caracms 0.2.0 → 0.3.1

package/src/live/mode.ts

@@ -1,13 +1,16 @@
 /**
  * Which mode the editor runs in, read from the environment (M4 Decision 1).
  *
- * - **Local mode**: `astro dev` with no `GITHUB_APP_ID`. M3's editor, files on disk.
- * - **Live mode**: whenever the App is configured, and **always on a production
- *   server**. It needs `GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY`, the repo
- *   (`RAILWAY_GIT_REPO_OWNER` and `RAILWAY_GIT_REPO_NAME`, or `GITHUB_REPO=owner/name`;
- *   Decision 3), `CARACMS_SECRET`, and `REDIS_URL` in production (dev may use the
- *   stand-in). A production server missing any of them still serves the public site;
- *   `/admin` answers 503 naming them (Phase 2 builds that from `missing`).
+ * - **Local mode**: `astro dev` with no GitHub credentials (`GITHUB_APP_ID` or
+ *   `CARACMS_GITHUB_TOKEN`). M3's editor, files on disk.
+ * - **Live mode**: whenever a credential is configured, and **always on a production
+ *   server**. It needs one GitHub credential (a fine-grained token, or the App's
+ *   `GITHUB_APP_ID` and `GITHUB_APP_PRIVATE_KEY`; runs-anywhere Decisions 3–4), the repo
+ *   (`GITHUB_REPO=owner/name`, or Railway's `RAILWAY_GIT_REPO_OWNER` and
+ *   `RAILWAY_GIT_REPO_NAME`; Decision 6), `CARACMS_SECRET`, `REDIS_URL` and the site's
+ *   `https://` address in production (dev may use the stand-in Redis). A production
+ *   server missing any of them still serves the public site; `/admin` answers 503
+ *   naming them (Phase 2 builds that from `missing`).
  * - **The in-memory GitHub** (Decision 2): `CARACMS_GITHUB=memory`, for tests and local
  *   browser runs, never against the site's own repo. It's live mode with no App and
  *   no repo, and it's **refused in production**.
@@ -19,9 +22,10 @@ import { DEFAULT_BRANCHES, type BranchNames } from './branches.ts';
 import { DEFAULT_TIMINGS, type LiveTimings } from './timings.ts';
 
 export interface LiveSettings {
-	/** `memory`: the in-memory GitHub backend (Decision 2). */
+	/** `memory`: the in-memory GitHub backend (Decision 2). `token`: CARACMS_GITHUB_TOKEN (runs-anywhere Decision 3). */
 	github:
 		| { kind: 'app'; appId: string; privateKey: string; owner: string; repo: string }
+		| { kind: 'token'; token: string; owner: string; repo: string }
 		| { kind: 'memory' };
 	/** Null in dev without REDIS_URL: the in-memory stand-in. */
 	redisUrl: string | null;
@@ -31,12 +35,22 @@ export interface LiveSettings {
 	allow: string[];
 	/** GITHUB_WEBHOOK_SECRET; null means the webhook route answers 404 (Decision 14). */
 	webhookSecret: string | null;
-	/** Try again (Decision 12): all three, or null. */
+	/** Try again through Railway's API (Decision 12): all three, or null. */
 	railway: { token: string; serviceId: string; environmentId: string } | null;
+	/** Try again through a deploy hook (runs-anywhere Decision 11): CARACMS_DEPLOY_HOOK_URL. A secret: never logged or sent to the browser. */
+	deployHook?: string | null;
+	/**
+	 * The site's public origin (runs-anywhere Decision 7): Astro's `site` (baked at build,
+	 * SITE_URL at build included), then SITE_URL, then RAILWAY_PUBLIC_DOMAIN. Never null
+	 * in production live mode; missing (a test's settings) means unknown.
+	 */
+	address?: string | null;
 	/** CARACMS_BACKUP_USER and CARACMS_BACKUP_PASSWORD, both or neither (Phase 3 checks the length). */
 	backup: { user: string; password: string } | null;
-	/** CARACMS_RUNNING_COMMIT, else RAILWAY_GIT_COMMIT_SHA; null with no deploy pipeline (Decision 12). */
+	/** The running commit at start (runs-anywhere Decision 9, `runningCommitFrom`); null with none known. */
 	runningCommit: string | null;
+	/** The commit baked in at build (`Baked.commit`); status reads the running commit afresh from it and the environment. */
+	bakedCommit?: string | null;
 	/** Dev only: CARACMS_TIMINGS, a JSON object of LiveTimings to shorten (Decision 2). */
 	timings: LiveTimings;
 	/**
@@ -56,17 +70,90 @@ export type Mode =
 
 type Env = Record<string, string | undefined>;
 
+/** What the build baked in (the integration's defines; editor/server/mode.ts passes them). */
+export interface Baked {
+	/** Astro's `site` at build: the config's, or SITE_URL's (M6 Decision 3). */
+	site?: string | null;
+	/** The commit the build was made from (runs-anywhere Decision 9). */
+	commit?: string | null;
+}
+
+// The sentences the configuration problems print, kept here so the docs can quote them.
+export const BOTH_CREDENTIALS_PROBLEM =
+	'Both a GitHub App (GITHUB_APP_ID) and a token (CARACMS_GITHUB_TOKEN) are set: set one of them, not both.';
+export const CLASSIC_TOKEN_PROBLEM =
+	'CARACMS_GITHUB_TOKEN is a classic token, which reaches every repo its owner can: use a fine-grained token (it starts with github_pat_) with access to this site\'s repo only.';
+export const NOT_FINE_GRAINED_PROBLEM = 'CARACMS_GITHUB_TOKEN must be a fine-grained token: it starts with github_pat_.';
+export const NO_ADDRESS_PROBLEM =
+	"The site's public address isn't known: set SITE_URL to it, like https://fernhill.ie, both when the site is built and when it runs. Without it, sign-in links can't be sent and the editor's saves are refused.";
+export const HTTP_ADDRESS_PROBLEM = (address: string) =>
+	`The site's address (${address}) is http://, but signing in needs https://: the session cookie is only ever sent over https. Set SITE_URL to the https:// address (http:// works for localhost only).`;
+export const BOTH_REDEPLOYERS_PROBLEM =
+	'Both CARACMS_DEPLOY_HOOK_URL and CARACMS_RAILWAY_TOKEN are set: Try again redeploys through one of them, so set only one.';
+
+/** The prefixes of GitHub's classic tokens (`ghp_` and the OAuth, user-to-server, server-to-server and refresh ones). */
+const CLASSIC_TOKEN = /^(ghp|gho|ghu|ghs|ghr)_/;
+
+/** On Railway: it sets these on every service (the gate detects the host the same way). */
+const onRailway = (env: Env) => Boolean(env.RAILWAY_ENVIRONMENT_ID?.trim() || env.RAILWAY_GIT_REPO_OWNER?.trim() || env.RAILWAY_GIT_REPO_NAME?.trim());
+
+/**
+ * The hosts' commit variables, in order (runs-anywhere Decision 9): Railway's, Render's,
+ * Coolify's. The build bakes the first one set (or `git rev-parse HEAD`).
+ */
+export const HOST_COMMIT_VARIABLES = ['RAILWAY_GIT_COMMIT_SHA', 'RENDER_GIT_COMMIT', 'SOURCE_COMMIT'] as const;
+
+/**
+ * The running commit (runs-anywhere Decision 9): CARACMS_RUNNING_COMMIT, then a host's
+ * variable, then the commit baked in at build. A value at run time wins over the baked
+ * one; the in-memory GitHub ignores the baked one (it's this repo's, which the in-memory
+ * repo never has). Null with none known.
+ */
+export function runningCommitFrom(env: Env, baked: string | null | undefined): string | null {
+	for (const name of ['CARACMS_RUNNING_COMMIT', ...HOST_COMMIT_VARIABLES]) {
+		const v = env[name]?.trim();
+		if (v) return v;
+	}
+	if (env.CARACMS_GITHUB?.trim() === 'memory') return null;
+	return baked?.trim() || null;
+}
+
+/**
+ * The site's public origin (runs-anywhere Decision 7): Astro's `site` as built, then
+ * SITE_URL, then Railway's public domain. Null when none is set or SITE_URL doesn't parse
+ * (the build already warned).
+ */
+export function addressFrom(env: Env, bakedSite: string | null | undefined): string | null {
+	for (const raw of [bakedSite, env.SITE_URL]) {
+		const v = raw?.trim();
+		if (!v) continue;
+		try {
+			const url = new URL(v);
+			if (url.protocol === 'https:' || url.protocol === 'http:') return url.origin;
+		} catch {
+			/* the next one */
+		}
+	}
+	const railway = env.RAILWAY_PUBLIC_DOMAIN?.trim();
+	return railway ? `https://${railway}` : null;
+}
+
+const isLocalhost = (host: string) => host === 'localhost' || host.endsWith('.localhost') || host === '127.0.0.1' || host === '[::1]';
+
 /**
  * Read the mode. `production` is whether this is a production server (the
  * integration knows: not `astro dev`); it defaults to `NODE_ENV === 'production'`.
+ * `baked` is what the build baked in (the address and the commit).
  */
-export function readMode(env: Env = process.env, production = env.NODE_ENV === 'production'): Mode {
+export function readMode(env: Env = process.env, production = env.NODE_ENV === 'production', baked: Baked = {}): Mode {
 	const get = (name: string) => {
 		const v = env[name]?.trim();
 		return v ? v : null;
 	};
 	const memory = get('CARACMS_GITHUB') === 'memory';
-	if (!production && !memory && !get('GITHUB_APP_ID')) return { kind: 'local' };
+	// Never GITHUB_TOKEN (Decision 4): the gh CLI and GitHub Actions export it.
+	const ghToken = get('CARACMS_GITHUB_TOKEN');
+	if (!production && !memory && !get('GITHUB_APP_ID') && !ghToken) return { kind: 'local' };
 
 	const missing: string[] = [];
 	const problems: string[] = [];
@@ -82,15 +169,38 @@ export function readMode(env: Env = process.env, production = env.NODE_ENV === '
 
 	let github: LiveSettings['github'] = { kind: 'memory' };
 	if (!memory || production) {
-		const appId = need('GITHUB_APP_ID');
-		const privateKey = need('GITHUB_APP_PRIVATE_KEY');
+		const appId = get('GITHUB_APP_ID');
 		const repo = readRepo(env, problems);
-		if (!repo) missing.push('RAILWAY_GIT_REPO_OWNER and RAILWAY_GIT_REPO_NAME (or GITHUB_REPO)');
-		github = { kind: 'app', appId, privateKey, owner: repo?.owner ?? '', repo: repo?.repo ?? '' };
+		const owner = repo?.owner ?? '';
+		const name = repo?.repo ?? '';
+		if (appId && ghToken) problems.push(BOTH_CREDENTIALS_PROBLEM);
+		if (ghToken) {
+			if (CLASSIC_TOKEN.test(ghToken)) problems.push(CLASSIC_TOKEN_PROBLEM);
+			else if (!ghToken.startsWith('github_pat_')) problems.push(NOT_FINE_GRAINED_PROBLEM);
+			github = { kind: 'token', token: ghToken, owner, repo: name };
+		} else if (appId) {
+			github = { kind: 'app', appId, privateKey: need('GITHUB_APP_PRIVATE_KEY'), owner, repo: name };
+		} else {
+			missing.push('CARACMS_GITHUB_TOKEN (or GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY)');
+		}
+		if (!repo && !problems.some((p) => p.startsWith('GITHUB_REPO'))) {
+			missing.push(onRailway(env) ? 'RAILWAY_GIT_REPO_OWNER and RAILWAY_GIT_REPO_NAME (or GITHUB_REPO)' : 'GITHUB_REPO');
+		}
 	}
 	const secret = need('CARACMS_SECRET');
 	const redisUrl = production ? need('REDIS_URL') : get('REDIS_URL');
 
+	// The address (Decision 7): known, and https:// (but for localhost), in production.
+	const address = addressFrom(env, baked.site);
+	if (production && !address) problems.push(NO_ADDRESS_PROBLEM);
+	if (production && address && address.startsWith('http:') && !isLocalhost(new URL(address).hostname)) problems.push(HTTP_ADDRESS_PROBLEM(address));
+
+	const deployHook = get('CARACMS_DEPLOY_HOOK_URL');
+	if (deployHook) {
+		if (get('CARACMS_RAILWAY_TOKEN')) problems.push(BOTH_REDEPLOYERS_PROBLEM);
+		if (!/^https?:\/\//i.test(deployHook)) problems.push('CARACMS_DEPLOY_HOOK_URL must be the hook\'s https:// address.');
+	}
+
 	const token = get('CARACMS_RAILWAY_TOKEN');
 	const serviceId = get('RAILWAY_SERVICE_ID');
 	const environmentId = get('RAILWAY_ENVIRONMENT_ID');
@@ -119,8 +229,11 @@ export function readMode(env: Env = process.env, production = env.NODE_ENV === '
 				.filter(Boolean),
 			webhookSecret: get('GITHUB_WEBHOOK_SECRET'),
 			railway: token && serviceId && environmentId ? { token, serviceId, environmentId } : null,
+			deployHook,
+			address,
 			backup: user && password ? { user, password } : null,
-			runningCommit: get('CARACMS_RUNNING_COMMIT') ?? get('RAILWAY_GIT_COMMIT_SHA'),
+			runningCommit: runningCommitFrom(env, baked.commit),
+			bakedCommit: baked.commit ?? null,
 			timings,
 			branches,
 			production,
@@ -164,7 +277,7 @@ function isBranchName(name: string): boolean {
 	);
 }
 
-/** The repo: GITHUB_REPO overrides Railway's own variables (Decision 3). */
+/** The repo: GITHUB_REPO overrides Railway's own variables (M4 Decision 3; runs-anywhere Decision 6). */
 function readRepo(env: Env, problems: string[]): { owner: string; repo: string } | null {
 	const override = env.GITHUB_REPO?.trim();
 	if (override) {

package/src/live/notices.ts

@@ -0,0 +1,100 @@
+/**
+ * The editor's notices in Redis (M4 Decision 7 and 10 step 1), in one place so the
+ * status cache hears of every write (Redis diet Decision 2).
+ *
+ * - **"Published as it stood"** (`caracms:notices`, a hash by notice id): Publish leaves
+ *   one for each person who had a published document open; dismissing it deletes it.
+ * - **Dismissed "draft kept" notices** (`caracms:dismissed`, a set of ids): those are
+ *   shared, worked out from git (`git.keptDraftNotices()`), so a dismissal is remembered
+ *   here; a new conflict has a new id and shows again.
+ *
+ * Both expire a week after their last write (`autosaveTtlMs`), as a backstop.
+ */
+import type { NoticeView } from '../editor/types.ts';
+import type { Person } from './messages.ts';
+import type { RedisClient } from './redis.ts';
+import { landed, type StatusCache } from './status-cache.ts';
+import type { LiveTimings } from './timings.ts';
+
+/** "Aoife published Home as it stood at 14:20", for one person. */
+export interface StoodNotice {
+	id: string;
+	/** The person it's for, lower-cased. */
+	for: string;
+	file: string;
+	title: string;
+	by: Person;
+	at: string;
+}
+
+export class Notices {
+	readonly redis: RedisClient;
+	readonly timings: LiveTimings;
+	private readonly cache: StatusCache | null;
+	readonly noticesKey: string;
+	readonly dismissedKey: string;
+
+	constructor(redis: RedisClient, timings: LiveTimings, prefix = 'caracms:', cache: StatusCache | null = null) {
+		this.redis = redis;
+		this.timings = timings;
+		this.cache = cache;
+		this.noticesKey = `${prefix}notices`;
+		this.dismissedKey = `${prefix}dismissed`;
+	}
+
+	/** Leave these "published as it stood" notices. */
+	async addStood(notices: readonly StoodNotice[]): Promise<void> {
+		if (notices.length === 0) return;
+		const fields = Object.fromEntries(notices.map((n) => [n.id, JSON.stringify(n)]));
+		await landed(this.cache, this.noticesKey, () => this.redis.hset(this.noticesKey, fields));
+		this.cache?.hash(this.noticesKey, fields);
+		await this.redis.pexpire(this.noticesKey, this.timings.autosaveTtlMs);
+	}
+
+	/** A "published as it stood" notice is done with. */
+	async remove(id: string): Promise<void> {
+		await landed(this.cache, this.noticesKey, () => this.redis.hdel(this.noticesKey, id));
+		this.cache?.hash(this.noticesKey, {}, [id]);
+	}
+
+	/** A shared "draft kept" notice was dismissed. */
+	async dismiss(id: string): Promise<void> {
+		await landed(this.cache, this.dismissedKey, () => this.redis.sadd(this.dismissedKey, id));
+		this.cache?.add(this.dismissedKey, id);
+		await this.redis.pexpire(this.dismissedKey, this.timings.autosaveTtlMs);
+	}
+
+	/** This person's notices, read from Redis now. `kept` and `titleFor` are git's (`keptDraftNotices`, `titleFor`). */
+	async of(person: Person, kept: readonly { file: string; commit: string }[], titleFor: (file: string) => string): Promise<NoticeView[]> {
+		const [dismissed, stood] = await this.redis.batch([
+			['smembers', this.dismissedKey],
+			['hgetall', this.noticesKey],
+		] as const);
+		return Notices.forPerson(person, kept, titleFor, new Set(dismissed), Object.values(stood));
+	}
+
+	/** This person's notices from what was read: the dismissed ids, and the stood notices' values. */
+	static forPerson(
+		person: Person,
+		kept: readonly { file: string; commit: string }[],
+		titleFor: (file: string) => string,
+		dismissed: ReadonlySet<string>,
+		stood: Iterable<string>,
+	): NoticeView[] {
+		const out: NoticeView[] = [];
+		for (const n of kept) {
+			const id = `kept:${n.file}:${n.commit}`;
+			if (!dismissed.has(id)) out.push({ id, kind: 'draft-kept', file: n.file, title: titleFor(n.file) });
+		}
+		const email = person.email.toLowerCase();
+		for (const raw of stood) {
+			try {
+				const n = JSON.parse(raw) as StoodNotice;
+				if (n.for === email) out.push({ id: n.id, kind: 'published-as-it-stood', file: n.file, title: n.title, by: n.by, at: n.at });
+			} catch {
+				/* skip */
+			}
+		}
+		return out;
+	}
+}

package/src/live/redis.ts

@@ -68,10 +68,24 @@ export interface RedisClient {
 	compareAndSet(key: string, expected: string | null, value: string, options?: { px?: number }): Promise<boolean>;
 	/** Delete `key` only if it holds `expected`. Atomic. For releasing a lock you hold. */
 	compareAndDelete(key: string, expected: string): Promise<boolean>;
+	/**
+	 * Several commands sent together (Redis diet Decision 7): ioredis's pipeline, one
+	 * round trip; the stand-in runs them in order. Replies come back in the commands'
+	 * order. Each command is billed and counted as one. A batch that failed in flight is
+	 * sent again only when every command in it is safe to send twice (see `connectRedis`).
+	 * A command that needs another's answer (an MGET of what a SCAN found) goes in the next batch.
+	 */
+	batch<const C extends readonly BatchCommand[]>(commands: C): Promise<BatchReplies<C>>;
 	/** Close the connection, if any. The client stays usable: the next command reconnects. */
 	close(): Promise<void>;
 }
 
+type BatchName = Exclude<keyof RedisClient, 'batch' | 'close'>;
+/** One command of a batch: its method's name and arguments, `['mget', keys]`, `['hgetall', key]`. */
+export type BatchCommand = { [K in BatchName]: readonly [K, ...Parameters<RedisClient[K]>] }[BatchName];
+/** The replies to a batch, as the methods of the same names give them. */
+export type BatchReplies<C extends readonly BatchCommand[]> = { -readonly [I in keyof C]: C[I] extends readonly [infer K extends BatchName, ...unknown[]] ? Awaited<ReturnType<RedisClient[K]>> : never };
+
 /** Redis couldn't be reached within the budget, or refused a command. `code` is the real socket error's. */
 export class RedisUnavailableError extends Error {
 	readonly code: string | null;
@@ -132,6 +146,86 @@ function withTimeout<T>(promise: Promise<T>, ms: number, what: string): Promise<
 }
 
 type Ioredis = InstanceType<typeof IORedis>;
+/** The client or a pipeline: the same calls, which a pipeline queues. */
+type Target = Record<string, (...args: unknown[]) => unknown>;
+
+/**
+ * How one command goes to ioredis: whether sending it twice is harmless, the call (to the
+ * client, or queued on a pipeline), and how its reply reads. `send: null`: the answer is
+ * known without asking (`answer`), so nothing is sent.
+ */
+interface Spec {
+	safe: boolean;
+	send: ((t: Target) => unknown) | null;
+	read: (c: Ioredis, reply: unknown) => unknown;
+	answer?: unknown;
+}
+
+const px = (ms: number) => Math.max(1, Math.round(ms));
+const asIs = (_c: Ioredis, reply: unknown) => reply;
+const isOne = (_c: Ioredis, reply: unknown) => reply === 1;
+const known = (answer: unknown): Spec => ({ safe: true, send: null, read: asIs, answer });
+const spec = (safe: boolean, name: string, args: unknown[], read: Spec['read'] = asIs): Spec => ({ safe, send: (t) => t[name]!(...args), read });
+
+function specOf(command: BatchCommand): Spec {
+	switch (command[0]) {
+		case 'get':
+		case 'pttl':
+		case 'hgetall':
+		case 'smembers':
+			return spec(true, command[0], [command[1]]);
+		case 'getdel':
+			return spec(false, 'getdel', [command[1]]);
+		case 'incr':
+			return spec(false, 'incr', [command[1]]);
+		case 'mget':
+			return command[1].length ? spec(true, 'mget', [...command[1]]) : known([]);
+		case 'set': {
+			const [, key, value, o = {}] = command;
+			const args: unknown[] = [key, value];
+			if (o.px !== undefined) args.push('PX', px(o.px));
+			if (o.nx) args.push('NX');
+			return spec(!o.nx, 'set', args, (_c, reply) => reply === 'OK');
+		}
+		case 'del': {
+			const [, ...keys] = command;
+			return keys.length ? spec(true, 'del', keys) : known(0);
+		}
+		case 'pexpire':
+			return spec(true, 'pexpire', [command[1], px(command[2])], isOne);
+		case 'hget':
+			return spec(true, 'hget', [command[1], command[2]]);
+		case 'hset':
+			return spec(true, 'hset', [command[1], command[2]]);
+		case 'hdel':
+		case 'sadd':
+		case 'srem': {
+			const [name, key, ...rest] = command;
+			return rest.length ? spec(true, name, [key, ...rest]) : known(0);
+		}
+		case 'scan': {
+			const pattern = command[1];
+			// The first page goes with the rest of a batch; any further pages follow on the same connection.
+			return spec(true, 'scan', ['0', 'MATCH', pattern, 'COUNT', SCAN_COUNT], async (c, reply) => {
+				let [cursor, page] = reply as [string, string[]];
+				const keys = new Set(page);
+				while (cursor !== '0') {
+					[cursor, page] = await c.scan(cursor, 'MATCH', pattern, 'COUNT', SCAN_COUNT);
+					for (const k of page) keys.add(k);
+				}
+				return [...keys];
+			});
+		}
+		case 'compareAndSet': {
+			const [, key, expected, value, o = {}] = command;
+			return spec(false, 'eval', [CAS_SET, 1, key, expected === null ? '1' : '0', expected ?? '', value, o.px === undefined ? '' : String(px(o.px))], isOne);
+		}
+		case 'compareAndDelete':
+			return spec(false, 'eval', [CAS_DEL, 1, command[1], command[2]], isOne);
+	}
+}
+
+const SCAN_COUNT = 200;
 
 /**
  * The real client. Nothing connects until the first command, and the connection
@@ -249,7 +343,8 @@ export function connectRedis(url: string, options: RedisOptions = {}): RedisClie
 					return await withTimeout(send(c), commandMs, 'Redis command');
 				} catch (error) {
 					const code = errorCode(error);
-					const lost = code === 'CARACMS_TIMEOUT' || /connection is closed|stream isn't writeable|command timed out/i.test(String((error as Error)?.message));
+					// A pipeline answered part way: ioredis aborts the rest ("Command aborted due to connection close").
+					const lost = code === 'CARACMS_TIMEOUT' || /connection is closed|stream isn't writeable|command timed out|aborted due to connection close/i.test(String((error as Error)?.message));
 					if (!lost) throw error; // Redis answered with an error: not ours to retry
 					drop(c);
 					if (!idempotent || Date.now() + backoffMs > deadline) {
@@ -264,45 +359,57 @@ export function connectRedis(url: string, options: RedisOptions = {}): RedisClie
 		}
 	};
 
+	/** One command, through `run`; one whose answer is known without asking (an MGET of no keys) isn't sent. */
+	const one = <T>(command: BatchCommand): Promise<T> => {
+		const s = specOf(command);
+		if (s.send === null) return Promise.resolve(s.answer as T);
+		return run(s.safe, async (c) => (await s.read(c, await s.send!(c as unknown as Target))) as T);
+	};
+
 	return {
-		get: (key) => run(true, (c) => c.get(key)),
-		mget: (keys) => (keys.length ? run(true, (c) => c.mget(...keys)) : Promise.resolve([])),
-		set: (key, value, o = {}) =>
-			run(!o.nx, async (c) => {
-				const args: (string | number)[] = [];
-				if (o.px !== undefined) args.push('PX', Math.max(1, Math.round(o.px)));
-				if (o.nx) args.push('NX');
-				const reply = await (c.set as (...a: unknown[]) => Promise<string | null>)(key, value, ...args);
-				return reply === 'OK';
-			}),
-		getdel: (key) => run(false, (c) => c.getdel(key)),
-		del: (...keys) => (keys.length ? run(true, (c) => c.del(...keys)) : Promise.resolve(0)),
-		incr: (key) => run(false, (c) => c.incr(key)),
-		pexpire: (key, ms) => run(true, async (c) => (await c.pexpire(key, Math.max(1, Math.round(ms)))) === 1),
-		pttl: (key) => run(true, (c) => c.pttl(key)),
-		hget: (key, field) => run(true, (c) => c.hget(key, field)),
-		hset: (key, fields) => run(true, (c) => c.hset(key, fields)),
-		hdel: (key, ...fields) => (fields.length ? run(true, (c) => c.hdel(key, ...fields)) : Promise.resolve(0)),
-		hgetall: (key) => run(true, (c) => c.hgetall(key)),
-		sadd: (key, ...members) => (members.length ? run(true, (c) => c.sadd(key, ...members)) : Promise.resolve(0)),
-		srem: (key, ...members) => (members.length ? run(true, (c) => c.srem(key, ...members)) : Promise.resolve(0)),
-		smembers: (key) => run(true, (c) => c.smembers(key)),
-		scan: (pattern) =>
-			run(true, async (c) => {
-				const keys = new Set<string>();
-				let cursor = '0';
-				do {
-					const [next, batch] = await c.scan(cursor, 'MATCH', pattern, 'COUNT', 200);
-					cursor = next;
-					for (const k of batch) keys.add(k);
-				} while (cursor !== '0');
-				return [...keys];
-			}),
-		compareAndSet: (key, expected, value, o = {}) =>
-			run(false, async (c) =>
-				(await c.eval(CAS_SET, 1, key, expected === null ? '1' : '0', expected ?? '', value, o.px === undefined ? '' : String(Math.max(1, Math.round(o.px))))) === 1,
-			),
-		compareAndDelete: (key, expected) => run(false, async (c) => (await c.eval(CAS_DEL, 1, key, expected)) === 1),
+		get: (key) => one(['get', key]),
+		mget: (keys) => one(['mget', keys]),
+		set: (key, value, o) => one(['set', key, value, o]),
+		getdel: (key) => one(['getdel', key]),
+		del: (...keys) => one(['del', ...keys]),
+		incr: (key) => one(['incr', key]),
+		pexpire: (key, ms) => one(['pexpire', key, ms]),
+		pttl: (key) => one(['pttl', key]),
+		hget: (key, field) => one(['hget', key, field]),
+		hset: (key, fields) => one(['hset', key, fields]),
+		hdel: (key, ...fields) => one(['hdel', key, ...fields]),
+		hgetall: (key) => one(['hgetall', key]),
+		sadd: (key, ...members) => one(['sadd', key, ...members]),
+		srem: (key, ...members) => one(['srem', key, ...members]),
+		smembers: (key) => one(['smembers', key]),
+		scan: (pattern) => one(['scan', pattern]),
+		compareAndSet: (key, expected, value, o) => one(['compareAndSet', key, expected, value, o]),
+		compareAndDelete: (key, expected) => one(['compareAndDelete', key, expected]),
+		// Redis diet Decision 7. ioredis answers a pipeline per command, `[error, reply]`, and
+		// a connection lost part way fills every unanswered one with "Connection is closed.":
+		// it can't say whether those ran (the command may have arrived, its answer not). So
+		// the batch is the unit: sent again whole when every command in it is safe to send
+		// twice, never when any isn't, and then it fails as a single unsafe command does.
+		batch: <const C extends readonly BatchCommand[]>(commands: C): Promise<BatchReplies<C>> => {
+			const specs = commands.map(specOf);
+			const sent = specs.filter((s) => s.send !== null);
+			if (sent.length === 0) return Promise.resolve(specs.map((s) => s.answer) as BatchReplies<C>);
+			return run(
+				sent.every((s) => s.safe),
+				async (c) => {
+					const pipeline = c.pipeline();
+					for (const s of sent) s.send!(pipeline as unknown as Target);
+					const results = await pipeline.exec();
+					if (!results) throw new Error('Redis gave no answer to the batch.');
+					const failed = results.find(([error]) => error);
+					if (failed) throw failed[0];
+					const out: unknown[] = [];
+					let i = 0;
+					for (const s of specs) out.push(s.send === null ? s.answer : await s.read(c, results[i++]![1]));
+					return out as BatchReplies<C>;
+				},
+			);
+		},
 		async close() {
 			if (idleTimer) clearTimeout(idleTimer);
 			idleTimer = null;
@@ -527,6 +634,21 @@ export function memoryRedis(options: { now?: () => number } = {}): MemoryRedis {
 			remove(key);
 			return true;
 		},
+		// Run in order, each counted; like a pipeline, every command runs and the first error is thrown after.
+		async batch<const C extends readonly BatchCommand[]>(commands: C): Promise<BatchReplies<C>> {
+			const out: unknown[] = [];
+			let failure: { error: unknown } | null = null;
+			for (const [name, ...args] of commands) {
+				try {
+					out.push(await (r[name] as (...a: unknown[]) => Promise<unknown>)(...args));
+				} catch (error) {
+					failure ??= { error };
+					out.push(null);
+				}
+			}
+			if (failure) throw failure.error;
+			return out as BatchReplies<C>;
+		},
 		async close() {},
 	};
 	return r;

package/src/live/runtime.ts

@@ -50,6 +50,8 @@ export interface RuntimeOptions {
 	log?: (line: string) => void;
 	runningCommit?: () => string | null;
 	railwayFetch?: typeof fetch;
+	/** Tests: the deploy hook's fetch. */
+	deployHookFetch?: typeof fetch;
 }
 
 /** Build and start a runtime (not shared: tests make their own). */
@@ -69,8 +71,9 @@ export async function createLiveRuntime(options: RuntimeOptions): Promise<LiveRu
 			backend = memory;
 		} else {
 			const tracker = new Tracker(now);
-			const { appId, privateKey, owner, repo } = settings.github;
-			backend = new GitHubBackend(new GitHubClient({ appId, privateKey, owner, repo, now }, tracker), settings.branches);
+			const gh = settings.github;
+			const connection = gh.kind === 'token' ? { token: gh.token, owner: gh.owner, repo: gh.repo, now } : { appId: gh.appId, privateKey: gh.privateKey, owner: gh.owner, repo: gh.repo, now };
+			backend = new GitHubBackend(new GitHubClient(connection, tracker), settings.branches);
 		}
 	}
 	const { main, drafts } = backend.branches;
@@ -86,7 +89,12 @@ export async function createLiveRuntime(options: RuntimeOptions): Promise<LiveRu
 		log,
 		runningCommit: options.runningCommit,
 		timings: settings.timings,
-		railway: settings.railway ? { ...settings.railway, fetch: options.railwayFetch } : null,
+		bakedCommit: settings.bakedCommit,
+		redeployer: settings.deployHook
+			? { kind: 'hook', url: settings.deployHook, fetch: options.deployHookFetch }
+			: settings.railway
+				? { kind: 'railway', ...settings.railway, fetch: options.railwayFetch }
+				: null,
 	});
 	// The copy only: the startup check waits for the live editor (editor.ts), which fills
 	// `commitPending` first, so a merge from main never runs ahead of pending autosaves (Decision 8).