Z.clientOptions}:_Z(Z)?{...Z}:{};return delete $.redisUrl,delete $.clientOptions,{redisUrl:(typeof Z.redisUrl==="string"?Z.redisUrl.trim():"")||void 0,clientOptions:$}}import{defaultLogger as _$}from"@ionite/core";function CZ(Z,$){return`${Z}:${encodeURIComponent($)}`}function C$(Z,$){if(typeof Z!=="object"||Z===null||Array.isArray(Z))return!1;let Q=Z,Y=Q.headers;return Q.kind==="delivery"&&typeof Q.key==="string"&&typeof Q.rawBody==="string"&&typeof Y==="object"&&Y!==null&&Y.requestId===$&&typeof Y.keyId==="string"&&typeof Y.signature==="string"}function N$(Z,$={}){if(!Z.getdel)throw Error("Redis adapter must implement getdel() for LFV callback coordination");let Q=Z.getdel.bind(Z),Y=$.channelPrefix?.trim()||"ionite:lfv:otp",W=$.logger??_$;return{async put(V,G,B){if(G.kind!=="delivery"||G.headers.requestId!==V)throw Error("LFV callback mailbox only accepts matching delivery envelopes");let U=Math.max(1,Math.ceil(B/1000));await Z.setex(CZ(Y,V),U,JSON.stringify(G))},async take(V){let G=await Q(CZ(Y,V));if(G==null)return;let B;try{B=JSON.parse(G)}catch(U){W.warn("Invalid JSON received from LFV Redis callback mailbox",{"ion.operation":"lfv.callback.redis.take","ion.outcome":"rejected",requestId:V,error:U instanceof Error?U.message:String(U)});return}if(!C$(B,V)){W.warn("Invalid envelope received from LFV Redis callback mailbox",{"ion.operation":"lfv.callback.redis.take","ion.outcome":"rejected",requestId:V});return}return B}}}import{StoreConflictError as A$}from"@ionite/core";function P$(Z){return JSON.stringify({token:Z.token,customer:Z.customer,createdAt:Z.createdAt.toISOString(),expiresAt:Z.expiresAt.toISOString()})}function NZ(Z,$){let Q=L(Z,{store:"magic-link",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt),expiresAt:new Date(Q.expiresAt)}}class AZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"magic-link-store"),this.log=F(Z)}key(Z){return C(this.prefix,"magic",X(Z))}async create(Z,$,Q){let Y=this.key(Z),W={token:Z,customer:$,createdAt:new Date,expiresAt:Q},V=Math.max(1,Math.floor((Q.getTime()-Date.now())/1000));if(await m(this.redis,Y,P$(W),{ttlSeconds:V})==="conflict")throw new A$(`Magic link with token ${Z} already exists`,"already_exists","token")}async get(Z){let $=await this.redis.get(this.key(Z));if($==null)return null;return NZ($,this.log)??null}async getAndDelete(Z){let $=this.key(Z),Q;if(typeof this.redis.getdel==="function")Q=await this.redis.getdel($);else if(Q=await this.redis.get($),Q!=null)await this.redis.del($);if(Q==null)return null;let Y=NZ(Q,this.log);if(Y==null)return null;if(Date.now()>Y.expiresAt.getTime())return null;return Y}async delete(Z){await this.redis.del(this.key(Z))}}import{defaultLogger as K$}from"@ionite/core";function R$(Z,$){if(typeof $!=="number"||$<=0)return Z;return new Promise((Q,Y)=>{let W=setTimeout(()=>{Y(Error(`Reactive Redis adapter did not become ready within ${$}ms`))},$);Z.then(()=>{clearTimeout(W),Q()},(V)=>{clearTimeout(W),Y(V)})})}function E$(){let Z,$;return{promise:new Promise((Y,W)=>{Z=Y,$=W}),resolve:Z,reject:$}}function PZ(Z){return typeof Z==="function"}function f$(Z){let $=Z.logger??K$,Q=Z.sourceName?.trim()||"redis",Y=Z.path.trim(),W,V,G=!1,B,U,J,O=!1,A=!1,q=!1,P=new Map,k=Promise.resolve(),f=E$();f.promise.catch(()=>{});let S={async get(H){return x((M)=>M.get(H))},async set(H,M){await x((z)=>z.set(H,M))},async setex(H,M,z){await x((N)=>N.setex(H,M,z))},async del(H){await x((M)=>M.del(H))},async sadd(H,...M){await x((z)=>z.sadd(H,...M))},async srem(H,...M){await x((z)=>z.srem(H,...M))},async smembers(H){return x((M)=>M.smembers(H))},async mget(H){return x((M)=>M.mget(H))},async publish(H,M){await x(async(z)=>{if(!z.publish)throw Error("Active Redis adapter does not support publish (Pub/Sub)");await z.publish(H,M)})},async subscribeChannel(H,M){let z=P.get(H);if(!z){let v=new Set;z={listeners:v,dispatch:(yZ)=>{for(let gZ of Array.from(v))try{gZ(yZ)}catch(u){$.warn("Redis channel listener threw",{"ion.operation":"redis.adapter.subscribe","ion.outcome":"failure",sourceName:Q,path:Y,channel:H,error:u instanceof Error?u.message:String(u)})}}},P.set(H,z)}let N=z;N.listeners.add(M);try{await jZ(H,N)}catch(v){if(N.listeners.delete(M),N.listeners.size===0)P.delete(H);throw v}return async()=>{if(N.listeners.delete(M),N.listeners.size===0){P.delete(H);let v=N.unsubscribe;N.unsubscribe=void 0,await v?.()}}},ready(H){return R$(f.promise,H)},isReady(){return W!==void 0},async close(){if(O=!0,e(),!G)G=!0,f.reject(Error(`Reactive Redis adapter for source "${Q}" at path "${Y}" was closed before becoming ready.`));await k.catch(()=>{}),await g(W),W=void 0;for(let H of P.values())H.unsubscribe=void 0;P.clear(),l()}};function r(H){k=k.then(H).catch((M)=>{if(!G)G=!0,f.reject(M);$.warn("Reactive Redis adapter update failed",{"ion.operation":"redis.adapter.update","ion.outcome":"degraded",sourceName:Q,path:Y,error:M instanceof Error?M.message:String(M)})})}async function t(){if(O)throw Error(`Reactive Redis adapter for source "${Q}" at path "${Y}" is closed.`);let H=W?.adapter;if(H)return H;if(await k.catch(()=>{}),O)throw Error(`Reactive Redis adapter for source "${Q}" at path "${Y}" is closed.`);let M=W?.adapter;if(M)return M;if(await f.promise,O)throw Error(`Reactive Redis adapter for source "${Q}" at path "${Y}" is closed.`);let z=W?.adapter;if(!z)throw Error(`Reactive Redis adapter for source "${Q}" at path "${Y}" did not become ready.`);return z}async function x(H){let M=await t();return H(M)}function e(){V?.(),V=void 0}async function jZ(H,M){if(M.unsubscribe)return;if(!M.attaching)M.attaching=(async()=>{let z=await t();if(!z.subscribeChannel)throw Error("Active Redis adapter does not support subscribeChannel (Pub/Sub)");if(M.listeners.size===0)return;M.unsubscribe=await z.subscribeChannel(H,M.dispatch)})().finally(()=>{M.attaching=void 0});await M.attaching}async function mZ(H){for(let[M,z]of P){if(z.attaching)await z.attaching.catch(()=>{});if(z.unsubscribe=void 0,!H.subscribeChannel){$.warn("Active Redis adapter does not support subscribeChannel; channel subscriptions dropped.",{"ion.operation":"redis.adapter.capabilities","ion.outcome":"degraded",sourceName:Q,path:Y,capability:"subscribeChannel"});return}try{z.unsubscribe=await H.subscribeChannel(M,z.dispatch)}catch(N){$.warn("Failed to re-subscribe Redis channel after client rotation",{"ion.operation":"redis.adapter.subscribe","ion.outcome":"failure",sourceName:Q,path:Y,channel:M,error:N instanceof Error?N.message:String(N)})}}}async function IZ(H){e(),V=await H.subscribe(Y,(M)=>{r(async()=>{if(O)return;await bZ(M)})},Z.subscription??Z.secretOptions)}async function bZ(H){if(O)return;let M=`${Q}:${Y}:${H.metadata.version}`;if(W!==void 0&&U===M&&B===H.metadata.version)return;let z=Z.endpointOf?.(H);if(W!==void 0&&z!=null&&z!==""&&J!=null&&J!==""&&z!==J)throw Error(`Reactive Redis adapter for source "${Q}" at path "${Y}" rejected a rotation that changed the endpoint (${J} -> ${z}); only credentials may rotate under an active adapter.`);let N=await Z.createClient(H);if(O){await g(N);return}let v=W;if(W=N,U=M,B=H.metadata.version,z!=null&&z!=="")J=z;if(l(),v!==void 0)await mZ(N.adapter);if(!G)G=!0,f.resolve();await g(v)}async function g(H){if(!H?.dispose)return;await H.dispose()}function l(){let H=W?.adapter;if(H?.runScript&&PZ(H.runScript))S.runScript=async(M,z,N)=>{return x(async(v)=>{if(!v.runScript)throw Error("Active Redis adapter does not support runScript");return v.runScript(M,z,N)})};else if(delete S.runScript,H!==void 0&&!A)A=!0,$.warn("Active Redis adapter does not support runScript (EVAL); stores fall back to non-isolated writes.",{"ion.operation":"redis.adapter.capabilities","ion.outcome":"degraded",sourceName:Q,path:Y,capability:"runScript"});if(H?.getdel&&PZ(H.getdel))S.getdel=async(M)=>{return x(async(z)=>{if(!z.getdel)return null;return z.getdel(M)})};else if(delete S.getdel,H!==void 0&&!q)q=!0,$.warn("Active Redis adapter does not support getdel (GETDEL); single-use consume falls back to get+del.",{"ion.operation":"redis.adapter.capabilities","ion.outcome":"degraded",sourceName:Q,path:Y,capability:"getdel"})}return l(),r(async()=>{if(O)return;await IZ(Z.source)}),S}import{StoreConflictError as S$}from"@ionite/core";var v$=5;function k$(Z,$){let Q;try{Q=JSON.parse(Z)}catch{return}if(Q==null||typeof Q!=="object"||Array.isArray(Q))return;return JSON.stringify({...Q,...$})}function KZ(Z){return JSON.stringify({...Z,createdAt:Z.createdAt.toISOString()})}function RZ(Z,$){let Q=L(Z,{store:"session",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt)}}function EZ(Z){if(!Z)return;let $=Z instanceof Date?Z.getTime():new Date(Z).getTime();if(Number.isNaN($))return;let Q=Math.ceil(($-Date.now())/1000);return Q>0?Q:1}class fZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"session-store"),this.log=F(Z)}key(Z){return C(this.prefix,"session",X(Z))}async create(Z){let $=this.key(Z.sid),Q=EZ(Z.expiresAt);if(await m(this.redis,$,KZ(Z),{ttlSeconds:Q})==="conflict")throw new S$(`Session with sid ${Z.sid} already exists`,"already_exists","sid")}async get(Z){let $=await this.redis.get(this.key(Z));if($==null)return null;return RZ($,this.log)??null}async update(Z,$){let Q=this.key(Z),Y=JSON.parse(JSON.stringify($)),W="expiresAt"in Y?EZ(Y.expiresAt):void 0;if(E(this.redis))for(let J=0;J<v$;J++){let O=await this.redis.get(Q);if(O==null)throw Error(`Session with sid ${Z} not found`);let A=k$(O,Y);if(A===void 0)throw Error(`Session with sid ${Z} not found`);let q=await c(this.redis,Q,O,A,W);if(q==="ok")return;if(q==="missing")throw Error(`Session with sid ${Z} not found`)}let V=await this.redis.get(Q);if(V==null)throw Error(`Session with sid ${Z} not found`);let G=RZ(V,this.log);if(G==null)throw Error(`Session with sid ${Z} not found`);let B={...G,...$},U=KZ(B);if(W!=null&&W>0)await this.redis.setex(Q,Math.max(1,Math.floor(W)),U);else await this.redis.set(Q,U)}async delete(Z){await this.redis.del(this.key(Z))}}var x$="tenant:ids";function h$(Z){return JSON.stringify({...Z,createdAt:Z.createdAt.toISOString(),updatedAt:Z.updatedAt.toISOString()})}function SZ(Z,$){let Q=L(Z,{store:"tenant",log:$});if(Q===void 0)return;return{...Q,createdAt:new Date(Q.createdAt),updatedAt:new Date(Q.updatedAt)}}class vZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"tenant-store"),this.log=F(Z)}key(...Z){return C(this.prefix,...Z)}entityKey(Z){return this.key("tenant",X(Z))}idsSetKey(){return this.key(x$)}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return SZ($,this.log)}async upsert(Z){return await new D().set(this.entityKey(Z.id),h$(Z)).sadd(this.idsSetKey(),Z.id).exec(this.redis),Z}async list(Z){let $=await this.redis.smembers(this.idsSetKey());if($.length===0)return K([],Z);let Q=$.map((V)=>this.entityKey(V)),W=(await this.redis.mget(Q)).map((V)=>V!=null?SZ(V,this.log):void 0).filter((V)=>V!=null);return K(W,Z)}async delete(Z){let $=await this.get(Z);return await new D().srem(this.idsSetKey(),Z).del(this.entityKey(Z)).exec(this.redis),$?1:0}}class kZ{store;ionCache;constructor(Z){this.ionCache=Z.ionCache,this.store=new vZ(Z)}async get(Z){return this.store.get(Z)}async upsert(Z){let $=await this.store.upsert(Z);return this.ionCache?.delete(Z.id),$}async list(Z){return this.store.list(Z)}async delete(Z){let $=await this.store.delete(Z);return this.ionCache?.delete(Z),$}async getIon(Z){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(Z)}}import{list as T$,StoreConflictError as xZ}from"@ionite/core";var w$="user:ids",j$="user:name:",m$="user:external-id:";function I$(Z){let $=Z.createdAt??new Date,Q=Z.updatedAt??$,Y={...Z,createdAt:$.toISOString(),updatedAt:Q.toISOString()};if(Y.sso&&typeof Y.sso==="object"&&Y.sso!==null){let W=Y.sso;if(W.expires instanceof Date)W.expires=W.expires.toISOString()}return JSON.stringify(Y)}function a(Z,$){let Q=L(Z,{store:"user",log:$});if(Q===void 0)return;if(Q.sso&&typeof Q.sso==="object"&&Q.sso!==null){let Y=Q.sso;if(typeof Y.expires==="string")Y.expires=new Date(Y.expires)}return{...Q,createdAt:typeof Q.createdAt==="string"?new Date(Q.createdAt):void 0,updatedAt:typeof Q.updatedAt==="string"?new Date(Q.updatedAt):void 0}}class hZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"user-store"),this.log=F(Z)}key(...Z){return C(this.prefix,...Z)}entityKey(Z){return this.key("user",X(Z))}idsSetKey(){return this.key(w$)}nameIndexKey(Z){return this.key(j$+X(Z))}externalIdIndexKey(Z){return this.key(m$+X(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return a($,this.log)}async getByExternalId(Z){let $=await this.redis.get(this.externalIdIndexKey(Z));return $?this.get($):void 0}async lookup(Z){return this.get(Z.id??"")}async upsert(Z){let $=Z.id?.trim()||crypto.randomUUID(),Q={...Z,id:$},Y=this.entityKey($),W=await this.redis.get(Y),V=W!=null?a(W,this.log)??null:null,G=Q.userName?.toLowerCase(),B=V?.userName?.toLowerCase(),U=Q.externalId,J=V?.externalId,O=new D;if(G)O.claimUnique(this.nameIndexKey(G),$);if(U)O.claimUnique(this.externalIdIndexKey(U),$);if(B&&B!==G)O.del(this.nameIndexKey(B));if(J&&J!==U)O.del(this.externalIdIndexKey(J));if(O.set(Y,I$(Q)),G)O.set(this.nameIndexKey(G),$);if(U)O.set(this.externalIdIndexKey(U),$);if(O.sadd(this.idsSetKey(),$),await O.exec(this.redis)==="conflict"){if(U){let A=await this.redis.get(this.externalIdIndexKey(U));if(A&&A!==$)throw new xZ(`externalId "${U}" is already in use`,"unique_violation","externalId")}throw new xZ(`userName "${Q.userName}" is already in use`,"unique_violation","userName")}return Q}async delete(Z){let $=await this.get(Z);if($==null)return 0;let Q=new D;if(Q.del(this.entityKey(Z)),$.userName)Q.del(this.nameIndexKey($.userName.toLowerCase()));if($.externalId)Q.del(this.externalIdIndexKey($.externalId));return Q.srem(this.idsSetKey(),Z),await Q.exec(this.redis),1}async list(Z){let $=h(Z),Q=(await this.redis.smembers(this.idsSetKey())).sort();if(Q.length===0)return T$(0,[],$.start??0,$.limit);let Y=Q.map((G)=>this.entityKey(G)),V=(await this.redis.mget(Y)).filter((G)=>G!=null).map((G)=>a(G,this.log)).filter((G)=>G!=null);return K(V,$)}}import{list as b$,StoreConflictError as y$}from"@ionite/core";var g$="workload-identity:ids",l$="workload-identity:client:",u$="workload-identity:external:";function p$(Z){let $=Z.createdAt??new Date,Q=Z.updatedAt??$;return JSON.stringify({...Z,createdAt:$.toISOString(),updatedAt:Q.toISOString()})}function s(Z,$){let Q=L(Z,{store:"workload-identity",log:$});if(Q===void 0)return;return{...Q,createdAt:typeof Q.createdAt==="string"?new Date(Q.createdAt):void 0,updatedAt:typeof Q.updatedAt==="string"?new Date(Q.updatedAt):void 0}}class TZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"workload-identity-store"),this.log=F(Z)}key(...Z){return C(this.prefix,...Z)}entityKey(Z){return this.key("workload-identity",X(Z))}idsSetKey(){return this.key(g$)}clientIndexKey(Z){return this.key(l$+X(Z))}externalIdIndexKey(Z){return this.key(u$+X(Z))}async get(Z){let $=await this.redis.get(this.entityKey(Z));if($==null)return;return s($,this.log)}async lookup(Z){if(Z.id){let $=await this.get(Z.id);if($)return $}if(Z.clientId){let $=await this.redis.get(this.clientIndexKey(Z.clientId));if($!=null)return this.get($)}if(Z.externalId)return this.getByExternalId(Z.externalId);return}async getByExternalId(Z){let $=await this.redis.get(this.externalIdIndexKey(Z));if($==null)return;return this.get($)}async upsert(Z){let $=Z.id?.trim()||crypto.randomUUID(),Q=this.entityKey($),Y=await this.redis.get(Q),W=null;if(Y!=null)W=s(Y,this.log)??null;let V=new Date,G={...Z,id:$,createdAt:W?.createdAt??Z.createdAt??V,updatedAt:V},B=new D;if(G.clientId)B.claimUnique(this.clientIndexKey(G.clientId),$);if(G.externalId)B.claimUnique(this.externalIdIndexKey(G.externalId),$);if(W?.clientId&&W.clientId!==G.clientId)B.del(this.clientIndexKey(W.clientId));if(W?.externalId&&W.externalId!==G.externalId)B.del(this.externalIdIndexKey(W.externalId));if(B.set(Q,p$(G)),G.clientId)B.set(this.clientIndexKey(G.clientId),$);if(G.externalId)B.set(this.externalIdIndexKey(G.externalId),$);if(B.sadd(this.idsSetKey(),$),await B.exec(this.redis)==="conflict")throw new y$(`clientId "${G.clientId}" is already in use`,"unique_violation","clientId");return G}async delete(Z){let $=await this.get(Z);if($==null)return 0;let Q=new D;if(Q.del(this.entityKey(Z)),$.clientId)Q.del(this.clientIndexKey($.clientId));if($.externalId)Q.del(this.externalIdIndexKey($.externalId));return Q.srem(this.idsSetKey(),Z),await Q.exec(this.redis),1}async list(Z){let $=h(Z),Q=(await this.redis.smembers(this.idsSetKey())).sort();if(Q.length===0)return b$(0,[],$.start??0,$.limit);let Y=Q.map((G)=>this.entityKey(G)),V=(await this.redis.mget(Y)).filter((G)=>G!=null).map((G)=>s(G,this.log)).filter((G)=>G!=null);return K(V,$)}}function c$(Z){return JSON.stringify({...Z,expires_at:Z.expires_at.toISOString(),created_at:Z.created_at.toISOString()})}function d$(Z,$){let Q=L(Z,{store:"workload-token",log:$});if(Q===void 0)return;return{...Q,expires_at:new Date(Q.expires_at),created_at:new Date(Q.created_at)}}class wZ{redis;prefix;log;constructor(Z){this.redis=Z.redis,this.prefix=_(Z,"workload-token-store"),this.log=F(Z)}key(Z){return C(this.prefix,"workload","token",X(Z))}async set(Z){let $=this.key(Z.workload_id),Q=Math.max(1,Math.floor((Z.expires_at.getTime()-Date.now())/1000));await this.redis.setex($,Q,c$(Z))}async get(Z){let $=await this.redis.get(this.key(Z));if($==null)return null;let Q=d$($,this.log);if(Q==null)return null;if(Date.now()>Q.expires_at.getTime())return await this.redis.del(this.key(Z)),null;return Q}async delete(Z){await this.redis.del(this.key(Z))}async isValid(Z){return await this.get(Z)!==null}async cleanup(){}}export{E as supportsRunScript,L$ as splitIonRedisSecret,LZ as scriptSha1,C as prefixedKey,F as getLogger,_ as getKeyPrefix,X as encodeKeyId,N$ as createRedisLfvTransport,f$ as createReactiveRedis,D$ as createEvalshaRunner,U$ as chunkedMget,m as atomicCreate,c as atomicCompareAndSet,wZ as RedisWorkloadTokenStore,TZ as RedisWorkloadIdentityStore,hZ as RedisUserStore,D as RedisTxn,kZ as RedisTenantStore,fZ as RedisSessionStore,XZ as RedisResourceStore,AZ as RedisMagicLinkStore,DZ as RedisCustomerStore,FZ as RedisAccessIndex,zZ as RedisAccessCatalogStore,JZ as RedisAccessAssignmentStore,QZ as MAX_LIST_LIMIT,B$ as DEFAULT_MGET_CHUNK_SIZE,$Z as DEFAULT_LIST_LIMIT};
+return 'ok'`;
+function namespacedSubject(subjectId, subjectType) {
+  return `${subjectType}:${subjectId}`;
+}
+function resourceToken(resource) {
+  return resource && resource.length > 0 ? resource : APP;
+}
+function encodeDescriptor(d) {
+  return JSON.stringify([d.subject, d.targetType, d.target, d.rToken]);
+}
+function decodeDescriptor(value) {
+  let parts;
+  try {
+    parts = JSON.parse(value);
+  } catch {
+    parts = [];
+  }
+  const [subject, targetType, target, rToken] = Array.isArray(parts) ? parts : [];
+  return {
+    subject: subject ?? "",
+    targetType: targetType ?? "permission",
+    target: target ?? "",
+    rToken: rToken ?? APP
+  };
+}
+
+class RedisAccessIndex {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "access-index");
+    this.log = getLogger(options);
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, ...parts);
+  }
+  subjectKeyPart(ns) {
+    const sep = ns.indexOf(":");
+    if (sep <= 0)
+      return encodeKeyId(ns);
+    return `${ns.slice(0, sep)}:${encodeKeyId(ns.slice(sep + 1))}`;
+  }
+  hasKey(subject, targetType, target, rToken) {
+    return this.key("idx:has", this.subjectKeyPart(subject), targetType, encodeKeyId(target), encodeKeyId(rToken));
+  }
+  anyKey(subject, targetType, target) {
+    return this.key("idx:any", this.subjectKeyPart(subject), targetType, encodeKeyId(target));
+  }
+  edgeRootsKey(subject, targetType, target, rToken) {
+    return this.key("idx:er", this.subjectKeyPart(subject), targetType, encodeKeyId(target), encodeKeyId(rToken));
+  }
+  tripleKey(subject, targetType, target) {
+    return this.key("idx:tr", this.subjectKeyPart(subject), targetType, encodeKeyId(target));
+  }
+  rootKey(rootId) {
+    return this.key("idx:root", encodeKeyId(rootId));
+  }
+  subjectKey(subject) {
+    return this.key("idx:subj", this.subjectKeyPart(subject));
+  }
+  subjectsKey() {
+    return this.key("idx:subjects");
+  }
+  disabledKey(subject) {
+    return this.key("idx:disabled", this.subjectKeyPart(subject));
+  }
+  async has(subject, targetType, target, resource, subjectType) {
+    assertRequiredSubjectType2(subjectType);
+    const subjectId = accessRefId2(subject);
+    const targetId = accessRefId2(target);
+    if (!subjectId || !targetId)
+      return { allow: false };
+    const ns = namespacedSubject(subjectId, subjectType);
+    if (resource === undefined) {
+      const [disabled, present] = await this.redis.mget([this.disabledKey(ns), this.anyKey(ns, targetType, targetId)]);
+      if (disabled != null)
+        return { allow: false, metadata: { reason: "subject_disabled" } };
+      return present != null ? this.allow(subjectId, subjectType, targetType, targetId, undefined) : { allow: false };
+    }
+    const resourceId = accessRefId2(resource);
+    const values = await this.redis.mget([
+      this.disabledKey(ns),
+      this.hasKey(ns, targetType, targetId, resourceToken(resourceId)),
+      this.hasKey(ns, targetType, targetId, APP)
+    ]);
+    if (values[0] != null)
+      return { allow: false, metadata: { reason: "subject_disabled" } };
+    if (values[1] != null)
+      return this.allow(subjectId, subjectType, targetType, targetId, resourceId);
+    if (values[2] != null)
+      return this.allow(subjectId, subjectType, targetType, targetId, undefined);
+    return { allow: false };
+  }
+  async hasGroup(subject, group, resource, subjectType) {
+    return this.has(subject, "group", group, resource, subjectType);
+  }
+  async hasRole(subject, role, resource, subjectType) {
+    return this.has(subject, "role", role, resource, subjectType);
+  }
+  async hasPermission(subject, permission, resource, subjectType) {
+    return this.has(subject, "permission", permission, resource, subjectType);
+  }
+  async hasAny(subject, targets, subjectType) {
+    if (targets.length === 0)
+      return { allow: false };
+    this.warnLargeCheck("redis.access_index.has_any", targets.length);
+    const decisions = await this.evaluateTargets(subject, targets, subjectType);
+    for (const decision of decisions) {
+      if (decision.allow)
+        return decision;
+    }
+    return { allow: false };
+  }
+  async hasAll(subject, targets, subjectType) {
+    if (targets.length === 0) {
+      const subjectId = accessRefId2(subject);
+      if (subjectId) {
+        const disabled = await this.redis.get(this.disabledKey(namespacedSubject(subjectId, subjectType)));
+        if (disabled != null)
+          return { allow: false, metadata: { reason: "subject_disabled" } };
+      }
+      return { allow: true };
+    }
+    this.warnLargeCheck("redis.access_index.has_all", targets.length);
+    const decisions = await this.evaluateTargets(subject, targets, subjectType);
+    const matched = [];
+    for (const decision of decisions) {
+      if (!decision.allow)
+        return { allow: false, matched };
+      if (decision.matched)
+        matched.push(...decision.matched);
+    }
+    return { allow: true, matched };
+  }
+  async evaluateTargets(subject, targets, subjectType) {
+    const subjectId = accessRefId2(subject);
+    if (!subjectId)
+      return targets.map(() => ({ allow: false }));
+    const ns = namespacedSubject(subjectId, subjectType);
+    const flatKeys = [this.disabledKey(ns)];
+    const plans = targets.map((target) => {
+      const targetId = accessRefId2(target.target);
+      if (!targetId)
+        return { kind: "invalid" };
+      if (target.resource === undefined) {
+        const idx = flatKeys.push(this.anyKey(ns, target.targetType, targetId)) - 1;
+        return { kind: "any", targetType: target.targetType, targetId, idx };
+      }
+      const resourceId = accessRefId2(target.resource);
+      const idxResource = flatKeys.push(this.hasKey(ns, target.targetType, targetId, resourceToken(resourceId))) - 1;
+      const idxApp = flatKeys.push(this.hasKey(ns, target.targetType, targetId, APP)) - 1;
+      return { kind: "resource", targetType: target.targetType, targetId, resourceId, idxResource, idxApp };
+    });
+    const values = await this.redis.mget(flatKeys);
+    if (values[0] != null) {
+      return targets.map(() => ({ allow: false, metadata: { reason: "subject_disabled" } }));
+    }
+    return plans.map((plan) => {
+      if (plan.kind === "invalid")
+        return { allow: false };
+      if (plan.kind === "any") {
+        return values[plan.idx] != null ? this.allow(subjectId, subjectType, plan.targetType, plan.targetId, undefined) : { allow: false };
+      }
+      if (values[plan.idxResource] != null) {
+        return this.allow(subjectId, subjectType, plan.targetType, plan.targetId, plan.resourceId);
+      }
+      if (values[plan.idxApp] != null) {
+        return this.allow(subjectId, subjectType, plan.targetType, plan.targetId, undefined);
+      }
+      return { allow: false };
+    });
+  }
+  edgeKeys(d) {
+    return [
+      this.edgeRootsKey(d.subject, d.targetType, d.target, d.rToken),
+      this.hasKey(d.subject, d.targetType, d.target, d.rToken),
+      this.tripleKey(d.subject, d.targetType, d.target),
+      this.anyKey(d.subject, d.targetType, d.target),
+      this.subjectKey(d.subject)
+    ];
+  }
+  async materialize(rootId, edges) {
+    const desired = new Map;
+    for (const edge of edges) {
+      const subjectId = accessRefId2(edge.subject);
+      const target = accessRefId2(edge.target);
+      if (!subjectId || !target)
+        continue;
+      assertRequiredSubjectType2(edge.subjectType, "Effective edge subjectType");
+      const subject = namespacedSubject(subjectId, edge.subjectType);
+      const rToken = resourceToken(edge.resource);
+      const d = { subject, targetType: edge.targetType, target, rToken };
+      desired.set(encodeDescriptor(d), d);
+    }
+    const currentEncoded = new Set(await this.redis.smembers(this.rootKey(rootId)));
+    const toAdd = [];
+    for (const [encoded, d] of desired) {
+      if (!currentEncoded.has(encoded))
+        toAdd.push({ encoded, d });
+    }
+    const toRemove = [];
+    for (const encoded of currentEncoded) {
+      if (!desired.has(encoded))
+        toRemove.push({ encoded, d: decodeDescriptor(encoded) });
+    }
+    if (toAdd.length === 0 && toRemove.length === 0)
+      return;
+    if (supportsRunScript(this.redis)) {
+      const keys = [this.rootKey(rootId), this.subjectsKey()];
+      const args = [rootId, String(toAdd.length), String(toRemove.length)];
+      for (const { encoded, d } of toAdd) {
+        keys.push(...this.edgeKeys(d));
+        args.push(encoded, d.rToken, d.subject);
+      }
+      for (const { encoded, d } of toRemove) {
+        keys.push(...this.edgeKeys(d));
+        args.push(encoded, d.rToken);
+      }
+      await this.redis.runScript(MATERIALIZE_DIFF_SCRIPT, keys, args);
+      return;
+    }
+    for (const { encoded, d } of toAdd) {
+      await this.redis.sadd(this.edgeRootsKey(d.subject, d.targetType, d.target, d.rToken), rootId);
+      await this.redis.set(this.hasKey(d.subject, d.targetType, d.target, d.rToken), "1");
+      await this.redis.sadd(this.tripleKey(d.subject, d.targetType, d.target), d.rToken);
+      await this.redis.set(this.anyKey(d.subject, d.targetType, d.target), "1");
+      await this.redis.sadd(this.rootKey(rootId), encoded);
+      await this.redis.sadd(this.subjectKey(d.subject), encoded);
+      await this.redis.sadd(this.subjectsKey(), d.subject);
+    }
+    for (const { encoded, d } of toRemove) {
+      await this.dropRootFromEdge(rootId, d.subject, d.targetType, d.target, d.rToken);
+      await this.redis.srem(this.rootKey(rootId), encoded);
+    }
+  }
+  async replaceSubject(subject, subjectType, edges) {
+    if (!supportsRunScript(this.redis)) {
+      throw new Error("RedisAccessIndex.replaceSubject requires an adapter with atomic runScript support.");
+    }
+    const subjectId = accessRefId2(subject);
+    if (!subjectId)
+      return;
+    const ns = namespacedSubject(subjectId, subjectType);
+    const desired = [];
+    for (const edge of edges) {
+      const edgeSubjectId = accessRefId2(edge.subject);
+      assertRequiredSubjectType2(edge.subjectType, "Effective edge subjectType");
+      const edgeSubjectType = edge.subjectType;
+      if (edgeSubjectId !== subjectId || edgeSubjectType !== subjectType) {
+        throw new Error(`AccessIndex.replaceSubject received an edge for ${edgeSubjectType}:${edgeSubjectId}; expected ${ns}.`);
+      }
+      const target = accessRefId2(edge.target);
+      if (!target)
+        continue;
+      const d = {
+        subject: ns,
+        targetType: edge.targetType,
+        target,
+        rToken: resourceToken(edge.resource)
+      };
+      desired.push({ rootId: edge.rootId, encoded: encodeDescriptor(d), d });
+    }
+    const currentEncoded = await this.redis.smembers(this.subjectKey(ns));
+    const currentDescriptors = currentEncoded.map(decodeDescriptor);
+    const currentRootSets = await Promise.all(currentDescriptors.map((d) => this.redis.smembers(this.edgeRootsKey(d.subject, d.targetType, d.target, d.rToken))));
+    const currentRootIds = [...new Set(currentRootSets.flat())];
+    const keys = [this.subjectKey(ns), this.subjectsKey()];
+    for (const d of currentDescriptors) {
+      const [edgeRoots, has, triple, any] = this.edgeKeys(d);
+      keys.push(edgeRoots, has, triple, any);
+    }
+    for (const rootId of currentRootIds)
+      keys.push(this.rootKey(rootId));
+    for (const item of desired) {
+      const [edgeRoots, has, triple, any] = this.edgeKeys(item.d);
+      keys.push(this.rootKey(item.rootId), edgeRoots, has, triple, any);
+    }
+    const args = [
+      ns,
+      String(currentDescriptors.length),
+      String(currentRootIds.length),
+      String(desired.length)
+    ];
+    for (const item of desired)
+      args.push(item.rootId, item.encoded, item.d.rToken);
+    await this.redis.runScript(REPLACE_SUBJECT_SCRIPT, keys, args);
+  }
+  async removeByRoot(rootId) {
+    const rootKey = this.rootKey(rootId);
+    const members = await this.redis.smembers(rootKey);
+    if (members.length === 0) {
+      await this.redis.del(rootKey);
+      return;
+    }
+    if (supportsRunScript(this.redis)) {
+      const keys = [rootKey];
+      const args = [rootId, String(members.length)];
+      for (const member of members) {
+        const d = decodeDescriptor(member);
+        keys.push(...this.edgeKeys(d));
+        args.push(member, d.rToken);
+      }
+      await this.redis.runScript(TEARDOWN_ROOT_SCRIPT, keys, args);
+      return;
+    }
+    for (const member of members) {
+      const { subject, targetType, target, rToken } = decodeDescriptor(member);
+      await this.dropRootFromEdge(rootId, subject, targetType, target, rToken);
+    }
+    await this.redis.del(rootKey);
+  }
+  async listSubjects() {
+    const namespaced = await this.redis.smembers(this.subjectsKey());
+    const subjects = [];
+    for (const ns of namespaced) {
+      const sep = ns.indexOf(":");
+      if (sep <= 0) {
+        throw new Error(`AccessIndex subject key "${ns}" is missing a subjectType prefix.`);
+      }
+      const subjectType = ns.slice(0, sep);
+      assertRequiredSubjectType2(subjectType, "AccessIndex subject key subjectType");
+      subjects.push({ subjectType, subject: ns.slice(sep + 1) });
+    }
+    return subjects;
+  }
+  async setSubjectDisabled(subject, subjectType, disabled) {
+    const subjectId = accessRefId2(subject);
+    if (!subjectId)
+      return;
+    const key = this.disabledKey(namespacedSubject(subjectId, subjectType));
+    if (disabled)
+      await this.redis.set(key, "1");
+    else
+      await this.redis.del(key);
+  }
+  async isSubjectDisabled(subject, subjectType) {
+    assertRequiredSubjectType2(subjectType);
+    const subjectId = accessRefId2(subject);
+    if (!subjectId)
+      return false;
+    const value = await this.redis.get(this.disabledKey(namespacedSubject(subjectId, subjectType)));
+    return value != null;
+  }
+  async clear(subject, subjectType) {
+    if (subject === undefined) {
+      const subjects = await this.redis.smembers(this.subjectsKey());
+      for (const s of subjects)
+        await this.clearSubject(s);
+      await this.redis.del(this.subjectsKey());
+      return;
+    }
+    assertRequiredSubjectType2(subjectType);
+    const subjectId = accessRefId2(subject);
+    if (!subjectId)
+      return;
+    const ns = namespacedSubject(subjectId, subjectType);
+    await this.clearSubject(ns);
+    await this.redis.srem(this.subjectsKey(), ns);
+  }
+  async clearSubject(subjectId) {
+    const subjectKey = this.subjectKey(subjectId);
+    const descriptors = await this.redis.smembers(subjectKey);
+    if (descriptors.length === 0) {
+      await this.redis.del(subjectKey);
+      return;
+    }
+    if (supportsRunScript(this.redis)) {
+      const keys = [subjectKey];
+      for (const descriptor of descriptors) {
+        const { targetType, target, rToken } = decodeDescriptor(descriptor);
+        keys.push(this.edgeRootsKey(subjectId, targetType, target, rToken), this.hasKey(subjectId, targetType, target, rToken), this.tripleKey(subjectId, targetType, target), this.anyKey(subjectId, targetType, target));
+      }
+      const rootIds = normalizeStringArray(await this.redis.runScript(CLEAR_SUBJECT_SCRIPT, keys, [String(descriptors.length)]));
+      if (rootIds.length > 0) {
+        await this.redis.runScript(DEL_KEYS_SCRIPT, rootIds.map((rootId) => this.rootKey(rootId)), []);
+      }
+      return;
+    }
+    for (const descriptor of descriptors) {
+      const { targetType, target, rToken } = decodeDescriptor(descriptor);
+      const edgeRootsKey = this.edgeRootsKey(subjectId, targetType, target, rToken);
+      const rootIds = await this.redis.smembers(edgeRootsKey);
+      for (const rootId of rootIds) {
+        await this.redis.srem(this.rootKey(rootId), descriptor);
+      }
+      await this.redis.del(edgeRootsKey);
+      await this.redis.del(this.hasKey(subjectId, targetType, target, rToken));
+      await this.redis.srem(this.tripleKey(subjectId, targetType, target), rToken);
+      const remainingTokens = await this.redis.smembers(this.tripleKey(subjectId, targetType, target));
+      if (remainingTokens.length === 0) {
+        await this.redis.del(this.tripleKey(subjectId, targetType, target));
+        await this.redis.del(this.anyKey(subjectId, targetType, target));
+      }
+    }
+    await this.redis.del(subjectKey);
+  }
+  async dropRootFromEdge(rootId, subject, targetType, target, rToken) {
+    const edgeRootsKey = this.edgeRootsKey(subject, targetType, target, rToken);
+    await this.redis.srem(edgeRootsKey, rootId);
+    const remainingRoots = await this.redis.smembers(edgeRootsKey);
+    if (remainingRoots.length > 0)
+      return;
+    await this.redis.del(edgeRootsKey);
+    await this.redis.del(this.hasKey(subject, targetType, target, rToken));
+    const descriptor = encodeDescriptor({ subject, targetType, target, rToken });
+    await this.redis.srem(this.subjectKey(subject), descriptor);
+    await this.redis.srem(this.tripleKey(subject, targetType, target), rToken);
+    const remainingTokens = await this.redis.smembers(this.tripleKey(subject, targetType, target));
+    if (remainingTokens.length === 0) {
+      await this.redis.del(this.tripleKey(subject, targetType, target));
+      await this.redis.del(this.anyKey(subject, targetType, target));
+    }
+  }
+  allow(subject, subjectType, targetType, target, resource) {
+    return {
+      allow: true,
+      matched: [{ subject, subjectType, targetType, target, resources: resource ? [resource] : undefined }]
+    };
+  }
+  warnLargeCheck(operation, count) {
+    if (count <= CHECK_WARNING_THRESHOLD)
+      return;
+    this.log.warn("Redis access index check received a large bounded target set; issuing per-target reads.", {
+      "ion.operation": operation,
+      "ion.outcome": "degraded",
+      count,
+      threshold: CHECK_WARNING_THRESHOLD
+    });
+  }
+}
+// packages/redis-core/src/adapter-helpers.ts
+var DEFAULT_MGET_CHUNK_SIZE = 512;
+async function chunkedMget(keys, fetch, chunkSize = DEFAULT_MGET_CHUNK_SIZE) {
+  if (keys.length === 0)
+    return [];
+  const size = chunkSize > 0 ? chunkSize : DEFAULT_MGET_CHUNK_SIZE;
+  const out = [];
+  for (let i = 0;i < keys.length; i += size) {
+    const part = await fetch(keys.slice(i, i + size));
+    for (const value of part)
+      out.push(value ?? null);
+  }
+  return out;
+}
+// packages/redis-core/src/customer-store.ts
+import {
+  list as list3,
+  StoreConflictError
+} from "@ionite/core";
+var IDS_SET2 = "customer:ids";
+var NAME_INDEX_PREFIX = "customer:name:";
+var EXTERNAL_ID_INDEX_PREFIX = "customer:external:";
+function serializeCustomer(customer) {
+  const createdAt = customer.createdAt ?? new Date;
+  const updatedAt = customer.updatedAt ?? createdAt;
+  const obj = {
+    ...customer,
+    createdAt: createdAt.toISOString(),
+    updatedAt: updatedAt.toISOString()
+  };
+  if (obj.ciam && typeof obj.ciam === "object" && obj.ciam !== null) {
+    const ciam = obj.ciam;
+    if (ciam.expires instanceof Date)
+      ciam.expires = ciam.expires.toISOString();
+  }
+  return JSON.stringify(obj);
+}
+function reviveCustomer(data, log) {
+  const raw = safeJsonParse(data, { store: "customer", log });
+  if (raw === undefined)
+    return;
+  if (raw.ciam && typeof raw.ciam === "object" && raw.ciam !== null) {
+    const ciam = raw.ciam;
+    if (typeof ciam.expires === "string")
+      ciam.expires = new Date(ciam.expires);
+  }
+  return {
+    ...raw,
+    createdAt: typeof raw.createdAt === "string" ? new Date(raw.createdAt) : undefined,
+    updatedAt: typeof raw.updatedAt === "string" ? new Date(raw.updatedAt) : undefined
+  };
+}
+
+class RedisCustomerStore {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "customer-store");
+    this.log = getLogger(options);
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, ...parts);
+  }
+  entityKey(id) {
+    return this.key("customer", encodeKeyId(id));
+  }
+  idsSetKey() {
+    return this.key(IDS_SET2);
+  }
+  nameIndexKey(normalized) {
+    return this.key(NAME_INDEX_PREFIX + encodeKeyId(normalized));
+  }
+  externalIdIndexKey(externalId) {
+    return this.key(EXTERNAL_ID_INDEX_PREFIX + encodeKeyId(externalId));
+  }
+  async get(sub) {
+    const raw = await this.redis.get(this.entityKey(sub));
+    if (raw == null)
+      return;
+    return reviveCustomer(raw, this.log);
+  }
+  async lookup(customer) {
+    if (customer.id) {
+      const byId = await this.get(customer.id);
+      if (byId)
+        return byId;
+    }
+    if (customer.userName) {
+      const id = await this.redis.get(this.nameIndexKey(customer.userName.toLowerCase()));
+      if (id != null)
+        return this.get(id);
+    }
+    if (customer.externalId) {
+      return this.getByExternalId(customer.externalId);
+    }
+    return;
+  }
+  async getByExternalId(externalId) {
+    const id = await this.redis.get(this.externalIdIndexKey(externalId));
+    if (id == null)
+      return;
+    return this.get(id);
+  }
+  async upsert(customer) {
+    const customerId = customer.id?.trim() || crypto.randomUUID();
+    const stored = { ...customer, id: customerId };
+    const k = this.entityKey(customerId);
+    const existingRaw = await this.redis.get(k);
+    const existing = existingRaw != null ? reviveCustomer(existingRaw, this.log) ?? null : null;
+    const newName = stored.userName?.toLowerCase();
+    const oldName = existing?.userName?.toLowerCase();
+    const newExternalId = stored.externalId;
+    const oldExternalId = existing?.externalId;
+    const txn = new RedisTxn;
+    if (newName)
+      txn.claimUnique(this.nameIndexKey(newName), customerId);
+    if (newExternalId)
+      txn.claimUnique(this.externalIdIndexKey(newExternalId), customerId);
+    if (oldName && oldName !== newName)
+      txn.del(this.nameIndexKey(oldName));
+    if (oldExternalId && oldExternalId !== newExternalId)
+      txn.del(this.externalIdIndexKey(oldExternalId));
+    txn.set(k, serializeCustomer(stored));
+    if (newName)
+      txn.set(this.nameIndexKey(newName), customerId);
+    if (newExternalId)
+      txn.set(this.externalIdIndexKey(newExternalId), customerId);
+    txn.sadd(this.idsSetKey(), customerId);
+    if (await txn.exec(this.redis) === "conflict") {
+      throw new StoreConflictError(`userName "${stored.userName}" is already in use`, "unique_violation", "userName");
+    }
+    return stored;
+  }
+  async delete(sub) {
+    const customer = await this.get(sub);
+    if (customer == null)
+      return 0;
+    const txn = new RedisTxn;
+    txn.del(this.entityKey(sub));
+    if (customer.userName)
+      txn.del(this.nameIndexKey(customer.userName.toLowerCase()));
+    if (customer.externalId)
+      txn.del(this.externalIdIndexKey(customer.externalId));
+    txn.srem(this.idsSetKey(), sub);
+    await txn.exec(this.redis);
+    return 1;
+  }
+  async list(options) {
+    const opts = normalizeListLimit(options);
+    const ids = (await this.redis.smembers(this.idsSetKey())).sort();
+    if (ids.length === 0)
+      return list3(0, [], opts.start ?? 0, opts.limit);
+    const keys = ids.map((id) => this.entityKey(id));
+    const values = await this.redis.mget(keys);
+    const arr = values.filter((v) => v != null).map((v) => reviveCustomer(v, this.log)).filter((c) => c != null);
+    return applyListOptions(arr, opts);
+  }
+}
+// packages/redis-core/src/evalsha.ts
+import { createHash as createHash2 } from "node:crypto";
+function scriptSha1(script) {
+  return createHash2("sha1").update(script, "utf8").digest("hex");
+}
+function isNoScriptError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.includes("NOSCRIPT");
+}
+function createEvalshaRunner(client) {
+  const shaByScript = new Map;
+  return async (script, keys, args) => {
+    let sha = shaByScript.get(script);
+    if (!sha) {
+      sha = scriptSha1(script);
+      shaByScript.set(script, sha);
+    }
+    try {
+      return await client.evalsha(sha, keys, args);
+    } catch (error) {
+      if (isNoScriptError(error))
+        return client.eval(script, keys, args);
+      throw error;
+    }
+  };
+}
+// packages/redis-core/src/ion-redis-shared.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function splitIonRedisSecret(secret) {
+  const clientOptions = isRecord(secret.clientOptions) ? { ...secret.clientOptions } : isRecord(secret) ? { ...secret } : {};
+  delete clientOptions.redisUrl;
+  delete clientOptions.clientOptions;
+  const redisUrl = typeof secret.redisUrl === "string" ? secret.redisUrl.trim() : "";
+  return {
+    redisUrl: redisUrl || undefined,
+    clientOptions
+  };
+}
+// packages/redis-core/src/lfv-callback-transport.ts
+import { defaultLogger as defaultLogger3 } from "@ionite/core";
+function channelFor(prefix, key) {
+  return `${prefix}:${encodeURIComponent(key)}`;
+}
+function isEnvelope(value, expectedRequestId) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const envelope = value;
+  const headers = envelope.headers;
+  return envelope.kind === "delivery" && typeof envelope.key === "string" && typeof envelope.rawBody === "string" && typeof headers === "object" && headers !== null && headers.requestId === expectedRequestId && typeof headers.keyId === "string" && typeof headers.signature === "string";
+}
+function createRedisLfvTransport(adapter, options = {}) {
+  if (!adapter.getdel) {
+    throw new Error("Redis adapter must implement getdel() for LFV callback coordination");
+  }
+  const getdel = adapter.getdel.bind(adapter);
+  const prefix = options.channelPrefix?.trim() || "ionite:lfv:otp";
+  const log = options.logger ?? defaultLogger3;
+  return {
+    async put(requestId, envelope, ttlMs) {
+      if (envelope.kind !== "delivery" || envelope.headers.requestId !== requestId) {
+        throw new Error("LFV callback mailbox only accepts matching delivery envelopes");
+      }
+      const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1000));
+      await adapter.setex(channelFor(prefix, requestId), ttlSeconds, JSON.stringify(envelope));
+    },
+    async take(requestId) {
+      const message = await getdel(channelFor(prefix, requestId));
+      if (message == null)
+        return;
+      let parsed;
+      try {
+        parsed = JSON.parse(message);
+      } catch (error) {
+        log.warn("Invalid JSON received from LFV Redis callback mailbox", {
+          "ion.operation": "lfv.callback.redis.take",
+          "ion.outcome": "rejected",
+          requestId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+        return;
+      }
+      if (!isEnvelope(parsed, requestId)) {
+        log.warn("Invalid envelope received from LFV Redis callback mailbox", {
+          "ion.operation": "lfv.callback.redis.take",
+          "ion.outcome": "rejected",
+          requestId
+        });
+        return;
+      }
+      return parsed;
+    }
+  };
+}
+// packages/redis-core/src/magic-link-store.ts
+import { StoreConflictError as StoreConflictError2 } from "@ionite/core";
+function serializeMagicLink(link) {
+  return JSON.stringify({
+    token: link.token,
+    customer: link.customer,
+    createdAt: link.createdAt.toISOString(),
+    expiresAt: link.expiresAt.toISOString()
+  });
+}
+function reviveMagicLink(data, log) {
+  const raw = safeJsonParse(data, { store: "magic-link", log });
+  if (raw === undefined)
+    return;
+  return {
+    ...raw,
+    createdAt: new Date(raw.createdAt),
+    expiresAt: new Date(raw.expiresAt)
+  };
+}
+
+class RedisMagicLinkStore {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "magic-link-store");
+    this.log = getLogger(options);
+  }
+  key(token) {
+    return prefixedKey(this.prefix, "magic", encodeKeyId(token));
+  }
+  async create(token, customer, expiresAt) {
+    const k = this.key(token);
+    const link = {
+      token,
+      customer,
+      createdAt: new Date,
+      expiresAt
+    };
+    const ttlSec = Math.max(1, Math.floor((expiresAt.getTime() - Date.now()) / 1000));
+    const result = await atomicCreate(this.redis, k, serializeMagicLink(link), { ttlSeconds: ttlSec });
+    if (result === "conflict") {
+      throw new StoreConflictError2(`Magic link with token ${token} already exists`, "already_exists", "token");
+    }
+  }
+  async get(token) {
+    const raw = await this.redis.get(this.key(token));
+    if (raw == null)
+      return null;
+    return reviveMagicLink(raw, this.log) ?? null;
+  }
+  async getAndDelete(token) {
+    const k = this.key(token);
+    let raw;
+    if (typeof this.redis.getdel === "function") {
+      raw = await this.redis.getdel(k);
+    } else {
+      raw = await this.redis.get(k);
+      if (raw != null)
+        await this.redis.del(k);
+    }
+    if (raw == null)
+      return null;
+    const link = reviveMagicLink(raw, this.log);
+    if (link == null)
+      return null;
+    if (Date.now() > link.expiresAt.getTime())
+      return null;
+    return link;
+  }
+  async delete(token) {
+    await this.redis.del(this.key(token));
+  }
+}
+// packages/redis-core/src/reactive-redis.ts
+import {
+  defaultLogger as defaultLogger4
+} from "@ionite/core";
+function readyWithOptionalTimeout(promise, timeout) {
+  if (typeof timeout !== "number" || timeout <= 0) {
+    return promise;
+  }
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`Reactive Redis adapter did not become ready within ${timeout}ms`));
+    }, timeout);
+    promise.then(() => {
+      clearTimeout(timer);
+      resolve();
+    }, (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+function createDeferred() {
+  let resolve;
+  let reject;
+  const promise = new Promise((nextResolve, nextReject) => {
+    resolve = nextResolve;
+    reject = nextReject;
+  });
+  return { promise, resolve, reject };
+}
+function isFunction(value) {
+  return typeof value === "function";
+}
+function createReactiveRedis(options) {
+  const log = options.logger ?? defaultLogger4;
+  const sourceName = options.sourceName?.trim() || "redis";
+  const secretPath = options.path.trim();
+  let currentClient;
+  let unsubscribe;
+  let readyResolved = false;
+  let lastAppliedVersion;
+  let lastConfiguredSignature;
+  let lastEndpoint;
+  let closed = false;
+  let warnedNoRunScript = false;
+  let warnedNoGetdel = false;
+  const channelSubscriptions = new Map;
+  let operationQueue = Promise.resolve();
+  const readyState = createDeferred();
+  readyState.promise.catch(() => {});
+  const reactive = {
+    async get(key) {
+      return withAdapter((adapter) => adapter.get(key));
+    },
+    async set(key, value) {
+      await withAdapter((adapter) => adapter.set(key, value));
+    },
+    async setex(key, seconds, value) {
+      await withAdapter((adapter) => adapter.setex(key, seconds, value));
+    },
+    async del(key) {
+      await withAdapter((adapter) => adapter.del(key));
+    },
+    async sadd(key, ...members) {
+      await withAdapter((adapter) => adapter.sadd(key, ...members));
+    },
+    async srem(key, ...members) {
+      await withAdapter((adapter) => adapter.srem(key, ...members));
+    },
+    async smembers(key) {
+      return withAdapter((adapter) => adapter.smembers(key));
+    },
+    async mget(keys) {
+      return withAdapter((adapter) => adapter.mget(keys));
+    },
+    async publish(channel, message) {
+      await withAdapter(async (adapter) => {
+        if (!adapter.publish) {
+          throw new Error("Active Redis adapter does not support publish (Pub/Sub)");
+        }
+        await adapter.publish(channel, message);
+      });
+    },
+    async subscribeChannel(channel, listener) {
+      let entry = channelSubscriptions.get(channel);
+      if (!entry) {
+        const listeners = new Set;
+        entry = {
+          listeners,
+          dispatch: (message) => {
+            for (const active of Array.from(listeners)) {
+              try {
+                active(message);
+              } catch (error) {
+                log.warn("Redis channel listener threw", {
+                  "ion.operation": "redis.adapter.subscribe",
+                  "ion.outcome": "failure",
+                  sourceName,
+                  path: secretPath,
+                  channel,
+                  error: error instanceof Error ? error.message : String(error)
+                });
+              }
+            }
+          }
+        };
+        channelSubscriptions.set(channel, entry);
+      }
+      const subscription = entry;
+      subscription.listeners.add(listener);
+      try {
+        await attachChannel(channel, subscription);
+      } catch (error) {
+        subscription.listeners.delete(listener);
+        if (subscription.listeners.size === 0)
+          channelSubscriptions.delete(channel);
+        throw error;
+      }
+      return async () => {
+        subscription.listeners.delete(listener);
+        if (subscription.listeners.size === 0) {
+          channelSubscriptions.delete(channel);
+          const unsubscribe2 = subscription.unsubscribe;
+          subscription.unsubscribe = undefined;
+          await unsubscribe2?.();
+        }
+      };
+    },
+    ready(timeout) {
+      return readyWithOptionalTimeout(readyState.promise, timeout);
+    },
+    isReady() {
+      return currentClient !== undefined;
+    },
+    async close() {
+      closed = true;
+      cleanupSubscription();
+      if (!readyResolved) {
+        readyResolved = true;
+        readyState.reject(new Error(`Reactive Redis adapter for source "${sourceName}" at path "${secretPath}" was closed before becoming ready.`));
+      }
+      await operationQueue.catch(() => {});
+      await disposeClient(currentClient);
+      currentClient = undefined;
+      for (const entry of channelSubscriptions.values()) {
+        entry.unsubscribe = undefined;
+      }
+      channelSubscriptions.clear();
+      syncOptionalCapabilities();
+    }
+  };
+  function enqueue(task) {
+    operationQueue = operationQueue.then(task).catch((error) => {
+      if (!readyResolved) {
+        readyResolved = true;
+        readyState.reject(error);
+      }
+      log.warn("Reactive Redis adapter update failed", {
+        "ion.operation": "redis.adapter.update",
+        "ion.outcome": "degraded",
+        sourceName,
+        path: secretPath,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  }
+  async function waitForAdapter() {
+    if (closed) {
+      throw new Error(`Reactive Redis adapter for source "${sourceName}" at path "${secretPath}" is closed.`);
+    }
+    const current = currentClient?.adapter;
+    if (current) {
+      return current;
+    }
+    await operationQueue.catch(() => {});
+    if (closed) {
+      throw new Error(`Reactive Redis adapter for source "${sourceName}" at path "${secretPath}" is closed.`);
+    }
+    const applied = currentClient?.adapter;
+    if (applied) {
+      return applied;
+    }
+    await readyState.promise;
+    if (closed) {
+      throw new Error(`Reactive Redis adapter for source "${sourceName}" at path "${secretPath}" is closed.`);
+    }
+    const next = currentClient?.adapter;
+    if (!next) {
+      throw new Error(`Reactive Redis adapter for source "${sourceName}" at path "${secretPath}" did not become ready.`);
+    }
+    return next;
+  }
+  async function withAdapter(run) {
+    const adapter = await waitForAdapter();
+    return run(adapter);
+  }
+  function cleanupSubscription() {
+    unsubscribe?.();
+    unsubscribe = undefined;
+  }
+  async function attachChannel(channel, entry) {
+    if (entry.unsubscribe)
+      return;
+    if (!entry.attaching) {
+      entry.attaching = (async () => {
+        const adapter = await waitForAdapter();
+        if (!adapter.subscribeChannel) {
+          throw new Error("Active Redis adapter does not support subscribeChannel (Pub/Sub)");
+        }
+        if (entry.listeners.size === 0)
+          return;
+        entry.unsubscribe = await adapter.subscribeChannel(channel, entry.dispatch);
+      })().finally(() => {
+        entry.attaching = undefined;
+      });
+    }
+    await entry.attaching;
+  }
+  async function resubscribeChannels(adapter) {
+    for (const [channel, entry] of channelSubscriptions) {
+      if (entry.attaching)
+        await entry.attaching.catch(() => {});
+      entry.unsubscribe = undefined;
+      if (!adapter.subscribeChannel) {
+        log.warn("Active Redis adapter does not support subscribeChannel; channel subscriptions dropped.", {
+          "ion.operation": "redis.adapter.capabilities",
+          "ion.outcome": "degraded",
+          sourceName,
+          path: secretPath,
+          capability: "subscribeChannel"
+        });
+        return;
+      }
+      try {
+        entry.unsubscribe = await adapter.subscribeChannel(channel, entry.dispatch);
+      } catch (error) {
+        log.warn("Failed to re-subscribe Redis channel after client rotation", {
+          "ion.operation": "redis.adapter.subscribe",
+          "ion.outcome": "failure",
+          sourceName,
+          path: secretPath,
+          channel,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+  async function subscribeToSource(source) {
+    cleanupSubscription();
+    unsubscribe = await source.subscribe(secretPath, (fullSecret) => {
+      enqueue(async () => {
+        if (closed)
+          return;
+        await applySecret(fullSecret);
+      });
+    }, options.subscription ?? options.secretOptions);
+  }
+  async function applySecret(fullSecret) {
+    if (closed)
+      return;
+    const nextSignature = `${sourceName}:${secretPath}:${fullSecret.metadata.version}`;
+    if (currentClient !== undefined && lastConfiguredSignature === nextSignature && lastAppliedVersion === fullSecret.metadata.version) {
+      return;
+    }
+    const nextEndpoint = options.endpointOf?.(fullSecret);
+    if (currentClient !== undefined && nextEndpoint != null && nextEndpoint !== "" && lastEndpoint != null && lastEndpoint !== "" && nextEndpoint !== lastEndpoint) {
+      throw new Error(`Reactive Redis adapter for source "${sourceName}" at path "${secretPath}" rejected a rotation that changed the endpoint (${lastEndpoint} -> ${nextEndpoint}); only credentials may rotate under an active adapter.`);
+    }
+    const nextClient = await options.createClient(fullSecret);
+    if (closed) {
+      await disposeClient(nextClient);
+      return;
+    }
+    const previousClient = currentClient;
+    currentClient = nextClient;
+    lastConfiguredSignature = nextSignature;
+    lastAppliedVersion = fullSecret.metadata.version;
+    if (nextEndpoint != null && nextEndpoint !== "")
+      lastEndpoint = nextEndpoint;
+    syncOptionalCapabilities();
+    if (previousClient !== undefined) {
+      await resubscribeChannels(nextClient.adapter);
+    }
+    if (!readyResolved) {
+      readyResolved = true;
+      readyState.resolve();
+    }
+    await disposeClient(previousClient);
+  }
+  async function disposeClient(client) {
+    if (!client?.dispose)
+      return;
+    await client.dispose();
+  }
+  function syncOptionalCapabilities() {
+    const adapter = currentClient?.adapter;
+    if (adapter?.runScript && isFunction(adapter.runScript)) {
+      reactive.runScript = async (script, keys, args) => {
+        return withAdapter(async (current) => {
+          if (!current.runScript)
+            throw new Error("Active Redis adapter does not support runScript");
+          return current.runScript(script, keys, args);
+        });
+      };
+    } else {
+      delete reactive.runScript;
+      if (adapter !== undefined && !warnedNoRunScript) {
+        warnedNoRunScript = true;
+        log.warn("Active Redis adapter does not support runScript (EVAL); stores fall back to non-isolated writes.", {
+          "ion.operation": "redis.adapter.capabilities",
+          "ion.outcome": "degraded",
+          sourceName,
+          path: secretPath,
+          capability: "runScript"
+        });
+      }
+    }
+    if (adapter?.getdel && isFunction(adapter.getdel)) {
+      reactive.getdel = async (key) => {
+        return withAdapter(async (current) => {
+          if (!current.getdel)
+            return null;
+          return current.getdel(key);
+        });
+      };
+    } else {
+      delete reactive.getdel;
+      if (adapter !== undefined && !warnedNoGetdel) {
+        warnedNoGetdel = true;
+        log.warn("Active Redis adapter does not support getdel (GETDEL); single-use consume falls back to get+del.", {
+          "ion.operation": "redis.adapter.capabilities",
+          "ion.outcome": "degraded",
+          sourceName,
+          path: secretPath,
+          capability: "getdel"
+        });
+      }
+    }
+  }
+  syncOptionalCapabilities();
+  enqueue(async () => {
+    if (closed)
+      return;
+    await subscribeToSource(options.source);
+  });
+  return reactive;
+}
+// packages/redis-core/src/session-store.ts
+import { StoreConflictError as StoreConflictError3 } from "@ionite/core";
+var SESSION_UPDATE_MAX_CAS_ATTEMPTS = 5;
+function mergeSessionRaw(raw, patch) {
+  let obj;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  if (obj == null || typeof obj !== "object" || Array.isArray(obj))
+    return;
+  return JSON.stringify({ ...obj, ...patch });
+}
+function serializeSession(session) {
+  return JSON.stringify({
+    ...session,
+    createdAt: session.createdAt.toISOString()
+  });
+}
+function reviveSession(data, log) {
+  const raw = safeJsonParse(data, { store: "session", log });
+  if (raw === undefined)
+    return;
+  return {
+    ...raw,
+    createdAt: new Date(raw.createdAt)
+  };
+}
+function ttlSecondsFromExpiresAt(expiresAt) {
+  if (!expiresAt)
+    return;
+  const t = expiresAt instanceof Date ? expiresAt.getTime() : new Date(expiresAt).getTime();
+  if (Number.isNaN(t))
+    return;
+  const seconds = Math.ceil((t - Date.now()) / 1000);
+  return seconds > 0 ? seconds : 1;
+}
+
+class RedisSessionStore {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "session-store");
+    this.log = getLogger(options);
+  }
+  key(sid) {
+    return prefixedKey(this.prefix, "session", encodeKeyId(sid));
+  }
+  async create(session) {
+    const k = this.key(session.sid);
+    const ttlSeconds = ttlSecondsFromExpiresAt(session.expiresAt);
+    const result = await atomicCreate(this.redis, k, serializeSession(session), { ttlSeconds });
+    if (result === "conflict") {
+      throw new StoreConflictError3(`Session with sid ${session.sid} already exists`, "already_exists", "sid");
+    }
+  }
+  async get(sid) {
+    const raw = await this.redis.get(this.key(sid));
+    if (raw == null)
+      return null;
+    return reviveSession(raw, this.log) ?? null;
+  }
+  async update(sid, data) {
+    const k = this.key(sid);
+    const patch = JSON.parse(JSON.stringify(data));
+    const ttlSeconds = "expiresAt" in patch ? ttlSecondsFromExpiresAt(patch.expiresAt) : undefined;
+    if (supportsRunScript(this.redis)) {
+      for (let attempt = 0;attempt < SESSION_UPDATE_MAX_CAS_ATTEMPTS; attempt++) {
+        const raw2 = await this.redis.get(k);
+        if (raw2 == null)
+          throw new Error(`Session with sid ${sid} not found`);
+        const merged = mergeSessionRaw(raw2, patch);
+        if (merged === undefined)
+          throw new Error(`Session with sid ${sid} not found`);
+        const result = await atomicCompareAndSet(this.redis, k, raw2, merged, ttlSeconds);
+        if (result === "ok")
+          return;
+        if (result === "missing")
+          throw new Error(`Session with sid ${sid} not found`);
+      }
+    }
+    const raw = await this.redis.get(k);
+    if (raw == null)
+      throw new Error(`Session with sid ${sid} not found`);
+    const session = reviveSession(raw, this.log);
+    if (session == null)
+      throw new Error(`Session with sid ${sid} not found`);
+    const updated = { ...session, ...data };
+    const value = serializeSession(updated);
+    if (ttlSeconds != null && ttlSeconds > 0) {
+      await this.redis.setex(k, Math.max(1, Math.floor(ttlSeconds)), value);
+    } else {
+      await this.redis.set(k, value);
+    }
+  }
+  async delete(sid) {
+    await this.redis.del(this.key(sid));
+  }
+}
+// packages/redis-core/src/tenant-store.ts
+var IDS_SET3 = "tenant:ids";
+function serializeTenant(tenant) {
+  return JSON.stringify({
+    ...tenant,
+    createdAt: tenant.createdAt.toISOString(),
+    updatedAt: tenant.updatedAt.toISOString()
+  });
+}
+function reviveTenant(data, log) {
+  const raw = safeJsonParse(data, { store: "tenant", log });
+  if (raw === undefined)
+    return;
+  return {
+    ...raw,
+    createdAt: new Date(raw.createdAt),
+    updatedAt: new Date(raw.updatedAt)
+  };
+}
+
+class RedisTenantStoreData {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "tenant-store");
+    this.log = getLogger(options);
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, ...parts);
+  }
+  entityKey(id) {
+    return this.key("tenant", encodeKeyId(id));
+  }
+  idsSetKey() {
+    return this.key(IDS_SET3);
+  }
+  async get(id) {
+    const raw = await this.redis.get(this.entityKey(id));
+    if (raw == null)
+      return;
+    return reviveTenant(raw, this.log);
+  }
+  async upsert(tenant) {
+    await new RedisTxn().set(this.entityKey(tenant.id), serializeTenant(tenant)).sadd(this.idsSetKey(), tenant.id).exec(this.redis);
+    return tenant;
+  }
+  async list(options) {
+    const ids = await this.redis.smembers(this.idsSetKey());
+    if (ids.length === 0) {
+      return applyListOptions([], options);
+    }
+    const keys = ids.map((id) => this.entityKey(id));
+    const rawList = await this.redis.mget(keys);
+    const items = rawList.map((raw) => raw != null ? reviveTenant(raw, this.log) : undefined).filter((t) => t != null);
+    return applyListOptions(items, options);
+  }
+  async delete(id) {
+    const existing = await this.get(id);
+    await new RedisTxn().srem(this.idsSetKey(), id).del(this.entityKey(id)).exec(this.redis);
+    return existing ? 1 : 0;
+  }
+}
+
+class RedisTenantStore {
+  store;
+  ionCache;
+  constructor(options) {
+    this.ionCache = options.ionCache;
+    this.store = new RedisTenantStoreData(options);
+  }
+  async get(id) {
+    return this.store.get(id);
+  }
+  async upsert(tenant) {
+    const stored = await this.store.upsert(tenant);
+    this.ionCache?.delete(tenant.id);
+    return stored;
+  }
+  async list(options) {
+    return this.store.list(options);
+  }
+  async delete(id) {
+    const removed = await this.store.delete(id);
+    this.ionCache?.delete(id);
+    return removed;
+  }
+  async getIon(id) {
+    if (!this.ionCache) {
+      throw new Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an ` + `lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose ` + `closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.`);
+    }
+    return this.ionCache.fetch(id);
+  }
+}
+// packages/redis-core/src/user-store.ts
+import {
+  list as list4,
+  StoreConflictError as StoreConflictError4
+} from "@ionite/core";
+var IDS_SET4 = "user:ids";
+var NAME_INDEX_PREFIX2 = "user:name:";
+var EXTERNAL_ID_INDEX_PREFIX2 = "user:external-id:";
+function serializeUser(user) {
+  const createdAt = user.createdAt ?? new Date;
+  const updatedAt = user.updatedAt ?? createdAt;
+  const obj = {
+    ...user,
+    createdAt: createdAt.toISOString(),
+    updatedAt: updatedAt.toISOString()
+  };
+  if (obj.sso && typeof obj.sso === "object" && obj.sso !== null) {
+    const sso = obj.sso;
+    if (sso.expires instanceof Date)
+      sso.expires = sso.expires.toISOString();
+  }
+  return JSON.stringify(obj);
+}
+function reviveUser(data, log) {
+  const raw = safeJsonParse(data, { store: "user", log });
+  if (raw === undefined)
+    return;
+  if (raw.sso && typeof raw.sso === "object" && raw.sso !== null) {
+    const sso = raw.sso;
+    if (typeof sso.expires === "string")
+      sso.expires = new Date(sso.expires);
+  }
+  return {
+    ...raw,
+    createdAt: typeof raw.createdAt === "string" ? new Date(raw.createdAt) : undefined,
+    updatedAt: typeof raw.updatedAt === "string" ? new Date(raw.updatedAt) : undefined
+  };
+}
+
+class RedisUserStore {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "user-store");
+    this.log = getLogger(options);
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, ...parts);
+  }
+  entityKey(id) {
+    return this.key("user", encodeKeyId(id));
+  }
+  idsSetKey() {
+    return this.key(IDS_SET4);
+  }
+  nameIndexKey(normalized) {
+    return this.key(NAME_INDEX_PREFIX2 + encodeKeyId(normalized));
+  }
+  externalIdIndexKey(externalId) {
+    return this.key(EXTERNAL_ID_INDEX_PREFIX2 + encodeKeyId(externalId));
+  }
+  async get(sub) {
+    const raw = await this.redis.get(this.entityKey(sub));
+    if (raw == null)
+      return;
+    return reviveUser(raw, this.log);
+  }
+  async getByExternalId(externalId) {
+    const id = await this.redis.get(this.externalIdIndexKey(externalId));
+    return id ? this.get(id) : undefined;
+  }
+  async lookup(user) {
+    return this.get(user.id ?? "");
+  }
+  async upsert(user) {
+    const userId = user.id?.trim() || crypto.randomUUID();
+    const storedUser = { ...user, id: userId };
+    const k = this.entityKey(userId);
+    const existingRaw = await this.redis.get(k);
+    const existing = existingRaw != null ? reviveUser(existingRaw, this.log) ?? null : null;
+    const newName = storedUser.userName?.toLowerCase();
+    const oldName = existing?.userName?.toLowerCase();
+    const newExternalId = storedUser.externalId;
+    const oldExternalId = existing?.externalId;
+    const txn = new RedisTxn;
+    if (newName)
+      txn.claimUnique(this.nameIndexKey(newName), userId);
+    if (newExternalId)
+      txn.claimUnique(this.externalIdIndexKey(newExternalId), userId);
+    if (oldName && oldName !== newName)
+      txn.del(this.nameIndexKey(oldName));
+    if (oldExternalId && oldExternalId !== newExternalId)
+      txn.del(this.externalIdIndexKey(oldExternalId));
+    txn.set(k, serializeUser(storedUser));
+    if (newName)
+      txn.set(this.nameIndexKey(newName), userId);
+    if (newExternalId)
+      txn.set(this.externalIdIndexKey(newExternalId), userId);
+    txn.sadd(this.idsSetKey(), userId);
+    if (await txn.exec(this.redis) === "conflict") {
+      if (newExternalId) {
+        const externalIdOwner = await this.redis.get(this.externalIdIndexKey(newExternalId));
+        if (externalIdOwner && externalIdOwner !== userId) {
+          throw new StoreConflictError4(`externalId "${newExternalId}" is already in use`, "unique_violation", "externalId");
+        }
+      }
+      throw new StoreConflictError4(`userName "${storedUser.userName}" is already in use`, "unique_violation", "userName");
+    }
+    return storedUser;
+  }
+  async delete(sub) {
+    const user = await this.get(sub);
+    if (user == null)
+      return 0;
+    const txn = new RedisTxn;
+    txn.del(this.entityKey(sub));
+    if (user.userName)
+      txn.del(this.nameIndexKey(user.userName.toLowerCase()));
+    if (user.externalId)
+      txn.del(this.externalIdIndexKey(user.externalId));
+    txn.srem(this.idsSetKey(), sub);
+    await txn.exec(this.redis);
+    return 1;
+  }
+  async list(options) {
+    const opts = normalizeListLimit(options);
+    const ids = (await this.redis.smembers(this.idsSetKey())).sort();
+    if (ids.length === 0)
+      return list4(0, [], opts.start ?? 0, opts.limit);
+    const keys = ids.map((id) => this.entityKey(id));
+    const values = await this.redis.mget(keys);
+    const arr = values.filter((v) => v != null).map((v) => reviveUser(v, this.log)).filter((u) => u != null);
+    return applyListOptions(arr, opts);
+  }
+}
+// packages/redis-core/src/workload-identity-store.ts
+import {
+  list as list5,
+  StoreConflictError as StoreConflictError5
+} from "@ionite/core";
+var IDS_SET5 = "workload-identity:ids";
+var CLIENT_INDEX_PREFIX = "workload-identity:client:";
+var EXTERNAL_ID_INDEX_PREFIX3 = "workload-identity:external:";
+function serializeIdentity(identity) {
+  const createdAt = identity.createdAt ?? new Date;
+  const updatedAt = identity.updatedAt ?? createdAt;
+  return JSON.stringify({
+    ...identity,
+    createdAt: createdAt.toISOString(),
+    updatedAt: updatedAt.toISOString()
+  });
+}
+function reviveIdentity(data, log) {
+  const raw = safeJsonParse(data, { store: "workload-identity", log });
+  if (raw === undefined)
+    return;
+  return {
+    ...raw,
+    createdAt: typeof raw.createdAt === "string" ? new Date(raw.createdAt) : undefined,
+    updatedAt: typeof raw.updatedAt === "string" ? new Date(raw.updatedAt) : undefined
+  };
+}
+
+class RedisWorkloadIdentityStore {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "workload-identity-store");
+    this.log = getLogger(options);
+  }
+  key(...parts) {
+    return prefixedKey(this.prefix, ...parts);
+  }
+  entityKey(id) {
+    return this.key("workload-identity", encodeKeyId(id));
+  }
+  idsSetKey() {
+    return this.key(IDS_SET5);
+  }
+  clientIndexKey(clientId) {
+    return this.key(CLIENT_INDEX_PREFIX + encodeKeyId(clientId));
+  }
+  externalIdIndexKey(externalId) {
+    return this.key(EXTERNAL_ID_INDEX_PREFIX3 + encodeKeyId(externalId));
+  }
+  async get(id) {
+    const raw = await this.redis.get(this.entityKey(id));
+    if (raw == null)
+      return;
+    return reviveIdentity(raw, this.log);
+  }
+  async lookup(identity) {
+    if (identity.id) {
+      const byId = await this.get(identity.id);
+      if (byId)
+        return byId;
+    }
+    if (identity.clientId) {
+      const id = await this.redis.get(this.clientIndexKey(identity.clientId));
+      if (id != null)
+        return this.get(id);
+    }
+    if (identity.externalId) {
+      return this.getByExternalId(identity.externalId);
+    }
+    return;
+  }
+  async getByExternalId(externalId) {
+    const id = await this.redis.get(this.externalIdIndexKey(externalId));
+    if (id == null)
+      return;
+    return this.get(id);
+  }
+  async upsert(identity) {
+    const id = identity.id?.trim() || crypto.randomUUID();
+    const k = this.entityKey(id);
+    const existingRaw = await this.redis.get(k);
+    let existing = null;
+    if (existingRaw != null)
+      existing = reviveIdentity(existingRaw, this.log) ?? null;
+    const now = new Date;
+    const stored = {
+      ...identity,
+      id,
+      createdAt: existing?.createdAt ?? identity.createdAt ?? now,
+      updatedAt: now
+    };
+    const txn = new RedisTxn;
+    if (stored.clientId)
+      txn.claimUnique(this.clientIndexKey(stored.clientId), id);
+    if (stored.externalId)
+      txn.claimUnique(this.externalIdIndexKey(stored.externalId), id);
+    if (existing?.clientId && existing.clientId !== stored.clientId) {
+      txn.del(this.clientIndexKey(existing.clientId));
+    }
+    if (existing?.externalId && existing.externalId !== stored.externalId) {
+      txn.del(this.externalIdIndexKey(existing.externalId));
+    }
+    txn.set(k, serializeIdentity(stored));
+    if (stored.clientId)
+      txn.set(this.clientIndexKey(stored.clientId), id);
+    if (stored.externalId)
+      txn.set(this.externalIdIndexKey(stored.externalId), id);
+    txn.sadd(this.idsSetKey(), id);
+    if (await txn.exec(this.redis) === "conflict") {
+      throw new StoreConflictError5(`clientId "${stored.clientId}" is already in use`, "unique_violation", "clientId");
+    }
+    return stored;
+  }
+  async delete(id) {
+    const identity = await this.get(id);
+    if (identity == null)
+      return 0;
+    const txn = new RedisTxn;
+    txn.del(this.entityKey(id));
+    if (identity.clientId)
+      txn.del(this.clientIndexKey(identity.clientId));
+    if (identity.externalId)
+      txn.del(this.externalIdIndexKey(identity.externalId));
+    txn.srem(this.idsSetKey(), id);
+    await txn.exec(this.redis);
+    return 1;
+  }
+  async list(options) {
+    const opts = normalizeListLimit(options);
+    const ids = (await this.redis.smembers(this.idsSetKey())).sort();
+    if (ids.length === 0)
+      return list5(0, [], opts.start ?? 0, opts.limit);
+    const keys = ids.map((id) => this.entityKey(id));
+    const values = await this.redis.mget(keys);
+    const arr = values.filter((v) => v != null).map((v) => reviveIdentity(v, this.log)).filter((i) => i != null);
+    return applyListOptions(arr, opts);
+  }
+}
+// packages/redis-core/src/workload-token-store.ts
+function serializeToken(token) {
+  return JSON.stringify({
+    ...token,
+    expires_at: token.expires_at.toISOString(),
+    created_at: token.created_at.toISOString()
+  });
+}
+function reviveToken(data, log) {
+  const raw = safeJsonParse(data, { store: "workload-token", log });
+  if (raw === undefined)
+    return;
+  return {
+    ...raw,
+    expires_at: new Date(raw.expires_at),
+    created_at: new Date(raw.created_at)
+  };
+}
+
+class RedisWorkloadTokenStore {
+  redis;
+  prefix;
+  log;
+  constructor(options) {
+    this.redis = options.redis;
+    this.prefix = getKeyPrefix(options, "workload-token-store");
+    this.log = getLogger(options);
+  }
+  key(workload_id) {
+    return prefixedKey(this.prefix, "workload", "token", encodeKeyId(workload_id));
+  }
+  async set(token) {
+    const k = this.key(token.workload_id);
+    const ttlSec = Math.max(1, Math.floor((token.expires_at.getTime() - Date.now()) / 1000));
+    await this.redis.setex(k, ttlSec, serializeToken(token));
+  }
+  async get(workload_id) {
+    const raw = await this.redis.get(this.key(workload_id));
+    if (raw == null)
+      return null;
+    const token = reviveToken(raw, this.log);
+    if (token == null)
+      return null;
+    if (Date.now() > token.expires_at.getTime()) {
+      await this.redis.del(this.key(workload_id));
+      return null;
+    }
+    return token;
+  }
+  async delete(workload_id) {
+    await this.redis.del(this.key(workload_id));
+  }
+  async isValid(workload_id) {
+    const token = await this.get(workload_id);
+    return token !== null;
+  }
+  async cleanup() {}
+}
+export {
+  supportsRunScript,
+  splitIonRedisSecret,
+  scriptSha1,
+  prefixedKey,
+  getLogger,
+  getKeyPrefix,
+  encodeKeyId,
+  createRedisLfvTransport,
+  createReactiveRedis,
+  createEvalshaRunner,
+  chunkedMget,
+  atomicCreate,
+  atomicCompareAndSet,
+  RedisWorkloadTokenStore,
+  RedisWorkloadIdentityStore,
+  RedisUserStore,
+  RedisTxn,
+  RedisTenantStore,
+  RedisSessionStore,
+  RedisResourceStore,
+  RedisMagicLinkStore,
+  RedisCustomerStore,
+  RedisAccessIndex,
+  RedisAccessCatalogStore,
+  RedisAccessAssignmentStore,
+  MAX_LIST_LIMIT,
+  DEFAULT_MGET_CHUNK_SIZE,
+  DEFAULT_LIST_LIMIT
+};