redis, postgres: full nox provider modules — client, tools, provisioner, events

redis provides redis-cache: a real admin client speaking RESP over a raw socket
(node:net, no deps); provisioner makes a keyspace-scoped ACL user per grant.
postgres provides postgres-database: admin client executing through psql (the
consistent shell-out port, like minio's mc), full DDL for create/drop database+
role, a CSV row parser, read-only query tool. Both emit
module.<x>.<thing>.provisioned/.deprovisioned from the provisioner. Both
typecheck; manifests parse.

modules/redis/provisioner/index.ts

@@ -0,0 +1,57 @@
+// redis's provisioner — the adapter that makes redis a provider of the mesh `redis-cache`
+// interface. The watching, sealing and grant-file handling are the sdk harness's; this writes only
+// the per-service half: how redis creates and removes a per-consumer cache (novox/hq ADR 0044/0045).
+//
+// The `redis-cache` interface: a consumer receives `{ host, port, username, password,
+// keyspacePrefix }` and stores its keys under `<keyspacePrefix>:*`, isolated from every other
+// consumer by an ACL user scoped to exactly that prefix.
+//
+// Identity (the ACL username and keyspace) is derived from `grant.consumer` alone — never from
+// `grant.values` — because on removal the harness hands the adapter a grant carrying only the
+// consumer. Deriving from the consumer keeps create and remove naming the same resource.
+
+import { runProvisioner, type Grant, type Credential } from "@novox/mesh-sdk/provisioner";
+import { emit } from "@novox/mesh-sdk/events";
+import { RedisClient, generatePassword } from "../client.js";
+
+const redis = RedisClient.fromEnv();
+
+/** A stable, ACL-safe identity for a consumer: only [A-Za-z0-9_.-], never empty. */
+function identity(consumer: string): string {
+  const safe = consumer.replace(/[^A-Za-z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
+  return safe || "consumer";
+}
+
+/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
+async function announce(type: string, body: Record<string, string>): Promise<void> {
+  try {
+    await emit(type, body);
+  } catch (err) {
+    console.error(`[provisioner:redis-cache] emit ${type} failed: ${err}`);
+  }
+}
+
+runProvisioner("redis-cache", {
+  async create(grant: Grant): Promise<Credential> {
+    const username = identity(grant.consumer);
+    const keyspacePrefix = username;
+    const password = generatePassword();
+    await redis.createAclUser(username, password, keyspacePrefix);
+    await announce("module.redis.cache.provisioned", { consumer: grant.consumer, username, keyspacePrefix });
+    return {
+      fields: {
+        host: redis.host,
+        port: String(redis.port),
+        username,
+        password,
+        keyspacePrefix,
+      },
+    };
+  },
+
+  async remove(grant: Grant): Promise<void> {
+    const username = identity(grant.consumer);
+    await redis.deleteAclUser(username);
+    await announce("module.redis.cache.deprovisioned", { consumer: grant.consumer, username });
+  },
+});