ocel 0.0.1-alpha.0 → 0.0.1

package/dist/generated/config.d.ts

@@ -0,0 +1,428 @@
+/** The project configuration `ocel deploy` reads, whether written as `ocel.json`, as `ocel.yaml` or as `ocel.config.ts`. */
+export interface OcelConfig {
+    /** The JSON Schema this config is written against. ocel init writes the schema shipped with the CLI that created it. */
+    $schema?: string;
+    /** The needs this project waives rather than have a deploy refused over. */
+    allowDegraded?: ("edge-middleware" | "edge-runtime" | "ppr-resume" | "edge-cache" | "streaming")[];
+    /** The apps this project deploys. Left off, ocel detects one at the project root. */
+    apps?: AppConfig[];
+    /** Resources this project declares that ocel binds instead of provisioning them itself. Keyed by resource type, then by the name the app declares. The value is "@" followed by the name a record your own infrastructure published, such as "@warehouse", and a name nothing has published refuses the deploy; or the record written inline, checked at deploy rather than provisioned, optionally keyed by the tier it serves. */
+    bindings?: {
+        /** Each key is a bucket resource this project declares. Its value is "@" followed by the name a record is published under, such as "@warehouse"; or the record itself, whose secrets are ocel variables written { "$env": "NAME" }; or that record keyed by the tier it serves, leaving the other tier to provision its own. */
+        bucket?: Record<string, `@${string}` | BucketBinding | {
+            /** The record previews bind. Left off, previews provision their own. */
+            preview?: BucketBinding;
+            /** The record production binds. Left off, production provisions its own. */
+            production?: BucketBinding;
+        }>;
+        /** Each key is a kv resource this project declares; its value is "@" followed by the name the record is published under, such as "@shared-cache". */
+        kv?: Record<string, `@${string}`>;
+        /** Each key is a postgres resource this project declares. Its value is "@" followed by the name a record is published under, such as "@warehouse"; or the record itself, whose secrets are ocel variables written { "$env": "NAME" }; or that record keyed by the tier it serves, leaving the other tier to provision its own. */
+        postgres?: Record<string, `@${string}` | PostgresBinding | {
+            /** The record previews bind. Left off, previews provision their own. */
+            preview?: PostgresBinding;
+            /** The record production binds. Left off, production provisions its own. */
+            production?: PostgresBinding;
+        }>;
+    };
+    /** Where the resources an app declares are found. */
+    discovery?: DiscoveryConfig;
+    /** Where the project's hostname records are written, keyed by the DNS service's identifier with its options as the value, or named alone. */
+    dns?: DNSDescriptor;
+    /** The hostnames this project is served on. */
+    domains?: ProjectDomainConfig;
+    /** The edge in front of the origin, keyed by its identifier with its options as the value, or named alone. Omit it for the provider's default: CloudFront on AWS, and no edge on GCP or a VPS. */
+    edge?: EdgeDescriptor;
+    /** Where each tier's values are read from. A tier left off reads its default: ocel's own store in your account for production and preview, the project's .env file for dev. */
+    envSource?: EnvSourceConfig;
+    /** The provider ocel deploy provisions into, keyed by its identifier with its options as the value. A provider that needs no options may be named alone. */
+    provider?: ProviderDescriptor;
+    /** Where this project's container images are pushed. */
+    registry?: RegistryConfig;
+    /** The project's deployment identity. Every stack and resource ocel creates in your own account is keyed on it, so changing it forks a new project. */
+    slug: string;
+    /** Transform modules applied while provisioning, in order — later modules win where their patches collide. Each is a path to a module whose default export is a defineTransform(...) result, keyed by the provider it patches. */
+    transforms?: string | string[];
+}
+export interface AppConfig {
+    /** The processor architecture an app's functions or container image are built for. Left off, what the provider runs the app on. */
+    arch?: "x86_64" | "arm64";
+    /** How a container app's image is built. */
+    build?: BuildConfig;
+    /** What the app runs on: serverless functions packed per route, or one container image serving everything. */
+    compute?: "serverless" | "container";
+    /** The hostnames this app is served on. */
+    domains?: AppDomainConfig;
+    /** The file the app is served from, when it is not the one ocel would detect. */
+    entrypoint?: string;
+    /** The variables folder this app reads, when it does not read the project's own. */
+    folder?: string;
+    /** What a serverless app is built with, when ocel is not to read it off the app's own manifest. */
+    framework?: "node" | "next" | "go" | "python" | "rust";
+    /** How a container app is checked before it is served. */
+    health?: HealthConfig;
+    /** The most instances of a container app run at once, however busy it is. Left off, as many as minInstances, or 1. A serverless app scales itself and takes no instance counts. */
+    maxInstances?: number;
+    /** The fewest instances of a container app kept running, however quiet it is. Left off, 1. A serverless app scales itself and takes no instance counts. */
+    minInstances?: number;
+    /** The app's name. It is a label of every resource the app deploys and of its preview hostname, so it is a DNS label. */
+    name: string;
+    /** The app's directory, relative to the config. */
+    path: string;
+}
+/** How a container app's image is built. */
+export interface BuildConfig {
+    /** The command that builds the app inside the image. Left off, the app's own build script runs. */
+    command?: string;
+    /** The directory the image is built from, relative to the project. Left off, it is the workspace root the app belongs to. */
+    context?: string;
+    /** The Dockerfile to build from. A relative path resolves against the app's directory. */
+    dockerfile?: string;
+}
+/** The hostnames this app is served on. */
+export interface AppDomainConfig {
+    /** The hostnames production is served on. */
+    production?: string | string[];
+}
+/** How a container app is checked before it is served. */
+export interface HealthConfig {
+    /** The path the check requests, off the app's own root. Any 2xx answer means up. Left off, a VPS finds the path by probing /up, /health, /healthz and / in turn and keeps the first that exists, and AWS and Google Cloud request /. */
+    path?: string;
+}
+/** An existing S3-compatible bucket a tier binds rather than provisioning its own. */
+export interface BucketBinding {
+    /** The public half of the key pair the runtime reaches the store with. */
+    accessKeyId: VariableRef;
+    /** The bucket's name in that store. */
+    bucket: string | VariableRef;
+    /** The address of the S3-compatible store the bucket lives in, such as https://<account>.r2.cloudflarestorage.com. */
+    endpoint: string | VariableRef;
+    /** Address the bucket as a path on the endpoint rather than as a subdomain of it, for stores that serve no virtual hosts. */
+    pathStyle?: boolean;
+    /** The prefix every key the app writes is kept under, so one bucket can store several resources or environments. */
+    prefix?: string | VariableRef;
+    /** The address the bucket's objects are served from publicly, when the code declares it public. */
+    publicBaseUrl?: string | VariableRef;
+    /** The region requests to the store are signed for; auto for R2. */
+    region: string | VariableRef;
+    /** The secret half of that key pair. */
+    secretAccessKey: VariableRef;
+}
+/** An ocel variable holding this value, written { "$env": "NAME" }, so the value itself never sits in the config. */
+export interface VariableRef {
+    /** The ocel variable containing this value, set per tier and environment with ocel env set. The app never reads it as a variable of its own. */
+    $env: string;
+}
+/** An existing Postgres database a tier binds rather than provisioning its own, reached by a connection string or by host and role. */
+export type PostgresBinding = PostgresUrlBinding | PostgresHostBinding;
+export interface PostgresUrlBinding {
+    /** The whole connection string, kept verbatim so its sslmode, options and pooler parameters reach the client. */
+    url: VariableRef;
+}
+export interface PostgresHostBinding {
+    /** The database the app connects to. */
+    database: string | VariableRef;
+    /** The server's hostname. */
+    host: string | VariableRef;
+    /** The role's password. */
+    password: VariableRef;
+    /** The server's port. Left off, 5432. */
+    port?: number;
+    /** How the connection is encrypted. Left off, each client library connects as it does by default. */
+    tls?: PostgresTLS;
+    /** The role the app connects as. */
+    username: string | VariableRef;
+}
+/** How the connection is encrypted. Left off, each client library connects as it does by default. */
+export interface PostgresTLS {
+    /** The certificate authority the server's certificate chains to, as PEM, when it is not one the system trusts. */
+    ca?: VariableRef;
+    /** require encrypts the connection; verify-full also checks the server's certificate and hostname. */
+    mode: "require" | "verify-full";
+}
+/** Where the resources an app declares are found. */
+export interface DiscoveryConfig {
+    /** The directories containing infrastructure declarations, relative to the config. Left off, ocel reads the default discovery directory. */
+    paths?: string[];
+}
+/** Where the project's hostname records are written, keyed by the DNS service's identifier with its options as the value, or named alone. */
+export type DNSDescriptor = "cloudflare" | "route53" | {
+    cloudflare: DNSOptions;
+    route53?: never;
+} | {
+    cloudflare?: never;
+    route53: DNSOptions;
+};
+export interface DNSOptions {
+    /** The zone the records are written into. Omit it and ocel picks the zone that covers the hostname. */
+    zone?: string;
+}
+/** The hostnames this project is served on. */
+export interface ProjectDomainConfig {
+    /** The wildcard hostname previews are served under, such as *.preview.example.com. */
+    preview?: string;
+    /** The hostnames production is served on. */
+    production?: string | string[];
+}
+/** The edge in front of the origin, keyed by its identifier with its options as the value, or named alone. Omit it for the provider's default: CloudFront on AWS, and no edge on GCP or a VPS. */
+export type EdgeDescriptor = "alb" | "api-gateway" | "cloudflare" | "cloudfront" | {
+    alb: AlbEdgeOptions;
+    "api-gateway"?: never;
+    cloudflare?: never;
+    cloudfront?: never;
+} | {
+    alb?: never;
+    "api-gateway": ApiGatewayEdgeOptions;
+    cloudflare?: never;
+    cloudfront?: never;
+} | {
+    alb?: never;
+    "api-gateway"?: never;
+    cloudflare: CloudflareEdgeOptions;
+    cloudfront?: never;
+} | {
+    alb?: never;
+    "api-gateway"?: never;
+    cloudflare?: never;
+    cloudfront: CloudFrontEdgeOptions;
+};
+/** Options for the Application Load Balancer edge. Everything the load balancer needs comes from the provider's own options. */
+export type AlbEdgeOptions = Record<string, never>;
+/** Options for the API Gateway edge. Everything API Gateway needs comes from the provider's own options. */
+export type ApiGatewayEdgeOptions = Record<string, never>;
+/** Options for the Cloudflare edge. The token and account id are read from the environment. */
+export interface CloudflareEdgeOptions {
+    /** Reach the origin through a tunnel the origin opens to the edge, rather than at its address, so the origin takes no traffic from anything else. Cloudflare in front of a VPS box opens one. */
+    tunnel?: boolean;
+}
+/** Options for the CloudFront edge. Everything CloudFront needs comes from the provider's own options. */
+export type CloudFrontEdgeOptions = Record<string, never>;
+/** Where each tier's values are read from. A tier left off reads its default: ocel's own store in your account for production and preview, the project's .env file for dev. */
+export interface EnvSourceConfig {
+    /** Where ocel dev and ocel run read values from on your machine. Left off, the project's .env file ("dotenv"). .env.local overrides whatever this reads. */
+    dev?: DevEnvSourceDescriptor;
+    /** Where every preview's tier-wide values are read from. Left off, ocel's own store in your account ("builtin"). A value set for one named preview stays ocel's own. */
+    preview?: EnvSourceDescriptor;
+    /** Where production's values are read from. Left off, ocel's own store in your account ("builtin"). */
+    production?: EnvSourceDescriptor;
+}
+/** Where ocel dev and ocel run read values from on your machine: the project's .env file ("dotenv"), or an env source keyed by its identifier with its options as the value. */
+export type DevEnvSourceDescriptor = "dotenv" | {
+    /** A command run on your machine, whose output is the values. */
+    exec: ExecOptions;
+    infisical?: never;
+} | {
+    /** Infisical, read as you: from INFISICAL_TOKEN, or else the infisical CLI you are logged in to. */
+    infisical: InfisicalOptions;
+    exec?: never;
+};
+/** A command whose output is a tier's values: run on the machine that deploys for production and preview, and on yours for dev. */
+export interface ExecOptions {
+    /** The command to run and its arguments. {folder} in an argument is replaced with the variables folder being read. */
+    command: string[];
+    /** What the command prints: a JSON object of names to values, or KEY=VALUE lines. */
+    format: "json" | "dotenv";
+}
+/** The Infisical project and environment a tier reads its values from. Production and preview read it as the machine identity auth names; dev reads it as you. */
+export interface InfisicalOptions {
+    /** The machine identity production or preview reads as, keyed by its login method. Required there, and refused for dev, which reads as you. */
+    auth?: InfisicalAuth;
+    /** The slug of the Infisical environment this tier reads, such as prod. */
+    environment: string;
+    /** The base URL of a self-hosted Infisical. Left off, https://app.infisical.com. */
+    host?: string;
+    /** The Infisical folder the project's values sit under. A variables folder such as /web reads from that folder beneath it. Left off, the environment's root, /. */
+    path?: string;
+    /** The id of the Infisical project the values live in. */
+    project: string;
+    /** What ocel may write into Infisical. "missing" creates a key a declaration names and Infisical lacks, and never overwrites one. "values" also updates a value Infisical holds, from ocel env set or the variables page, unless it changed in Infisical since ocel last read it. Nothing ocel does ever deletes a key there. Left off, "never". Refused for dev, which only reads. */
+    write?: "never" | "missing" | "values";
+}
+/** How ocel logs in to Infisical, keyed by the login method. */
+export type InfisicalAuth = {
+    /** Universal Auth: a client id and client secret, each an ocel variable. */
+    universal: UniversalAuth;
+    identity?: never;
+} | {
+    /** This target's own cloud identity signs in, so no secret is stored. */
+    identity: IdentityAuth;
+    universal?: never;
+};
+/** Logs in to Infisical with a Universal Auth client id and client secret, each an ocel variable. */
+export interface UniversalAuth {
+    /** The ocel variable containing the Universal Auth client id. */
+    clientId: VariableRef;
+    /** The ocel variable containing the Universal Auth client secret. */
+    clientSecret: VariableRef;
+}
+/** Logs in to Infisical as the target's own cloud identity, so no secret is stored. */
+export interface IdentityAuth {
+    /** The id of the Infisical machine identity to sign in as. */
+    identityId: string;
+}
+/** Where production or preview reads its values from: ocel's own store in your account ("builtin"), or an env source keyed by its identifier with its options as the value. */
+export type EnvSourceDescriptor = "builtin" | {
+    /** A command run on the machine that deploys, whose output is the tier's values. It runs at each deploy and on no schedule. */
+    exec: ExecOptions;
+    infisical?: never;
+} | {
+    /** Infisical, read as the machine identity auth names and synced every minute. */
+    infisical: InfisicalOptions;
+    exec?: never;
+};
+/** The provider ocel deploy provisions into, keyed by its identifier with its options as the value. A provider that needs no options may be named alone. */
+export type ProviderDescriptor = "aws" | {
+    aws: AwsProviderOptions;
+    gcp?: never;
+    vps?: never;
+} | {
+    aws?: never;
+    gcp: GcpProviderOptions;
+    vps?: never;
+} | {
+    aws?: never;
+    gcp?: never;
+    vps: VpsProviderOptions;
+};
+export interface AwsProviderOptions {
+    /** Certificates to serve a hostname with, keyed by hostname, valued by the ARN of an already-issued ACM certificate. A hostname left off gets a certificate ocel requests, validates and deletes again. */
+    certificates?: Record<string, string>;
+    /** The AWS region to deploy into. */
+    region?: string;
+    /** ARN of a KMS key to encrypt this account's variables under. Omit it and ocel bootstrap --features variables-key makes a key ocel owns. */
+    variablesKey?: string;
+}
+export interface GcpProviderOptions {
+    /** The Google Cloud project to deploy into. */
+    project: string;
+    /** The region to deploy into. A project spans them all, so this names the one. */
+    region: string;
+}
+export interface VpsProviderOptions {
+    /** Certificates to serve a hostname with, keyed by hostname, valued by the path to the certificate on the machine. */
+    certificates?: Record<string, string>;
+    /** Path to the public key the ocel-deploy login accepts; defaults to the bootstrapping login's keys. */
+    deployKey?: string;
+    /** Deploy previews even though the proxy orders a publicly trusted certificate for each preview hostname, which Certificate Transparency logs publish within minutes. Left out, such a preview deploy is refused: set proxy.traefik.previewResolver, pin a wildcard certificate for the preview base, or front the box with an edge that shields it with an origin certificate instead. */
+    perHostnamePreviewCertificates?: boolean;
+    /** What fronts this machine on ports 80 and 443. Leave it out and ocel runs its own proxy; name the one the machine already runs to deploy behind it. */
+    proxy?: VpsProxy;
+    /** The machine to deploy onto: a Host alias from ssh_config, or the destination spelled out. */
+    ssh: string | VpsTarget;
+}
+/** What fronts this machine on ports 80 and 443. Leave it out and ocel runs its own proxy; name the one the machine already runs to deploy behind it. */
+export type VpsProxy = "manual" | {
+    /** A Traefik the machine already runs, reading ocel's routes from a directory its file provider watches. */
+    traefik: VpsTraefik;
+    caddy?: never;
+    manual?: never;
+} | {
+    /** A Caddy the machine already runs, importing ocel's site blocks from a directory. */
+    caddy: VpsCaddy;
+    traefik?: never;
+    manual?: never;
+} | {
+    /** A proxy you route to ocel yourself; ocel writes nothing to it. */
+    manual: VpsManual;
+    traefik?: never;
+    caddy?: never;
+};
+/** A Traefik the machine already runs, reading ocel's routes from a directory its file provider watches. */
+export type VpsTraefik = {
+    /** Where directory is mounted in the container your Traefik runs in, as its providers.file.directory names it; ocel.yml names the origin certificates it places in directory by this path. Left out, directory itself. */
+    containerDirectory?: string;
+    /** The directory Traefik's file provider watches, where ocel writes its routers. */
+    directory?: string;
+    /** The entry points ocel's routers attach to. */
+    entrypoints?: VpsEntrypoints;
+    /** A docker network ocel's switchboard joins, so Traefik reaches it by name. Not with port. */
+    network?: string;
+    /** The loopback port ocel's switchboard is published on for Traefik to reach, in place of the network a preset fills; 8480 when left out. Not with network. */
+    port?: number;
+    /** The host tool whose Traefik this is. It fills in every other field, and a field written beside it overrides. */
+    preset: "coolify" | "dokploy";
+    /** A resolver that can issue the preview base's wildcard over DNS-01. Set, previews share one wildcard certificate; left out, each preview hostname gets its own from resolver. */
+    previewResolver?: string;
+    /** The certificate resolver every hostname router ocel writes names. */
+    resolver?: string;
+} | {
+    /** Where directory is mounted in the container your Traefik runs in, as its providers.file.directory names it; ocel.yml names the origin certificates it places in directory by this path. Left out, directory itself. */
+    containerDirectory?: string;
+    /** The directory Traefik's file provider watches, where ocel writes its routers. */
+    directory: string;
+    /** The entry points ocel's routers attach to. */
+    entrypoints?: VpsEntrypoints;
+    /** A docker network ocel's switchboard joins, so Traefik reaches it by name. Not with port. */
+    network?: string;
+    /** The loopback port ocel's switchboard is published on for Traefik to reach, in place of the network a preset fills; 8480 when left out. Not with network. */
+    port?: number;
+    preset?: never;
+    /** A resolver that can issue the preview base's wildcard over DNS-01. Set, previews share one wildcard certificate; left out, each preview hostname gets its own from resolver. */
+    previewResolver?: string;
+    /** The certificate resolver every hostname router ocel writes names. */
+    resolver: string;
+};
+/** The entry points ocel's routers attach to. */
+export interface VpsEntrypoints {
+    /** The entry point ocel's http-to-https redirect routers attach to; web when left out. */
+    http?: string;
+    /** The entry point ocel's hostname routers attach to; websecure when left out. */
+    https?: string;
+}
+/** A Caddy the machine already runs, importing ocel's site blocks from a directory. */
+export type VpsCaddy = {
+    /** The config file caddy reload names inside the container; /etc/caddy/Caddyfile when left out. */
+    config?: string;
+    /** The container Caddy runs in; left out, Caddy runs as the systemd caddy.service. */
+    container?: string;
+    /** Where directory is mounted in the container Caddy runs in; ocel.caddy names the origin certificates it places in directory by this path. Left out, directory itself. */
+    containerDirectory?: string;
+    /** The directory the running Caddy imports site blocks from. */
+    directory?: string;
+    /** A docker network ocel's switchboard joins, so Caddy reaches it by name. Not with port. */
+    network?: string;
+    /** The loopback port ocel's switchboard is published on for Caddy to reach, in place of the network a preset fills; 8480 when left out. Not with network. */
+    port?: number;
+    /** The host tool whose Caddy this is. It fills in every other field, and a field written beside it overrides. */
+    preset: "coolify";
+} | {
+    /** The config file caddy reload names inside the container; /etc/caddy/Caddyfile when left out. */
+    config?: string;
+    /** The container Caddy runs in; left out, Caddy runs as the systemd caddy.service. */
+    container?: string;
+    /** Where directory is mounted in the container Caddy runs in; ocel.caddy names the origin certificates it places in directory by this path. Left out, directory itself. */
+    containerDirectory?: string;
+    /** The directory the running Caddy imports site blocks from. */
+    directory: string;
+    /** A docker network ocel's switchboard joins, so Caddy reaches it by name. Not with port. */
+    network?: string;
+    /** The loopback port ocel's switchboard is published on for Caddy to reach, in place of the network a preset fills; 8480 when left out. Not with network. */
+    port?: number;
+    preset?: never;
+};
+/** A proxy you route to ocel yourself; ocel writes nothing to it. */
+export interface VpsManual {
+    /** A docker network ocel's switchboard also joins, so a proxy on it reaches the switchboard by name even after it is recreated. */
+    network?: string;
+    /** The loopback port your proxy forwards to ocel's switchboard on; 8480 when left out. */
+    port?: number;
+}
+export interface VpsTarget {
+    /** The hostname or address to reach the machine at. */
+    host: string;
+    /** The private key to authenticate with, as a path. */
+    identityFile?: string;
+    /** The port sshd listens on. Omit it and ssh's own default applies. */
+    port?: number;
+    /** The account to log in as. Omit it and ssh resolves the user itself. */
+    user?: string;
+}
+/** Where this project's container images are pushed. */
+export interface RegistryConfig {
+    /** The environment variable containing the password or token, written as "${REGISTRY_TOKEN}" and read where the push authenticates — never the secret itself. */
+    password: `\${${string}`;
+    /** The registry host and the namespace images sit under, such as ghcr.io/acme. No scheme, and no credentials. */
+    server: string;
+    /** The username the push authenticates as, where the registry wants one. */
+    username?: string;
+}

package/dist/generated/config.js

@@ -0,0 +1,2 @@
+// generated by scripts/schema/build.mjs from the committed JSON Schema; do not edit
+export {};

package/dist/kv/entries.d.ts

@@ -0,0 +1,193 @@
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+import type { ChainableCommander, Redis } from "ioredis";
+import { KvShape } from "../gen/proto/app/resources/v1/resources_pb.js";
+import { type KeyArgs, type KeyOf, type Pattern } from "./pattern.js";
+import { type KVDuration, type TTL, type WriteOptions } from "./ttl.js";
+export type Shape = "text" | "counter" | "json" | "list" | "set";
+export declare const shapes: Record<Shape, KvShape>;
+/** How an entry is declared. */
+export interface EntryOptions {
+    /** How long a key lives after each write; without it, until it is deleted or evicted. */
+    ttl?: KVDuration;
+}
+/** How a `json` entry is declared. */
+export interface JsonEntryOptions<TSchema extends StandardSchemaV1> extends EntryOptions {
+    /** The Standard Schema every value is checked against, on write and on read. */
+    schema: TSchema;
+    /**
+     * What a read does with a stored value that fails the schema: `"throw"` (the default)
+     * throws an {@link InvalidKVValueError}, and `"miss"` reads it as absent.
+     */
+    onInvalid?: "throw" | "miss";
+}
+/** An entry as declared, before it is a member of a store. */
+export interface EntryDeclaration<TShape extends Shape = Shape, TPattern extends string = string, TInput = unknown, TOutput = unknown> {
+    /** The encoding the entry's keys hold. */
+    readonly shape: TShape;
+    /** The pattern its keys are built from. */
+    readonly pattern: TPattern;
+    /** Type-only: the value a write takes and the value a read answers. */
+    readonly types?: {
+        input: TInput;
+        output: TOutput;
+    };
+}
+export declare function declareEntry<TShape extends Shape, TPattern extends string, TInput, TOutput>(shape: TShape, pattern: TPattern, options: EntryOptions & {
+    schema?: StandardSchemaV1;
+    onInvalid?: "throw" | "miss";
+}): EntryDeclaration<TShape, TPattern, TInput, TOutput>;
+export interface DeclaredEntry {
+    shape: Shape;
+    pattern: string;
+    parsed: Pattern;
+    ttl: number | undefined;
+    schema: StandardSchemaV1 | undefined;
+    missOnInvalid: boolean;
+    source: string;
+}
+export declare function readDeclaredEntry(declaration: EntryDeclaration): DeclaredEntry;
+/** A `text` entry: a string under each key. */
+export interface TextEntry<TPattern extends string> {
+    /** The string under the key, or `undefined` when there is none. */
+    get(...key: KeyArgs<TPattern>): Promise<string | undefined>;
+    /** The string under each key, in order, read in one round trip. */
+    getMany(keys: readonly KeyOf<TPattern>[]): Promise<(string | undefined)[]>;
+    /** Writes the string under the key. */
+    set(...args: [...KeyArgs<TPattern>, value: string, options?: WriteOptions]): Promise<void>;
+    /** Deletes the key, answering whether it existed. */
+    delete(...key: KeyArgs<TPattern>): Promise<boolean>;
+}
+/**
+ * A `counter` entry: an integer under each key, changed atomically. A count is a safe
+ * integer: reading or answering one past ±(2^53 - 1) throws a `RangeError`.
+ */
+export interface CounterEntry<TPattern extends string> {
+    /** The integer under the key, or `undefined` when there is none. */
+    get(...key: KeyArgs<TPattern>): Promise<number | undefined>;
+    /** The integer under each key, in order, read in one round trip. */
+    getMany(keys: readonly KeyOf<TPattern>[]): Promise<(number | undefined)[]>;
+    /** Writes the integer under the key. */
+    set(...args: [...KeyArgs<TPattern>, value: number, options?: WriteOptions]): Promise<void>;
+    /** Adds `by` (1 by default) to the integer under the key, from 0 when there is none, and answers the sum. */
+    increment(...args: [...KeyArgs<TPattern>, by?: number, options?: WriteOptions]): Promise<number>;
+    /** Subtracts `by` (1 by default) from the integer under the key, from 0 when there is none, and answers the difference. */
+    decrement(...args: [...KeyArgs<TPattern>, by?: number, options?: WriteOptions]): Promise<number>;
+    /** Deletes the key, answering whether it existed. */
+    delete(...key: KeyArgs<TPattern>): Promise<boolean>;
+}
+/** A `json` entry: a value checked against the entry's schema under each key. */
+export interface JsonEntry<TPattern extends string, TInput, TOutput> {
+    /** The value under the key, or `undefined` when there is none. */
+    get(...key: KeyArgs<TPattern>): Promise<TOutput | undefined>;
+    /** The value under each key, in order, read in one round trip. */
+    getMany(keys: readonly KeyOf<TPattern>[]): Promise<(TOutput | undefined)[]>;
+    /** Checks the value against the schema and writes the value the schema answers under the key. */
+    set(...args: [...KeyArgs<TPattern>, value: TInput, options?: WriteOptions]): Promise<void>;
+    /** Deletes the key, answering whether it existed. */
+    delete(...key: KeyArgs<TPattern>): Promise<boolean>;
+}
+/** A `list` entry: a list of strings under each key. */
+export interface ListEntry<TPattern extends string> {
+    /** Appends the values to the end of the list, answering its new length. */
+    push(...args: [...KeyArgs<TPattern>, values: string | readonly string[], options?: WriteOptions]): Promise<number>;
+    /** Prepends the values to the start of the list, answering its new length. */
+    unshift(...args: [...KeyArgs<TPattern>, values: string | readonly string[], options?: WriteOptions]): Promise<number>;
+    /** Removes and answers the last value, or `undefined` when the list is empty. */
+    pop(...key: KeyArgs<TPattern>): Promise<string | undefined>;
+    /** Removes and answers the first value, or `undefined` when the list is empty. */
+    shift(...key: KeyArgs<TPattern>): Promise<string | undefined>;
+    /** The value at `index`, counting back from the end when negative, or `undefined` past either end. */
+    at(...args: [...KeyArgs<TPattern>, index: number]): Promise<string | undefined>;
+    /** The values from `start` up to but not including `end`, as `Array.prototype.slice` reads them. */
+    slice(...args: [...KeyArgs<TPattern>, start?: number, end?: number]): Promise<string[]>;
+    /** How many values the list holds. */
+    length(...key: KeyArgs<TPattern>): Promise<number>;
+    /** Deletes the list, answering whether it existed. */
+    delete(...key: KeyArgs<TPattern>): Promise<boolean>;
+}
+/** A `set` entry: a set of strings under each key. */
+export interface SetEntry<TPattern extends string> {
+    /** Adds the members, answering how many were not already in the set. */
+    add(...args: [...KeyArgs<TPattern>, members: string | readonly string[], options?: WriteOptions]): Promise<number>;
+    /** Removes the member, answering whether it was in the set. */
+    delete(...args: [...KeyArgs<TPattern>, member: string]): Promise<boolean>;
+    /** Whether the member is in the set. */
+    has(...args: [...KeyArgs<TPattern>, member: string]): Promise<boolean>;
+    /** How many members the set holds. */
+    size(...key: KeyArgs<TPattern>): Promise<number>;
+    /** Every member of the set. */
+    values(...key: KeyArgs<TPattern>): Promise<Set<string>>;
+    /** Deletes the set, answering whether it existed. */
+    clear(...key: KeyArgs<TPattern>): Promise<boolean>;
+}
+/** The member a store holds for an entry declaration. */
+export type EntryOf<TDeclaration> = TDeclaration extends EntryDeclaration<infer TShape, infer TPattern, infer TInput, infer TOutput> ? {
+    text: TextEntry<TPattern>;
+    counter: CounterEntry<TPattern>;
+    json: JsonEntry<TPattern, TInput, TOutput>;
+    list: ListEntry<TPattern>;
+    set: SetEntry<TPattern>;
+}[TShape] : never;
+type OpenClient = (operation: string) => Redis;
+type Args = unknown[];
+declare class Entry {
+    protected readonly name: string;
+    protected readonly declaration: DeclaredEntry;
+    private readonly openClient;
+    private readonly keyed;
+    constructor(name: string, declaration: DeclaredEntry, openClient: OpenClient);
+    protected open(operation: string): Redis;
+    protected split(args: Args): [string, Args];
+    protected keyOf(key: unknown): string;
+    protected ttl(options: unknown): TTL;
+    protected setString(client: Redis, key: string, value: string, ttl: TTL): Promise<void>;
+    protected write<T>(client: Redis, key: string, ttl: TTL, command: (transaction: ChainableCommander) => ChainableCommander): Promise<T>;
+    protected readMany(operation: string, keys: readonly unknown[]): Promise<(string | null)[]>;
+    protected deleteKey(operation: string, args: Args): Promise<boolean>;
+}
+export declare class TextHandle extends Entry {
+    get(...args: Args): Promise<string | undefined>;
+    getMany(keys: readonly unknown[]): Promise<(string | undefined)[]>;
+    set(...args: Args): Promise<void>;
+    delete(...args: Args): Promise<boolean>;
+}
+export declare class CounterHandle extends Entry {
+    private decode;
+    get(...args: Args): Promise<number | undefined>;
+    getMany(keys: readonly unknown[]): Promise<(number | undefined)[]>;
+    set(...args: Args): Promise<void>;
+    increment(...args: Args): Promise<number>;
+    decrement(...args: Args): Promise<number>;
+    private add;
+    delete(...args: Args): Promise<boolean>;
+}
+export declare class JsonHandle extends Entry {
+    private get schema();
+    private decode;
+    private refuseRead;
+    get(...args: Args): Promise<unknown>;
+    getMany(keys: readonly unknown[]): Promise<unknown[]>;
+    set(...args: Args): Promise<void>;
+    delete(...args: Args): Promise<boolean>;
+}
+export declare class ListHandle extends Entry {
+    push(...args: Args): Promise<number>;
+    unshift(...args: Args): Promise<number>;
+    private insert;
+    pop(...args: Args): Promise<string | undefined>;
+    shift(...args: Args): Promise<string | undefined>;
+    at(...args: Args): Promise<string | undefined>;
+    slice(...args: Args): Promise<string[]>;
+    length(...args: Args): Promise<number>;
+    delete(...args: Args): Promise<boolean>;
+}
+export declare class SetHandle extends Entry {
+    add(...args: Args): Promise<number>;
+    delete(...args: Args): Promise<boolean>;
+    has(...args: Args): Promise<boolean>;
+    size(...args: Args): Promise<number>;
+    values(...args: Args): Promise<Set<string>>;
+    clear(...args: Args): Promise<boolean>;
+}
+export declare const handles: Record<Shape, new (name: string, declaration: DeclaredEntry, openClient: OpenClient) => Entry>;
+export {};