@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/server/kernel/realtime-transport.d.ts

@@ -1,8 +1,13 @@
-import type { RealtimeTransport, RealtimePresence } from '@openora/core/contracts';
+import type { RealtimePresence, RealtimeTransport } from '@openora/core/contracts';
+/** First-party process-local fan-out used by the default SSE transport. */
 export declare class InProcessRealtimeTransport implements RealtimeTransport {
     private readonly channels;
+    private readonly inProcessPresence;
     readonly presence: RealtimePresence;
     publish<T>(channel: string, event: T): void;
-    subscribe<T>(channel: string, handler: (event: T) => void): () => void;
+    remove<T>(channel: string, event: T): void;
+    subscribe<T>(channel: string, handler: (event: T) => void, clientId?: string): () => void;
+    revokeClientFromChannel(clientId: string, channel: string): void;
+    getOnlineUserIds(channel: string): Promise<string[]>;
 }
 //# sourceMappingURL=realtime-transport.d.ts.map

package/dist/server/kernel/realtime-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-transport.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA0BnF,qBAAa,0BAA2B,YAAW,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAA2B;IAE9D,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAa3C,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI;CAWvE"}
+{"version":3,"file":"realtime-transport.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AA6CnF,2EAA2E;AAC3E,qBAAa,0BAA2B,YAAW,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAA0B;IAE7D,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAe3C,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAI1C,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IAiBzF,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAehE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAGrD"}

package/dist/server/kernel/realtime-transport.js

@@ -1,52 +1,93 @@
 class InProcessPresence {
     members = new Map();
-    join(channel, memberId) {
-        const set = this.members.get(channel) ?? new Set();
-        set.add(memberId);
-        this.members.set(channel, set);
-    }
-    leave(channel, memberId) {
-        const set = this.members.get(channel);
-        if (!set)
+    join(channel, memberId, connectionId) {
+        const channelMembers = this.members.get(channel) ?? new Map();
+        const connections = channelMembers.get(memberId) ?? new Set();
+        connections.add(connectionId);
+        channelMembers.set(memberId, connections);
+        this.members.set(channel, channelMembers);
+    }
+    leave(channel, memberId, connectionId) {
+        const channelMembers = this.members.get(channel);
+        const connections = channelMembers?.get(memberId);
+        if (!channelMembers || !connections) {
             return;
-        set.delete(memberId);
-        if (set.size === 0)
+        }
+        connections.delete(connectionId);
+        if (connections.size === 0) {
+            channelMembers.delete(memberId);
+        }
+        if (channelMembers.size === 0) {
             this.members.delete(channel);
+        }
     }
     count(channel) {
         return this.members.get(channel)?.size ?? 0;
     }
+    /** Returns authenticated member IDs (excludes anonymous:* entries). */
+    getUserIds(channel) {
+        const channelMembers = this.members.get(channel);
+        if (!channelMembers) {
+            return [];
+        }
+        return Array.from(channelMembers.keys()).filter((id) => !id.startsWith('anonymous:'));
+    }
 }
-// Reference adoption: chat message fan-out + big-win feed. See ADR-0007.
+/** First-party process-local fan-out used by the default SSE transport. */
 export class InProcessRealtimeTransport {
     channels = new Map();
-    presence = new InProcessPresence();
+    inProcessPresence = new InProcessPresence();
+    presence = this.inProcessPresence;
     publish(channel, event) {
         const subscribers = this.channels.get(channel);
-        if (!subscribers)
+        if (!subscribers) {
             return;
+        }
         // Snapshot so a handler that unsubscribes mid-iteration can't corrupt the loop.
-        for (const handler of Array.from(subscribers)) {
+        for (const { handler } of Array.from(subscribers)) {
             try {
                 handler(event);
             }
             catch {
-                // failing subscriber must not break fan-out to others
+                // One disconnected subscriber must not stop fan-out to others.
             }
         }
     }
-    subscribe(channel, handler) {
-        const set = this.channels.get(channel) ?? new Set();
-        set.add(handler);
-        this.channels.set(channel, set);
+    remove(channel, event) {
+        this.publish(channel, event);
+    }
+    subscribe(channel, handler, clientId) {
+        const subscribers = this.channels.get(channel) ?? new Set();
+        const subscription = { handler: handler, clientId };
+        subscribers.add(subscription);
+        this.channels.set(channel, subscribers);
         return () => {
             const current = this.channels.get(channel);
-            if (!current)
+            if (!current) {
                 return;
-            current.delete(handler);
-            if (current.size === 0)
+            }
+            current.delete(subscription);
+            if (current.size === 0) {
                 this.channels.delete(channel);
+            }
         };
     }
+    revokeClientFromChannel(clientId, channel) {
+        const subscribers = this.channels.get(channel);
+        if (!subscribers) {
+            return;
+        }
+        for (const subscription of Array.from(subscribers)) {
+            if (subscription.clientId === clientId) {
+                subscribers.delete(subscription);
+            }
+        }
+        if (subscribers.size === 0) {
+            this.channels.delete(channel);
+        }
+    }
+    getOnlineUserIds(channel) {
+        return Promise.resolve(this.inProcessPresence.getUserIds(channel));
+    }
 }
 //# sourceMappingURL=realtime-transport.js.map

package/dist/server/kernel/realtime-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-transport.js","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAIA,MAAM,iBAAiB;IACJ,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE1D,IAAI,CAAC,OAAe,EAAE,QAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,QAAgB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,OAAO,0BAA0B;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,QAAQ,GAAqB,IAAI,iBAAiB,EAAE,CAAC;IAE9D,OAAO,CAAI,OAAe,EAAE,KAAQ;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,gFAAgF;QAChF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,CAAI,OAAe,EAAE,OAA2B;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAW,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,OAAkB,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,CAAC,MAAM,CAAC,OAAkB,CAAC,CAAC;YACnC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"realtime-transport.js","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAKA,MAAM,iBAAiB;IACJ,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEvE,IAAI,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB;QAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAuB,CAAC;QACnF,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACtE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9B,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,uEAAuE;IACvE,UAAU,CAAC,OAAe;QACxB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACxF,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,0BAA0B;IACpB,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAChD,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACpD,QAAQ,GAAqB,IAAI,CAAC,iBAAiB,CAAC;IAE7D,OAAO,CAAI,OAAe,EAAE,KAAQ;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,gFAAgF;QAChF,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAI,OAAe,EAAE,KAAQ;QACjC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,SAAS,CAAI,OAAe,EAAE,OAA2B,EAAE,QAAiB;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAgB,CAAC;QAC1E,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,OAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/D,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACxC,OAAO,GAAG,EAAE;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,uBAAuB,CAAC,QAAgB,EAAE,OAAe;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,IAAI,YAAY,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACvC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,OAAe;QAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/server/kernel/redis-cache.d.ts

@@ -7,6 +7,9 @@ export declare class RedisCache implements CacheAdapter {
     set<T>(key: string, value: T, opts: {
         ttlMs: number;
     }): Promise<void>;
+    setIfAbsent<T>(key: string, value: T, opts: {
+        ttlMs: number;
+    }): Promise<boolean>;
     delete(key: string | string[]): Promise<void>;
 }
 //# sourceMappingURL=redis-cache.d.ts.map

package/dist/server/kernel/redis-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-cache.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,qBAAa,UAAW,YAAW,YAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAO3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD"}
+{"version":3,"file":"redis-cache.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,qBAAa,UAAW,YAAW,YAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAW3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAWhF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpD"}

package/dist/server/kernel/redis-cache.js

@@ -10,26 +10,41 @@ export class RedisCache {
         this.client = client;
     }
     async get(key) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return undefined;
+        }
         const raw = await this.client.get(PREFIX + key);
-        if (raw === null)
+        if (raw === null) {
             return undefined;
+        }
         return JSON.parse(raw);
     }
     async set(key, value, opts) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return;
+        }
         await this.client.set(PREFIX + key, JSON.stringify(value), {
             expiration: { type: 'PX', value: opts.ttlMs },
         });
     }
+    async setIfAbsent(key, value, opts) {
+        if (!this.client.isReady) {
+            throw new Error('Redis is not ready');
+        }
+        const result = await this.client.set(PREFIX + key, JSON.stringify(value), {
+            expiration: { type: 'PX', value: opts.ttlMs },
+            NX: true,
+        });
+        return result === 'OK';
+    }
     async delete(key) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return;
+        }
         const keys = (Array.isArray(key) ? key : [key]).map((k) => PREFIX + k);
-        if (keys.length === 0)
+        if (keys.length === 0) {
             return;
+        }
         await this.client.del(keys);
     }
 }

package/dist/server/kernel/redis-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-cache.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAuB;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACzD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAsB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"redis-cache.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAuB;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACzD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAuB;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACxE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC7C,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QACH,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAsB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/dist/server/kernel/redis-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-client.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AAQ1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAS1D"}
+{"version":3,"file":"redis-client.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AAU1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAY1D"}

package/dist/server/kernel/redis-client.js

@@ -1,5 +1,6 @@
 import { createClient } from 'redis';
 import { createLogger } from './logger.js';
+const REDIS_CONNECT_TIMEOUT_MS = 5000;
 // One shared client for both the RedisCache and RedisRateLimiter adapters, bound
 // by createApp when REDIS_URL is set. node-redis throws at the process level if no
 // 'error' listener is attached, so we attach one and log instead of crashing;
@@ -10,7 +11,10 @@ export function createRedisClient(url) {
     const logger = createLogger('redis');
     const client = createClient({
         url,
-        socket: { reconnectStrategy: (retries) => Math.min(retries * 100, 2000) },
+        socket: {
+            connectTimeout: REDIS_CONNECT_TIMEOUT_MS,
+            reconnectStrategy: (retries) => Math.min(retries * 100, 2000),
+        },
     });
     client.on('error', (err) => logger.error({ err }, 'redis client error'));
     client.connect().catch((err) => logger.error({ err }, 'redis connect failed'));

package/dist/server/kernel/redis-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-client.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG;QACH,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE;KAC1E,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"redis-client.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG;QACH,MAAM,EAAE;YACN,cAAc,EAAE,wBAAwB;YACxC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;SAC9D;KACF,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/kernel/redis-rate-limiter.d.ts

@@ -1,10 +1,22 @@
 import type { RateLimiterAdapter, RateLimitOptions, RateLimitResult } from '@openora/core/contracts';
 import type { RedisClient } from './redis-client.js';
+/**
+ * Redis-backed `RATE_LIMITER`, auto-bound by `createApp` when `REDIS_URL` is
+ * set - a fixed-window counter, incremented and expiry-set in one atomic Lua
+ * round-trip so concurrent replicas can't both read a stale count and slip
+ * past the limit. On a backend error/unreachable client it fails OPEN
+ * (allows the request) by default; callers that pass `onUnavailable: 'deny'`
+ * (credential-guessing surfaces, where an unthrottled window is worse than a
+ * false-positive 429) fail CLOSED instead. Never logs the raw key - it can
+ * embed a token or email (`pwreset:<token>`, `login:<email>`) - only the
+ * prefix before the first `:` is recorded.
+ */
 export declare class RedisRateLimiter implements RateLimiterAdapter {
     private readonly client;
     private readonly logger;
     constructor(client: RedisClient);
     consume(key: string, opts: RateLimitOptions): Promise<RateLimitResult>;
+    reset(key: string): Promise<void>;
     private unavailable;
 }
 //# sourceMappingURL=redis-rate-limiter.d.ts.map

package/dist/server/kernel/redis-rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAqBrD,qBAAa,gBAAiB,YAAW,kBAAkB;IAG7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAEhC,MAAM,EAAE,WAAW;IAE1C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsB5E,OAAO,CAAC,WAAW;CAUpB"}
+{"version":3,"file":"redis-rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAqBrD;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IAG7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAEhC,MAAM,EAAE,WAAW;IAE1C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmBtE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvC,OAAO,CAAC,WAAW;CAUpB"}

package/dist/server/kernel/redis-rate-limiter.js

@@ -15,6 +15,17 @@ if count == 1 then
 end
 return { count, redis.call('PTTL', KEYS[1]) }
 `;
+/**
+ * Redis-backed `RATE_LIMITER`, auto-bound by `createApp` when `REDIS_URL` is
+ * set - a fixed-window counter, incremented and expiry-set in one atomic Lua
+ * round-trip so concurrent replicas can't both read a stale count and slip
+ * past the limit. On a backend error/unreachable client it fails OPEN
+ * (allows the request) by default; callers that pass `onUnavailable: 'deny'`
+ * (credential-guessing surfaces, where an unthrottled window is worse than a
+ * false-positive 429) fail CLOSED instead. Never logs the raw key - it can
+ * embed a token or email (`pwreset:<token>`, `login:<email>`) - only the
+ * prefix before the first `:` is recorded.
+ */
 export class RedisRateLimiter {
     client;
     logger = createLogger('redis-rate-limiter');
@@ -22,8 +33,9 @@ export class RedisRateLimiter {
         this.client = client;
     }
     async consume(key, opts) {
-        if (!this.client.isReady)
+        if (!this.client.isReady) {
             return this.unavailable(opts, { keyPrefix: key.split(':')[0] });
+        }
         try {
             const reply = await this.client.eval(CONSUME_SCRIPT, {
                 keys: [PREFIX + key],
@@ -39,6 +51,17 @@ export class RedisRateLimiter {
             return this.unavailable(opts, { keyPrefix: key.split(':')[0], err });
         }
     }
+    async reset(key) {
+        if (!this.client.isReady) {
+            return;
+        }
+        try {
+            await this.client.del(PREFIX + key);
+        }
+        catch (err) {
+            this.logger.warn({ keyPrefix: key.split(':')[0], err }, 'rate limiter reset failed');
+        }
+    }
     // Backend unreachable: fail-open by default to keep availability (throttling pauses
     // during an outage); fail-closed for keys that opt into 'deny' where an unthrottled
     // window is worse than a 429 (credential guessing).

package/dist/server/kernel/redis-rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-rate-limiter.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,yEAAyE;AACzE,qFAAqF;AACrF,MAAM,cAAc,GAAG;;;;;;CAMtB,CAAC;AAEF,MAAM,OAAO,gBAAgB;IAGE;IAFZ,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAE7D,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBACnD,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC;gBACpB,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,oDAAoD;IACpD,oFAAoF;IACpF,0DAA0D;IAClD,WAAW,CAAC,IAAsB,EAAE,GAA4B;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO,EAAE,EACxD,kCAAkC,CACnC,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"redis-rate-limiter.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,yEAAyE;AACzE,qFAAqF;AACrF,MAAM,cAAc,GAAG;;;;;;CAMtB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IAGE;IAFZ,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAE7D,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBACnD,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC;gBACpB,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,oDAAoD;IACpD,oFAAoF;IACpF,0DAA0D;IAClD,WAAW,CAAC,IAAsB,EAAE,GAA4B;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO,EAAE,EACxD,kCAAkC,CACnC,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/server/kernel/redis-streams-broker.d.ts

@@ -0,0 +1,65 @@
+import type { MessageBrokerAdapter, EventEnvelope, BrokerHandler, SubscribeOptions } from '@openora/core/contracts';
+import type { RedisClient } from './redis-client.js';
+type RedisStreamsBrokerOptions = {
+    serviceName: string;
+    startId?: '$' | '0';
+};
+/**
+ * Durable `MESSAGE_BROKER` reference driver on Redis Streams, auto-bound by
+ * `createApp` when `REDIS_URL` is set (ADR-0030 - production is distributed-only,
+ * core ships no in-process default).
+ *
+ * Every `subscribe(topic, handler)` call for the same (topic, group) - default
+ * group is the deployment's `serviceName` - coalesces into ONE Redis consumer-group
+ * loop that fans out to every registered local handler, then XACKs once: an event
+ * is delivered to exactly one replica of the service (competing consumers across
+ * replicas via the shared group), and that replica runs every local handler for
+ * the topic (matches in-process fan-out semantics, but once per cluster, not once
+ * per replica). A distinct `SERVICE_NAME` per split service gives each service its
+ * own copy of every event; `createApp` requires one as soon as `SERVICE_MANIFEST`
+ * is set, since the group name is a durable identity and can't be derived from a
+ * module list that reorders and grows.
+ *
+ * Blocking `XREADGROUP` runs on a `client.duplicate()`d connection per loop, never
+ * on the shared client - `publish` (`XADD`, non-blocking) uses the shared client,
+ * so a blocked read never stalls the cache/rate-limiter commands sharing it.
+ * `publish` awaits the XADD and lets errors propagate (the `OutboxRelay` marks a
+ * row published only after this resolves - it must be reliable, not a silent
+ * no-op). Handler errors are guarded + logged, then the entry is XACKed regardless
+ * (matches `EventBus.on` - no per-handler retry; must-not-lose events use the
+ * outbox). A crash before XACK leaves the entry pending; `XAUTOCLAIM` periodically
+ * reclaims idle-pending entries so at-least-once delivery survives a replica crash.
+ *
+ * At-least-once holds from group creation onward, NOT before it. A group is created
+ * at `startId` (default `$`) on first subscribe and persists in Redis from then on,
+ * so restarts and outages are covered: the group keeps its cursor, undelivered
+ * entries wait in the stream, and pending ones are reclaimed. The one uncovered
+ * window is a group's FIRST-EVER creation - a service extracted after events were
+ * already flowing starts from `$` and never sees the backlog. `startId: '0'` closes
+ * that window by replaying everything still retained (up to STREAM_MAXLEN), at the
+ * cost of re-running every handler for those events: safe on a fresh deploy (empty
+ * streams), a duplicate-side-effect hazard for a late-added service, since core has
+ * no dedup layer - `EventBus.on` invokes handlers directly, and `eventId` is a key
+ * consumers must dedup on themselves.
+ *
+ * `orderingKey` is NOT honoured - Redis Streams have no partitioning, so per-key
+ * ordering across concurrent consumers isn't guaranteed (same footnote as
+ * `BullMqJobQueue`'s `orderingKey`).
+ */
+export declare class RedisStreamsBroker implements MessageBrokerAdapter {
+    private readonly client;
+    private readonly logger;
+    private readonly serviceName;
+    private readonly startId;
+    private readonly consumerId;
+    private readonly loops;
+    constructor(client: RedisClient, opts: RedisStreamsBrokerOptions);
+    publish(envelope: EventEnvelope): Promise<void>;
+    subscribe(topic: string, handler: BrokerHandler, options?: SubscribeOptions): () => void;
+    close(): Promise<void>;
+    private startLoop;
+    private reclaimPending;
+    private dispatch;
+}
+export {};
+//# sourceMappingURL=redis-streams-broker.d.ts.map

package/dist/server/kernel/redis-streams-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-streams-broker.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-streams-broker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA4BrD,KAAK,yBAAyB,GAAG;IAC/B,WAAW,EAAE,MAAM,CAAC;IAOpB,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;CACrB,CAAC;AAgBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,kBAAmB,YAAW,oBAAoB;IAQ3D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;gBAGtC,MAAM,EAAE,WAAW,EACpC,IAAI,EAAE,yBAAyB;IAM3B,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASrD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,IAAI;IAwBlF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,OAAO,CAAC,SAAS;YA0EH,cAAc;YAyBd,QAAQ;CA6BvB"}

package/dist/server/kernel/redis-streams-broker.js

@@ -0,0 +1,208 @@
+import { randomUUID } from 'node:crypto';
+import { createLogger } from './logger.js';
+const STREAM_PREFIX = 'oss:evt:';
+const STREAM_MAXLEN = 10_000;
+const READ_COUNT = 10;
+const BLOCK_MS = 5_000;
+const CLAIM_INTERVAL_MS = 30_000;
+const CLAIM_MIN_IDLE_MS = 60_000;
+const RETRY_DELAY_MS = 2_000;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function streamKey(topic) {
+    return STREAM_PREFIX + topic;
+}
+function isBusyGroupError(err) {
+    return err instanceof Error && err.message.includes('BUSYGROUP');
+}
+/**
+ * Durable `MESSAGE_BROKER` reference driver on Redis Streams, auto-bound by
+ * `createApp` when `REDIS_URL` is set (ADR-0030 - production is distributed-only,
+ * core ships no in-process default).
+ *
+ * Every `subscribe(topic, handler)` call for the same (topic, group) - default
+ * group is the deployment's `serviceName` - coalesces into ONE Redis consumer-group
+ * loop that fans out to every registered local handler, then XACKs once: an event
+ * is delivered to exactly one replica of the service (competing consumers across
+ * replicas via the shared group), and that replica runs every local handler for
+ * the topic (matches in-process fan-out semantics, but once per cluster, not once
+ * per replica). A distinct `SERVICE_NAME` per split service gives each service its
+ * own copy of every event; `createApp` requires one as soon as `SERVICE_MANIFEST`
+ * is set, since the group name is a durable identity and can't be derived from a
+ * module list that reorders and grows.
+ *
+ * Blocking `XREADGROUP` runs on a `client.duplicate()`d connection per loop, never
+ * on the shared client - `publish` (`XADD`, non-blocking) uses the shared client,
+ * so a blocked read never stalls the cache/rate-limiter commands sharing it.
+ * `publish` awaits the XADD and lets errors propagate (the `OutboxRelay` marks a
+ * row published only after this resolves - it must be reliable, not a silent
+ * no-op). Handler errors are guarded + logged, then the entry is XACKed regardless
+ * (matches `EventBus.on` - no per-handler retry; must-not-lose events use the
+ * outbox). A crash before XACK leaves the entry pending; `XAUTOCLAIM` periodically
+ * reclaims idle-pending entries so at-least-once delivery survives a replica crash.
+ *
+ * At-least-once holds from group creation onward, NOT before it. A group is created
+ * at `startId` (default `$`) on first subscribe and persists in Redis from then on,
+ * so restarts and outages are covered: the group keeps its cursor, undelivered
+ * entries wait in the stream, and pending ones are reclaimed. The one uncovered
+ * window is a group's FIRST-EVER creation - a service extracted after events were
+ * already flowing starts from `$` and never sees the backlog. `startId: '0'` closes
+ * that window by replaying everything still retained (up to STREAM_MAXLEN), at the
+ * cost of re-running every handler for those events: safe on a fresh deploy (empty
+ * streams), a duplicate-side-effect hazard for a late-added service, since core has
+ * no dedup layer - `EventBus.on` invokes handlers directly, and `eventId` is a key
+ * consumers must dedup on themselves.
+ *
+ * `orderingKey` is NOT honoured - Redis Streams have no partitioning, so per-key
+ * ordering across concurrent consumers isn't guaranteed (same footnote as
+ * `BullMqJobQueue`'s `orderingKey`).
+ */
+export class RedisStreamsBroker {
+    client;
+    logger = createLogger('message-broker');
+    serviceName;
+    startId;
+    consumerId = randomUUID();
+    loops = new Map();
+    constructor(client, opts) {
+        this.client = client;
+        this.serviceName = opts.serviceName;
+        this.startId = opts.startId ?? '$';
+    }
+    async publish(envelope) {
+        await this.client.xAdd(streamKey(envelope.topic), '*', { data: JSON.stringify(envelope) }, { TRIM: { strategy: 'MAXLEN', strategyModifier: '~', threshold: STREAM_MAXLEN } });
+    }
+    subscribe(topic, handler, options) {
+        const group = options?.consumerGroup ?? this.serviceName;
+        const key = streamKey(topic);
+        const loopKey = `${key}::${group}`;
+        let loop = this.loops.get(loopKey);
+        if (!loop) {
+            loop = this.startLoop(key, group);
+            this.loops.set(loopKey, loop);
+        }
+        loop.handlers.add(handler);
+        return () => {
+            const current = this.loops.get(loopKey);
+            if (!current || !current.handlers.delete(handler)) {
+                return;
+            }
+            if (current.handlers.size === 0) {
+                this.loops.delete(loopKey);
+                current.stop();
+            }
+        };
+    }
+    async close() {
+        const loops = [...this.loops.values()];
+        this.loops.clear();
+        for (const loop of loops) {
+            loop.stop();
+        }
+        await Promise.allSettled(loops.map((loop) => loop.done));
+    }
+    startLoop(key, group) {
+        const handlers = new Set();
+        const reader = this.client.duplicate();
+        reader.on('error', (err) => this.logger.error({ err, key, group }, 'stream reader connection error'));
+        let stopped = false;
+        let lastClaimAt = 0;
+        const stop = () => {
+            stopped = true;
+            // Rejects the in-flight blocking XREADGROUP (if any) immediately, instead of
+            // waiting up to BLOCK_MS for it to time out on its own.
+            reader.destroy();
+        };
+        // `ready` gates connecting + group creation, and stays false until BOTH have
+        // succeeded - so a Redis outage at loop start retries the whole handshake with
+        // backoff rather than permanently abandoning this (topic, group)'s consumption.
+        // It is NOT reset on a later error: node-redis owns reconnection from there on
+        // (socket.reconnectStrategy re-establishes the connection and re-queues the
+        // blocked XREADGROUP), and the group already exists, so there is nothing to redo.
+        // Both steps are idempotent regardless - `connect()` throws 'Socket already
+        // opened' once the socket is open, hence the isOpen guard, and a re-created group
+        // comes back BUSYGROUP, which is tolerated below.
+        const done = (async () => {
+            let ready = false;
+            while (!stopped) {
+                try {
+                    if (!ready) {
+                        if (!reader.isOpen) {
+                            await reader.connect();
+                        }
+                        try {
+                            await reader.xGroupCreate(key, group, this.startId, { MKSTREAM: true });
+                        }
+                        catch (err) {
+                            if (!isBusyGroupError(err)) {
+                                throw err;
+                            }
+                        }
+                        ready = true;
+                    }
+                    if (Date.now() - lastClaimAt > CLAIM_INTERVAL_MS) {
+                        lastClaimAt = Date.now();
+                        await this.reclaimPending(reader, key, group, handlers);
+                    }
+                    const reply = (await reader.xReadGroup(group, this.consumerId, { key, id: '>' }, { COUNT: READ_COUNT, BLOCK: BLOCK_MS }));
+                    if (!reply) {
+                        continue;
+                    }
+                    for (const stream of reply) {
+                        for (const message of stream.messages) {
+                            await this.dispatch(reader, key, group, message, handlers);
+                        }
+                    }
+                }
+                catch (err) {
+                    if (stopped) {
+                        break;
+                    }
+                    this.logger.error({ err, key, group }, 'stream loop error, retrying');
+                    await delay(RETRY_DELAY_MS);
+                }
+            }
+        })();
+        return { handlers, stop, done };
+    }
+    async reclaimPending(reader, key, group, handlers) {
+        try {
+            const claimed = (await reader.xAutoClaim(key, group, this.consumerId, CLAIM_MIN_IDLE_MS, '0-0', { COUNT: READ_COUNT }));
+            for (const message of claimed.messages) {
+                if (message) {
+                    await this.dispatch(reader, key, group, message, handlers);
+                }
+            }
+        }
+        catch (err) {
+            this.logger.error({ err, key, group }, 'stream reclaim failed');
+        }
+    }
+    async dispatch(reader, key, group, message, handlers) {
+        const raw = message.message['data'];
+        if (raw === undefined) {
+            await reader.xAck(key, group, message.id);
+            return;
+        }
+        let envelope;
+        try {
+            envelope = JSON.parse(raw);
+        }
+        catch (err) {
+            this.logger.error({ err, key, group, id: message.id }, 'stream envelope parse failed');
+            await reader.xAck(key, group, message.id);
+            return;
+        }
+        for (const fn of handlers) {
+            try {
+                await fn(envelope);
+            }
+            catch (err) {
+                this.logger.error({ err, topic: envelope.topic }, 'message broker handler threw');
+            }
+        }
+        await reader.xAck(key, group, message.id);
+    }
+}
+//# sourceMappingURL=redis-streams-broker.js.map