@o3co/auth-provider-store-redis 0.0.0-stage → 0.18.0-rc.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 1o1 Co. Ltd.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @o3co/auth-provider-store-redis
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Part of auth-provider 0.18.0-rc.1, built from `modules/store-redis` of https://github.com/o3co/auth.provider. Its modules, settings and documentation are there.
+
+Copyright 2026 1o1 Co. Ltd. Licensed under the Apache License, Version 2.0.

package/package.json

@@ -1,6 +1,25 @@
 {
   "name": "@o3co/auth-provider-store-redis",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.18.0-rc.1",
+  "type": "module",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/o3co/auth.provider",
+    "directory": "modules/store-redis"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    "./redis/module": {
+      "types": "./redis/src/module.d.ts",
+      "default": "./redis/src/module.js"
+    }
+  },
+  "dependencies": {
+    "@o3co/auth-provider-foundation": "0.18.0-rc.1",
+    "ioredis": "5.11.1",
+    "zod": "4.6.5"
+  }
 }

package/redis/README.md

@@ -0,0 +1,45 @@
+# redis
+
+## Responsibilities
+- Implements the `store` contract with Redis, with one script per shape of basic operation and none per feature.
+- Maps each partition to a hash tag, so a batch and a consistent read run in one slot.
+- Checks, once at boot, that the Redis configuration gives the declared spaces their guarantees.
+- Confirms an answer before giving it, for spaces that need replicated or confirmed reads.
+
+## Not here
+- Space names and meanings, and the shapes of values. Which feature uses it.
+
+## Offers
+- Composition definition only: the `store` contract's implementation.
+- The probe `redis` at `kernel`'s `probes`, which PINGs both connections.
+- Operator section:
+  - `url` (`redis` or `rediss`), `prefix` (lower-case letters, digits and `-`; default `store`).
+  - `connect-timeout-ms` (default 2000), `command-timeout-ms` (default 1000), `replication-timeout-ms` (default 1000).
+  - `replication`: `replicas` or `none`, required when a space needs replicated or confirmed reads.
+
+## Invariants
+- Boot is refused on Redis below 7.0, a server that is no primary, or a cluster, proxies splitting keys across nodes included.
+- Boot is refused on a no eviction space without `noeviction`, and on a durable space without `appendonly yes` and `appendfsync always`.
+- Boot is refused on a space needing replicated or confirmed reads without `replication`.
+- A refusal or a warning never tells the URL, which may hold a password; an error event is logged by its name alone.
+- `replicas`: at boot, `min-replicas-to-write` and `min-replicas-max-lag` are 1 or more; at runtime, no replica seen is unavailable.
+- `none`: the operator states there is no failover, so even confirmed writes are lost by one; a replica seen, at boot or at runtime, is refused or unavailable.
+- A confirmation writes the confirmation key on a connection of its own, then waits until every replica ROLE shows has it.
+- A timeout, too few replicas, or another server than the one that answered is unavailable, the answer then unknown.
+- A confirmation asked during a round rides on the next round.
+- Every script first deletes keys and set members whose expiry is at or before its time, as Redis still holds them then.
+- Versions are `server.epoch.n` and never repeat after a restart, a failover, or the end of the key counting them.
+- A command whose reply was lost is never sent again; a dropped connection fails at once, and nothing ends the process.
+- The store clock is Redis's time; values, counts and sets are kept in separate keys, values untouched.
+- Outside the guarantees, the operator's: keeping a detached or lagging replica from promotion, replicas' disk writes, `CONFIG SET` after boot.
+
+## Data
+- Keys under the prefix, one hash tag per space and partition, holding values, counts, sets, versions and marks.
+
+## Depends on
+- `kernel`, `store`
+
+## Vocabulary
+- slot: the range of keys one node holds; a partition fits in one.
+- confirmation key: one key per prefix, written in a confirmation round, apart from idempotency marks.
+- round: one write to the confirmation key and one WAIT.

package/redis/config.example

@@ -0,0 +1,4 @@
+redis {
+	url = "rediss://redis.example.invalid:6379"
+	replication = replicas
+}

package/redis/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/redis/src/module.js

@@ -0,0 +1,165 @@
+import { contract, defineModule, probes } from "@o3co/auth-provider-foundation/kernel";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { Redis } from "ioredis";
+import { z } from "zod";
+import { redisProbe } from "./probe.js";
+import { redisStore } from "./redis-store.js";
+const section = z.strictObject({
+    url: z.url({ protocol: /^rediss?$/ }).describe("The Redis server to connect to."),
+    prefix: z
+        .string()
+        .regex(/^[a-z0-9-]+$/)
+        .default("store")
+        .describe("What every key the store writes begins with."),
+    "connect-timeout-ms": z
+        .number()
+        .int()
+        .min(100)
+        .default(2000)
+        .describe("How long connecting to Redis may take, in milliseconds."),
+    "replication-timeout-ms": z
+        .number()
+        .int()
+        .min(1)
+        .max(60_000)
+        .default(1000)
+        .describe("How long a confirmation waits for every replica to have a write, in milliseconds."),
+    "command-timeout-ms": z
+        .number()
+        .int()
+        .min(10)
+        .max(60_000)
+        .default(1000)
+        .describe("How long one Redis command may take, in milliseconds."),
+    replication: z
+        .enum(["none", "replicas"])
+        .optional()
+        .describe('Required when a space asks for replication or confirmed reads. "replicas": every write must reach the replicas, and Redis itself must refuse writes without them. "none": the operator states there is no failover at all, accepting that a failover would lose writes.'),
+});
+const minimumVersion = [7, 0];
+async function configValue(client, name) {
+    const pair = (await client.config("GET", name));
+    return pair[1];
+}
+const roleOf = async (client) => (await client.call("ROLE"));
+const replicasOf = (role) => (Array.isArray(role[2]) ? role[2].length : 0);
+async function serverProblems(client, role) {
+    const problems = [];
+    if (role[0] !== "master")
+        problems.push("connect to a primary (role master)");
+    if (/cluster_enabled:1/.test(await client.info("cluster"))) {
+        problems.push("Redis cluster, and proxies that split keys across nodes, are not supported");
+    }
+    const version = /redis_version:(\d+)\.(\d+)/.exec(await client.info("server"));
+    const [major, minor] = [Number(version?.[1] ?? 0), Number(version?.[2] ?? 0)];
+    if (major < (minimumVersion[0] ?? 0) ||
+        (major === minimumVersion[0] && minor < (minimumVersion[1] ?? 0))) {
+        problems.push(`needs Redis ${minimumVersion.join(".")} or later`);
+    }
+    return problems;
+}
+async function evictionProblems(client, declared) {
+    const kept = declared.filter((s) => s.guarantees.includes("no-eviction"));
+    if (kept.length === 0 || (await configValue(client, "maxmemory-policy")) === "noeviction")
+        return [];
+    const names = kept.map((s) => s.name).join(", ");
+    return [`the no eviction guarantee needs maxmemory-policy noeviction: ${names}`];
+}
+async function replicationProblems(client, role, declared, replication) {
+    const replicated = declared.filter((s) => s.guarantees.includes("replicated") || s.guarantees.includes("confirmed-reads"));
+    if (replicated.length === 0)
+        return [];
+    if (replication === undefined) {
+        const names = replicated.map((s) => s.name).join(", ");
+        return [
+            `spaces need replicated or confirmed reads, so redis.replication (none or replicas) is required: ${names}`,
+        ];
+    }
+    if (replication === "replicas" &&
+        (Number(await configValue(client, "min-replicas-to-write")) < 1 ||
+            Number(await configValue(client, "min-replicas-max-lag")) < 1)) {
+        return [
+            "with replication replicas, set min-replicas-to-write and min-replicas-max-lag to 1 or more",
+        ];
+    }
+    if (replication === "none" && replicasOf(role) > 0) {
+        return ["replication is none but a replica is connected"];
+    }
+    return [];
+}
+async function durabilityProblems(client, declared) {
+    const durable = declared.filter((s) => s.guarantees.includes("durable"));
+    if (durable.length === 0)
+        return [];
+    const persisted = (await configValue(client, "appendonly")) === "yes" &&
+        (await configValue(client, "appendfsync")) === "always";
+    if (persisted)
+        return [];
+    const names = durable.map((s) => s.name).join(", ");
+    return [`the durable guarantee needs appendonly yes and appendfsync always: ${names}`];
+}
+/** What the server's settings fail to give the declared spaces; empty when everything holds. */
+async function unmet(client, declared, replication) {
+    const role = await roleOf(client);
+    return [
+        ...(await serverProblems(client, role)),
+        ...(await evictionProblems(client, declared)),
+        ...(await replicationProblems(client, role, declared, replication)),
+        ...(await durabilityProblems(client, declared)),
+    ];
+}
+/** The two connections, open and checked, for the store and its probe alike. */
+const connections = contract("redis.connections");
+export default defineModule({ name: "redis", section }, (m) => [
+    m.provide(connections).by(async (c) => {
+        const client = new Redis(c.section.url, {
+            lazyConnect: true,
+            connectTimeout: c.section["connect-timeout-ms"],
+            maxRetriesPerRequest: 0,
+            enableOfflineQueue: false,
+            // A command whose reply was lost must not be sent again on a new connection: a resent
+            // WAIT would confirm nothing, and a resent script would run twice.
+            autoResendUnfulfilledCommands: false,
+            commandTimeout: c.section["command-timeout-ms"],
+        });
+        client.on("error", () => c.log.warn("redis.error"));
+        const confirmer = client.duplicate({
+            commandTimeout: c.section["replication-timeout-ms"] + c.section["command-timeout-ms"],
+        });
+        confirmer.on("error", () => c.log.warn("redis.error"));
+        let problems;
+        const declared = await c.collect(spaces);
+        try {
+            await client.connect();
+            await confirmer.connect();
+            problems = await unmet(client, declared, c.section.replication);
+        }
+        catch {
+            client.disconnect();
+            confirmer.disconnect();
+            return c.refuse("redis.url", "cannot connect to Redis, or cannot check its configuration");
+        }
+        if (problems.length > 0) {
+            client.disconnect();
+            confirmer.disconnect();
+            return c.refuse("redis", problems.join("; "));
+        }
+        c.onStop(async () => {
+            await client.quit().catch(() => client.disconnect());
+            await confirmer.quit().catch(() => confirmer.disconnect());
+        });
+        return { client, confirmer, declared };
+    }),
+    m.provide(store).by(async (c) => {
+        const { client, confirmer, declared } = await c.get(connections);
+        return redisStore(client, confirmer, {
+            prefix: c.section.prefix,
+            replicationTimeoutMs: c.section["replication-timeout-ms"],
+            replication: c.section.replication,
+        }, declared);
+    }),
+    m.contribute(probes).by(async (c) => {
+        const { client, confirmer } = await c.get(connections);
+        return redisProbe([client, confirmer]);
+    }),
+]);

package/redis/src/probe.d.ts

@@ -0,0 +1,4 @@
+import type { Probe } from "@o3co/auth-provider-foundation/kernel";
+import type { Redis } from "ioredis";
+/** Passes when every connection answers PING; a dropped one fails at once, having no offline queue. */
+export declare function redisProbe(connections: readonly Redis[]): Probe;

package/redis/src/probe.js

@@ -0,0 +1,9 @@
+/** Passes when every connection answers PING; a dropped one fails at once, having no offline queue. */
+export function redisProbe(connections) {
+    return {
+        name: "redis",
+        check: async () => {
+            await Promise.all(connections.map((connection) => connection.ping()));
+        },
+    };
+}

package/redis/src/redis-store.d.ts

@@ -0,0 +1,13 @@
+import { type Space, type Store } from "@o3co/auth-provider-foundation/store";
+import type { Redis } from "ioredis";
+export interface RedisStoreOptions {
+    readonly prefix: string;
+    readonly replicationTimeoutMs: number;
+    /** What the operator declared: no failover at all, or replicas that must take every write. */
+    readonly replication: "none" | "replicas" | undefined;
+}
+/**
+ * `client` serves the operations; `confirmer` is a connection of its own for confirming
+ * replication, so a WAIT never holds up the other commands.
+ */
+export declare function redisStore(client: Redis, confirmer: Redis, options: RedisStoreOptions, declared: readonly Space[]): Store;

package/redis/src/redis-store.js

@@ -0,0 +1,240 @@
+import { createHash } from "node:crypto";
+import { Unavailable } from "@o3co/auth-provider-foundation/kernel";
+import { canonicalJson, checkedStore, codePointOrder, idempotencyRequest, } from "@o3co/auth-provider-foundation/store";
+import { sharedRounds } from "./rounds.js";
+import * as scripts from "./scripts.js";
+const enc = encodeURIComponent;
+/** cjson turns empty or sparse Lua arrays into objects; rebuild them by count. */
+function list(value, n) {
+    return Array.from({ length: n }, (_, i) => value[i]);
+}
+/** Script answers carry numbers as strings; turn the known ones back into numbers (the fields scripts.ts answers). */
+function numbers(answer) {
+    const out = { ...answer };
+    for (const field of ["now", "remainingMs", "resetAt", "count"]) {
+        if (typeof out[field] === "string")
+            out[field] = Number(out[field]);
+    }
+    return out;
+}
+const digest = (request) => createHash("sha256").update(request).digest("hex");
+/** Where a script answer records the server it ran on, out of sight of the callers. */
+const servedBy = Symbol("served by");
+const writtenKinds = new Set(["written", "removed", "taken", "committed", "counted"]);
+/**
+ * `client` serves the operations; `confirmer` is a connection of its own for confirming
+ * replication, so a WAIT never holds up the other commands.
+ */
+export function redisStore(client, confirmer, options, declared) {
+    const { prefix, replicationTimeoutMs } = options;
+    const slot = (key) => `${prefix}:{${enc(key.space.name)}:${enc(key.partition)}}`;
+    const valueKey = (key) => `${slot(key)}:v:${enc(key.name)}`;
+    const counterKey = (key) => `${slot(key)}:c:${enc(key.name)}`;
+    const setKey = (key) => `${slot(key)}:s:${enc(key.name)}`;
+    const versionKey = (key) => `${slot(key)}:#version`;
+    const markKey = (key, mark) => `${slot(key)}:#mark:${enc(mark ?? "")}`;
+    /** Runs a script; every answer comes with the run id of the server that computed it. */
+    const run = async (script, keys, args) => {
+        let reply;
+        try {
+            reply = await client.eval(script, keys.length, ...keys, ...args);
+        }
+        catch {
+            throw new Unavailable("store");
+        }
+        const text = String(reply);
+        const split = text.indexOf("\n");
+        const answer = numbers(JSON.parse(text.slice(split + 1)));
+        Object.defineProperty(answer, servedBy, { value: text.slice(0, split), enumerable: false });
+        return answer;
+    };
+    /**
+     * One confirmation round: in one trip, learn the replicas and the server, and write a key on
+     * the confirming connection; then wait until every replica online now has it. Replication is
+     * ordered, so a round covers everything the primary did before. WAIT waits only for its own
+     * connection's writes, hence the key; and a connection of its own keeps WAIT from holding other
+     * commands. The confirming connection must talk to the same server as the operations (a DNS or
+     * load-balancer change can part them), and the replicas must match what the operator declared.
+     */
+    const round = async () => {
+        try {
+            const replies = await confirmer
+                .pipeline()
+                .call("ROLE")
+                .info("server")
+                .set(`${prefix}:#confirm`, "1", "PX", 60_000)
+                .exec();
+            if (!replies || replies.some(([error]) => error))
+                throw new Error("confirmation failed");
+            const role = replies[0]?.[1];
+            const server = /run_id:(\w+)/.exec(String(replies[1]?.[1]))?.[1];
+            if (role[0] !== "master" || server === undefined)
+                throw new Error("not a primary");
+            const replicas = Array.isArray(role[2]) ? role[2].length : 0;
+            if (options.replication === "none") {
+                if (replicas === 0)
+                    return server;
+                throw new Error("replicas seen where none were declared");
+            }
+            // A primary cut off from the others also sees none, and what it confirmed would be lost.
+            if (replicas === 0)
+                throw new Error("no replica to confirm with");
+            const acknowledged = Number(await confirmer.call("WAIT", replicas, replicationTimeoutMs));
+            if (acknowledged >= replicas)
+                return server;
+        }
+        catch { }
+        throw new Unavailable("store");
+    };
+    const confirmed = sharedRounds(round);
+    /**
+     * Replicated spaces confirm what they wrote; spaces asking for confirmed reads confirm every
+     * answer. The round must have run on the server that computed the answer.
+     */
+    const confirmOn = async (key, wrote, answer) => {
+        const guarantees = key.space.guarantees;
+        const needed = guarantees.includes("confirmed-reads") || (guarantees.includes("replicated") && wrote);
+        if (!needed)
+            return;
+        const server = await confirmed();
+        if (server !== answer[servedBy])
+            throw new Unavailable("store");
+    };
+    const confirm = async (key, answer) => {
+        await confirmOn(key, writtenKinds.has(answer.kind), answer);
+        return answer;
+    };
+    const expiryArgs = (expiry) => {
+        if (expiry.kind === "after" || expiry.kind === "extend")
+            return [expiry.kind, String(expiry.ms)];
+        if (expiry.kind === "at")
+            return ["at", String(expiry.at)];
+        return [expiry.kind, ""];
+    };
+    const entry = (raw) => raw
+        ? Object.freeze({
+            value: JSON.parse(raw.value),
+            version: raw.version,
+            expiresAt: raw.expiresAt === null ? null : Number(raw.expiresAt),
+        })
+        : null;
+    const samePartition = (keys) => {
+        if (new Set(keys.map(slot)).size > 1)
+            throw new Error("keys span more than one partition");
+    };
+    const marked = (options) => options?.idempotency ? "1" : "0";
+    const writeWith = async (mode, key, value, expected, options) => {
+        const [kind, arg] = expiryArgs(options.expiry);
+        const args = mode === "replaceIf" ? [expected, value, options.expiry] : [value, options.expiry];
+        const answer = await run(scripts.write, [valueKey(key), versionKey(key), markKey(key, options.idempotency)], [
+            mode,
+            canonicalJson(value),
+            expected,
+            kind,
+            arg,
+            options.deadline ?? "",
+            digest(idempotencyRequest(mode, [key], args)),
+            marked(options),
+        ]);
+        return confirm(key, answer);
+    };
+    return checkedStore({
+        get: async (key) => {
+            const read = await confirm(key, await run(scripts.read, [valueKey(key)], []));
+            return { entry: entry(list(read.entries, 1)[0]), now: read.now };
+        },
+        getMany: async (keys) => {
+            samePartition(keys);
+            const read = await run(scripts.read, keys.map(valueKey), []);
+            const [first] = keys;
+            if (first)
+                await confirm(first, read);
+            return { entries: list(read.entries, read.n).map(entry), now: read.now };
+        },
+        put: (key, value, options) => writeWith("put", key, value, "", options),
+        putIfAbsent: (key, value, options) => writeWith("putIfAbsent", key, value, "", options),
+        replaceIf: (key, version, value, options) => writeWith("replaceIf", key, value, version, options),
+        removeIf: async (key, expected, options) => {
+            const by = "version" in expected ? "version" : "value";
+            const target = "version" in expected ? expected.version : canonicalJson(expected.value);
+            const answer = await run(scripts.removeIf, [valueKey(key), markKey(key, options?.idempotency)], [
+                by,
+                target,
+                options?.deadline ?? "",
+                digest(idempotencyRequest("removeIf", [key], [expected])),
+                marked(options),
+            ]);
+            await confirm(key, answer);
+            return answer.kind === "removed"
+                ? { kind: "removed", old: entry(answer.old) }
+                : answer;
+        },
+        take: async (key, options) => {
+            const answer = await run(scripts.take, [valueKey(key), markKey(key, options?.idempotency)], [options?.deadline ?? "", digest(idempotencyRequest("take", [key], [])), marked(options)]);
+            await confirm(key, answer);
+            return answer.kind === "taken"
+                ? { kind: "taken", entry: entry(answer.entry) }
+                : answer;
+        },
+        batch: async (conditions, writes, options) => {
+            const keys = [...conditions.map((c) => c.key), ...writes.map((w) => w.key)];
+            samePartition(keys);
+            const [first] = keys;
+            if (!first)
+                return run(scripts.deadlineOnly, [], [options?.deadline ?? ""]);
+            const names = [...new Set(keys.map(valueKey))];
+            const index = (key) => names.indexOf(valueKey(key)) + 1;
+            const spec = {
+                conditions: conditions.map((c) => "absent" in c
+                    ? { i: index(c.key), absent: true }
+                    : { i: index(c.key), version: c.version }),
+                writes: writes.map((w) => {
+                    if ("remove" in w)
+                        return { i: index(w.key), remove: true };
+                    const [kind, arg] = expiryArgs(w.expiry);
+                    return { i: index(w.key), put: canonicalJson(w.put), kind, arg };
+                }),
+            };
+            const request = idempotencyRequest("batch", keys, [
+                conditions.map((c) => ("absent" in c ? { absent: true } : { version: c.version })),
+                writes.map((w) => ("remove" in w ? null : [w.put, w.expiry])),
+            ]);
+            const answer = await run(scripts.batch, [...names, versionKey(first), markKey(first, options?.idempotency)], [JSON.stringify(spec), options?.deadline ?? "", digest(request), marked(options)]);
+            await confirm(first, answer);
+            return answer.kind === "committed"
+                ? { kind: "committed", versions: list(answer.versions, answer.n) }
+                : answer;
+        },
+        count: async (key, window, options) => {
+            const answer = await run(scripts.count, [counterKey(key), markKey(key, options?.idempotency)], [
+                window.ms,
+                window.limit,
+                options?.deadline ?? "",
+                digest(idempotencyRequest("count", [key], [window.ms, window.limit])),
+                marked(options),
+            ]);
+            return confirm(key, answer);
+        },
+        setAdd: async (key, member, score, options) => {
+            const [kind, arg] = expiryArgs(options.expiry);
+            const answer = await run(scripts.setAdd, [setKey(key)], [member, score, options.cap, kind, arg]);
+            // A set's add always writes.
+            await confirmOn(key, true, answer);
+            return { evicted: list(answer.evicted, answer.n) };
+        },
+        setMembers: async (key) => {
+            const answer = await confirm(key, await run(scripts.setMembers, [setKey(key)], []));
+            const flat = Array.isArray(answer.members) ? answer.members : [];
+            const members = [];
+            for (let i = 0; i < flat.length; i += 2) {
+                members.push({ member: flat[i], score: Number(flat[i + 1]) });
+            }
+            members.sort((a, b) => codePointOrder(a.member, b.member));
+            return { members, now: answer.now };
+        },
+        setRemove: async (key, member) => {
+            await confirm(key, await run(scripts.setRemove, [setKey(key)], [member]));
+        },
+        now: async () => (await run(scripts.now, [], [])).now,
+    }, declared);
+}

package/redis/src/rounds.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Shares confirmation rounds: a call made while a round is running waits for the next round,
+ * never the running one, whose start may predate the caller's own work.
+ */
+export declare function sharedRounds<T>(round: () => Promise<T>): () => Promise<T>;

package/redis/src/rounds.js

@@ -0,0 +1,25 @@
+/**
+ * Shares confirmation rounds: a call made while a round is running waits for the next round,
+ * never the running one, whose start may predate the caller's own work.
+ */
+export function sharedRounds(round) {
+    let running;
+    let next;
+    const start = () => {
+        running = round().finally(() => {
+            running = undefined;
+        });
+        return running;
+    };
+    return () => {
+        if (!running)
+            return start();
+        next ??= running
+            .catch(() => { })
+            .then(() => {
+            next = undefined;
+            return start();
+        });
+        return next;
+    };
+}

package/redis/src/scripts.d.ts

@@ -0,0 +1,26 @@
+/** KEYS: key, version key, mark key. ARGV: mode, value, expected, kind, arg, deadline, digest, has mark. */
+export declare const write = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nlocal key, vkey, ikey = KEYS[1], KEYS[2], ARGV[8] == '1' and KEYS[3] or ''\nlocal seen = guard(ikey, ARGV[7], ARGV[6])\nif seen then return out(seen) end\nlocal mode = ARGV[1]\nlocal exists = redis.call('EXISTS', key) == 1\nlocal answer\nif mode == 'putIfAbsent' and exists then\n  local ttl = redis.call('PTTL', key)\n  answer = cjson.encode({kind = 'exists', remainingMs = ttl >= 0 and num(ttl) or cjson.null})\nelseif mode == 'replaceIf' and not exists then\n  answer = cjson.encode({kind = 'missing'})\nelseif mode == 'replaceIf' and redis.call('HGET', key, 'ver') ~= ARGV[3] then\n  answer = cjson.encode({kind = 'conflict'})\nelse\n  local expires = expiry(ARGV[4], ARGV[5], redis.call('PEXPIRETIME', key))\n  answer = cjson.encode({kind = 'written', version = store_value(key, vkey, ARGV[2], expires)})\nend\nreturn out(remember(ikey, ARGV[7], answer, ARGV[6]))\n";
+/** KEYS: key, mark key. ARGV: by ('version'|'value'), expected, deadline, digest, has mark. */
+export declare const removeIf = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nlocal key, ikey = KEYS[1], ARGV[5] == '1' and KEYS[2] or ''\nlocal seen = guard(ikey, ARGV[4], ARGV[3])\nif seen then return out(seen) end\nlocal held = entry(KEYS[1])\nlocal answer\nif not held then\n  answer = cjson.encode({kind = 'missing'})\nelseif (ARGV[1] == 'version' and held.version ~= ARGV[2]) or (ARGV[1] == 'value' and held.value ~= ARGV[2]) then\n  answer = cjson.encode({kind = 'conflict'})\nelse\n  redis.call('DEL', key)\n  answer = cjson.encode({kind = 'removed', old = held})\nend\nreturn out(remember(ikey, ARGV[4], answer, ARGV[3]))\n";
+/** KEYS: the keys to read. */
+export declare const read = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nlocal entries = {}\nfor i, key in ipairs(KEYS) do entries[i] = entry(key) end\nreturn out(cjson.encode({now = num(now), entries = entries, n = #KEYS}))\n";
+/** KEYS: key, mark key. ARGV: deadline, digest, has mark. */
+export declare const take = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nlocal ikey = ARGV[3] == '1' and KEYS[2] or ''\nlocal seen = guard(ikey, ARGV[2], ARGV[1])\nif seen then return out(seen) end\nlocal held = entry(KEYS[1])\nlocal answer\nif not held then\n  answer = cjson.encode({kind = 'missing'})\nelse\n  redis.call('DEL', KEYS[1])\n  answer = cjson.encode({kind = 'taken', entry = held})\nend\nreturn out(remember(ikey, ARGV[2], answer, ARGV[1]))\n";
+/**
+ * KEYS: the batch keys, then the version key, then the mark key.
+ * ARGV: spec JSON {conditions = [{i, version|absent}], writes = [{i, put, kind, arg}|{i, remove}]},
+ * deadline, digest, has mark.
+ */
+export declare const batch = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nlocal spec = cjson.decode(ARGV[1])\nlocal n = #KEYS\nlocal vkey = KEYS[n - 1]\nlocal ikey = ARGV[4] == '1' and KEYS[n] or ''\nlocal seen = guard(ikey, ARGV[3], ARGV[2])\nif seen then return out(seen) end\nfor index, c in ipairs(spec.conditions) do\n  local ver = redis.call('HGET', KEYS[c.i], 'ver')\n  local holds\n  if c.absent then holds = not ver else holds = ver == c.version end\n  if not holds then return out(remember(ikey, ARGV[3], cjson.encode({kind = 'conflict', index = index - 1}), ARGV[2])) end\nend\nlocal expiries = {}\nfor index, w in ipairs(spec.writes) do\n  if not w.remove then expiries[index] = expiry(w.kind, w.arg, redis.call('PEXPIRETIME', KEYS[w.i])) end\nend\nlocal versions = {}\nfor index, w in ipairs(spec.writes) do\n  if w.remove then\n    redis.call('DEL', KEYS[w.i])\n    versions[index] = cjson.null\n  else\n    versions[index] = store_value(KEYS[w.i], vkey, w.put, expiries[index])\n  end\nend\nreturn out(remember(ikey, ARGV[3], cjson.encode({kind = 'committed', versions = versions, n = #spec.writes}), ARGV[2]))\n";
+/** No keys. ARGV: deadline. An empty batch still honours its deadline. */
+export declare const deadlineOnly = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nif ARGV[1] ~= '' and now > tonumber(ARGV[1]) then return out(cjson.encode({kind = 'late'})) end\nreturn out(cjson.encode({kind = 'committed', versions = {}, n = 0}))\n";
+/** KEYS: counter key, mark key. ARGV: window ms, limit, deadline, digest, has mark. Not versioned: it is hit hard. */
+export declare const count = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nlocal ikey = ARGV[5] == '1' and KEYS[2] or ''\nlocal seen = guard(ikey, ARGV[4], ARGV[3])\nif seen then return out(seen) end\nlocal ms, limit = tonumber(ARGV[1]), tonumber(ARGV[2])\nlocal current = redis.call('GET', KEYS[1])\nlocal answer\nif not current then\n  if limit < 1 then\n    answer = cjson.encode({kind = 'limited', resetAt = num(now + ms)})\n  else\n    redis.call('SET', KEYS[1], 1, 'PX', ms)\n    answer = cjson.encode({kind = 'counted', count = 1, resetAt = num(now + ms)})\n  end\nelse\n  local reset = num(now + redis.call('PTTL', KEYS[1]))\n  if tonumber(current) >= limit then\n    answer = cjson.encode({kind = 'limited', resetAt = reset})\n  else\n    answer = cjson.encode({kind = 'counted', count = redis.call('INCR', KEYS[1]), resetAt = reset})\n  end\nend\nreturn out(remember(ikey, ARGV[4], answer, ARGV[3]))\n";
+/** KEYS: set key. ARGV: member, score, cap, kind, arg. A set's expiry never shrinks. */
+export declare const setAdd = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nlocal key = KEYS[1]\nredis.call('ZREMRANGEBYSCORE', key, '-inf', num(now))\nlocal fresh = redis.call('EXISTS', key) == 0\nlocal current = redis.call('PEXPIRETIME', key)\nlocal proposed = expiry(ARGV[4], ARGV[5], fresh and -2 or current)\nlocal final\nif fresh then final = proposed\nelseif current == -1 or proposed == nil then final = nil\nelse final = math.max(current, proposed) end\nredis.call('ZADD', key, 'GT', ARGV[2], ARGV[1])\nlocal evicted = {}\nlocal over = redis.call('ZCARD', key) - tonumber(ARGV[3])\nif over > 0 then\n  local popped = redis.call('ZPOPMIN', key, over)\n  for i = 1, #popped, 2 do table.insert(evicted, popped[i]) end\nend\nif redis.call('EXISTS', key) == 1 then\n  if final == nil then redis.call('PERSIST', key) else redis.call('PEXPIREAT', key, final) end\nend\nreturn out(cjson.encode({evicted = evicted, n = #evicted}))\n";
+/** KEYS: set key. */
+export declare const setMembers = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nredis.call('ZREMRANGEBYSCORE', KEYS[1], '-inf', num(now))\nreturn out(cjson.encode({now = num(now), members = redis.call('ZRANGE', KEYS[1], 0, -1, 'WITHSCORES')}))\n";
+/** KEYS: set key. ARGV: member. */
+export declare const setRemove = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nredis.call('ZREM', KEYS[1], ARGV[1])\nreturn out(cjson.encode({kind = 'written'}))\n";
+/** The store clock's present time. */
+export declare const now = "\nlocal t = redis.call('TIME')\nlocal now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)\nlocal function num(x) return string.format('%.0f', x) end\nlocal run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')\n-- Every answer names the server it was computed on, so a confirmation is checked against it.\nlocal function out(answer) return run_id .. '\\n' .. answer end\n-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.\nfor _, key in ipairs(KEYS) do\n  local expires = redis.call('PEXPIRETIME', key)\n  if expires >= 0 and expires <= now then redis.call('DEL', key) end\nend\nlocal function next_version(vkey)\n  local server = string.sub(run_id, 1, 12)\n    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)\n  local epoch = redis.call('HGET', vkey, 'epoch')\n  if not epoch then\n    epoch = t[1] .. string.format('%06d', tonumber(t[2]))\n    redis.call('HSET', vkey, 'epoch', epoch)\n  end\n  local n = redis.call('HINCRBY', vkey, 'n', 1)\n  redis.call('PEXPIRE', vkey, 86400000)\n  return server .. '.' .. epoch .. '.' .. num(n)\nend\nlocal function expiry(kind, arg, current)\n  if kind == 'after' then return now + tonumber(arg) end\n  if kind == 'at' then return tonumber(arg) end\n  if kind == 'never' then return nil end\n  if kind == 'keep' then\n    if current < 0 then return nil end\n    return current\n  end\n  -- extend: never shorter than it was, and a key that never ends stays so.\n  if current == -1 then return nil end\n  return math.max(current, now + tonumber(arg))\nend\nlocal function store_value(key, vkey, value, expires)\n  local v = next_version(vkey)\n  redis.call('DEL', key)\n  redis.call('HSET', key, 'v', value, 'ver', v)\n  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end\n  return v\nend\nlocal function guard(ikey, digest, deadline)\n  if ikey ~= '' then\n    local seen = redis.call('GET', ikey)\n    if seen then\n      local record = cjson.decode(seen)\n      if record.d == digest then return record.a end\n      return cjson.encode({kind = 'reused'})\n    end\n  end\n  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end\n  return nil\nend\n-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.\nlocal mark_without_deadline_ms = 300000\nlocal mark_past_deadline_ms = 1000\nlocal function remember(ikey, digest, answer, deadline)\n  if ikey ~= '' then\n    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms\n    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)\n  end\n  return answer\nend\nlocal function entry(key)\n  local held = redis.call('HMGET', key, 'v', 'ver')\n  if not held[1] then return false end\n  local expires = redis.call('PEXPIRETIME', key)\n  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}\nend\n\nreturn out(cjson.encode({now = num(now)}))\n";

package/redis/src/scripts.js

@@ -0,0 +1,241 @@
+/**
+ * Shared prelude: store time, versions, expiry and idempotency. Every input has been checked at
+ * the store contract boundary, so nothing below fails after the first write.
+ *
+ * A version is "<server>.<epoch>.<n>". <server> joins the run id (new on every restart) and the
+ * replication id (new when a replica is promoted), so a counter rolled back by a restart or a
+ * failover never hands out a version seen before; <epoch> is the store time when the counter
+ * was created, so a counter that expired and came back starts afresh too. The counter lives a
+ * day past its last use. Numbers go out as strings, since cjson keeps only 14 digits.
+ */
+const prelude = `
+local t = redis.call('TIME')
+local now = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)
+local function num(x) return string.format('%.0f', x) end
+local run_id = string.match(redis.call('INFO', 'server'), 'run_id:(%w+)')
+-- Every answer names the server it was computed on, so a confirmation is checked against it.
+local function out(answer) return run_id .. '\\n' .. answer end
+-- An entry is gone at its very expiry time by this script's clock; Redis would still hold it.
+for _, key in ipairs(KEYS) do
+  local expires = redis.call('PEXPIRETIME', key)
+  if expires >= 0 and expires <= now then redis.call('DEL', key) end
+end
+local function next_version(vkey)
+  local server = string.sub(run_id, 1, 12)
+    .. string.sub(string.match(redis.call('INFO', 'replication'), 'master_replid:(%w+)'), 1, 12)
+  local epoch = redis.call('HGET', vkey, 'epoch')
+  if not epoch then
+    epoch = t[1] .. string.format('%06d', tonumber(t[2]))
+    redis.call('HSET', vkey, 'epoch', epoch)
+  end
+  local n = redis.call('HINCRBY', vkey, 'n', 1)
+  redis.call('PEXPIRE', vkey, 86400000)
+  return server .. '.' .. epoch .. '.' .. num(n)
+end
+local function expiry(kind, arg, current)
+  if kind == 'after' then return now + tonumber(arg) end
+  if kind == 'at' then return tonumber(arg) end
+  if kind == 'never' then return nil end
+  if kind == 'keep' then
+    if current < 0 then return nil end
+    return current
+  end
+  -- extend: never shorter than it was, and a key that never ends stays so.
+  if current == -1 then return nil end
+  return math.max(current, now + tonumber(arg))
+end
+local function store_value(key, vkey, value, expires)
+  local v = next_version(vkey)
+  redis.call('DEL', key)
+  redis.call('HSET', key, 'v', value, 'ver', v)
+  if expires ~= nil then redis.call('PEXPIREAT', key, expires) end
+  return v
+end
+local function guard(ikey, digest, deadline)
+  if ikey ~= '' then
+    local seen = redis.call('GET', ikey)
+    if seen then
+      local record = cjson.decode(seen)
+      if record.d == digest then return record.a end
+      return cjson.encode({kind = 'reused'})
+    end
+  end
+  if deadline ~= '' and now > tonumber(deadline) then return cjson.encode({kind = 'late'}) end
+  return nil
+end
+-- A mark is kept a second past its deadline, or five minutes and a second without one, as store says.
+local mark_without_deadline_ms = 300000
+local mark_past_deadline_ms = 1000
+local function remember(ikey, digest, answer, deadline)
+  if ikey ~= '' then
+    local base = deadline ~= '' and tonumber(deadline) or now + mark_without_deadline_ms
+    redis.call('SET', ikey, cjson.encode({d = digest, a = answer}), 'PXAT', base + mark_past_deadline_ms)
+  end
+  return answer
+end
+local function entry(key)
+  local held = redis.call('HMGET', key, 'v', 'ver')
+  if not held[1] then return false end
+  local expires = redis.call('PEXPIRETIME', key)
+  return {value = held[1], version = held[2], expiresAt = expires >= 0 and num(expires) or cjson.null}
+end
+`;
+/** KEYS: key, version key, mark key. ARGV: mode, value, expected, kind, arg, deadline, digest, has mark. */
+export const write = `${prelude}
+local key, vkey, ikey = KEYS[1], KEYS[2], ARGV[8] == '1' and KEYS[3] or ''
+local seen = guard(ikey, ARGV[7], ARGV[6])
+if seen then return out(seen) end
+local mode = ARGV[1]
+local exists = redis.call('EXISTS', key) == 1
+local answer
+if mode == 'putIfAbsent' and exists then
+  local ttl = redis.call('PTTL', key)
+  answer = cjson.encode({kind = 'exists', remainingMs = ttl >= 0 and num(ttl) or cjson.null})
+elseif mode == 'replaceIf' and not exists then
+  answer = cjson.encode({kind = 'missing'})
+elseif mode == 'replaceIf' and redis.call('HGET', key, 'ver') ~= ARGV[3] then
+  answer = cjson.encode({kind = 'conflict'})
+else
+  local expires = expiry(ARGV[4], ARGV[5], redis.call('PEXPIRETIME', key))
+  answer = cjson.encode({kind = 'written', version = store_value(key, vkey, ARGV[2], expires)})
+end
+return out(remember(ikey, ARGV[7], answer, ARGV[6]))
+`;
+/** KEYS: key, mark key. ARGV: by ('version'|'value'), expected, deadline, digest, has mark. */
+export const removeIf = `${prelude}
+local key, ikey = KEYS[1], ARGV[5] == '1' and KEYS[2] or ''
+local seen = guard(ikey, ARGV[4], ARGV[3])
+if seen then return out(seen) end
+local held = entry(KEYS[1])
+local answer
+if not held then
+  answer = cjson.encode({kind = 'missing'})
+elseif (ARGV[1] == 'version' and held.version ~= ARGV[2]) or (ARGV[1] == 'value' and held.value ~= ARGV[2]) then
+  answer = cjson.encode({kind = 'conflict'})
+else
+  redis.call('DEL', key)
+  answer = cjson.encode({kind = 'removed', old = held})
+end
+return out(remember(ikey, ARGV[4], answer, ARGV[3]))
+`;
+/** KEYS: the keys to read. */
+export const read = `${prelude}
+local entries = {}
+for i, key in ipairs(KEYS) do entries[i] = entry(key) end
+return out(cjson.encode({now = num(now), entries = entries, n = #KEYS}))
+`;
+/** KEYS: key, mark key. ARGV: deadline, digest, has mark. */
+export const take = `${prelude}
+local ikey = ARGV[3] == '1' and KEYS[2] or ''
+local seen = guard(ikey, ARGV[2], ARGV[1])
+if seen then return out(seen) end
+local held = entry(KEYS[1])
+local answer
+if not held then
+  answer = cjson.encode({kind = 'missing'})
+else
+  redis.call('DEL', KEYS[1])
+  answer = cjson.encode({kind = 'taken', entry = held})
+end
+return out(remember(ikey, ARGV[2], answer, ARGV[1]))
+`;
+/**
+ * KEYS: the batch keys, then the version key, then the mark key.
+ * ARGV: spec JSON {conditions = [{i, version|absent}], writes = [{i, put, kind, arg}|{i, remove}]},
+ * deadline, digest, has mark.
+ */
+export const batch = `${prelude}
+local spec = cjson.decode(ARGV[1])
+local n = #KEYS
+local vkey = KEYS[n - 1]
+local ikey = ARGV[4] == '1' and KEYS[n] or ''
+local seen = guard(ikey, ARGV[3], ARGV[2])
+if seen then return out(seen) end
+for index, c in ipairs(spec.conditions) do
+  local ver = redis.call('HGET', KEYS[c.i], 'ver')
+  local holds
+  if c.absent then holds = not ver else holds = ver == c.version end
+  if not holds then return out(remember(ikey, ARGV[3], cjson.encode({kind = 'conflict', index = index - 1}), ARGV[2])) end
+end
+local expiries = {}
+for index, w in ipairs(spec.writes) do
+  if not w.remove then expiries[index] = expiry(w.kind, w.arg, redis.call('PEXPIRETIME', KEYS[w.i])) end
+end
+local versions = {}
+for index, w in ipairs(spec.writes) do
+  if w.remove then
+    redis.call('DEL', KEYS[w.i])
+    versions[index] = cjson.null
+  else
+    versions[index] = store_value(KEYS[w.i], vkey, w.put, expiries[index])
+  end
+end
+return out(remember(ikey, ARGV[3], cjson.encode({kind = 'committed', versions = versions, n = #spec.writes}), ARGV[2]))
+`;
+/** No keys. ARGV: deadline. An empty batch still honours its deadline. */
+export const deadlineOnly = `${prelude}
+if ARGV[1] ~= '' and now > tonumber(ARGV[1]) then return out(cjson.encode({kind = 'late'})) end
+return out(cjson.encode({kind = 'committed', versions = {}, n = 0}))
+`;
+/** KEYS: counter key, mark key. ARGV: window ms, limit, deadline, digest, has mark. Not versioned: it is hit hard. */
+export const count = `${prelude}
+local ikey = ARGV[5] == '1' and KEYS[2] or ''
+local seen = guard(ikey, ARGV[4], ARGV[3])
+if seen then return out(seen) end
+local ms, limit = tonumber(ARGV[1]), tonumber(ARGV[2])
+local current = redis.call('GET', KEYS[1])
+local answer
+if not current then
+  if limit < 1 then
+    answer = cjson.encode({kind = 'limited', resetAt = num(now + ms)})
+  else
+    redis.call('SET', KEYS[1], 1, 'PX', ms)
+    answer = cjson.encode({kind = 'counted', count = 1, resetAt = num(now + ms)})
+  end
+else
+  local reset = num(now + redis.call('PTTL', KEYS[1]))
+  if tonumber(current) >= limit then
+    answer = cjson.encode({kind = 'limited', resetAt = reset})
+  else
+    answer = cjson.encode({kind = 'counted', count = redis.call('INCR', KEYS[1]), resetAt = reset})
+  end
+end
+return out(remember(ikey, ARGV[4], answer, ARGV[3]))
+`;
+/** KEYS: set key. ARGV: member, score, cap, kind, arg. A set's expiry never shrinks. */
+export const setAdd = `${prelude}
+local key = KEYS[1]
+redis.call('ZREMRANGEBYSCORE', key, '-inf', num(now))
+local fresh = redis.call('EXISTS', key) == 0
+local current = redis.call('PEXPIRETIME', key)
+local proposed = expiry(ARGV[4], ARGV[5], fresh and -2 or current)
+local final
+if fresh then final = proposed
+elseif current == -1 or proposed == nil then final = nil
+else final = math.max(current, proposed) end
+redis.call('ZADD', key, 'GT', ARGV[2], ARGV[1])
+local evicted = {}
+local over = redis.call('ZCARD', key) - tonumber(ARGV[3])
+if over > 0 then
+  local popped = redis.call('ZPOPMIN', key, over)
+  for i = 1, #popped, 2 do table.insert(evicted, popped[i]) end
+end
+if redis.call('EXISTS', key) == 1 then
+  if final == nil then redis.call('PERSIST', key) else redis.call('PEXPIREAT', key, final) end
+end
+return out(cjson.encode({evicted = evicted, n = #evicted}))
+`;
+/** KEYS: set key. */
+export const setMembers = `${prelude}
+redis.call('ZREMRANGEBYSCORE', KEYS[1], '-inf', num(now))
+return out(cjson.encode({now = num(now), members = redis.call('ZRANGE', KEYS[1], 0, -1, 'WITHSCORES')}))
+`;
+/** KEYS: set key. ARGV: member. */
+export const setRemove = `${prelude}
+redis.call('ZREM', KEYS[1], ARGV[1])
+return out(cjson.encode({kind = 'written'}))
+`;
+/** The store clock's present time. */
+export const now = `${prelude}
+return out(cjson.encode({now = num(now)}))
+`;