@luckystack/core 0.6.3 → 0.6.4

package/CHANGELOG.md

@@ -18,19 +18,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Decoupled secrets-resolved hook** (ADR 0026): `notifySecretsResolved(changedKeys?)`
   + `registerSecretsResolvedListener(fn)`. A secret resolver (e.g.
   `@luckystack/secret-manager` via `onApplied: notifySecretsResolved`) fires it after
-  overwriting `process.env`; `redis.ts` self-registers a listener that drops the cached
-  default client when a `REDIS_` credential changed, so Redis auth via a secret-manager
-  POINTER survives boot AND rotation with no hand-wiring. Generic — Prisma pools / SDK
-  clients can subscribe too. Also adds an optional structural `secretManager?` field on
-  `ProjectConfig` (`SecretManagerConfigRef`) so the server boot can detect a resolver.
+  overwriting `process.env`; `redis.ts` self-registers a listener that EAGERLY REBUILDS +
+  registers the default client when a `REDIS_` credential changed, so Redis auth via a
+  secret-manager POINTER survives boot AND rotation with no hand-wiring. Generic — Prisma
+  pools / SDK clients can subscribe too. Also adds `rebuildDefaultRedisClient()` and an
+  optional structural `secretManager?` field on `ProjectConfig` (`SecretManagerConfigRef`)
+  so the server boot can detect a resolver.
 
 ### Fixed
 
 - **Redis secret-manager pointer boot** (ADR 0026): the default Redis client no longer
   fails auth with a baked-in `REDIS_PASSWORD_V<n>` pointer when it was built (during an
-  early import) before secrets resolved — the decoupled hook above + the server-boot
-  reset rebuild it from the resolved env. The `WRONGPASS` diagnostic now points at the
-  automatic handling + the `envNames` allowlist requirement.
+  early import) before secrets resolved. **Correction over 0.6.3:** a plain
+  `resetDefaultRedisClient()` was INSUFFICIENT (it defers the lazy rebuild, so the stale
+  value resurfaced, and never overrode an already-registered client). The framework now
+  EAGERLY REBUILDS + registers a fresh client from the resolved env
+  (`rebuildDefaultRedisClient()`), so the boot-UUID write authenticates with the real
+  password — no consumer code. The `WRONGPASS` diagnostic points at the automatic handling
+  + the `envNames` allowlist requirement.
 - **CORE-2** — `tryCatchSync<T, P = void>` now mirrors `tryCatch`'s `P` default,
   so a params-less call can pass only the result type (`tryCatchSync<URL>(() =>
   new URL(raw))`) instead of failing with TS2558.

package/dist/index.d.ts

@@ -6,7 +6,7 @@ import { z } from 'zod';
 import * as _prisma_client_runtime_library from '@prisma/client/runtime/library';
 import * as _prisma_client from '@prisma/client';
 import { PrismaClient } from '@prisma/client';
-import Redis, { Redis as Redis$1 } from 'ioredis';
+import Redis$1, { Redis } from 'ioredis';
 import { RedisAdapterOptions } from '@socket.io/redis-adapter';
 import { ServerResponse, IncomingMessage, IncomingHttpHeaders } from 'node:http';
 import 'socket.io-client';
@@ -679,6 +679,7 @@ declare const isDbHealthCheckRegistered: () => boolean;
 declare const resetDbHealthCheckForTests: () => void;
 
 declare const resetDefaultRedisClient: () => void;
+declare const rebuildDefaultRedisClient: () => Redis;
 interface RedisConnectionOptions {
     host: string;
     port: number;
@@ -687,7 +688,7 @@ interface RedisConnectionOptions {
 }
 declare const getRedisConnectionOptions: () => RedisConnectionOptions;
 declare const registerStrayPrefixCommand: (...commands: string[]) => void;
-declare const redis: Redis;
+declare const redis: Redis$1;
 
 type SecretsResolvedListener = (changedKeys: readonly string[] | undefined) => void;
 declare const registerSecretsResolvedListener: (listener: SecretsResolvedListener) => (() => void);
@@ -722,15 +723,15 @@ declare const releaseLease: (name: string, token: string) => Promise<boolean>;
 
 declare const DEFAULT_CLIENT_KEY = "default";
 declare const registerPrismaClient: (client: PrismaClient, key?: string) => PrismaClient;
-declare const registerRedisClient: (client: Redis$1, key?: string) => Redis$1;
+declare const registerRedisClient: (client: Redis, key?: string) => Redis;
 declare const isPrismaClientRegistered: () => boolean;
 declare const isRedisClientRegistered: () => boolean;
 declare const getPrismaClientKeys: () => string[];
 declare const getRedisClientKeys: () => string[];
 declare const getPrismaClientFor: (key?: string) => PrismaClient;
-declare const getRedisClientFor: (key?: string) => Redis$1;
+declare const getRedisClientFor: (key?: string) => Redis;
 declare const getPrismaClient: () => PrismaClient;
-declare const getRedisClient: () => Redis$1;
+declare const getRedisClient: () => Redis;
 declare const resetClientsForTests: () => void;
 
 interface AttachSocketRedisAdapterOptions {
@@ -744,9 +745,9 @@ interface AttachSocketRedisAdapterOptions {
      * a dedicated adapter connection, custom auth, or a sentinel/cluster handle.
      * When omitted the framework duplicates the default `redis` handle.
      */
-    pubClient?: Redis$1;
+    pubClient?: Redis;
     /** Pre-built sub client (see `pubClient`). */
-    subClient?: Redis$1;
+    subClient?: Redis;
 }
 declare const attachSocketRedisAdapter: (io: Server, options?: AttachSocketRedisAdapterOptions) => void;
 
@@ -1894,4 +1895,4 @@ declare const clearAllHooks: () => void;
 declare const registerSyncHook: <TName extends SyncHookName>(name: TName, handler: SyncHookHandler<SyncHookPayloads[TName]>) => (() => void);
 declare const dispatchSyncHook: <TName extends SyncHookName>(name: TName, payload: SyncHookPayloads[TName]) => void;
 
-export { type ApiAuthRejectedPayload, type ApiErrorPayload, type ApiResponseEnvelope, AuthProps, type AvatarConfig, type AvatarConfigInput, BOOT_KEY_PREFIX, BaseSessionLayout, type CheckRateLimitParams, type CookiePrefixConstraints, type CorsRejectedPayload, type CreateLocalizedNormalizerInput, type CsrfConfig, type CsrfCookieOptions, type CsrfMismatchPayload, DEFAULT_AVATAR_CONFIG, DEFAULT_CLIENT_KEY, DEFAULT_CSRF_CONFIG, DEFAULT_ENV_FILES, DEFAULT_REDACTED_LOG_KEYS, DEPTH_TRUNCATED_PLACEHOLDER, type DbHealthCheck, type DbHealthResult, DeepPartial, type DeployConfigShape, type DeployDevelopmentShape, type DeployEnvironmentShape, type DeployResourceShape, type DeployRoutingShape, type DispatchResult, type EmailAttachment, type EmailMessage, type EmailResult, type EmailSender, type EmailSenderRegistry, type ErrorFormatter, type ErrorFormatterContext, ErrorParam, ErrorResponseInput, type ErrorTracker, type ErrorTrackerContext, type ErrorTrackerEvent, type ErrorTrackerUser, type FormatterEnvelope, GENERATED_API_DOCS_PATH, GENERATED_API_SCHEMAS_PATH, GENERATED_SOCKET_TYPES_PATH, HealthHashConfig, type HealthHashDescriptor, type HookHandler, type HookName, type HookPayloads, type HookResult, type HookSessionShape, type HookStopSignal, type HttpMethod, type LanguageCode, type LocaleReloader, type LocalizedNormalizer, type NormalizeErrorResponseInput, NormalizedErrorResponse, type OnUploadCompletePayload, type OnUploadStartPayload, type OneTimeTokenHandle, PUBLIC_DIR, type PeerRequire, type PostApiExecutePayload, type PostApiRespondPayload, type PostApiValidatePayload, type PostAvatarServePayload, type PostErrorNormalizePayload, type PostHttpRequestPayload, type PostSessionRefreshPayload, type PostSyncAuthorizePayload, type PostSyncExecutePayload, type PostSyncFanoutPayload, type PostSyncValidatePayload, type PreApiExecutePayload, type PreApiRespondPayload, type PreApiValidatePayload, type PreAvatarServePayload, type PreCaptureFilter, type PreErrorNormalizePayload, type PreHttpRequestPayload, type PreServerStopPayload, type PreSessionRefreshPayload, type PreSocketMessagePayload, type PreSyncAuthorizePayload, type PreSyncExecutePayload, type PreSyncFanoutPayload, type PreSyncRecipientPayload, type PreSyncValidatePayload, type PresetDefinition, type ProcessUploadInput, type ProcessUploadResult, REDACTED_PLACEHOLDER, ROOT_DIR, type RateLimitExceededPayload, type RateLimitResult, type RateLimitStrategy, type RedisConnectionOptions, type RedisKeyFormatter, type Registry, type RegistryOptions, type ResolveClientIpParams, type RoomNameFormatter, type RoomNameFormatterContext, type RuntimeApiMapsResult, type RuntimeEnv, type RuntimeMapsProvider, type RuntimeSyncMapsResult, SERVER_DIR, SERVER_FUNCTIONS_DIR, SHARED_DIR, SRC_DIR, type SecretsResolvedListener, type ServiceDefinition, type ServicesConfigShape, type SessionCreatedPayload, type SessionLogoutInput, type SessionProvider, type SessionRevokedPayload, type SessionSaveResult, type SocketMiddleware, type SpanHandle, type SpanResult, type SyncErrorPayload, type SyncHookHandler, type SyncHookName, type SyncHookPayloads, TSCONFIG_ALIAS_FILES, type TranslateFunction, type TranslateInput, UNKNOWN_CLIENT_IP, UPLOADS_DIR, type ValidationResult$1 as ValidationResult, abortAllForSocket, abortApiByResponseIndex, abortSyncByCb, acquireLease, allowedOrigin, type apiMessage, appendErrorTracker, applyCookiePrefixConstraints, applyErrorFormatter, applySocketMiddlewares, applyStrayKeyPrefix, attachSocketRedisAdapter, bootstrapEnv, captureException, captureExceptionAcrossTrackers, captureMessage, captureMessageAcrossTrackers, checkRateLimit, clearAllHooks, clearAllRateLimits, clearRateLimit, clearSocketMiddlewares, collectSynchronizedEnvKeys, computeSynchronizedEnvHashes, consumeOneTimeToken, consumeOneTimeTokenJson, createLocalizedNormalizer, createRegistry, defaultRateLimitStrategy, defaultRedisKeyFormatter, defaultRoomNameFormatter, deriveTokenBucketId, describeHealthHashConfig, dispatchHook, dispatchSyncHook, ensurePeerDepInstalled, env, escapeHtml, extractLanguageFromHeader, extractTokenFromRequest, extractTokenFromSocket, flushErrorTrackers, formatKey, formatRoomName, getActiveErrorTrackers, getAvatarConfig, getBindAddress, getCookieValue, getCsrfConfig, getCurrentErrorTrackerIdentity, getDbHealthCheck, getDeployConfig, getEffectiveHttpMethod, getEmailSender, getEmailSenderByName, getEnv, getEnvFiles, getErrorFormatter, getGeneratedApiDocsPath, getGeneratedApiSchemasPath, getGeneratedSocketTypesPath, getIoInstance, getLocaleReloader, getLocalizedNormalizer, getParams, getPrismaClient, getPrismaClientFor, getPrismaClientKeys, getPublicDir, getRateLimitStatus, getRateLimitStrategy, getRedactedLogKeys, getRedisClient, getRedisClientFor, getRedisClientKeys, getRedisConnectionOptions, getRedisKeyFormatter, getRegisteredSessionProvider, getRoomNameFormatter, getRuntimeApiMaps, getRuntimeSyncMaps, getServerDir, getServerFunctionDirs, getServerFunctionsDir, getServicesConfig, getSharedDir, getSocketMiddlewares, getSrcDir, getUploadsDir, hasCookie, hashSynchronizedValue, hashSynchronizedValueWith, inferHttpMethod, initConsolelog, initSharedSentry, isDbHealthCheckRegistered, isDeployConfigRegistered, isEmailSenderRegistered, isFalsy, isGetMethodName, isLocalizedNormalizerRegistered, isLoopbackIp, isMethodAllowed, isPrismaClientRegistered, isPrismaClientResolvable, isProduction, isRedactedLogKey, isRedisClientRegistered, isRuntimeMapsProviderRegistered, isServicesConfigRegistered, isSessionProviderRegistered, issueOneTimeToken, listEmailSenderNames, loadEnvFiles, loadPeer, normalizeErrorResponse, normalizeOrigin, notifySecretsResolved, oneTimeTokenKey, performLogout, prisma, processUpload, readBootUuid, readSession, recordMetricAcrossTrackers, redis, registerApiAbortController, registerAvatarConfig, registerBindAddress, registerCsrfConfig, registerDbHealthCheck, registerDeployConfig, registerEmailSender, registerEmailSenders, registerErrorFormatter, registerErrorTracker, registerErrorTrackers, registerHook, registerLocaleReloader, registerLocalizedNormalizer, registerPreCaptureFilter, registerPrismaClient, registerRateLimitStrategy, registerRedactedLogKeys, registerRedisClient, registerRedisKeyFormatter, registerRoomNameFormatter, registerRuntimeMapsProvider, registerSecretsResolvedListener, registerServicesConfig, registerSessionProvider, registerSocketMiddleware, registerStrayPrefixCommand, registerSyncAbortController, registerSyncHook, releaseLease, removeSession, renewLease, resetClientsForTests, resetCsrfConfigForTests, resetDbHealthCheckForTests, resetDefaultRedisClient, resetRedactedLogKeysForTests, resetRedisKeyFormatterForTests, resetSessionProviderForTests, resolveClientIp, resolveEnvKey, resolveErrorMessage, resolveFromRoot, resolveHealthHashConfig, resolveHealthHashConfigFromDescriptor, runWithErrorTrackerIdentity, runWithErrorTrackerIdentityScope, sanitizeErrorString, sanitizeErrorStrings, sanitizeForLog, serveAvatar, setCurrentErrorTrackerIdentity, setErrorTrackerUser, setIoInstance, setSentryUser, startSpan, startSpanAcrossTrackers, startSpanHandle, type syncMessage, tryCatch, tryCatchSync, unregisterApiAbortController, unregisterSyncAbortController, validateInputByType, validateRequest, writeBootUuid, writeSession };
+export { type ApiAuthRejectedPayload, type ApiErrorPayload, type ApiResponseEnvelope, AuthProps, type AvatarConfig, type AvatarConfigInput, BOOT_KEY_PREFIX, BaseSessionLayout, type CheckRateLimitParams, type CookiePrefixConstraints, type CorsRejectedPayload, type CreateLocalizedNormalizerInput, type CsrfConfig, type CsrfCookieOptions, type CsrfMismatchPayload, DEFAULT_AVATAR_CONFIG, DEFAULT_CLIENT_KEY, DEFAULT_CSRF_CONFIG, DEFAULT_ENV_FILES, DEFAULT_REDACTED_LOG_KEYS, DEPTH_TRUNCATED_PLACEHOLDER, type DbHealthCheck, type DbHealthResult, DeepPartial, type DeployConfigShape, type DeployDevelopmentShape, type DeployEnvironmentShape, type DeployResourceShape, type DeployRoutingShape, type DispatchResult, type EmailAttachment, type EmailMessage, type EmailResult, type EmailSender, type EmailSenderRegistry, type ErrorFormatter, type ErrorFormatterContext, ErrorParam, ErrorResponseInput, type ErrorTracker, type ErrorTrackerContext, type ErrorTrackerEvent, type ErrorTrackerUser, type FormatterEnvelope, GENERATED_API_DOCS_PATH, GENERATED_API_SCHEMAS_PATH, GENERATED_SOCKET_TYPES_PATH, HealthHashConfig, type HealthHashDescriptor, type HookHandler, type HookName, type HookPayloads, type HookResult, type HookSessionShape, type HookStopSignal, type HttpMethod, type LanguageCode, type LocaleReloader, type LocalizedNormalizer, type NormalizeErrorResponseInput, NormalizedErrorResponse, type OnUploadCompletePayload, type OnUploadStartPayload, type OneTimeTokenHandle, PUBLIC_DIR, type PeerRequire, type PostApiExecutePayload, type PostApiRespondPayload, type PostApiValidatePayload, type PostAvatarServePayload, type PostErrorNormalizePayload, type PostHttpRequestPayload, type PostSessionRefreshPayload, type PostSyncAuthorizePayload, type PostSyncExecutePayload, type PostSyncFanoutPayload, type PostSyncValidatePayload, type PreApiExecutePayload, type PreApiRespondPayload, type PreApiValidatePayload, type PreAvatarServePayload, type PreCaptureFilter, type PreErrorNormalizePayload, type PreHttpRequestPayload, type PreServerStopPayload, type PreSessionRefreshPayload, type PreSocketMessagePayload, type PreSyncAuthorizePayload, type PreSyncExecutePayload, type PreSyncFanoutPayload, type PreSyncRecipientPayload, type PreSyncValidatePayload, type PresetDefinition, type ProcessUploadInput, type ProcessUploadResult, REDACTED_PLACEHOLDER, ROOT_DIR, type RateLimitExceededPayload, type RateLimitResult, type RateLimitStrategy, type RedisConnectionOptions, type RedisKeyFormatter, type Registry, type RegistryOptions, type ResolveClientIpParams, type RoomNameFormatter, type RoomNameFormatterContext, type RuntimeApiMapsResult, type RuntimeEnv, type RuntimeMapsProvider, type RuntimeSyncMapsResult, SERVER_DIR, SERVER_FUNCTIONS_DIR, SHARED_DIR, SRC_DIR, type SecretsResolvedListener, type ServiceDefinition, type ServicesConfigShape, type SessionCreatedPayload, type SessionLogoutInput, type SessionProvider, type SessionRevokedPayload, type SessionSaveResult, type SocketMiddleware, type SpanHandle, type SpanResult, type SyncErrorPayload, type SyncHookHandler, type SyncHookName, type SyncHookPayloads, TSCONFIG_ALIAS_FILES, type TranslateFunction, type TranslateInput, UNKNOWN_CLIENT_IP, UPLOADS_DIR, type ValidationResult$1 as ValidationResult, abortAllForSocket, abortApiByResponseIndex, abortSyncByCb, acquireLease, allowedOrigin, type apiMessage, appendErrorTracker, applyCookiePrefixConstraints, applyErrorFormatter, applySocketMiddlewares, applyStrayKeyPrefix, attachSocketRedisAdapter, bootstrapEnv, captureException, captureExceptionAcrossTrackers, captureMessage, captureMessageAcrossTrackers, checkRateLimit, clearAllHooks, clearAllRateLimits, clearRateLimit, clearSocketMiddlewares, collectSynchronizedEnvKeys, computeSynchronizedEnvHashes, consumeOneTimeToken, consumeOneTimeTokenJson, createLocalizedNormalizer, createRegistry, defaultRateLimitStrategy, defaultRedisKeyFormatter, defaultRoomNameFormatter, deriveTokenBucketId, describeHealthHashConfig, dispatchHook, dispatchSyncHook, ensurePeerDepInstalled, env, escapeHtml, extractLanguageFromHeader, extractTokenFromRequest, extractTokenFromSocket, flushErrorTrackers, formatKey, formatRoomName, getActiveErrorTrackers, getAvatarConfig, getBindAddress, getCookieValue, getCsrfConfig, getCurrentErrorTrackerIdentity, getDbHealthCheck, getDeployConfig, getEffectiveHttpMethod, getEmailSender, getEmailSenderByName, getEnv, getEnvFiles, getErrorFormatter, getGeneratedApiDocsPath, getGeneratedApiSchemasPath, getGeneratedSocketTypesPath, getIoInstance, getLocaleReloader, getLocalizedNormalizer, getParams, getPrismaClient, getPrismaClientFor, getPrismaClientKeys, getPublicDir, getRateLimitStatus, getRateLimitStrategy, getRedactedLogKeys, getRedisClient, getRedisClientFor, getRedisClientKeys, getRedisConnectionOptions, getRedisKeyFormatter, getRegisteredSessionProvider, getRoomNameFormatter, getRuntimeApiMaps, getRuntimeSyncMaps, getServerDir, getServerFunctionDirs, getServerFunctionsDir, getServicesConfig, getSharedDir, getSocketMiddlewares, getSrcDir, getUploadsDir, hasCookie, hashSynchronizedValue, hashSynchronizedValueWith, inferHttpMethod, initConsolelog, initSharedSentry, isDbHealthCheckRegistered, isDeployConfigRegistered, isEmailSenderRegistered, isFalsy, isGetMethodName, isLocalizedNormalizerRegistered, isLoopbackIp, isMethodAllowed, isPrismaClientRegistered, isPrismaClientResolvable, isProduction, isRedactedLogKey, isRedisClientRegistered, isRuntimeMapsProviderRegistered, isServicesConfigRegistered, isSessionProviderRegistered, issueOneTimeToken, listEmailSenderNames, loadEnvFiles, loadPeer, normalizeErrorResponse, normalizeOrigin, notifySecretsResolved, oneTimeTokenKey, performLogout, prisma, processUpload, readBootUuid, readSession, rebuildDefaultRedisClient, recordMetricAcrossTrackers, redis, registerApiAbortController, registerAvatarConfig, registerBindAddress, registerCsrfConfig, registerDbHealthCheck, registerDeployConfig, registerEmailSender, registerEmailSenders, registerErrorFormatter, registerErrorTracker, registerErrorTrackers, registerHook, registerLocaleReloader, registerLocalizedNormalizer, registerPreCaptureFilter, registerPrismaClient, registerRateLimitStrategy, registerRedactedLogKeys, registerRedisClient, registerRedisKeyFormatter, registerRoomNameFormatter, registerRuntimeMapsProvider, registerSecretsResolvedListener, registerServicesConfig, registerSessionProvider, registerSocketMiddleware, registerStrayPrefixCommand, registerSyncAbortController, registerSyncHook, releaseLease, removeSession, renewLease, resetClientsForTests, resetCsrfConfigForTests, resetDbHealthCheckForTests, resetDefaultRedisClient, resetRedactedLogKeysForTests, resetRedisKeyFormatterForTests, resetSessionProviderForTests, resolveClientIp, resolveEnvKey, resolveErrorMessage, resolveFromRoot, resolveHealthHashConfig, resolveHealthHashConfigFromDescriptor, runWithErrorTrackerIdentity, runWithErrorTrackerIdentityScope, sanitizeErrorString, sanitizeErrorStrings, sanitizeForLog, serveAvatar, setCurrentErrorTrackerIdentity, setErrorTrackerUser, setIoInstance, setSentryUser, startSpan, startSpanAcrossTrackers, startSpanHandle, type syncMessage, tryCatch, tryCatchSync, unregisterApiAbortController, unregisterSyncAbortController, validateInputByType, validateRequest, writeBootUuid, writeSession };

package/dist/index.js

@@ -624,11 +624,10 @@ var readPositiveIntEnv = (name, fallback) => {
   const parsed = Number.parseInt(raw, 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 };
-var buildDefaultRedisClient = () => {
-  if (cachedDefault) return cachedDefault;
+var constructRedisClient = () => {
   const maxReconnectAttempts = readPositiveIntEnv("LUCKYSTACK_REDIS_MAX_RECONNECTS", DEFAULT_MAX_REDIS_RECONNECT_ATTEMPTS);
   const maxBackoffMs = readPositiveIntEnv("LUCKYSTACK_REDIS_MAX_BACKOFF_MS", DEFAULT_MAX_REDIS_BACKOFF_MS);
-  cachedDefault = new Redis({
+  const client = new Redis({
     host: env.REDIS_HOST,
     port: Number.parseInt(env.REDIS_PORT, 10),
     ...process.env.REDIS_USER && { username: process.env.REDIS_USER },
@@ -643,21 +642,26 @@ var buildDefaultRedisClient = () => {
       return Math.min(times * 50, maxBackoffMs);
     }
   });
-  cachedDefault.on("ready", async () => {
+  client.on("ready", async () => {
     getLogger().info("Connected to Redis");
   });
-  cachedDefault.on("error", (err) => {
+  client.on("error", (err) => {
     const message = String(err?.message ?? err);
     const password = process.env.REDIS_PASSWORD ?? "";
     if (/WRONGPASS|NOAUTH|invalid username-password/i.test(message) && /_V\d+$/i.test(password)) {
       getLogger().error(
-        `Redis auth failed and REDIS_PASSWORD ("${password}") looks like an UNRESOLVED secret-manager pointer. The default Redis client was likely built before secret-manager init ran. The framework now drops a stale client automatically when \`config.secretManager.url\` is set (server boot) and when \`initSecretManager\` is wired with \`onApplied: notifySecretsResolved\`; if you resolve secrets by other means, call \`resetDefaultRedisClient()\` (or \`registerRedisClient(new Redis(getRedisConnectionOptions()))\`) after resolution. Also confirm \`REDIS_PASSWORD\` is listed in the secret-manager \`envNames\` allowlist (unset resolves nothing). See docs/luckystack/ARCHITECTURE_SECRET_MANAGER.md.`,
+        `Redis auth failed and REDIS_PASSWORD ("${password}") looks like an UNRESOLVED secret-manager pointer. The default Redis client was likely built before secret-manager init ran. The framework now EAGERLY REBUILDS + registers a fresh client automatically when \`config.secretManager.url\` is set (server boot) and when \`initSecretManager\` is wired with \`onApplied: notifySecretsResolved\`; if you resolve secrets by other means, call \`rebuildDefaultRedisClient()\` (or \`registerRedisClient(new Redis(getRedisConnectionOptions()))\`) after resolution. Also confirm \`REDIS_PASSWORD\` is listed in the secret-manager \`envNames\` allowlist (unset resolves nothing). See docs/luckystack/ARCHITECTURE_SECRET_MANAGER.md.`,
         err
       );
       return;
     }
     getLogger().error("Error connecting to Redis", err);
   });
+  return client;
+};
+var buildDefaultRedisClient = () => {
+  if (cachedDefault) return cachedDefault;
+  cachedDefault = constructRedisClient();
   return cachedDefault;
 };
 var resetDefaultRedisClient = () => {
@@ -669,10 +673,23 @@ var resetDefaultRedisClient = () => {
   } catch {
   }
 };
+var rebuildDefaultRedisClient = () => {
+  const previousRegistered = isRedisClientRegistered() ? getRedisClient() : null;
+  resetDefaultRedisClient();
+  const client = constructRedisClient();
+  registerRedisClient(client);
+  if (previousRegistered && previousRegistered !== client) {
+    try {
+      previousRegistered.disconnect();
+    } catch {
+    }
+  }
+  return client;
+};
 setDefaultRedisResolver(buildDefaultRedisClient);
 registerSecretsResolvedListener((changedKeys) => {
   if (changedKeys === void 0 || changedKeys.some((key) => /^REDIS_/i.test(key))) {
-    resetDefaultRedisClient();
+    rebuildDefaultRedisClient();
   }
 });
 var getRedisConnectionOptions = () => ({
@@ -2295,6 +2312,7 @@ export {
   processUpload,
   readBootUuid,
   readSession,
+  rebuildDefaultRedisClient,
   recordMetricAcrossTrackers,
   redis,
   registerApiAbortController,