Bust every cached page — consumer or admin — that a write touching
customerIds could have affected.
The collection tag is always cleared alongside, because an unscoped admin page carries only that tag and no customer id can reach it.
keys deletes exact entries in addition to the tag surgery, passing the
key arguments — this cache hashes and prefixes them. It exists because
invalidateTag resolves keys through the FT index, which does not exist in
memory mode (valkeyClient: null); there the tag bust is a total no-op, and
an exact-key delete is the only thing that keeps read-after-write honest.
Services that folded get onto search pass that get's arguments.
These deletes only reach this instance's own key space, because the key space is partitioned per surface. That is sufficient, and a writer must not try to name the other surface's key:
get entry is itself tagged (by customer
id, or by the collection tag when unscoped), so the tag bust above already
evicts it from the shared L2 and publishes the peer eviction.ProtectedsearchTags to write on a page, derived from the scope the query searched — never from the customers present in the result.
That distinction is load-bearing. An entry tagged with the customer ids in
the page carries no tags when the page is empty, so nothing can ever bust
it and a later create leaves it stale for the full L2 TTL. Tagging by
scope means an empty page still carries the tag for what it searched.
An unscoped read falls back to the collection tag, since no customer-id tag can reach a row whose owner did not exist when the entry was written.
StaticdeserializeThe inverse of serializePaymentInstrument: rehydrates the Date
fields. The spread preserves the type discriminant, so the ten-member
union survives the round trip.
StaticserializeA search row → its JSON-safe form. Safe to call without a cache instance.
Root of the payment-instrument class hierarchy: it owns the one read cache both surfaces share, the single seam that busts it, and the serialization that defines the cached shape.
payment_instrumenthas twelve writer classes — ten per-rail instrument services,PaymentInstrumentAdminService, and the out-of-packageVictorCounterpartyBackfillService. Rather than hand each writer a separate buster collaborator, every writer extends this class and callsinvalidateCache. A writer that forgets is a visible omission in one place, not a silently-stale cache. See SearchCache for why the cache lives at the root rather than beside each service.The ten rail services are writers only: they extend this class for the bust seam, not for a read surface. Anything needing to read instruments holds a
PaymentInstrumentQueryService(or the admin query service) — a rail service must never become the read path for a different rail's rows.Both surfaces project exactly the same row shape, so one value type and one (de)serialize pair serve the whole namespace. Their filters still differ (the consumer search excludes deprecated REDEMPTION-kind rows and restricts to
SUPPORTED_TYPES; the admin search does neither), so an identical filter set from each service would select different rows — which is why each surface gets its own key space, while both keep the shared customer-id tag vocabulary.