implemented 0.db as admin database architecture + updated test file

* main:
  fixed test not running due to misaligned path

Cargo.toml

@@ -1,9 +1,30 @@
-[workspace]
-members = ["herodb"]
-resolver = "2"
+[package]
+name = "herodb"
+version = "0.0.1"
+authors = ["ThreeFold Tech NV"]
+edition = "2024"
 
-# You can define shared profiles for all workspace members here
-[profile.release]
-lto = true
-codegen-units = 1
-strip = true
+[dependencies]
+anyhow = "1.0.59"
+bytes = "1.3.0"
+thiserror = "1.0.32"
+tokio = { version = "1.23.0", features = ["full"] }
+clap = { version = "4.5.20", features = ["derive"] }
+byteorder = "1.4.3"
+futures = "0.3"
+sled = "0.34"
+redb = "2.1.3"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+bincode = "1.3"
+chacha20poly1305 = "0.10.1"
+rand = "0.8"
+sha2 = "0.10"
+age = "0.10"
+secrecy = "0.8"
+ed25519-dalek = "2"
+base64 = "0.22"
+jsonrpsee = { version = "0.26.0", features = ["http-client", "ws-client", "server", "macros"] }
+
+[dev-dependencies]
+redis = { version = "0.24", features = ["aio", "tokio-comp"] }

README.md

@@ -0,0 +1,85 @@
+# HeroDB
+
+HeroDB is a Redis-compatible database built with Rust, offering a flexible and secure storage solution. It supports two primary storage backends: `redb` (default) and `sled`, both with full encryption capabilities. HeroDB aims to provide a robust and performant key-value store with advanced features like data-at-rest encryption, hash operations, list operations, and cursor-based scanning.
+
+## Purpose
+
+The main purpose of HeroDB is to offer a lightweight, embeddable, and Redis-compatible database that prioritizes data security through transparent encryption. It's designed for applications that require fast, reliable data storage with the option for strong cryptographic protection, without the overhead of a full-fledged Redis server.
+
+## Features
+
+- **Redis Compatibility**: Supports a subset of Redis commands over RESP (Redis Serialization Protocol) via TCP.
+- **Dual Backend Support**:
+    - `redb` (default): Optimized for concurrent access and high-throughput scenarios.
+    - `sled`: A lock-free, log-structured database, excellent for specific workloads.
+- **Data-at-Rest Encryption**: Transparent encryption for both backends using the `age` encryption library.
+- **Key-Value Operations**: Full support for basic string, hash, and list operations.
+- **Expiration**: Time-to-live (TTL) functionality for keys.
+- **Scanning**: Cursor-based iteration for keys and hash fields (`SCAN`, `HSCAN`).
+- **AGE Cryptography Commands**: HeroDB-specific extensions for cryptographic operations.
+
+## Quick Start
+
+### Building HeroDB
+
+To build HeroDB, navigate to the project root and run:
+
+```bash
+cargo build --release
+```
+
+### Running HeroDB
+
+You can start HeroDB with different backends and encryption options:
+
+#### Default `redb` Backend
+
+```bash
+./target/release/herodb --dir /tmp/herodb_redb --port 6379
+```
+
+#### `sled` Backend
+
+```bash
+./target/release/herodb --dir /tmp/herodb_sled --port 6379 --sled
+```
+
+#### `redb` with Encryption
+
+```bash
+./target/release/herodb --dir /tmp/herodb_encrypted --port 6379 --encrypt --encryption_key mysecretkey
+```
+
+#### `sled` with Encryption
+
+```bash
+./target/release/herodb --dir /tmp/herodb_sled_encrypted --port 6379 --sled --encrypt --encryption_key mysecretkey
+```
+
+## Usage with Redis Clients
+
+HeroDB can be interacted with using any standard Redis client, such as `redis-cli`, `redis-py` (Python), or `ioredis` (Node.js).
+
+### Example with `redis-cli`
+
+```bash
+redis-cli -p 6379 SET mykey "Hello from HeroDB!"
+redis-cli -p 6379 GET mykey
+# → "Hello from HeroDB!"
+
+redis-cli -p 6379 HSET user:1 name "Alice" age "30"
+redis-cli -p 6379 HGET user:1 name
+# → "Alice"
+
+redis-cli -p 6379 SCAN 0 MATCH user:* COUNT 10
+# → 1) "0"
+#    2) 1) "user:1"
+```
+
+## Documentation
+
+For more detailed information on commands, features, and advanced usage, please refer to the documentation:
+
+- [Basics](docs/basics.md)
+- [Supported Commands](docs/cmds.md)
+- [AGE Cryptography](docs/age.md)

docs/age.md

@@ -16,33 +16,40 @@ Note: Database-at-rest encryption flags in the test harness are unrelated to AGE
 
 ## Quick start
 
-Assuming the server is running on localhost on some PORT:
+Assuming the server is running on localhost on some $PORT:
+```bash
+~/code/git.ourworld.tf/herocode/herodb/herodb/build.sh
+~/code/git.ourworld.tf/herocode/herodb/target/release/herodb --dir /tmp/data --debug --$PORT 6381 --encryption-key 1234 --encrypt
+```
+
 
 ```bash
+export PORT=6381
 # Generate an ephemeral keypair and encrypt/decrypt a message (stateless mode)
-redis-cli -p PORT AGE GENENC
+redis-cli -p $PORT AGE GENENC
 # → returns an array: [recipient, identity]
 
-redis-cli -p PORT AGE ENCRYPT <recipient> "hello world"
+redis-cli -p $PORT AGE ENCRYPT <recipient> "hello world"
 # → returns ciphertext (base64 in a bulk string)
 
-redis-cli -p PORT AGE DECRYPT <identity> <ciphertext_b64>
+redis-cli -p $PORT AGE DECRYPT <identity> <ciphertext_b64>
 # → returns "hello world"
 ```
 
 For key‑managed mode, generate a named key once and reference it by name afterwards:
 
 ```bash
-redis-cli -p PORT AGE KEYGEN app1
+redis-cli -p $PORT AGE KEYGEN app1
 # → persists encryption keypair under name "app1"
 
-redis-cli -p PORT AGE ENCRYPTNAME app1 "hello"
-redis-cli -p PORT AGE DECRYPTNAME app1 <ciphertext_b64>
+redis-cli -p $PORT AGE ENCRYPTNAME app1 "hello"
+redis-cli -p $PORT AGE DECRYPTNAME app1 <ciphertext_b64>
 ```
 
 ## Stateless AGE (ephemeral)
 
 Characteristics
+
 - No server‑side storage of keys.
 - You pass the actual key material with every call.
 - Not listable via AGE LIST.
@@ -53,35 +60,39 @@ Commands and examples
 
 ```bash
 # Generate an ephemeral encryption keypair 
-redis-cli -p PORT AGE GENENC
+redis-cli -p $PORT AGE GENENC
 # Example output (abridged):
-# 1) "age1qz..."          # recipient (public)
-# 2) "AGE-SECRET-KEY-1..." # identity (secret)
+# 1) "age1qz..."          # recipient (public key) = can be used by others e.g. to verify what I sign
+# 2) "AGE-SECRET-KEY-1..." # identity (secret) = is like my private, cannot lose this one
 
-# Encrypt with the recipient
-redis-cli -p PORT AGE ENCRYPT "age1qz..." "hello world"
-# → returns bulk string payload: base64 ciphertext
+# Encrypt with the recipient public key
+redis-cli -p $PORT AGE ENCRYPT "age1qz..." "hello world"
 
-# Decrypt with the identity (secret)
-redis-cli -p PORT AGE DECRYPT "AGE-SECRET-KEY-1..." "<ciphertext_b64>"
+# → returns bulk string payload: base64 ciphertext (encrypted content)
+
+# Decrypt with the identity (secret) in other words your private key
+redis-cli -p $PORT AGE DECRYPT "AGE-SECRET-KEY-1..." "<ciphertext_b64>"
 # → "hello world"
 ```
 
 2) Ephemeral signing keys
 
+> ? is this same as my private key
+
 ```bash
+
 # Generate an ephemeral signing keypair
-redis-cli -p PORT AGE GENSIGN
+redis-cli -p $PORT AGE GENSIGN
 # Example output:
 # 1) "<verify_pub_b64>"
 # 2) "<sign_secret_b64>"
 
 # Sign a message with the secret
-redis-cli -p PORT AGE SIGN "<sign_secret_b64>" "msg"
+redis-cli -p $PORT AGE SIGN "<sign_secret_b64>" "msg"
 # → returns "<signature_b64>"
 
 # Verify with the public key
-redis-cli -p PORT AGE VERIFY "<verify_pub_b64>" "msg" "<signature_b64>"
+redis-cli -p $PORT AGE VERIFY "<verify_pub_b64>" "msg" "<signature_b64>"
 # → 1 (valid) or 0 (invalid)
 ```
 
@@ -105,15 +116,17 @@ Commands and examples
 
 ```bash
 # Create/persist a named encryption keypair
-redis-cli -p PORT AGE KEYGEN app1
+redis-cli -p $PORT AGE KEYGEN app1
 # → returns [recipient, identity] but also stores them under name "app1"
 
+> TODO: should not return identity (security, but there can be separate function to export it e.g. AGE EXPORTKEY app1)
+
 # Encrypt using the stored public key
-redis-cli -p PORT AGE ENCRYPTNAME app1 "hello"
+redis-cli -p $PORT AGE ENCRYPTNAME app1 "hello"
 # → returns bulk string payload: base64 ciphertext
 
 # Decrypt using the stored secret
-redis-cli -p PORT AGE DECRYPTNAME app1 "<ciphertext_b64>"
+redis-cli -p $PORT AGE DECRYPTNAME app1 "<ciphertext_b64>"
 # → "hello"
 ```
 
@@ -121,22 +134,24 @@ redis-cli -p PORT AGE DECRYPTNAME app1 "<ciphertext_b64>"
 
 ```bash
 # Create/persist a named signing keypair
-redis-cli -p PORT AGE SIGNKEYGEN app1
+redis-cli -p $PORT AGE SIGNKEYGEN app1
 # → returns [verify_pub_b64, sign_secret_b64] and stores under name "app1"
 
+> TODO: should not return sign_secret_b64 (for security, but there can be separate function to export it e.g. AGE EXPORTSIGNKEY app1)
+
 # Sign using the stored secret
-redis-cli -p PORT AGE SIGNNAME app1 "msg"
+redis-cli -p $PORT AGE SIGNNAME app1 "msg"
 # → returns "<signature_b64>"
 
 # Verify using the stored public key
-redis-cli -p PORT AGE VERIFYNAME app1 "msg" "<signature_b64>"
+redis-cli -p $PORT AGE VERIFYNAME app1 "msg" "<signature_b64>"
 # → 1 (valid) or 0 (invalid)
 ```
 
 3) List stored AGE keys
 
 ```bash
-redis-cli -p PORT AGE LIST
+redis-cli -p $PORT AGE LIST
 # Example output includes labels such as "encpub" and your key names (e.g., "app1")
 ```
 

docs/basics.md

@@ -0,0 +1,623 @@
+Here's an expanded version of the cmds.md documentation to include the list commands:
+# HeroDB Commands
+
+HeroDB implements a subset of Redis commands over the Redis protocol. This document describes the available commands and their usage.
+
+## String Commands
+
+### PING
+Ping the server to test connectivity.
+```bash
+redis-cli -p $PORT PING
+# → PONG
+```
+
+### ECHO
+Echo the given message.
+```bash
+redis-cli -p $PORT ECHO "hello"
+# → hello
+```
+
+### SET
+Set a key to hold a string value.
+```bash
+redis-cli -p $PORT SET key value
+# → OK
+```
+
+Options:
+- EX seconds: Set expiration in seconds
+- PX milliseconds: Set expiration in milliseconds
+- NX: Only set if key doesn't exist
+- XX: Only set if key exists
+- GET: Return old value
+
+Examples:
+```bash
+redis-cli -p $PORT SET key value EX 60
+redis-cli -p $PORT SET key value PX 1000
+redis-cli -p $PORT SET key value NX
+redis-cli -p $PORT SET key value XX
+redis-cli -p $PORT SET key value GET
+```
+
+### GET
+Get the value of a key.
+```bash
+redis-cli -p $PORT GET key
+# → value
+```
+
+### MGET
+Get values of multiple keys.
+```bash
+redis-cli -p $PORT MGET key1 key2 key3
+# → 1) "value1"
+#    2) "value2"
+#    3) (nil)
+```
+
+### MSET
+Set multiple key-value pairs.
+```bash
+redis-cli -p $PORT MSET key1 value1 key2 value2
+# → OK
+```
+
+### INCR
+Increment the integer value of a key by 1.
+```bash
+redis-cli -p $PORT SET counter 10
+redis-cli -p $PORT INCR counter
+# → 11
+```
+
+### DEL
+Delete a key.
+```bash
+redis-cli -p $PORT DEL key
+# → 1
+```
+
+For multiple keys:
+```bash
+redis-cli -p $PORT DEL key1 key2 key3
+# → number of keys deleted
+```
+
+### TYPE
+Determine the type of a key.
+```bash
+redis-cli -p $PORT TYPE key
+# → string
+```
+
+### EXISTS
+Check if a key exists.
+```bash
+redis-cli -p $PORT EXISTS key
+# → 1 (exists) or 0 (doesn't exist)
+```
+
+For multiple keys:
+```bash
+redis-cli -p $PORT EXISTS key1 key2 key3
+# → count of existing keys
+```
+
+### EXPIRE / PEXPIRE
+Set expiration time for a key.
+```bash
+redis-cli -p $PORT EXPIRE key 60
+# → 1 (timeout set) or 0 (timeout not set)
+
+redis-cli -p $PORT PEXPIRE key 1000
+# → 1 (timeout set) or 0 (timeout not set)
+```
+
+### EXPIREAT / PEXPIREAT
+Set expiration timestamp for a key.
+```bash
+redis-cli -p $PORT EXPIREAT key 1672531200
+# → 1 (timeout set) or 0 (timeout not set)
+
+redis-cli -p $PORT PEXPIREAT key 1672531200000
+# → 1 (timeout set) or 0 (timeout not set)
+```
+
+### TTL
+Get the time to live for a key.
+```bash
+redis-cli -p $PORT TTL key
+# → remaining time in seconds
+```
+
+### PERSIST
+Remove expiration from a key.
+```bash
+redis-cli -p $PORT PERSIST key
+# → 1 (timeout removed) or 0 (key has no timeout)
+```
+
+## Hash Commands
+
+### HSET
+Set field-value pairs in a hash.
+```bash
+redis-cli -p $PORT HSET hashkey field1 value1 field2 value2
+# → number of fields added
+```
+
+### HGET
+Get value of a field in a hash.
+```bash
+redis-cli -p $PORT HGET hashkey field1
+# → value1
+```
+
+### HGETALL
+Get all field-value pairs in a hash.
+```bash
+redis-cli -p $PORT HGETALL hashkey
+# → 1) "field1"
+#    2) "value1"
+#    3) "field2"
+#    4) "value2"
+```
+
+### HDEL
+Delete fields from a hash.
+```bash
+redis-cli -p $PORT HDEL hashkey field1 field2
+# → number of fields deleted
+```
+
+### HEXISTS
+Check if a field exists in a hash.
+```bash
+redis-cli -p $PORT HEXISTS hashkey field1
+# → 1 (exists) or 0 (doesn't exist)
+```
+
+### HKEYS
+Get all field names in a hash.
+```bash
+redis-cli -p $PORT HKEYS hashkey
+# → 1) "field1"
+#    2) "field2"
+```
+
+### HVALS
+Get all values in a hash.
+```bash
+redis-cli -p $PORT HVALS hashkey
+# → 1) "value1"
+#    2) "value2"
+```
+
+### HLEN
+Get number of fields in a hash.
+```bash
+redis-cli -p $PORT HLEN hashkey
+# → number of fields
+```
+
+### HMGET
+Get values of multiple fields in a hash.
+```bash
+redis-cli -p $PORT HMGET hashkey field1 field2 field3
+# → 1) "value1"
+#    2) "value2"
+#    3) (nil)
+```
+
+### HSETNX
+Set field-value pair in hash only if field doesn't exist.
+```bash
+redis-cli -p $PORT HSETNX hashkey field1 value1
+# → 1 (field set) or 0 (field not set)
+```
+
+### HINCRBY
+Increment integer value of a field in a hash.
+```bash
+redis-cli -p $PORT HINCRBY hashkey field1 5
+# → new value
+```
+
+### HINCRBYFLOAT
+Increment float value of a field in a hash.
+```bash
+redis-cli -p $PORT HINCRBYFLOAT hashkey field1 3.14
+# → new value
+```
+
+### HSCAN
+Incrementally iterate over fields in a hash.
+```bash
+redis-cli -p $PORT HSCAN hashkey 0
+# → 1) "next_cursor"
+#    2) 1) "field1"
+#       2) "value1"
+#       3) "field2"
+#       4) "value2"
+```
+
+Options:
+- MATCH pattern: Filter fields by pattern
+- COUNT number: Suggest number of fields to return
+
+Examples:
+```bash
+redis-cli -p $PORT HSCAN hashkey 0 MATCH f*
+redis-cli -p $PORT HSCAN hashkey 0 COUNT 10
+redis-cli -p $PORT HSCAN hashkey 0 MATCH f* COUNT 10
+```
+
+## List Commands
+
+### LPUSH
+Insert elements at the head of a list.
+```bash
+redis-cli -p $PORT LPUSH listkey element1 element2 element3
+# → number of elements in the list
+```
+
+### RPUSH
+Insert elements at the tail of a list.
+```bash
+redis-cli -p $PORT RPUSH listkey element1 element2 element3
+# → number of elements in the list
+```
+
+### LPOP
+Remove and return elements from the head of a list.
+```bash
+redis-cli -p $PORT LPOP listkey
+# → element1
+```
+
+With count:
+```bash
+redis-cli -p $PORT LPOP listkey 2
+# → 1) "element1"
+#    2) "element2"
+```
+
+### RPOP
+Remove and return elements from the tail of a list.
+```bash
+redis-cli -p $PORT RPOP listkey
+# → element3
+```
+
+With count:
+```bash
+redis-cli -p $PORT RPOP listkey 2
+# → 1) "element3"
+#    2) "element2"
+```
+
+### LLEN
+Get the length of a list.
+```bash
+redis-cli -p $PORT LLEN listkey
+# → number of elements in the list
+```
+
+### LINDEX
+Get element at index in a list.
+```bash
+redis-cli -p $PORT LINDEX listkey 0
+# → first element
+```
+
+Negative indices count from the end:
+```bash
+redis-cli -p $PORT LINDEX listkey -1
+# → last element
+```
+
+### LRANGE
+Get a range of elements from a list.
+```bash
+redis-cli -p $PORT LRANGE listkey 0 -1
+# → 1) "element1"
+#    2) "element2"
+#    3) "element3"
+```
+
+### LTRIM
+Trim a list to specified range.
+```bash
+redis-cli -p $PORT LTRIM listkey 0 1
+# → OK (list now contains only first 2 elements)
+```
+
+### LREM
+Remove elements from a list.
+```bash
+redis-cli -p $PORT LREM listkey 2 element1
+# → number of elements removed
+```
+
+Count values:
+- Positive: Remove from head
+- Negative: Remove from tail
+- Zero: Remove all
+
+### LINSERT
+Insert element before or after pivot element.
+```bash
+redis-cli -p $PORT LINSERT listkey BEFORE pivot newelement
+# → number of elements in the list
+```
+
+### BLPOP
+Blocking remove and return elements from the head of a list.
+```bash
+redis-cli -p $PORT BLPOP listkey1 listkey2 5
+# → 1) "listkey1"
+#    2) "element1"
+```
+
+If no elements are available, blocks for specified timeout (in seconds) until an element is pushed to one of the lists.
+
+### BRPOP
+Blocking remove and return elements from the tail of a list.
+```bash
+redis-cli -p $PORT BRPOP listkey1 listkey2 5
+# → 1) "listkey1"
+#    2) "element1"
+```
+
+If no elements are available, blocks for specified timeout (in seconds) until an element is pushed to one of the lists.
+
+## Keyspace Commands
+
+### KEYS
+Get all keys matching pattern.
+```bash
+redis-cli -p $PORT KEYS *
+# → 1) "key1"
+#    2) "key2"
+```
+
+### SCAN
+Incrementally iterate over keys.
+```bash
+redis-cli -p $PORT SCAN 0
+# → 1) "next_cursor"
+#    2) 1) "key1"
+#       2) "key2"
+```
+
+Options:
+- MATCH pattern: Filter keys by pattern
+- COUNT number: Suggest number of keys to return
+
+Examples:
+```bash
+redis-cli -p $PORT SCAN 0 MATCH k*
+redis-cli -p $PORT SCAN 0 COUNT 10
+redis-cli -p $PORT SCAN 0 MATCH k* COUNT 10
+```
+
+### DBSIZE
+Get number of keys in current database.
+```bash
+redis-cli -p $PORT DBSIZE
+# → number of keys
+```
+
+### FLUSHDB
+Remove all keys from current database.
+```bash
+redis-cli -p $PORT FLUSHDB
+# → OK
+```
+
+## Configuration Commands
+
+### CONFIG GET
+Get configuration parameter.
+```bash
+redis-cli -p $PORT CONFIG GET dir
+# → 1) "dir"
+#    2) "/path/to/db"
+
+redis-cli -p $PORT CONFIG GET dbfilename
+# → 1) "dbfilename"
+#    2) "0.db"
+```
+
+## Client Commands
+
+### CLIENT SETNAME
+Set current connection name.
+```bash
+redis-cli -p $PORT CLIENT SETNAME myconnection
+# → OK
+```
+
+### CLIENT GETNAME
+Get current connection name.
+```bash
+redis-cli -p $PORT CLIENT GETNAME
+# → myconnection
+```
+
+## Transaction Commands
+
+### MULTI
+Start a transaction block.
+```bash
+redis-cli -p $PORT MULTI
+# → OK
+```
+
+### EXEC
+Execute all commands in transaction block.
+```bash
+redis-cli -p $PORT MULTI
+redis-cli -p $PORT SET key1 value1
+redis-cli -p $PORT SET key2 value2
+redis-cli -p $PORT EXEC
+# → 1) OK
+#    2) OK
+```
+
+### DISCARD
+Discard all commands in transaction block.
+```bash
+redis-cli -p $PORT MULTI
+redis-cli -p $PORT SET key1 value1
+redis-cli -p $PORT DISCARD
+# → OK
+```
+
+## AGE Commands
+
+### AGE GENENC
+Generate ephemeral encryption keypair.
+```bash
+redis-cli -p $PORT AGE GENENC
+# → 1) "recipient_public_key"
+#    2) "identity_secret_key"
+```
+
+### AGE ENCRYPT
+Encrypt message with recipient public key.
+```bash
+redis-cli -p $PORT AGE ENCRYPT recipient_public_key "message"
+# → base64_encoded_ciphertext
+```
+
+### AGE DECRYPT
+Decrypt ciphertext with identity secret key.
+```bash
+redis-cli -p $PORT AGE DECRYPT identity_secret_key base64_encoded_ciphertext
+# → decrypted_message
+```
+
+### AGE GENSIGN
+Generate ephemeral signing keypair.
+```bash
+redis-cli -p $PORT AGE GENSIGN
+# → 1) "verify_public_key"
+#    2) "sign_secret_key"
+```
+
+### AGE SIGN
+Sign message with signing secret key.
+```bash
+redis-cli -p $PORT AGE SIGN sign_secret_key "message"
+# → base64_encoded_signature
+```
+
+### AGE VERIFY
+Verify signature with verify public key.
+```bash
+redis-cli -p $PORT AGE VERIFY verify_public_key "message" base64_encoded_signature
+# → 1 (valid) or 0 (invalid)
+```
+
+### AGE KEYGEN
+Generate and persist named encryption keypair.
+```bash
+redis-cli -p $PORT AGE KEYGEN keyname
+# → 1) "recipient_public_key"
+#    2) "identity_secret_key"
+```
+
+### AGE SIGNKEYGEN
+Generate and persist named signing keypair.
+```bash
+redis-cli -p $PORT AGE SIGNKEYGEN keyname
+# → 1) "verify_public_key"
+#    2) "sign_secret_key"
+```
+
+### AGE ENCRYPTNAME
+Encrypt message with named key.
+```bash
+redis-cli -p $PORT AGE ENCRYPTNAME keyname "message"
+# → base64_encoded_ciphertext
+```
+
+### AGE DECRYPTNAME
+Decrypt ciphertext with named key.
+```bash
+redis-cli -p $PORT AGE DECRYPTNAME keyname base64_encoded_ciphertext
+# → decrypted_message
+```
+
+### AGE SIGNNAME
+Sign message with named signing key.
+```bash
+redis-cli -p $PORT AGE SIGNNAME keyname "message"
+# → base64_encoded_signature
+```
+
+### AGE VERIFYNAME
+Verify signature with named verify key.
+```bash
+redis-cli -p $PORT AGE VERIFYNAME keyname "message" base64_encoded_signature
+# → 1 (valid) or 0 (invalid)
+```
+
+### AGE LIST
+List all stored AGE keys.
+```bash
+redis-cli -p $PORT AGE LIST
+# → 1) "keyname1"
+#    2) "keyname2"
+```
+
+## Server Information Commands
+
+### INFO
+Get server information.
+```bash
+redis-cli -p $PORT INFO
+# → Server information
+```
+
+With section:
+```bash
+redis-cli -p $PORT INFO replication
+# → Replication information
+```
+
+### COMMAND
+Get command information (stub implementation).
+```bash
+redis-cli -p $PORT COMMAND
+# → Empty array (stub)
+```
+
+## Database Selection
+
+### SELECT
+Select database by index.
+```bash
+redis-cli -p $PORT SELECT 0
+# → OK
+```
+
+```
+
+This expanded documentation includes all the list commands that were implemented in the cmd.rs file:
+1. LPUSH - push elements to the left (head) of a list
+2. RPUSH - push elements to the right (tail) of a list
+3. LPOP - pop elements from the left (head) of a list
+4. RPOP - pop elements from the right (tail) of a list
+5. BLPOP - blocking pop from the left with timeout
+6. BRPOP - blocking pop from the right with timeout
+7. LLEN - get list length
+8. LREM - remove elements from list
+9. LTRIM - trim list to range
+10. LINDEX - get element by index
+11. LRANGE - get range of elements
+

docs/cmds.md

@@ -0,0 +1,125 @@
+
+## Backend Support
+
+HeroDB supports two storage backends, both with full encryption support:
+
+- **redb** (default): Full-featured, optimized for production use
+- **sled**: Alternative embedded database with encryption support
+
+### Starting HeroDB with Different Backends
+
+```bash
+# Use default redb backend
+./target/release/herodb --dir /tmp/herodb_redb --port 6379
+
+# Use sled backend
+./target/release/herodb --dir /tmp/herodb_sled --port 6379 --sled
+
+# Use redb with encryption
+./target/release/herodb --dir /tmp/herodb_encrypted --port 6379 --encrypt --key mysecretkey
+
+# Use sled with encryption
+./target/release/herodb --dir /tmp/herodb_sled_encrypted --port 6379 --sled --encrypt --key mysecretkey
+```
+
+### Command Support by Backend
+
+Command Category | redb | sled | Notes |
+|-----------------|------|------|-------|
+**Strings** | | | |
+SET | ✅ | ✅ | Full support |
+GET | ✅ | ✅ | Full support |
+DEL | ✅ | ✅ | Full support |
+EXISTS | ✅ | ✅ | Full support |
+INCR/DECR | ✅ | ✅ | Full support |
+MGET/MSET | ✅ | ✅ | Full support |
+**Hashes** | | | |
+HSET | ✅ | ✅ | Full support |
+HGET | ✅ | ✅ | Full support |
+HGETALL | ✅ | ✅ | Full support |
+HDEL | ✅ | ✅ | Full support |
+HEXISTS | ✅ | ✅ | Full support |
+HKEYS | ✅ | ✅ | Full support |
+HVALS | ✅ | ✅ | Full support |
+HLEN | ✅ | ✅ | Full support |
+HMGET | ✅ | ✅ | Full support |
+HSETNX | ✅ | ✅ | Full support |
+HINCRBY/HINCRBYFLOAT | ✅ | ✅ | Full support |
+HSCAN | ✅ | ✅ | Full support with pattern matching |
+**Lists** | | | |
+LPUSH/RPUSH | ✅ | ✅ | Full support |
+LPOP/RPOP | ✅ | ✅ | Full support |
+LLEN | ✅ | ✅ | Full support |
+LRANGE | ✅ | ✅ | Full support |
+LINDEX | ✅ | ✅ | Full support |
+LTRIM | ✅ | ✅ | Full support |
+LREM | ✅ | ✅ | Full support |
+BLPOP/BRPOP | ✅ | ❌ | Blocking operations not in sled |
+**Expiration** | | | |
+EXPIRE | ✅ | ✅ | Full support in both |
+TTL | ✅ | ✅ | Full support in both |
+PERSIST | ✅ | ✅ | Full support in both |
+SETEX/PSETEX | ✅ | ✅ | Full support in both |
+EXPIREAT/PEXPIREAT | ✅ | ✅ | Full support in both |
+**Scanning** | | | |
+KEYS | ✅ | ✅ | Full support with patterns |
+SCAN | ✅ | ✅ | Full cursor-based iteration |
+HSCAN | ✅ | ✅ | Full cursor-based iteration |
+**Transactions** | | | |
+MULTI/EXEC/DISCARD | ✅ | ❌ | Only supported in redb |
+**Encryption** | | | |
+Data-at-rest encryption | ✅ | ✅ | Both support [age](age.tech) encryption |
+AGE commands | ✅ | ✅ | Both support AGE crypto commands |
+**Full-Text Search** | | | |
+FT.CREATE | ✅ | ✅ | Create search index with schema |
+FT.ADD | ✅ | ✅ | Add document to search index |
+FT.SEARCH | ✅ | ✅ | Search documents with query |
+FT.DEL | ✅ | ✅ | Delete document from index |
+FT.INFO | ✅ | ✅ | Get index information |
+FT.DROP | ✅ | ✅ | Drop search index |
+FT.ALTER | ✅ | ✅ | Alter index schema |
+FT.AGGREGATE | ✅ | ✅ | Aggregate search results |
+
+### Performance Considerations
+
+- **redb**: Optimized for concurrent access, better for high-throughput scenarios
+- **sled**: Lock-free architecture, excellent for specific workloads
+
+### Encryption Features
+
+Both backends support:
+- Transparent data-at-rest encryption using the `age` encryption library
+- Per-database encryption (databases >= 10 are encrypted when `--encrypt` flag is used)
+- Secure key derivation using the master key
+
+### Backend Selection Examples
+
+```bash
+# Example: Testing both backends
+redis-cli -p 6379 SET mykey "redb value"
+redis-cli -p 6381 SET mykey "sled value"
+
+# Example: Using encryption with both
+./target/release/herodb --port 6379 --encrypt --key secret123
+./target/release/herodb --port 6381 --sled --encrypt --key secret123
+
+# Both support the same Redis commands
+redis-cli -p 6379 HSET user:1 name "Alice" age "30"
+redis-cli -p 6381 HSET user:1 name "Alice" age "30"
+
+# Both support SCAN operations
+redis-cli -p 6379 SCAN 0 MATCH user:* COUNT 10
+redis-cli -p 6381 SCAN 0 MATCH user:* COUNT 10
+```
+
+### Migration Between Backends
+
+To migrate data between backends, use Redis replication or dump/restore:
+
+```bash
+# Export from redb
+redis-cli -p 6379 --rdb dump.rdb
+
+# Import to sled
+redis-cli -p 6381 --pipe < dump.rdb
+```

docs/search.md

@@ -0,0 +1,397 @@
+# Full-Text Search with Tantivy
+
+HeroDB includes powerful full-text search capabilities powered by [Tantivy](https://github.com/quickwit-oss/tantivy), a fast full-text search engine library written in Rust. This provides Redis-compatible search commands similar to RediSearch.
+
+## Overview
+
+The search functionality allows you to:
+- Create search indexes with custom schemas
+- Index documents with multiple field types
+- Perform complex queries with filters
+- Support for text, numeric, date, and geographic data
+- Real-time search with high performance
+
+## Search Commands
+
+### FT.CREATE - Create Search Index
+
+Create a new search index with a defined schema.
+
+```bash
+FT.CREATE index_name SCHEMA field_name field_type [options] [field_name field_type [options] ...]
+```
+
+**Field Types:**
+- `TEXT` - Full-text searchable text fields
+- `NUMERIC` - Numeric fields (integers, floats)
+- `TAG` - Tag fields for exact matching
+- `GEO` - Geographic coordinates (lat,lon)
+- `DATE` - Date/timestamp fields
+
+**Field Options:**
+- `STORED` - Store field value for retrieval
+- `INDEXED` - Make field searchable
+- `TOKENIZED` - Enable tokenization for text fields
+- `FAST` - Enable fast access for numeric fields
+
+**Example:**
+```bash
+# Create a product search index
+FT.CREATE products SCHEMA 
+  title TEXT STORED INDEXED TOKENIZED
+  description TEXT STORED INDEXED TOKENIZED  
+  price NUMERIC STORED INDEXED FAST
+  category TAG STORED
+  location GEO STORED
+  created_date DATE STORED INDEXED
+```
+
+### FT.ADD - Add Document to Index
+
+Add a document to a search index.
+
+```bash
+FT.ADD index_name doc_id [SCORE score] FIELDS field_name field_value [field_name field_value ...]
+```
+
+**Example:**
+```bash
+# Add a product document
+FT.ADD products product:1 SCORE 1.0 FIELDS 
+  title "Wireless Headphones" 
+  description "High-quality wireless headphones with noise cancellation"
+  price 199.99
+  category "electronics"
+  location "37.7749,-122.4194"
+  created_date 1640995200000
+```
+
+### FT.SEARCH - Search Documents
+
+Search for documents in an index.
+
+```bash
+FT.SEARCH index_name query [LIMIT offset count] [FILTER field min max] [RETURN field [field ...]]
+```
+
+**Query Syntax:**
+- Simple terms: `wireless headphones`
+- Phrase queries: `"noise cancellation"`
+- Field-specific: `title:wireless`
+- Boolean operators: `wireless AND headphones`
+- Wildcards: `head*`
+
+**Examples:**
+```bash
+# Simple text search
+FT.SEARCH products "wireless headphones"
+
+# Search with filters
+FT.SEARCH products "headphones" FILTER price 100 300 LIMIT 0 10
+
+# Field-specific search
+FT.SEARCH products "title:wireless AND category:electronics"
+
+# Return specific fields only
+FT.SEARCH products "*" RETURN title price
+```
+
+### FT.DEL - Delete Document
+
+Remove a document from the search index.
+
+```bash
+FT.DEL index_name doc_id
+```
+
+**Example:**
+```bash
+FT.DEL products product:1
+```
+
+### FT.INFO - Get Index Information
+
+Get information about a search index.
+
+```bash
+FT.INFO index_name
+```
+
+**Returns:**
+- Index name and document count
+- Field definitions and types
+- Index configuration
+
+**Example:**
+```bash
+FT.INFO products
+```
+
+### FT.DROP - Drop Index
+
+Delete an entire search index.
+
+```bash
+FT.DROP index_name
+```
+
+**Example:**
+```bash
+FT.DROP products
+```
+
+### FT.ALTER - Alter Index Schema
+
+Add new fields to an existing index.
+
+```bash
+FT.ALTER index_name SCHEMA ADD field_name field_type [options]
+```
+
+**Example:**
+```bash
+FT.ALTER products SCHEMA ADD brand TAG STORED
+```
+
+### FT.AGGREGATE - Aggregate Search Results
+
+Perform aggregations on search results.
+
+```bash
+FT.AGGREGATE index_name query [GROUPBY field] [REDUCE function field AS alias]
+```
+
+**Example:**
+```bash
+# Group products by category and count
+FT.AGGREGATE products "*" GROUPBY category REDUCE COUNT 0 AS count
+```
+
+## Field Types in Detail
+
+### TEXT Fields
+- **Purpose**: Full-text search on natural language content
+- **Features**: Tokenization, stemming, stop-word removal
+- **Options**: `STORED`, `INDEXED`, `TOKENIZED`
+- **Example**: Product titles, descriptions, content
+
+### NUMERIC Fields  
+- **Purpose**: Numeric data for range queries and sorting
+- **Types**: I64, U64, F64
+- **Options**: `STORED`, `INDEXED`, `FAST`
+- **Example**: Prices, quantities, ratings
+
+### TAG Fields
+- **Purpose**: Exact-match categorical data
+- **Features**: No tokenization, exact string matching
+- **Options**: `STORED`, case sensitivity control
+- **Example**: Categories, brands, status values
+
+### GEO Fields
+- **Purpose**: Geographic coordinates
+- **Format**: "latitude,longitude" (e.g., "37.7749,-122.4194")
+- **Features**: Geographic distance queries
+- **Options**: `STORED`
+
+### DATE Fields
+- **Purpose**: Timestamp and date data
+- **Format**: Unix timestamp in milliseconds
+- **Features**: Range queries, temporal filtering
+- **Options**: `STORED`, `INDEXED`, `FAST`
+
+## Search Query Syntax
+
+### Basic Queries
+```bash
+# Single term
+FT.SEARCH products "wireless"
+
+# Multiple terms (AND by default)
+FT.SEARCH products "wireless headphones"
+
+# Phrase query
+FT.SEARCH products "\"noise cancellation\""
+```
+
+### Field-Specific Queries
+```bash
+# Search in specific field
+FT.SEARCH products "title:wireless"
+
+# Multiple field queries
+FT.SEARCH products "title:wireless AND description:bluetooth"
+```
+
+### Boolean Operators
+```bash
+# AND operator
+FT.SEARCH products "wireless AND headphones"
+
+# OR operator  
+FT.SEARCH products "wireless OR bluetooth"
+
+# NOT operator
+FT.SEARCH products "headphones NOT wired"
+```
+
+### Wildcards and Fuzzy Search
+```bash
+# Wildcard search
+FT.SEARCH products "head*"
+
+# Fuzzy search (approximate matching)
+FT.SEARCH products "%headphone%"
+```
+
+### Range Queries
+```bash
+# Numeric range in query
+FT.SEARCH products "@price:[100 300]"
+
+# Date range
+FT.SEARCH products "@created_date:[1640995200000 1672531200000]"
+```
+
+## Filtering and Sorting
+
+### FILTER Clause
+```bash
+# Numeric filter
+FT.SEARCH products "headphones" FILTER price 100 300
+
+# Multiple filters
+FT.SEARCH products "*" FILTER price 100 500 FILTER rating 4 5
+```
+
+### LIMIT Clause
+```bash
+# Pagination
+FT.SEARCH products "wireless" LIMIT 0 10    # First 10 results
+FT.SEARCH products "wireless" LIMIT 10 10   # Next 10 results
+```
+
+### RETURN Clause
+```bash
+# Return specific fields
+FT.SEARCH products "*" RETURN title price
+
+# Return all stored fields (default)
+FT.SEARCH products "*"
+```
+
+## Performance Considerations
+
+### Indexing Strategy
+- Only index fields you need to search on
+- Use `FAST` option for frequently filtered numeric fields
+- Consider storage vs. search performance trade-offs
+
+### Query Optimization
+- Use specific field queries when possible
+- Combine filters with text queries for better performance
+- Use pagination with LIMIT for large result sets
+
+### Memory Usage
+- Tantivy indexes are memory-mapped for performance
+- Index size depends on document count and field configuration
+- Monitor disk space for index storage
+
+## Integration with Redis Commands
+
+Search indexes work alongside regular Redis data:
+
+```bash
+# Store product data in Redis hash
+HSET product:1 title "Wireless Headphones" price "199.99"
+
+# Index the same data for search
+FT.ADD products product:1 FIELDS title "Wireless Headphones" price 199.99
+
+# Search returns document IDs that can be used with Redis commands
+FT.SEARCH products "wireless"
+# Returns: product:1
+
+# Retrieve full data using Redis
+HGETALL product:1
+```
+
+## Example Use Cases
+
+### E-commerce Product Search
+```bash
+# Create product catalog index
+FT.CREATE catalog SCHEMA 
+  name TEXT STORED INDEXED TOKENIZED
+  description TEXT INDEXED TOKENIZED
+  price NUMERIC STORED INDEXED FAST
+  category TAG STORED
+  brand TAG STORED
+  rating NUMERIC STORED FAST
+
+# Add products
+FT.ADD catalog prod:1 FIELDS name "iPhone 14" price 999 category "phones" brand "apple" rating 4.5
+FT.ADD catalog prod:2 FIELDS name "Samsung Galaxy" price 899 category "phones" brand "samsung" rating 4.3
+
+# Search queries
+FT.SEARCH catalog "iPhone"
+FT.SEARCH catalog "phones" FILTER price 800 1000
+FT.SEARCH catalog "@brand:apple"
+```
+
+### Content Management
+```bash
+# Create content index
+FT.CREATE content SCHEMA
+  title TEXT STORED INDEXED TOKENIZED
+  body TEXT INDEXED TOKENIZED
+  author TAG STORED
+  published DATE STORED INDEXED
+  tags TAG STORED
+
+# Search content
+FT.SEARCH content "machine learning"
+FT.SEARCH content "@author:john AND @tags:ai"
+FT.SEARCH content "*" FILTER published 1640995200000 1672531200000
+```
+
+### Geographic Search
+```bash
+# Create location-based index
+FT.CREATE places SCHEMA
+  name TEXT STORED INDEXED TOKENIZED
+  location GEO STORED
+  type TAG STORED
+
+# Add locations
+FT.ADD places place:1 FIELDS name "Golden Gate Bridge" location "37.8199,-122.4783" type "landmark"
+
+# Geographic queries (future feature)
+FT.SEARCH places "@location:[37.7749 -122.4194 10 km]"
+```
+
+## Error Handling
+
+Common error responses:
+- `ERR index not found` - Index doesn't exist
+- `ERR field not found` - Field not defined in schema
+- `ERR invalid query syntax` - Malformed query
+- `ERR document not found` - Document ID doesn't exist
+
+## Best Practices
+
+1. **Schema Design**: Plan your schema carefully - changes require reindexing
+2. **Field Selection**: Only store and index fields you actually need
+3. **Batch Operations**: Add multiple documents efficiently
+4. **Query Testing**: Test queries for performance with realistic data
+5. **Monitoring**: Monitor index size and query performance
+6. **Backup**: Include search indexes in backup strategies
+
+## Future Enhancements
+
+Planned features:
+- Geographic distance queries
+- Advanced aggregations and faceting
+- Highlighting of search results
+- Synonyms and custom analyzers
+- Real-time suggestions and autocomplete
+- Index replication and sharding

examples/README.md

@@ -0,0 +1,171 @@
+# HeroDB Tantivy Search Examples
+
+This directory contains examples demonstrating HeroDB's full-text search capabilities powered by Tantivy.
+
+## Tantivy Search Demo (Bash Script)
+
+### Overview
+The `tantivy_search_demo.sh` script provides a comprehensive demonstration of HeroDB's search functionality using Redis commands. It showcases various search scenarios including basic text search, filtering, sorting, geographic queries, and more.
+
+### Prerequisites
+1. **HeroDB Server**: The server must be running on port 6381
+2. **Redis CLI**: The `redis-cli` tool must be installed and available in your PATH
+
+### Running the Demo
+
+#### Step 1: Start HeroDB Server
+```bash
+# From the project root directory
+cargo run -- --port 6381
+```
+
+#### Step 2: Run the Demo (in a new terminal)
+```bash
+# From the project root directory
+./examples/tantivy_search_demo.sh
+```
+
+### What the Demo Covers
+
+The script demonstrates 15 different search scenarios:
+
+1. **Index Creation** - Creating a search index with various field types
+2. **Data Insertion** - Adding sample products to the index
+3. **Basic Text Search** - Simple keyword searches
+4. **Filtered Search** - Combining text search with category filters
+5. **Numeric Range Search** - Finding products within price ranges
+6. **Sorting Results** - Ordering results by different fields
+7. **Limited Results** - Pagination and result limiting
+8. **Complex Queries** - Multi-field searches with sorting
+9. **Geographic Search** - Location-based queries
+10. **Index Information** - Getting statistics about the search index
+11. **Search Comparison** - Tantivy vs simple pattern matching
+12. **Fuzzy Search** - Typo tolerance and approximate matching
+13. **Phrase Search** - Exact phrase matching
+14. **Boolean Queries** - AND, OR, NOT operators
+15. **Cleanup** - Removing test data
+
+### Sample Data
+
+The demo uses a product catalog with the following fields:
+- **title** (TEXT) - Product name with higher search weight
+- **description** (TEXT) - Detailed product description
+- **category** (TAG) - Comma-separated categories
+- **price** (NUMERIC) - Product price for range queries
+- **rating** (NUMERIC) - Customer rating for sorting
+- **location** (GEO) - Geographic coordinates for location searches
+
+### Key Redis Commands Demonstrated
+
+#### Index Management
+```bash
+# Create search index
+FT.CREATE product_catalog ON HASH PREFIX 1 product: SCHEMA title TEXT WEIGHT 2.0 SORTABLE description TEXT category TAG SEPARATOR , price NUMERIC SORTABLE rating NUMERIC SORTABLE location GEO
+
+# Get index information
+FT.INFO product_catalog
+
+# Drop index
+FT.DROPINDEX product_catalog
+```
+
+#### Search Queries
+```bash
+# Basic text search
+FT.SEARCH product_catalog wireless
+
+# Filtered search
+FT.SEARCH product_catalog 'organic @category:{food}'
+
+# Numeric range
+FT.SEARCH product_catalog '@price:[50 150]'
+
+# Sorted results
+FT.SEARCH product_catalog '@category:{electronics}' SORTBY price ASC
+
+# Geographic search
+FT.SEARCH product_catalog '@location:[37.7749 -122.4194 50 km]'
+
+# Boolean queries
+FT.SEARCH product_catalog 'wireless AND audio'
+FT.SEARCH product_catalog 'coffee OR tea'
+
+# Phrase search
+FT.SEARCH product_catalog '"noise canceling"'
+```
+
+### Interactive Features
+
+The demo script includes:
+- **Colored output** for better readability
+- **Pause between steps** to review results
+- **Error handling** with clear error messages
+- **Automatic cleanup** of test data
+- **Progress indicators** showing what each step demonstrates
+
+### Troubleshooting
+
+#### HeroDB Not Running
+```
+✗ HeroDB is not running on port 6381
+ℹ Please start HeroDB with: cargo run -- --port 6381
+```
+**Solution**: Start the HeroDB server in a separate terminal.
+
+#### Redis CLI Not Found
+```
+redis-cli: command not found
+```
+**Solution**: Install Redis tools or use an alternative Redis client.
+
+#### Connection Refused
+```
+Could not connect to Redis at localhost:6381: Connection refused
+```
+**Solution**: Ensure HeroDB is running and listening on the correct port.
+
+### Manual Testing
+
+You can also run individual commands manually:
+
+```bash
+# Connect to HeroDB
+redis-cli -h localhost -p 6381
+
+# Create a simple index
+FT.CREATE myindex ON HASH SCHEMA title TEXT description TEXT
+
+# Add a document
+HSET doc:1 title "Hello World" description "This is a test document"
+
+# Search
+FT.SEARCH myindex hello
+```
+
+### Performance Notes
+
+- **Indexing**: Documents are indexed in real-time as they're added
+- **Search Speed**: Full-text search is much faster than pattern matching on large datasets
+- **Memory Usage**: Tantivy indexes are memory-efficient and disk-backed
+- **Scalability**: Supports millions of documents with sub-second search times
+
+### Advanced Features
+
+The demo showcases advanced Tantivy features:
+- **Relevance Scoring** - Results ranked by relevance
+- **Fuzzy Matching** - Handles typos and approximate matches
+- **Field Weighting** - Title field has higher search weight
+- **Multi-field Search** - Search across multiple fields simultaneously
+- **Geographic Queries** - Distance-based location searches
+- **Numeric Ranges** - Efficient range queries on numeric fields
+- **Tag Filtering** - Fast categorical filtering
+
+### Next Steps
+
+After running the demo, explore:
+1. **Custom Schemas** - Define your own field types and configurations
+2. **Large Datasets** - Test with thousands or millions of documents
+3. **Real Applications** - Integrate search into your applications
+4. **Performance Tuning** - Optimize for your specific use case
+
+For more information, see the [search documentation](../herodb/docs/search.md).

examples/simple_demo.sh

@@ -0,0 +1,186 @@
+#!/bin/bash
+
+# Simple HeroDB Demo - Basic Redis Commands
+# This script demonstrates basic Redis functionality that's currently implemented
+
+set -e  # Exit on any error
+
+# Configuration
+REDIS_HOST="localhost"
+REDIS_PORT="6381"
+REDIS_CLI="redis-cli -h $REDIS_HOST -p $REDIS_PORT"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Function to print colored output
+print_header() {
+    echo -e "${BLUE}=== $1 ===${NC}"
+}
+
+print_success() {
+    echo -e "${GREEN}✓ $1${NC}"
+}
+
+print_info() {
+    echo -e "${YELLOW}ℹ $1${NC}"
+}
+
+print_error() {
+    echo -e "${RED}✗ $1${NC}"
+}
+
+# Function to check if HeroDB is running
+check_herodb() {
+    print_info "Checking if HeroDB is running on port $REDIS_PORT..."
+    if ! $REDIS_CLI ping > /dev/null 2>&1; then
+        print_error "HeroDB is not running on port $REDIS_PORT"
+        print_info "Please start HeroDB with: cargo run -- --port $REDIS_PORT"
+        exit 1
+    fi
+    print_success "HeroDB is running and responding"
+}
+
+# Function to execute Redis command with error handling
+execute_cmd() {
+    local cmd="$1"
+    local description="$2"
+    
+    echo -e "${YELLOW}Command:${NC} $cmd"
+    if result=$($REDIS_CLI $cmd 2>&1); then
+        echo -e "${GREEN}Result:${NC} $result"
+        return 0
+    else
+        print_error "Failed: $description"
+        echo "Error: $result"
+        return 1
+    fi
+}
+
+# Main demo function
+main() {
+    clear
+    print_header "HeroDB Basic Functionality Demo"
+    echo "This demo shows basic Redis commands that are currently implemented"
+    echo "HeroDB runs on port $REDIS_PORT (instead of Redis default 6379)"
+    echo
+
+    # Check if HeroDB is running
+    check_herodb
+    echo
+
+    print_header "Step 1: Basic Key-Value Operations"
+    
+    execute_cmd "SET greeting 'Hello HeroDB!'" "Setting a simple key-value pair"
+    echo
+    execute_cmd "GET greeting" "Getting the value"
+    echo
+    execute_cmd "SET counter 42" "Setting a numeric value"
+    echo
+    execute_cmd "INCR counter" "Incrementing the counter"
+    echo
+    execute_cmd "GET counter" "Getting the incremented value"
+    echo
+
+    print_header "Step 2: Hash Operations"
+    
+    execute_cmd "HSET user:1 name 'John Doe' email 'john@example.com' age 30" "Setting hash fields"
+    echo
+    execute_cmd "HGET user:1 name" "Getting a specific field"
+    echo
+    execute_cmd "HGETALL user:1" "Getting all fields"
+    echo
+    execute_cmd "HLEN user:1" "Getting hash length"
+    echo
+
+    print_header "Step 3: List Operations"
+    
+    execute_cmd "LPUSH tasks 'Write code' 'Test code' 'Deploy code'" "Adding items to list"
+    echo
+    execute_cmd "LLEN tasks" "Getting list length"
+    echo
+    execute_cmd "LRANGE tasks 0 -1" "Getting all list items"
+    echo
+    execute_cmd "LPOP tasks" "Popping from left"
+    echo
+    execute_cmd "LRANGE tasks 0 -1" "Checking remaining items"
+    echo
+
+    print_header "Step 4: Key Management"
+    
+    execute_cmd "KEYS *" "Listing all keys"
+    echo
+    execute_cmd "EXISTS greeting" "Checking if key exists"
+    echo
+    execute_cmd "TYPE user:1" "Getting key type"
+    echo
+    execute_cmd "DBSIZE" "Getting database size"
+    echo
+
+    print_header "Step 5: Expiration"
+    
+    execute_cmd "SET temp_key 'temporary value'" "Setting temporary key"
+    echo
+    execute_cmd "EXPIRE temp_key 5" "Setting 5 second expiration"
+    echo
+    execute_cmd "TTL temp_key" "Checking time to live"
+    echo
+    print_info "Waiting 2 seconds..."
+    sleep 2
+    execute_cmd "TTL temp_key" "Checking TTL again"
+    echo
+
+    print_header "Step 6: Multiple Operations"
+    
+    execute_cmd "MSET key1 'value1' key2 'value2' key3 'value3'" "Setting multiple keys"
+    echo
+    execute_cmd "MGET key1 key2 key3" "Getting multiple values"
+    echo
+    execute_cmd "DEL key1 key2" "Deleting multiple keys"
+    echo
+    execute_cmd "EXISTS key1 key2 key3" "Checking existence of multiple keys"
+    echo
+
+    print_header "Step 7: Search Commands (Placeholder)"
+    print_info "Testing FT.CREATE command (currently returns placeholder response)"
+    
+    execute_cmd "FT.CREATE test_index SCHEMA title TEXT description TEXT" "Creating search index"
+    echo
+
+    print_header "Step 8: Server Information"
+    
+    execute_cmd "INFO" "Getting server information"
+    echo
+    execute_cmd "CONFIG GET dir" "Getting configuration"
+    echo
+
+    print_header "Step 9: Cleanup"
+    
+    execute_cmd "FLUSHDB" "Clearing database"
+    echo
+    execute_cmd "DBSIZE" "Confirming database is empty"
+    echo
+
+    print_header "Demo Summary"
+    echo "This demonstration showed:"
+    echo "• Basic key-value operations (GET, SET, INCR)"
+    echo "• Hash operations (HSET, HGET, HGETALL)"
+    echo "• List operations (LPUSH, LPOP, LRANGE)"
+    echo "• Key management (KEYS, EXISTS, TYPE, DEL)"
+    echo "• Expiration handling (EXPIRE, TTL)"
+    echo "• Multiple key operations (MSET, MGET)"
+    echo "• Server information commands"
+    echo
+    print_success "HeroDB basic functionality demo completed successfully!"
+    echo
+    print_info "Note: Full-text search (FT.*) commands are defined but not yet fully implemented"
+    print_info "To run HeroDB server: cargo run -- --port 6381"
+    print_info "To connect with redis-cli: redis-cli -h localhost -p 6381"
+}
+
+# Run the demo
+main "$@"

herodb/Cargo.toml

@@ -1,28 +0,0 @@
-[package]
-name = "herodb"
-version = "0.0.1"
-authors = ["Pin Fang <fpfangpin@hotmail.com>"]
-edition = "2021"
-
-[dependencies]
-anyhow = "1.0.59"
-bytes = "1.3.0"
-thiserror = "1.0.32"
-tokio = { version = "1.23.0", features = ["full"] }
-clap = { version = "4.5.20", features = ["derive"] }
-byteorder = "1.4.3"
-futures = "0.3"
-redb = "2.1.3"
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
-bincode = "1.3.3"
-chacha20poly1305 = "0.10.1"
-rand = "0.8"
-sha2 = "0.10"
-age = "0.10"
-secrecy = "0.8"
-ed25519-dalek = "2"
-base64 = "0.22"
-
-[dev-dependencies]
-redis = { version = "0.24", features = ["aio", "tokio-comp"] }

herodb/src/main.rs

@@ -1,81 +0,0 @@
-// #![allow(unused_imports)]
-
-use tokio::net::TcpListener;
-
-use herodb::server;
-
-use clap::Parser;
-
-/// Simple program to greet a person
-#[derive(Parser, Debug)]
-#[command(version, about, long_about = None)]
-struct Args {
-    /// The directory of Redis DB file
-    #[arg(long)]
-    dir: String,
-
-    /// The port of the Redis server, default is 6379 if not specified
-    #[arg(long)]
-    port: Option<u16>,
-
-    /// Enable debug mode
-    #[arg(long)]
-    debug: bool,
-
-
-    /// Master encryption key for encrypted databases
-    #[arg(long)]
-    encryption_key: Option<String>,
-
-    /// Encrypt the database
-    #[arg(long)]
-    encrypt: bool,
-}
-
-#[tokio::main]
-async fn main() {
-    // parse args
-    let args = Args::parse();
-
-    // bind port
-    let port = args.port.unwrap_or(6379);
-    println!("will listen on port: {}", port);
-    let listener = TcpListener::bind(format!("127.0.0.1:{}", port))
-        .await
-        .unwrap();
-
-    // new DB option
-    let option = herodb::options::DBOption {
-        dir: args.dir,
-        port,
-        debug: args.debug,
-        encryption_key: args.encryption_key,
-        encrypt: args.encrypt,
-    };
-
-    // new server
-    let server = server::Server::new(option).await;
-
-    // Add a small delay to ensure the port is ready
-    tokio::time::sleep(std::time::Duration::from_millis(100)).await;
-
-    // accept new connections
-    loop {
-        let stream = listener.accept().await;
-        match stream {
-            Ok((stream, _)) => {
-                println!("accepted new connection");
-
-                let mut sc = server.clone();
-                tokio::spawn(async move {
-                    if let Err(e) = sc.handle(stream).await {
-                        println!("error: {:?}, will close the connection. Bye", e);
-                    }
-                });
-            }
-            Err(e) => {
-                println!("error: {}", e);
-            }
-        }
-    }
-}

herodb/src/options.rs

@@ -1,8 +0,0 @@
-#[derive(Clone)]
-pub struct DBOption {
-    pub dir: String,
-    pub port: u16,
-    pub debug: bool,
-    pub encrypt: bool,
-    pub encryption_key: Option<String>, // Master encryption key
-}

herodb/src/storage/mod.rs

@@ -1,126 +0,0 @@
-use std::{
-    path::Path,
-    time::{SystemTime, UNIX_EPOCH},
-};
-
-use redb::{Database, TableDefinition};
-use serde::{Deserialize, Serialize};
-
-use crate::crypto::CryptoFactory;
-use crate::error::DBError;
-
-// Re-export modules
-mod storage_basic;
-mod storage_hset;
-mod storage_lists;
-mod storage_extra;
-
-// Re-export implementations
-// Note: These imports are used by the impl blocks in the submodules
-// The compiler shows them as unused because they're not directly used in this file
-// but they're needed for the Storage struct methods to be available
-pub use storage_extra::*;
-
-// Table definitions for different Redis data types
-const TYPES_TABLE: TableDefinition<&str, &str> = TableDefinition::new("types");
-const STRINGS_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("strings");
-const HASHES_TABLE: TableDefinition<(&str, &str), &[u8]> = TableDefinition::new("hashes");
-const LISTS_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("lists");
-const STREAMS_META_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("streams_meta");
-const STREAMS_DATA_TABLE: TableDefinition<(&str, &str), &[u8]> = TableDefinition::new("streams_data");
-const ENCRYPTED_TABLE: TableDefinition<&str, u8> = TableDefinition::new("encrypted");
-const EXPIRATION_TABLE: TableDefinition<&str, u64> = TableDefinition::new("expiration");
-
-#[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct StreamEntry {
-    pub fields: Vec<(String, String)>,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct ListValue {
-    pub elements: Vec<String>,
-}
-
-#[inline]
-pub fn now_in_millis() -> u128 {
-    let start = SystemTime::now();
-    let duration_since_epoch = start.duration_since(UNIX_EPOCH).unwrap();
-    duration_since_epoch.as_millis()
-}
-
-pub struct Storage {
-    db: Database,
-    crypto: Option<CryptoFactory>,
-}
-
-impl Storage {
-    pub fn new(path: impl AsRef<Path>, should_encrypt: bool, master_key: Option<&str>) -> Result<Self, DBError> {
-        let db = Database::create(path)?;
-        
-        // Create tables if they don't exist
-        let write_txn = db.begin_write()?;
-        {
-            let _ = write_txn.open_table(TYPES_TABLE)?;
-            let _ = write_txn.open_table(STRINGS_TABLE)?;
-            let _ = write_txn.open_table(HASHES_TABLE)?;
-            let _ = write_txn.open_table(LISTS_TABLE)?;
-            let _ = write_txn.open_table(STREAMS_META_TABLE)?;
-            let _ = write_txn.open_table(STREAMS_DATA_TABLE)?;
-            let _ = write_txn.open_table(ENCRYPTED_TABLE)?;
-            let _ = write_txn.open_table(EXPIRATION_TABLE)?;
-        }
-        write_txn.commit()?;
-        
-        // Check if database was previously encrypted
-        let read_txn = db.begin_read()?;
-        let encrypted_table = read_txn.open_table(ENCRYPTED_TABLE)?;
-        let was_encrypted = encrypted_table.get("encrypted")?.map(|v| v.value() == 1).unwrap_or(false);
-        drop(read_txn);
-        
-        let crypto = if should_encrypt || was_encrypted {
-            if let Some(key) = master_key {
-                Some(CryptoFactory::new(key.as_bytes()))
-            } else {
-                return Err(DBError("Encryption requested but no master key provided".to_string()));
-            }
-        } else {
-            None
-        };
-        
-        // If we're enabling encryption for the first time, mark it
-        if should_encrypt && !was_encrypted {
-            let write_txn = db.begin_write()?;
-            {
-                let mut encrypted_table = write_txn.open_table(ENCRYPTED_TABLE)?;
-                encrypted_table.insert("encrypted", &1u8)?;
-            }
-            write_txn.commit()?;
-        }
-        
-        Ok(Storage {
-            db,
-            crypto,
-        })
-    }
-    
-    pub fn is_encrypted(&self) -> bool {
-        self.crypto.is_some()
-    }
-
-    // Helper methods for encryption
-    fn encrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
-        if let Some(crypto) = &self.crypto {
-            Ok(crypto.encrypt(data))
-        } else {
-            Ok(data.to_vec())
-        }
-    }
-    
-    fn decrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
-        if let Some(crypto) = &self.crypto {
-            Ok(crypto.decrypt(data)?)
-        } else {
-            Ok(data.to_vec())
-        }
-    }
-}

specs/backgroundinfo/sled.md

@@ -0,0 +1,113 @@
+========================
+CODE SNIPPETS
+========================
+TITLE: Basic Database Operations with sled in Rust
+DESCRIPTION: This snippet demonstrates fundamental operations using the `sled` embedded database in Rust. It covers opening a database tree, inserting and retrieving key-value pairs, performing range queries, deleting entries, and executing an atomic compare-and-swap operation. It also shows how to flush changes to disk for durability.
+
+SOURCE: https://github.com/spacejam/sled/blob/main/README.md#_snippet_0
+
+LANGUAGE: Rust
+CODE:
+```
+let tree = sled::open("/tmp/welcome-to-sled")?;
+
+// insert and get, similar to std's BTreeMap
+let old_value = tree.insert("key", "value")?;
+
+assert_eq!(
+  tree.get(&"key")?,
+  Some(sled::IVec::from("value")),
+);
+
+// range queries
+for kv_result in tree.range("key_1".."key_9") {}
+
+// deletion
+let old_value = tree.remove(&"key")?;
+
+// atomic compare and swap
+tree.compare_and_swap(
+  "key",
+  Some("current_value"),
+  Some("new_value"),
+)?;
+
+// block until all operations are stable on disk
+// (flush_async also available to get a Future)
+tree.flush()?;
+```
+
+----------------------------------------
+
+TITLE: Subscribing to sled Events Asynchronously (Rust)
+DESCRIPTION: This snippet demonstrates how to asynchronously subscribe to events on key prefixes in a `sled` database. It initializes a `sled` database, creates a `Subscriber` for all key prefixes, inserts a key-value pair to trigger an event, and then uses `extreme::run` to await and process incoming events. The `Subscriber` struct implements `Future<Output=Option<Event>>`, allowing it to be awaited in an async context.
+
+SOURCE: https://github.com/spacejam/sled/blob/main/README.md#_snippet_1
+
+LANGUAGE: Rust
+CODE:
+```
+let sled = sled::open("my_db").unwrap();
+
+let mut sub = sled.watch_prefix("");
+
+sled.insert(b"a", b"a").unwrap();
+
+extreme::run(async move {
+    while let Some(event) = (&mut sub).await {
+        println!("got event {:?}", event);
+    }
+});
+```
+
+----------------------------------------
+
+TITLE: Iterating Subscriber Events with Async/Await in Rust
+DESCRIPTION: This snippet demonstrates how to asynchronously iterate over events from a `Subscriber` instance in Rust. Since `Subscriber` now implements `Future`, it can be awaited in a loop to process incoming events, enabling efficient prefix watching. The loop continues as long as new events are available.
+
+SOURCE: https://github.com/spacejam/sled/blob/main/CHANGELOG.md#_snippet_0
+
+LANGUAGE: Rust
+CODE:
+```
+while let Some(event) = (&mut subscriber).await {}
+```
+
+----------------------------------------
+
+TITLE: Suppressing TSAN Race on Arc::drop in Rust
+DESCRIPTION: This suppression addresses a false positive race detection by ThreadSanitizer in Rust's `Arc::drop` implementation. TSAN fails to correctly reason about the raw atomic `Acquire` fence used after the strong-count atomic subtraction with a `Release` fence in the `Drop` implementation, leading to an erroneous race report.
+
+SOURCE: https://github.com/spacejam/sled/blob/main/tsan_suppressions.txt#_snippet_0
+
+LANGUAGE: TSAN Suppression
+CODE:
+```
+race:Arc*drop
+```
+
+----------------------------------------
+
+TITLE: Suppressing TSAN Race on std::thread::local in Rust
+DESCRIPTION: This suppression addresses ThreadSanitizer false positives when using Rust's `std::thread::local`. Similar to `lazy_static`, `std::thread::local` utilizes implicit barriers that TSAN fails to recognize, leading to incorrect race condition reports.
+
+SOURCE: https://github.com/spacejam/sled/blob/main/tsan_suppressions.txt#_snippet_2
+
+LANGUAGE: TSAN Suppression
+CODE:
+```
+race:std::thread::local
+```
+
+----------------------------------------
+
+TITLE: Suppressing TSAN Race on lazy_static in Rust
+DESCRIPTION: This suppression targets ThreadSanitizer false positives related to the `lazy_static` crate in Rust. `lazy_static` relies on implicit memory barriers that TSAN does not correctly detect, causing it to report races where none exist.
+
+SOURCE: https://github.com/spacejam/sled/blob/main/tsan_suppressions.txt#_snippet_1
+
+LANGUAGE: TSAN Suppression
+CODE:
+```
+race:lazy_static
+```

specs/lance_implementation.md

@@ -0,0 +1,735 @@
+Looking at your request to ensure embedding happens with an external embedding provider configured in Redis at `config:core:aiembed:url`, I'll modify the implementation to use an external embedding service instead of local models.
+
+## Updated Implementation with External Embedding Provider
+
+### 1. Update Dependencies in `Cargo.toml`
+
+```toml
+[dependencies]
+# ... existing dependencies ...
+lance = "0.18"
+lance-index = "0.18"
+lance-linalg = "0.18"
+arrow = "52"
+arrow-array = "52"
+arrow-schema = "52"
+parquet = "52"
+uuid = { version = "1.10", features = ["v4"] }
+reqwest = { version = "0.11", features = ["json"] }
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+base64 = "0.22"
+image = "0.25"
+```
+
+### 2. Create Enhanced Lance Module with External Embedding
+
+Create `src/lance_store.rs`:
+
+```rust
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+use tokio::sync::RwLock;
+
+use arrow::array::{Float32Array, StringArray, BinaryArray, ArrayRef};
+use arrow::datatypes::{DataType, Field, Schema};
+use arrow::record_batch::RecordBatch;
+use lance::dataset::{Dataset, WriteParams, WriteMode};
+use lance::index::vector::VectorIndexParams;
+use lance_index::vector::pq::PQBuildParams;
+use lance_index::vector::ivf::IvfBuildParams;
+
+use serde::{Deserialize, Serialize};
+use crate::error::DBError;
+use crate::cmd::Protocol;
+
+#[derive(Debug, Serialize, Deserialize)]
+struct EmbeddingRequest {
+    texts: Option<Vec<String>>,
+    images: Option<Vec<String>>, // base64 encoded
+    model: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct EmbeddingResponse {
+    embeddings: Vec<Vec<f32>>,
+    model: String,
+    usage: Option<HashMap<String, u32>>,
+}
+
+pub struct LanceStore {
+    datasets: Arc<RwLock<HashMap<String, Arc<Dataset>>>>,
+    data_dir: PathBuf,
+    http_client: reqwest::Client,
+}
+
+impl LanceStore {
+    pub async fn new(data_dir: PathBuf) -> Result<Self, DBError> {
+        // Create data directory if it doesn't exist
+        std::fs::create_dir_all(&data_dir)
+            .map_err(|e| DBError(format!("Failed to create Lance data directory: {}", e)))?;
+        
+        let http_client = reqwest::Client::builder()
+            .timeout(std::time::Duration::from_secs(30))
+            .build()
+            .map_err(|e| DBError(format!("Failed to create HTTP client: {}", e)))?;
+        
+        Ok(Self {
+            datasets: Arc::new(RwLock::new(HashMap::new())),
+            data_dir,
+            http_client,
+        })
+    }
+    
+    /// Get embedding service URL from Redis config
+    async fn get_embedding_url(&self, server: &crate::server::Server) -> Result<String, DBError> {
+        // Get the embedding URL from Redis config
+        let key = "config:core:aiembed:url";
+        
+        // Use HGET to retrieve the URL from Redis hash
+        let cmd = crate::cmd::Cmd::HGet {
+            key: key.to_string(),
+            field: "url".to_string(),
+        };
+        
+        // Execute command to get the config
+        let result = cmd.run(server).await?;
+        
+        match result {
+            Protocol::BulkString(url) => Ok(url),
+            Protocol::SimpleString(url) => Ok(url),
+            Protocol::Nil => Err(DBError(
+                "Embedding service URL not configured. Set it with: HSET config:core:aiembed:url url <YOUR_EMBEDDING_SERVICE_URL>".to_string()
+            )),
+            _ => Err(DBError("Invalid embedding URL configuration".to_string())),
+        }
+    }
+    
+    /// Call external embedding service
+    async fn call_embedding_service(
+        &self,
+        server: &crate::server::Server,
+        texts: Option<Vec<String>>,
+        images: Option<Vec<String>>,
+    ) -> Result<Vec<Vec<f32>>, DBError> {
+        let url = self.get_embedding_url(server).await?;
+        
+        let request = EmbeddingRequest {
+            texts,
+            images,
+            model: None, // Let the service use its default
+        };
+        
+        let response = self.http_client
+            .post(&url)
+            .json(&request)
+            .send()
+            .await
+            .map_err(|e| DBError(format!("Failed to call embedding service: {}", e)))?;
+        
+        if !response.status().is_success() {
+            let status = response.status();
+            let error_text = response.text().await.unwrap_or_default();
+            return Err(DBError(format!(
+                "Embedding service returned error {}: {}", 
+                status, error_text
+            )));
+        }
+        
+        let embedding_response: EmbeddingResponse = response
+            .json()
+            .await
+            .map_err(|e| DBError(format!("Failed to parse embedding response: {}", e)))?;
+        
+        Ok(embedding_response.embeddings)
+    }
+    
+    pub async fn embed_text(
+        &self, 
+        server: &crate::server::Server,
+        texts: Vec<String>
+    ) -> Result<Vec<Vec<f32>>, DBError> {
+        if texts.is_empty() {
+            return Ok(Vec::new());
+        }
+        
+        self.call_embedding_service(server, Some(texts), None).await
+    }
+    
+    pub async fn embed_image(
+        &self,
+        server: &crate::server::Server,
+        image_bytes: Vec<u8>
+    ) -> Result<Vec<f32>, DBError> {
+        // Convert image bytes to base64
+        let base64_image = base64::encode(&image_bytes);
+        
+        let embeddings = self.call_embedding_service(
+            server, 
+            None, 
+            Some(vec![base64_image])
+        ).await?;
+        
+        embeddings.into_iter()
+            .next()
+            .ok_or_else(|| DBError("No embedding returned for image".to_string()))
+    }
+    
+    pub async fn create_dataset(
+        &self,
+        name: &str,
+        schema: Schema,
+    ) -> Result<(), DBError> {
+        let dataset_path = self.data_dir.join(format!("{}.lance", name));
+        
+        // Create empty dataset with schema
+        let write_params = WriteParams {
+            mode: WriteMode::Create,
+            ..Default::default()
+        };
+        
+        // Create an empty RecordBatch with the schema
+        let empty_batch = RecordBatch::new_empty(Arc::new(schema));
+        let batches = vec![empty_batch];
+        
+        let dataset = Dataset::write(
+            batches,
+            dataset_path.to_str().unwrap(),
+            Some(write_params)
+        ).await
+        .map_err(|e| DBError(format!("Failed to create dataset: {}", e)))?;
+        
+        let mut datasets = self.datasets.write().await;
+        datasets.insert(name.to_string(), Arc::new(dataset));
+        
+        Ok(())
+    }
+    
+    pub async fn write_vectors(
+        &self,
+        dataset_name: &str,
+        vectors: Vec<Vec<f32>>,
+        metadata: Option<HashMap<String, Vec<String>>>,
+    ) -> Result<usize, DBError> {
+        let dataset_path = self.data_dir.join(format!("{}.lance", dataset_name));
+        
+        // Open or get cached dataset
+        let dataset = self.get_or_open_dataset(dataset_name).await?;
+        
+        // Build RecordBatch
+        let num_vectors = vectors.len();
+        if num_vectors == 0 {
+            return Ok(0);
+        }
+        
+        let dim = vectors.first()
+            .ok_or_else(|| DBError("Empty vectors".to_string()))?
+            .len();
+        
+        // Flatten vectors
+        let flat_vectors: Vec<f32> = vectors.into_iter().flatten().collect();
+        let vector_array = Float32Array::from(flat_vectors);
+        let vector_array = arrow::array::FixedSizeListArray::try_new_from_values(
+            vector_array, 
+            dim as i32
+        ).map_err(|e| DBError(format!("Failed to create vector array: {}", e)))?;
+        
+        let mut arrays: Vec<ArrayRef> = vec![Arc::new(vector_array)];
+        let mut fields = vec![Field::new(
+            "vector",
+            DataType::FixedSizeList(
+                Arc::new(Field::new("item", DataType::Float32, true)),
+                dim as i32
+            ),
+            false
+        )];
+        
+        // Add metadata columns if provided
+        if let Some(metadata) = metadata {
+            for (key, values) in metadata {
+                if values.len() != num_vectors {
+                    return Err(DBError(format!(
+                        "Metadata field '{}' has {} values but expected {}", 
+                        key, values.len(), num_vectors
+                    )));
+                }
+                let array = StringArray::from(values);
+                arrays.push(Arc::new(array));
+                fields.push(Field::new(&key, DataType::Utf8, true));
+            }
+        }
+        
+        let schema = Arc::new(Schema::new(fields));
+        let batch = RecordBatch::try_new(schema, arrays)
+            .map_err(|e| DBError(format!("Failed to create RecordBatch: {}", e)))?;
+        
+        // Append to dataset
+        let write_params = WriteParams {
+            mode: WriteMode::Append,
+            ..Default::default()
+        };
+        
+        Dataset::write(
+            vec![batch],
+            dataset_path.to_str().unwrap(),
+            Some(write_params)
+        ).await
+        .map_err(|e| DBError(format!("Failed to write to dataset: {}", e)))?;
+        
+        // Refresh cached dataset
+        let mut datasets = self.datasets.write().await;
+        datasets.remove(dataset_name);
+        
+        Ok(num_vectors)
+    }
+    
+    pub async fn search_vectors(
+        &self,
+        dataset_name: &str,
+        query_vector: Vec<f32>,
+        k: usize,
+        nprobes: Option<usize>,
+        refine_factor: Option<usize>,
+    ) -> Result<Vec<(f32, HashMap<String, String>)>, DBError> {
+        let dataset = self.get_or_open_dataset(dataset_name).await?;
+        
+        // Build query
+        let mut query = dataset.scan();
+        query = query.nearest(
+            "vector",
+            &query_vector,
+            k,
+        ).map_err(|e| DBError(format!("Failed to build search query: {}", e)))?;
+        
+        if let Some(nprobes) = nprobes {
+            query = query.nprobes(nprobes);
+        }
+        
+        if let Some(refine) = refine_factor {
+            query = query.refine_factor(refine);
+        }
+        
+        // Execute search
+        let results = query
+            .try_into_stream()
+            .await
+            .map_err(|e| DBError(format!("Failed to execute search: {}", e)))?
+            .try_collect::<Vec<_>>()
+            .await
+            .map_err(|e| DBError(format!("Failed to collect results: {}", e)))?;
+        
+        // Process results
+        let mut output = Vec::new();
+        for batch in results {
+            // Get distances
+            let distances = batch
+                .column_by_name("_distance")
+                .ok_or_else(|| DBError("No distance column".to_string()))?
+                .as_any()
+                .downcast_ref::<Float32Array>()
+                .ok_or_else(|| DBError("Invalid distance type".to_string()))?;
+            
+            // Get metadata
+            for i in 0..batch.num_rows() {
+                let distance = distances.value(i);
+                let mut metadata = HashMap::new();
+                
+                for field in batch.schema().fields() {
+                    if field.name() != "vector" && field.name() != "_distance" {
+                        if let Some(col) = batch.column_by_name(field.name()) {
+                            if let Some(str_array) = col.as_any().downcast_ref::<StringArray>() {
+                                if !str_array.is_null(i) {
+                                    metadata.insert(
+                                        field.name().to_string(),
+                                        str_array.value(i).to_string()
+                                    );
+                                }
+                            }
+                        }
+                    }
+                }
+                
+                output.push((distance, metadata));
+            }
+        }
+        
+        Ok(output)
+    }
+    
+    pub async fn store_multimodal(
+        &self,
+        server: &crate::server::Server,
+        dataset_name: &str,
+        text: Option<String>,
+        image_bytes: Option<Vec<u8>>,
+        metadata: HashMap<String, String>,
+    ) -> Result<String, DBError> {
+        // Generate ID
+        let id = uuid::Uuid::new_v4().to_string();
+        
+        // Generate embeddings using external service
+        let embedding = if let Some(text) = text.as_ref() {
+            self.embed_text(server, vec![text.clone()]).await?
+                .into_iter()
+                .next()
+                .ok_or_else(|| DBError("No embedding returned".to_string()))?
+        } else if let Some(img) = image_bytes.as_ref() {
+            self.embed_image(server, img.clone()).await?
+        } else {
+            return Err(DBError("No text or image provided".to_string()));
+        };
+        
+        // Prepare metadata
+        let mut full_metadata = metadata;
+        full_metadata.insert("id".to_string(), id.clone());
+        if let Some(text) = text {
+            full_metadata.insert("text".to_string(), text);
+        }
+        if let Some(img) = image_bytes {
+            full_metadata.insert("image_base64".to_string(), base64::encode(img));
+        }
+        
+        // Convert metadata to column vectors
+        let mut metadata_cols = HashMap::new();
+        for (key, value) in full_metadata {
+            metadata_cols.insert(key, vec![value]);
+        }
+        
+        // Write to dataset
+        self.write_vectors(dataset_name, vec![embedding], Some(metadata_cols)).await?;
+        
+        Ok(id)
+    }
+    
+    pub async fn search_with_text(
+        &self,
+        server: &crate::server::Server,
+        dataset_name: &str,
+        query_text: String,
+        k: usize,
+        nprobes: Option<usize>,
+        refine_factor: Option<usize>,
+    ) -> Result<Vec<(f32, HashMap<String, String>)>, DBError> {
+        // Embed the query text using external service
+        let embeddings = self.embed_text(server, vec![query_text]).await?;
+        let query_vector = embeddings.into_iter()
+            .next()
+            .ok_or_else(|| DBError("No embedding returned for query".to_string()))?;
+        
+        // Search with the embedding
+        self.search_vectors(dataset_name, query_vector, k, nprobes, refine_factor).await
+    }
+    
+    pub async fn create_index(
+        &self,
+        dataset_name: &str,
+        index_type: &str,
+        num_partitions: Option<usize>,
+        num_sub_vectors: Option<usize>,
+    ) -> Result<(), DBError> {
+        let dataset = self.get_or_open_dataset(dataset_name).await?;
+        
+        let mut params = VectorIndexParams::default();
+        
+        match index_type.to_uppercase().as_str() {
+            "IVF_PQ" => {
+                params.ivf = IvfBuildParams {
+                    num_partitions: num_partitions.unwrap_or(256),
+                    ..Default::default()
+                };
+                params.pq = PQBuildParams {
+                    num_sub_vectors: num_sub_vectors.unwrap_or(16),
+                    ..Default::default()
+                };
+            }
+            _ => return Err(DBError(format!("Unsupported index type: {}", index_type))),
+        }
+        
+        dataset.create_index(
+            &["vector"],
+            lance::index::IndexType::Vector,
+            None,
+            &params,
+            true
+        ).await
+        .map_err(|e| DBError(format!("Failed to create index: {}", e)))?;
+        
+        Ok(())
+    }
+    
+    async fn get_or_open_dataset(&self, name: &str) -> Result<Arc<Dataset>, DBError> {
+        let mut datasets = self.datasets.write().await;
+        
+        if let Some(dataset) = datasets.get(name) {
+            return Ok(dataset.clone());
+        }
+        
+        let dataset_path = self.data_dir.join(format!("{}.lance", name));
+        if !dataset_path.exists() {
+            return Err(DBError(format!("Dataset '{}' does not exist", name)));
+        }
+        
+        let dataset = Dataset::open(dataset_path.to_str().unwrap())
+            .await
+            .map_err(|e| DBError(format!("Failed to open dataset: {}", e)))?;
+        
+        let dataset = Arc::new(dataset);
+        datasets.insert(name.to_string(), dataset.clone());
+        
+        Ok(dataset)
+    }
+    
+    pub async fn list_datasets(&self) -> Result<Vec<String>, DBError> {
+        let mut datasets = Vec::new();
+        
+        let entries = std::fs::read_dir(&self.data_dir)
+            .map_err(|e| DBError(format!("Failed to read data directory: {}", e)))?;
+        
+        for entry in entries {
+            let entry = entry.map_err(|e| DBError(format!("Failed to read entry: {}", e)))?;
+            let path = entry.path();
+            
+            if path.is_dir() {
+                if let Some(name) = path.file_name() {
+                    if let Some(name_str) = name.to_str() {
+                        if name_str.ends_with(".lance") {
+                            let dataset_name = name_str.trim_end_matches(".lance");
+                            datasets.push(dataset_name.to_string());
+                        }
+                    }
+                }
+            }
+        }
+        
+        Ok(datasets)
+    }
+    
+    pub async fn drop_dataset(&self, name: &str) -> Result<(), DBError> {
+        // Remove from cache
+        let mut datasets = self.datasets.write().await;
+        datasets.remove(name);
+        
+        // Delete from disk
+        let dataset_path = self.data_dir.join(format!("{}.lance", name));
+        if dataset_path.exists() {
+            std::fs::remove_dir_all(dataset_path)
+                .map_err(|e| DBError(format!("Failed to delete dataset: {}", e)))?;
+        }
+        
+        Ok(())
+    }
+    
+    pub async fn get_dataset_info(&self, name: &str) -> Result<HashMap<String, String>, DBError> {
+        let dataset = self.get_or_open_dataset(name).await?;
+        
+        let mut info = HashMap::new();
+        info.insert("name".to_string(), name.to_string());
+        info.insert("version".to_string(), dataset.version().to_string());
+        info.insert("num_rows".to_string(), dataset.count_rows().await?.to_string());
+        
+        // Get schema info
+        let schema = dataset.schema();
+        let fields: Vec<String> = schema.fields()
+            .iter()
+            .map(|f| format!("{}:{}", f.name(), f.data_type()))
+            .collect();
+        info.insert("schema".to_string(), fields.join(", "));
+        
+        Ok(info)
+    }
+}
+```
+
+### 3. Update Command Implementations
+
+Update the command implementations to pass the server reference for embedding service access:
+
+```rust
+// In cmd.rs, update the lance command implementations
+
+async fn lance_store_cmd(
+    server: &Server,
+    dataset: &str,
+    text: Option<String>,
+    image_base64: Option<String>,
+    metadata: HashMap<String, String>,
+) -> Result<Protocol, DBError> {
+    let lance_store = server.lance_store()?;
+    
+    // Decode image if provided
+    let image_bytes = if let Some(b64) = image_base64 {
+        Some(base64::decode(b64).map_err(|e| 
+            DBError(format!("Invalid base64 image: {}", e)))?)
+    } else {
+        None
+    };
+    
+    // Pass server reference for embedding service access
+    let id = lance_store.store_multimodal(
+        server,  // Pass server to access Redis config
+        dataset,
+        text,
+        image_bytes,
+        metadata,
+    ).await?;
+    
+    Ok(Protocol::BulkString(id))
+}
+
+async fn lance_embed_text_cmd(
+    server: &Server,
+    texts: &[String],
+) -> Result<Protocol, DBError> {
+    let lance_store = server.lance_store()?;
+    
+    // Pass server reference for embedding service access
+    let embeddings = lance_store.embed_text(server, texts.to_vec()).await?;
+    
+    // Return as array of vectors
+    let mut output = Vec::new();
+    for embedding in embeddings {
+        let vector_str = format!("[{}]", 
+            embedding.iter()
+                .map(|f| f.to_string())
+                .collect::<Vec<_>>()
+                .join(",")
+        );
+        output.push(Protocol::BulkString(vector_str));
+    }
+    
+    Ok(Protocol::Array(output))
+}
+
+async fn lance_search_text_cmd(
+    server: &Server,
+    dataset: &str,
+    query_text: &str,
+    k: usize,
+    nprobes: Option<usize>,
+    refine_factor: Option<usize>,
+) -> Result<Protocol, DBError> {
+    let lance_store = server.lance_store()?;
+    
+    // Search using text query (will be embedded automatically)
+    let results = lance_store.search_with_text(
+        server,
+        dataset,
+        query_text.to_string(),
+        k,
+        nprobes,
+        refine_factor,
+    ).await?;
+    
+    // Format results
+    let mut output = Vec::new();
+    for (distance, metadata) in results {
+        let metadata_json = serde_json::to_string(&metadata)
+            .unwrap_or_else(|_| "{}".to_string());
+        
+        output.push(Protocol::Array(vec![
+            Protocol::BulkString(distance.to_string()),
+            Protocol::BulkString(metadata_json),
+        ]));
+    }
+    
+    Ok(Protocol::Array(output))
+}
+
+// Add new command for text-based search
+pub enum Cmd {
+    // ... existing commands ...
+    LanceSearchText {
+        dataset: String,
+        query_text: String,
+        k: usize,
+        nprobes: Option<usize>,
+        refine_factor: Option<usize>,
+    },
+}
+```
+
+## Usage Examples
+
+### 1. Configure the Embedding Service
+
+First, users need to configure the embedding service URL:
+
+```bash
+# Configure the embedding service endpoint
+redis-cli> HSET config:core:aiembed:url url "http://localhost:8000/embeddings"
+OK
+
+# Or use a cloud service
+redis-cli> HSET config:core:aiembed:url url "https://api.openai.com/v1/embeddings"
+OK
+```
+
+### 2. Use Lance Commands with Automatic External Embedding
+
+```bash
+# Create a dataset
+redis-cli> LANCE.CREATE products DIM 1536 SCHEMA name:string price:float category:string
+OK
+
+# Store text with automatic embedding (calls external service)
+redis-cli> LANCE.STORE products TEXT "Wireless noise-canceling headphones with 30-hour battery" name:AirPods price:299.99 category:Electronics
+"uuid-123-456"
+
+# Search using text query (automatically embeds the query)
+redis-cli> LANCE.SEARCH.TEXT products "best headphones for travel" K 5
+1) "0.92" 
+2) "{\"id\":\"uuid-123\",\"name\":\"AirPods\",\"price\":\"299.99\"}"
+
+# Get embeddings directly
+redis-cli> LANCE.EMBED.TEXT "This text will be embedded"
+1) "[0.123, 0.456, 0.789, ...]"
+```
+
+## External Embedding Service API Specification
+
+The external embedding service should accept POST requests with this format:
+
+```json
+// Request
+{
+  "texts": ["text1", "text2"],  // Optional
+  "images": ["base64_img1"],    // Optional
+  "model": "text-embedding-ada-002"  // Optional
+}
+
+// Response
+{
+  "embeddings": [[0.1, 0.2, ...], [0.3, 0.4, ...]],
+  "model": "text-embedding-ada-002",
+  "usage": {
+    "prompt_tokens": 100,
+    "total_tokens": 100
+  }
+}
+```
+
+## Error Handling
+
+The implementation includes comprehensive error handling:
+
+1. **Missing Configuration**: Clear error message if embedding URL not configured
+2. **Service Failures**: Graceful handling of embedding service errors
+3. **Timeout Protection**: 30-second timeout for embedding requests
+4. **Retry Logic**: Could be added for resilience
+
+## Benefits of This Approach
+
+1. **Flexibility**: Supports any embedding service with compatible API
+2. **Cost Control**: Use your preferred embedding provider
+3. **Scalability**: Embedding service can be scaled independently
+4. **Consistency**: All embeddings use the same configured service
+5. **Security**: API keys and endpoints stored securely in Redis
+
+This implementation ensures that all embedding operations go through the external service configured in Redis, providing a clean separation between the vector database functionality and the embedding generation.
+
+
+TODO EXTRA:
+
+- secret for the embedding service API key
+

src/admin_meta.rs

@@ -0,0 +1,361 @@
+use std::path::PathBuf;
+use std::sync::{Arc, OnceLock, Mutex, RwLock};
+use std::collections::HashMap;
+
+use crate::error::DBError;
+use crate::options;
+use crate::rpc::Permissions;
+use crate::storage::Storage;
+use crate::storage_sled::SledStorage;
+use crate::storage_trait::StorageBackend;
+
+// Key builders
+fn k_admin_next_id() -> &'static str {
+    "admin:next_id"
+}
+fn k_admin_dbs() -> &'static str {
+    "admin:dbs"
+}
+fn k_meta_db(id: u64) -> String {
+    format!("meta:db:{}", id)
+}
+fn k_meta_db_keys(id: u64) -> String {
+    format!("meta:db:{}:keys", id)
+}
+fn k_meta_db_enc(id: u64) -> String {
+    format!("meta:db:{}:enc", id)
+}
+
+// Global cache of admin DB 0 handles per base_dir to avoid sled/reDB file-lock contention
+// and to correctly isolate different test instances with distinct directories.
+static ADMIN_STORAGES: OnceLock<RwLock<HashMap<String, Arc<dyn StorageBackend>>>> = OnceLock::new();
+
+// Global registry for data DB storages to avoid double-open across process.
+static DATA_STORAGES: OnceLock<RwLock<HashMap<u64, Arc<dyn StorageBackend>>>> = OnceLock::new();
+static DATA_INIT_LOCK: Mutex<()> = Mutex::new(());
+
+fn init_admin_storage(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+) -> Result<Arc<dyn StorageBackend>, DBError> {
+    let db_file = PathBuf::from(base_dir).join("0.db");
+    if let Some(parent_dir) = db_file.parent() {
+        std::fs::create_dir_all(parent_dir).map_err(|e| {
+            DBError(format!("Failed to create directory {}: {}", parent_dir.display(), e))
+        })?;
+    }
+    let storage: Arc<dyn StorageBackend> = match backend {
+        options::BackendType::Redb => Arc::new(Storage::new(&db_file, true, Some(admin_secret))?),
+        options::BackendType::Sled => Arc::new(SledStorage::new(&db_file, true, Some(admin_secret))?),
+    };
+    Ok(storage)
+}
+
+// Get or initialize a cached handle to admin DB 0 per base_dir (thread-safe, no double-open race)
+pub fn open_admin_storage(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+) -> Result<Arc<dyn StorageBackend>, DBError> {
+    let map = ADMIN_STORAGES.get_or_init(|| RwLock::new(HashMap::new()));
+    // Fast path
+    if let Some(st) = map.read().unwrap().get(base_dir) {
+        return Ok(st.clone());
+    }
+    // Slow path with write lock
+    {
+        let mut w = map.write().unwrap();
+        if let Some(st) = w.get(base_dir) {
+            return Ok(st.clone());
+        }
+        let st = init_admin_storage(base_dir, backend, admin_secret)?;
+        w.insert(base_dir.to_string(), st.clone());
+        return Ok(st);
+    }
+}
+
+// Ensure admin structures exist in encrypted DB 0
+pub fn ensure_bootstrap(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+) -> Result<(), DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+
+    // Initialize next id if missing
+    if !admin.exists(k_admin_next_id())? {
+        admin.set(k_admin_next_id().to_string(), "1".to_string())?;
+    }
+    // admin:dbs is a hash; it's fine if it doesn't exist (hlen -> 0)
+    Ok(())
+}
+
+// Get or initialize a shared handle to a data DB (> 0), avoiding double-open across subsystems
+pub fn open_data_storage(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+) -> Result<Arc<dyn StorageBackend>, DBError> {
+    if id == 0 {
+        return open_admin_storage(base_dir, backend, admin_secret);
+    }
+
+    // Validate existence in admin metadata
+    if !db_exists(base_dir, backend.clone(), admin_secret, id)? {
+        return Err(DBError(format!(
+            "Cannot open database instance {}, as that database instance does not exist.",
+            id
+        )));
+    }
+
+    let map = DATA_STORAGES.get_or_init(|| RwLock::new(HashMap::new()));
+    // Fast path
+    if let Some(st) = map.read().unwrap().get(&id) {
+        return Ok(st.clone());
+    }
+
+    // Slow path with init lock
+    let _guard = DATA_INIT_LOCK.lock().unwrap();
+    if let Some(st) = map.read().unwrap().get(&id) {
+        return Ok(st.clone());
+    }
+
+    // Determine per-db encryption
+    let enc = get_enc_key(base_dir, backend.clone(), admin_secret, id)?;
+    let should_encrypt = enc.is_some();
+
+    // Build database file path and ensure parent dir exists
+    let db_file = PathBuf::from(base_dir).join(format!("{}.db", id));
+    if let Some(parent_dir) = db_file.parent() {
+        std::fs::create_dir_all(parent_dir).map_err(|e| {
+            DBError(format!("Failed to create directory {}: {}", parent_dir.display(), e))
+        })?;
+    }
+
+    // Open storage
+    let storage: Arc<dyn StorageBackend> = match backend {
+        options::BackendType::Redb => Arc::new(Storage::new(&db_file, should_encrypt, enc.as_deref())?),
+        options::BackendType::Sled => Arc::new(SledStorage::new(&db_file, should_encrypt, enc.as_deref())?),
+    };
+
+    // Publish to registry
+    map.write().unwrap().insert(id, storage.clone());
+    Ok(storage)
+}
+
+// Allocate the next DB id and persist new pointer
+pub fn allocate_next_id(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+) -> Result<u64, DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    let cur = admin
+        .get(k_admin_next_id())?
+        .unwrap_or_else(|| "1".to_string());
+    let id: u64 = cur.parse().unwrap_or(1);
+    let next = id.checked_add(1).ok_or_else(|| DBError("next_id overflow".into()))?;
+    admin.set(k_admin_next_id().to_string(), next.to_string())?;
+
+    // Register into admin:dbs set/hash
+    let _ = admin.hset(k_admin_dbs(), vec![(id.to_string(), "1".to_string())])?;
+
+    // Default meta for the new db: public true
+    let meta_key = k_meta_db(id);
+    let _ = admin.hset(&meta_key, vec![("public".to_string(), "true".to_string())])?;
+
+    Ok(id)
+}
+
+// Check existence of a db id in admin:dbs
+pub fn db_exists(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+) -> Result<bool, DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    Ok(admin.hexists(k_admin_dbs(), &id.to_string())?)
+}
+
+// Get per-db encryption key, if any
+pub fn get_enc_key(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+) -> Result<Option<String>, DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    admin.get(&k_meta_db_enc(id))
+}
+
+// Set per-db encryption key (called during create)
+pub fn set_enc_key(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+    key: &str,
+) -> Result<(), DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    admin.set(k_meta_db_enc(id), key.to_string())
+}
+
+// Set database public flag
+pub fn set_database_public(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+    public: bool,
+) -> Result<(), DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    let mk = k_meta_db(id);
+    let _ = admin.hset(&mk, vec![("public".to_string(), public.to_string())])?;
+    Ok(())
+}
+
+// Internal: load public flag; default to true when meta missing
+fn load_public(
+    admin: &Arc<dyn StorageBackend>,
+    id: u64,
+) -> Result<bool, DBError> {
+    let mk = k_meta_db(id);
+    match admin.hget(&mk, "public")? {
+        Some(v) => Ok(v == "true"),
+        None => Ok(true),
+    }
+}
+
+// Add access key for db (value format: "Read:ts" or "ReadWrite:ts")
+pub fn add_access_key(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+    key_plain: &str,
+    perms: Permissions,
+) -> Result<(), DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    let hash = crate::rpc::hash_key(key_plain);
+    let v = match perms {
+        Permissions::Read => format!("Read:{}", now_secs()),
+        Permissions::ReadWrite => format!("ReadWrite:{}", now_secs()),
+    };
+    let _ = admin.hset(&k_meta_db_keys(id), vec![(hash, v)])?;
+    Ok(())
+}
+
+// Delete access key by hash
+pub fn delete_access_key(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+    key_hash: &str,
+) -> Result<bool, DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    let n = admin.hdel(&k_meta_db_keys(id), vec![key_hash.to_string()])?;
+    Ok(n > 0)
+}
+
+// List access keys, returning (hash, perms, created_at_secs)
+pub fn list_access_keys(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+) -> Result<Vec<(String, Permissions, u64)>, DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    let pairs = admin.hgetall(&k_meta_db_keys(id))?;
+    let mut out = Vec::new();
+    for (hash, val) in pairs {
+        let (perm, ts) = parse_perm_value(&val);
+        out.push((hash, perm, ts));
+    }
+    Ok(out)
+}
+
+// Verify access permission for db id with optional key
+// Returns:
+// - Ok(Some(Permissions)) when access is allowed
+// - Ok(None) when not allowed or db missing (caller can distinguish by calling db_exists)
+pub fn verify_access(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+    id: u64,
+    key_opt: Option<&str>,
+) -> Result<Option<Permissions>, DBError> {
+    // Admin DB 0: require exact admin_secret
+    if id == 0 {
+        if let Some(k) = key_opt {
+            if k == admin_secret {
+                return Ok(Some(Permissions::ReadWrite));
+            }
+        }
+        return Ok(None);
+    }
+
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    if !admin.hexists(k_admin_dbs(), &id.to_string())? {
+        return Ok(None);
+    }
+
+    // Public?
+    if load_public(&admin, id)? {
+        return Ok(Some(Permissions::ReadWrite));
+    }
+
+    // Private: require key and verify
+    if let Some(k) = key_opt {
+        let hash = crate::rpc::hash_key(k);
+        if let Some(v) = admin.hget(&k_meta_db_keys(id), &hash)? {
+            let (perm, _ts) = parse_perm_value(&v);
+            return Ok(Some(perm));
+        }
+    }
+    Ok(None)
+}
+
+// Enumerate all db ids
+pub fn list_dbs(
+    base_dir: &str,
+    backend: options::BackendType,
+    admin_secret: &str,
+) -> Result<Vec<u64>, DBError> {
+    let admin = open_admin_storage(base_dir, backend, admin_secret)?;
+    let ids = admin.hkeys(k_admin_dbs())?;
+    let mut out = Vec::new();
+    for s in ids {
+        if let Ok(v) = s.parse() {
+            out.push(v);
+        }
+    }
+    Ok(out)
+}
+
+// Helper: parse permission value "Read:ts" or "ReadWrite:ts"
+fn parse_perm_value(v: &str) -> (Permissions, u64) {
+    let mut parts = v.split(':');
+    let p = parts.next().unwrap_or("Read");
+    let ts = parts
+        .next()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(0u64);
+    let perm = match p {
+        "ReadWrite" => Permissions::ReadWrite,
+        _ => Permissions::Read,
+    };
+    (perm, ts)
+}
+
+fn now_secs() -> u64 {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}

src/cmd.rs

@@ -1,5 +1,4 @@
 use crate::{error::DBError, protocol::Protocol, server::Server};
-use serde::Serialize;
 use tokio::time::{timeout, Duration};
 use futures::future::select_all;
 
@@ -7,7 +6,7 @@ use futures::future::select_all;
 pub enum Cmd {
     Ping,
     Echo(String),
-    Select(u64), // Changed from u16 to u64
+    Select(u64, Option<String>), // db_index, optional_key
     Get(String),
     Set(String, String),
     SetPx(String, String, u128),
@@ -99,11 +98,18 @@ impl Cmd {
                 Ok((
                     match cmd[0].to_lowercase().as_str() {
                         "select" => {
-                            if cmd.len() != 2 {
+                            if cmd.len() < 2 || cmd.len() > 4 {
                                 return Err(DBError("wrong number of arguments for SELECT".to_string()));
                             }
                             let idx = cmd[1].parse::<u64>().map_err(|_| DBError("ERR DB index is not an integer".to_string()))?;
-                            Cmd::Select(idx)
+                            let key = if cmd.len() == 4 && cmd[2].to_lowercase() == "key" {
+                                Some(cmd[3].clone())
+                            } else if cmd.len() == 2 {
+                                None
+                            } else {
+                                return Err(DBError("ERR syntax error".to_string()));
+                            };
+                            Cmd::Select(idx, key)
                         }
                         "echo" => Cmd::Echo(cmd[1].clone()),
                         "ping" => Cmd::Ping,
@@ -643,7 +649,7 @@ impl Cmd {
         }
 
         match self {
-            Cmd::Select(db) => select_cmd(server, db).await,
+            Cmd::Select(db, key) => select_cmd(server, db, key).await,
             Cmd::Ping => Ok(Protocol::SimpleString("PONG".to_string())),
             Cmd::Echo(s) => Ok(Protocol::BulkString(s)),
             Cmd::Get(k) => get_cmd(server, &k).await,
@@ -737,7 +743,14 @@ impl Cmd {
     
     pub fn to_protocol(self) -> Protocol {
         match self {
-            Cmd::Select(db) => Protocol::Array(vec![Protocol::BulkString("select".to_string()), Protocol::BulkString(db.to_string())]),
+            Cmd::Select(db, key) => {
+                let mut arr = vec![Protocol::BulkString("select".to_string()), Protocol::BulkString(db.to_string())];
+                if let Some(k) = key {
+                    arr.push(Protocol::BulkString("key".to_string()));
+                    arr.push(Protocol::BulkString(k));
+                }
+                Protocol::Array(arr)
+            }
             Cmd::Ping => Protocol::Array(vec![Protocol::BulkString("ping".to_string())]),
             Cmd::Echo(s) => Protocol::Array(vec![Protocol::BulkString("echo".to_string()), Protocol::BulkString(s)]),
             Cmd::Get(k) => Protocol::Array(vec![Protocol::BulkString("get".to_string()), Protocol::BulkString(k)]),
@@ -754,9 +767,65 @@ async fn flushdb_cmd(server: &mut Server) -> Result<Protocol, DBError> {
     }
 }
 
-async fn select_cmd(server: &mut Server, db: u64) -> Result<Protocol, DBError> {
-    // Test if we can access the database (this will create it if needed)
+async fn select_cmd(server: &mut Server, db: u64, key: Option<String>) -> Result<Protocol, DBError> {
+    // Authorization and existence checks via admin DB 0
+    // DB 0: require KEY admin-secret
+    if db == 0 {
+        match key {
+            Some(k) if k == server.option.admin_secret => {
+                server.selected_db = 0;
+                server.current_permissions = Some(crate::rpc::Permissions::ReadWrite);
+                // Will create encrypted 0.db if missing
+                match server.current_storage() {
+                    Ok(_) => return Ok(Protocol::SimpleString("OK".to_string())),
+                    Err(e) => return Ok(Protocol::err(&e.0)),
+                }
+            }
+            _ => {
+                return Ok(Protocol::err("ERR invalid access key"));
+            }
+        }
+    }
+
+    // DB > 0: must exist in admin:dbs
+    let exists = match crate::admin_meta::db_exists(
+        &server.option.dir,
+        server.option.backend.clone(),
+        &server.option.admin_secret,
+        db,
+    ) {
+        Ok(b) => b,
+        Err(e) => return Ok(Protocol::err(&e.0)),
+    };
+
+    if !exists {
+        return Ok(Protocol::err(&format!(
+            "Cannot open database instance {}, as that database instance does not exist.",
+            db
+        )));
+    }
+
+    // Verify permissions (public => RW; private => use key)
+    let perms_opt = match crate::admin_meta::verify_access(
+        &server.option.dir,
+        server.option.backend.clone(),
+        &server.option.admin_secret,
+        db,
+        key.as_deref(),
+    ) {
+        Ok(p) => p,
+        Err(e) => return Ok(Protocol::err(&e.0)),
+    };
+
+    let perms = match perms_opt {
+        Some(p) => p,
+        None => return Ok(Protocol::err("ERR invalid access key")),
+    };
+
+    // Set selected database and permissions, then open storage
     server.selected_db = db;
+    server.current_permissions = Some(perms);
+
     match server.current_storage() {
         Ok(_) => Ok(Protocol::SimpleString("OK".to_string())),
         Err(e) => Ok(Protocol::err(&e.0)),
@@ -1004,6 +1073,9 @@ async fn brpop_cmd(server: &Server, keys: &[String], timeout_secs: f64) -> Resul
 }
 
 async fn lpush_cmd(server: &Server, key: &str, elements: &[String]) -> Result<Protocol, DBError> {
+    if !server.has_write_permission() {
+        return Ok(Protocol::err("ERR write permission denied"));
+    }
     match server.current_storage()?.lpush(key, elements.to_vec()) {
         Ok(len) => {
             // Attempt to deliver to any blocked BLPOP waiters
@@ -1093,26 +1165,23 @@ async fn dbsize_cmd(server: &Server) -> Result<Protocol, DBError> {
     }
 }
 
-#[derive(Serialize)]
-struct ServerInfo {
-    redis_version: String,
-    encrypted: bool,
-    selected_db: u64,
-}
-
 async fn info_cmd(server: &Server, section: &Option<String>) -> Result<Protocol, DBError> {
-    let info = ServerInfo {
-        redis_version: "7.0.0".to_string(),
-        encrypted: server.current_storage()?.is_encrypted(),
-        selected_db: server.selected_db,
-    };
+    let storage_info = server.current_storage()?.info()?;
+    let mut info_map: std::collections::HashMap<String, String> = storage_info.into_iter().collect();
+
+    info_map.insert("redis_version".to_string(), "7.0.0".to_string());
+    info_map.insert("selected_db".to_string(), server.selected_db.to_string());
+    info_map.insert("backend".to_string(), format!("{:?}", server.option.backend));
+
 
     let mut info_string = String::new();
-    info_string.push_str(&format!("# Server\n"));
-    info_string.push_str(&format!("redis_version:{}\n", info.redis_version));
-    info_string.push_str(&format!("encrypted:{}\n", if info.encrypted { 1 } else { 0 }));
-    info_string.push_str(&format!("# Keyspace\n"));
-    info_string.push_str(&format!("db{}:keys=0,expires=0,avg_ttl=0\n", info.selected_db));
+    info_string.push_str("# Server\n");
+    info_string.push_str(&format!("redis_version:{}\n", info_map.get("redis_version").unwrap()));
+    info_string.push_str(&format!("backend:{}\n", info_map.get("backend").unwrap()));
+    info_string.push_str(&format!("encrypted:{}\n", info_map.get("is_encrypted").unwrap()));
+    
+    info_string.push_str("# Keyspace\n");
+    info_string.push_str(&format!("db{}:keys={},expires=0,avg_ttl=0\n", info_map.get("selected_db").unwrap(), info_map.get("db_size").unwrap()));
 
     match section {
         Some(s) => {
@@ -1138,6 +1207,9 @@ async fn type_cmd(server: &Server, k: &String) -> Result<Protocol, DBError> {
 }
 
 async fn del_cmd(server: &Server, k: &str) -> Result<Protocol, DBError> {
+    if !server.has_write_permission() {
+        return Ok(Protocol::err("ERR write permission denied"));
+    }
     server.current_storage()?.del(k.to_string())?;
     Ok(Protocol::SimpleString("1".to_string()))
 }
@@ -1163,6 +1235,9 @@ async fn set_px_cmd(
 }
 
 async fn set_cmd(server: &Server, k: &str, v: &str) -> Result<Protocol, DBError> {
+    if !server.has_write_permission() {
+        return Ok(Protocol::err("ERR write permission denied"));
+    }
     server.current_storage()?.set(k.to_string(), v.to_string())?;
     Ok(Protocol::SimpleString("OK".to_string()))
 }
@@ -1277,6 +1352,9 @@ async fn get_cmd(server: &Server, k: &str) -> Result<Protocol, DBError> {
 
 // Hash command implementations
 async fn hset_cmd(server: &Server, key: &str, pairs: &[(String, String)]) -> Result<Protocol, DBError> {
+    if !server.has_write_permission() {
+        return Ok(Protocol::err("ERR write permission denied"));
+    }
     let new_fields = server.current_storage()?.hset(key, pairs.to_vec())?;
     Ok(Protocol::SimpleString(new_fields.to_string()))
 }

src/crypto.rs

@@ -23,6 +23,7 @@ impl From<CryptoError> for crate::error::DBError {
 }
 
 /// Super-simple factory: new(secret) + encrypt(bytes) + decrypt(bytes)
+#[derive(Clone)]
 pub struct CryptoFactory {
     key: chacha20poly1305::Key,
 }

src/lib.rs

@@ -4,5 +4,10 @@ pub mod crypto;
 pub mod error;
 pub mod options;
 pub mod protocol;
+pub mod rpc;
+pub mod rpc_server;
 pub mod server;
 pub mod storage;
+pub mod storage_trait;  // Add this
+pub mod storage_sled;   // Add this
+pub mod admin_meta;

src/main.rs

@@ -0,0 +1,140 @@
+// #![allow(unused_imports)]
+
+use tokio::net::TcpListener;
+
+use herodb::server;
+use herodb::rpc_server;
+
+use clap::Parser;
+
+/// Simple program to greet a person
+#[derive(Parser, Debug)]
+#[command(version, about, long_about = None)]
+struct Args {
+    /// The directory of Redis DB file
+    #[arg(long)]
+    dir: String,
+
+    /// The port of the Redis server, default is 6379 if not specified
+    #[arg(long)]
+    port: Option<u16>,
+
+    /// Enable debug mode
+    #[arg(long)]
+    debug: bool,
+
+    /// Master encryption key for encrypted databases (deprecated; ignored for data DBs)
+    #[arg(long)]
+    encryption_key: Option<String>,
+
+    /// Encrypt the database (deprecated; ignored for data DBs)
+    #[arg(long)]
+    encrypt: bool,
+
+    /// Enable RPC management server
+    #[arg(long)]
+    enable_rpc: bool,
+
+    /// RPC server port (default: 8080)
+    #[arg(long, default_value = "8080")]
+    rpc_port: u16,
+
+    /// Use the sled backend
+    #[arg(long)]
+    sled: bool,
+
+    /// Admin secret used to encrypt DB 0 and authorize admin access (required)
+    #[arg(long)]
+    admin_secret: String,
+}
+
+#[tokio::main]
+async fn main() {
+    // parse args
+    let args = Args::parse();
+
+    // bind port
+    let port = args.port.unwrap_or(6379);
+    println!("will listen on port: {}", port);
+    let listener = TcpListener::bind(format!("127.0.0.1:{}", port))
+        .await
+        .unwrap();
+
+    // deprecation warnings for legacy flags
+    if args.encrypt || args.encryption_key.is_some() {
+        eprintln!("warning: --encrypt and --encryption-key are deprecated and ignored for data DBs. Admin DB 0 is always encrypted with --admin-secret.");
+    }
+    // basic validation for admin secret
+    if args.admin_secret.trim().is_empty() {
+        eprintln!("error: --admin-secret must not be empty");
+        std::process::exit(2);
+    }
+
+    // new DB option
+    let option = herodb::options::DBOption {
+        dir: args.dir.clone(),
+        port,
+        debug: args.debug,
+        encryption_key: args.encryption_key,
+        encrypt: args.encrypt,
+        backend: if args.sled {
+            herodb::options::BackendType::Sled
+        } else {
+            herodb::options::BackendType::Redb
+        },
+        admin_secret: args.admin_secret.clone(),
+    };
+
+    let backend = option.backend.clone();
+
+    // Bootstrap admin DB 0 before opening any server storage
+    if let Err(e) = herodb::admin_meta::ensure_bootstrap(&args.dir, backend.clone(), &args.admin_secret) {
+        eprintln!("Failed to bootstrap admin DB 0: {}", e.0);
+        std::process::exit(2);
+    }
+
+    // new server
+    let server = server::Server::new(option).await;
+
+    // Add a small delay to ensure the port is ready
+    tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+
+    // Start RPC server if enabled
+    let rpc_handle = if args.enable_rpc {
+        let rpc_addr = format!("127.0.0.1:{}", args.rpc_port).parse().unwrap();
+        let base_dir = args.dir.clone();
+
+        match rpc_server::start_rpc_server(rpc_addr, base_dir, backend, args.admin_secret.clone()).await {
+            Ok(handle) => {
+                println!("RPC management server started on port {}", args.rpc_port);
+                Some(handle)
+            }
+            Err(e) => {
+                eprintln!("Failed to start RPC server: {}", e);
+                None
+            }
+        }
+    } else {
+        None
+    };
+
+    // accept new connections
+    loop {
+        let stream = listener.accept().await;
+        match stream {
+            Ok((stream, _)) => {
+                println!("accepted new connection");
+
+                let mut sc = server.clone();
+                tokio::spawn(async move {
+                    if let Err(e) = sc.handle(stream).await {
+                        println!("error: {:?}, will close the connection. Bye", e);
+                    }
+                });
+            }
+            Err(e) => {
+                println!("error: {}", e);
+            }
+        }
+    }
+}

src/options.rs

@@ -0,0 +1,19 @@
+#[derive(Debug, Clone)]
+pub enum BackendType {
+    Redb,
+    Sled,
+}
+
+#[derive(Debug, Clone)]
+pub struct DBOption {
+    pub dir: String,
+    pub port: u16,
+    pub debug: bool,
+    // Deprecated for data DBs; retained for backward-compat on CLI parsing
+    pub encrypt: bool,
+    // Deprecated for data DBs; retained for backward-compat on CLI parsing
+    pub encryption_key: Option<String>,
+    pub backend: BackendType,
+    // New: required admin secret, used to encrypt DB 0 and authorize admin operations
+    pub admin_secret: String,
+}

src/rpc.rs

@@ -0,0 +1,572 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::RwLock;
+use jsonrpsee::{core::RpcResult, proc_macros::rpc};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use crate::server::Server;
+use crate::options::DBOption;
+use crate::admin_meta;
+
+/// Database backend types
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum BackendType {
+    Redb,
+    Sled,
+    // Future: InMemory, Custom(String)
+}
+
+/// Database configuration
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DatabaseConfig {
+    pub name: Option<String>,
+    pub storage_path: Option<String>,
+    pub max_size: Option<u64>,
+    pub redis_version: Option<String>,
+}
+
+/// Database information returned by metadata queries
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DatabaseInfo {
+    pub id: u64,
+    pub name: Option<String>,
+    pub backend: BackendType,
+    pub encrypted: bool,
+    pub redis_version: Option<String>,
+    pub storage_path: Option<String>,
+    pub size_on_disk: Option<u64>,
+    pub key_count: Option<u64>,
+    pub created_at: u64,
+    pub last_access: Option<u64>,
+}
+
+/// Access permissions for database keys
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub enum Permissions {
+    Read,
+    ReadWrite,
+}
+
+/// Access key information
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AccessKey {
+    pub hash: String,
+    pub permissions: Permissions,
+    pub created_at: u64,
+}
+
+/// Database metadata containing access keys
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DatabaseMeta {
+    pub public: bool,
+    pub keys: HashMap<String, AccessKey>,
+}
+
+/// Access key information returned by RPC
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AccessKeyInfo {
+    pub hash: String,
+    pub permissions: Permissions,
+    pub created_at: u64,
+}
+
+/// Hash a plaintext key using SHA-256
+pub fn hash_key(key: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(key.as_bytes());
+    format!("{:x}", hasher.finalize())
+}
+
+/// RPC trait for HeroDB management
+#[rpc(server, client, namespace = "herodb")]
+pub trait Rpc {
+    /// Create a new database with specified configuration
+    #[method(name = "createDatabase")]
+    async fn create_database(
+        &self,
+        backend: BackendType,
+        config: DatabaseConfig,
+        encryption_key: Option<String>,
+    ) -> RpcResult<u64>;
+
+    /// Set encryption for an existing database (write-only key)
+    #[method(name = "setEncryption")]
+    async fn set_encryption(&self, db_id: u64, encryption_key: String) -> RpcResult<bool>;
+
+    /// List all managed databases
+    #[method(name = "listDatabases")]
+    async fn list_databases(&self) -> RpcResult<Vec<DatabaseInfo>>;
+
+    /// Get detailed information about a specific database
+    #[method(name = "getDatabaseInfo")]
+    async fn get_database_info(&self, db_id: u64) -> RpcResult<DatabaseInfo>;
+
+    /// Delete a database
+    #[method(name = "deleteDatabase")]
+    async fn delete_database(&self, db_id: u64) -> RpcResult<bool>;
+
+    /// Get server statistics
+    #[method(name = "getServerStats")]
+    async fn get_server_stats(&self) -> RpcResult<HashMap<String, serde_json::Value>>;
+
+    /// Add an access key to a database
+    #[method(name = "addAccessKey")]
+    async fn add_access_key(&self, db_id: u64, key: String, permissions: String) -> RpcResult<bool>;
+
+    /// Delete an access key from a database
+    #[method(name = "deleteAccessKey")]
+    async fn delete_access_key(&self, db_id: u64, key_hash: String) -> RpcResult<bool>;
+
+    /// List all access keys for a database
+    #[method(name = "listAccessKeys")]
+    async fn list_access_keys(&self, db_id: u64) -> RpcResult<Vec<AccessKeyInfo>>;
+
+    /// Set database public/private status
+    #[method(name = "setDatabasePublic")]
+    async fn set_database_public(&self, db_id: u64, public: bool) -> RpcResult<bool>;
+}
+
+/// RPC Server implementation
+pub struct RpcServerImpl {
+    /// Base directory for database files
+    base_dir: String,
+    /// Managed database servers
+    servers: Arc<RwLock<HashMap<u64, Arc<Server>>>>,
+    /// Next unencrypted database ID to assign
+    next_unencrypted_id: Arc<RwLock<u64>>,
+    /// Next encrypted database ID to assign
+    next_encrypted_id: Arc<RwLock<u64>>,
+    /// Default backend type
+    backend: crate::options::BackendType,
+    /// Encryption keys for databases
+    encryption_keys: Arc<RwLock<HashMap<u64, Option<String>>>>,
+    /// Admin secret used to encrypt DB 0 and authorize admin access
+    admin_secret: String,
+}
+
+impl RpcServerImpl {
+    /// Create a new RPC server instance
+    pub fn new(base_dir: String, backend: crate::options::BackendType, admin_secret: String) -> Self {
+        Self {
+            base_dir,
+            servers: Arc::new(RwLock::new(HashMap::new())),
+            next_unencrypted_id: Arc::new(RwLock::new(0)),
+            next_encrypted_id: Arc::new(RwLock::new(10)),
+            backend,
+            encryption_keys: Arc::new(RwLock::new(HashMap::new())),
+            admin_secret,
+        }
+    }
+
+    /// Get or create a server instance for the given database ID
+    async fn get_or_create_server(&self, db_id: u64) -> Result<Arc<Server>, jsonrpsee::types::ErrorObjectOwned> {
+        // Check if server already exists
+        {
+            let servers = self.servers.read().await;
+            if let Some(server) = servers.get(&db_id) {
+                return Ok(server.clone());
+            }
+        }
+
+        // Validate existence via admin DB 0 (metadata), not filesystem presence
+        let exists = admin_meta::db_exists(&self.base_dir, self.backend.clone(), &self.admin_secret, db_id)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(-32000, e.0, None::<()>))?;
+        if !exists {
+            return Err(jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Database {} not found", db_id),
+                None::<()>
+            ));
+        }
+
+        // Create server instance with default options
+        let db_option = DBOption {
+            dir: self.base_dir.clone(),
+            port: 0, // Not used for RPC-managed databases
+            debug: false,
+            encryption_key: None,
+            encrypt: false,
+            backend: self.backend.clone(),
+            admin_secret: self.admin_secret.clone(),
+        };
+
+        let mut server = Server::new(db_option).await;
+
+        // Set the selected database to the db_id
+        server.selected_db = db_id;
+
+        // Lazily open/create physical storage according to admin meta (per-db encryption)
+        let _ = server.current_storage();
+
+        // Store the server
+        let mut servers = self.servers.write().await;
+        servers.insert(db_id, Arc::new(server.clone()));
+
+        Ok(Arc::new(server))
+    }
+
+    /// Discover existing database IDs from admin DB 0
+    async fn discover_databases(&self) -> Vec<u64> {
+        admin_meta::list_dbs(&self.base_dir, self.backend.clone(), &self.admin_secret)
+            .unwrap_or_default()
+    }
+
+    /// Get the next available database ID
+    async fn get_next_db_id(&self, is_encrypted: bool) -> u64 {
+        if is_encrypted {
+            let mut id = self.next_encrypted_id.write().await;
+            let current_id = *id;
+            *id += 1;
+            current_id
+        } else {
+            let mut id = self.next_unencrypted_id.write().await;
+            let current_id = *id;
+            *id += 1;
+            current_id
+        }
+    }
+
+    /// Load database metadata from file (static version)
+    pub async fn load_meta_static(base_dir: &str, db_id: u64) -> Result<DatabaseMeta, jsonrpsee::types::ErrorObjectOwned> {
+        let meta_path = std::path::PathBuf::from(base_dir).join(format!("{}_meta.json", db_id));
+
+        // If meta file doesn't exist, create and persist default
+        if !meta_path.exists() {
+            let default_meta = DatabaseMeta {
+                public: true,
+                keys: HashMap::new(),
+            };
+            // Persist default metadata to disk
+            Self::save_meta_static(base_dir, db_id, &default_meta).await?;
+            return Ok(default_meta);
+        }
+
+        // Read file as UTF-8 JSON
+        let json_str = std::fs::read_to_string(&meta_path)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to read meta file: {}", e),
+                None::<()>
+            ))?;
+
+        serde_json::from_str(&json_str)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to parse meta JSON: {}", e),
+                None::<()>
+            ))
+    }
+
+    /// Load database metadata from file
+    async fn load_meta(&self, db_id: u64) -> Result<DatabaseMeta, jsonrpsee::types::ErrorObjectOwned> {
+        let meta_path = std::path::PathBuf::from(&self.base_dir).join(format!("{}_meta.json", db_id));
+
+        // If meta file doesn't exist, create and persist default
+        if !meta_path.exists() {
+            let default_meta = DatabaseMeta {
+                public: true,
+                keys: HashMap::new(),
+            };
+            self.save_meta(db_id, &default_meta).await?;
+            return Ok(default_meta);
+        }
+
+        // Read file as UTF-8 JSON (meta files are always plain JSON)
+        let json_str = std::fs::read_to_string(&meta_path)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to read meta file: {}", e),
+                None::<()>
+            ))?;
+
+        serde_json::from_str(&json_str)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to parse meta JSON: {}", e),
+                None::<()>
+            ))
+    }
+
+    /// Save database metadata to file (static version)
+    pub async fn save_meta_static(base_dir: &str, db_id: u64, meta: &DatabaseMeta) -> Result<(), jsonrpsee::types::ErrorObjectOwned> {
+        let meta_path = std::path::PathBuf::from(base_dir).join(format!("{}_meta.json", db_id));
+
+        let json_str = serde_json::to_string_pretty(meta)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to serialize meta: {}", e),
+                None::<()>
+            ))?;
+
+        std::fs::write(&meta_path, json_str)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to write meta file: {}", e),
+                None::<()>
+            ))?;
+
+        Ok(())
+    }
+
+    /// Save database metadata to file
+    async fn save_meta(&self, db_id: u64, meta: &DatabaseMeta) -> Result<(), jsonrpsee::types::ErrorObjectOwned> {
+        let meta_path = std::path::PathBuf::from(&self.base_dir).join(format!("{}_meta.json", db_id));
+
+        let json_str = serde_json::to_string_pretty(meta)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to serialize meta: {}", e),
+                None::<()>
+            ))?;
+
+        // Meta files are always stored as plain JSON (even when data DB is encrypted)
+        std::fs::write(&meta_path, json_str)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                format!("Failed to write meta file: {}", e),
+                None::<()>
+            ))?;
+
+        Ok(())
+    }
+
+    /// Build database file path for given server/db_id
+    fn db_file_path(&self, server: &Server, db_id: u64) -> std::path::PathBuf {
+        std::path::PathBuf::from(&server.option.dir).join(format!("{}.db", db_id))
+    }
+
+    /// Recursively compute size on disk for the database path
+    fn compute_size_on_disk(&self, path: &std::path::Path) -> Option<u64> {
+        fn dir_size(p: &std::path::Path) -> u64 {
+            if p.is_file() {
+                std::fs::metadata(p).map(|m| m.len()).unwrap_or(0)
+            } else if p.is_dir() {
+                let mut total = 0u64;
+                if let Ok(read) = std::fs::read_dir(p) {
+                    for entry in read.flatten() {
+                        total += dir_size(&entry.path());
+                    }
+                }
+                total
+            } else {
+                0
+            }
+        }
+        Some(dir_size(path))
+    }
+
+    /// Extract created and last access times (secs) from a path, with fallbacks
+    fn get_file_times_secs(path: &std::path::Path) -> (u64, Option<u64>) {
+        let now = std::time::SystemTime::now();
+        let created = std::fs::metadata(path)
+            .and_then(|m| m.created().or_else(|_| m.modified()))
+            .unwrap_or(now)
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs();
+
+        let last_access = std::fs::metadata(path)
+            .and_then(|m| m.accessed())
+            .ok()
+            .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok().map(|d| d.as_secs()));
+
+        (created, last_access)
+    }
+
+    /// Compose a DatabaseInfo by probing storage, metadata and filesystem
+    async fn build_database_info(&self, db_id: u64, server: &Server) -> DatabaseInfo {
+        // Probe storage to determine encryption state
+        let storage = server.current_storage().ok();
+        let encrypted = storage.as_ref().map(|s| s.is_encrypted()).unwrap_or(server.option.encrypt);
+
+        // Load meta to get access key count
+        let meta = Self::load_meta_static(&self.base_dir, db_id).await.unwrap_or(DatabaseMeta {
+            public: true,
+            keys: HashMap::new(),
+        });
+        let key_count = Some(meta.keys.len() as u64);
+
+        // Compute size on disk and timestamps
+        let db_path = self.db_file_path(server, db_id);
+        let size_on_disk = self.compute_size_on_disk(&db_path);
+
+        let meta_path = std::path::PathBuf::from(&self.base_dir).join(format!("{}_meta.json", db_id));
+        let (created_at, last_access) = if meta_path.exists() {
+            Self::get_file_times_secs(&meta_path)
+        } else {
+            Self::get_file_times_secs(&db_path)
+        };
+
+        let backend = match server.option.backend {
+            crate::options::BackendType::Redb => BackendType::Redb,
+            crate::options::BackendType::Sled => BackendType::Sled,
+        };
+
+        DatabaseInfo {
+            id: db_id,
+            name: None,
+            backend,
+            encrypted,
+            redis_version: Some("7.0".to_string()),
+            storage_path: Some(server.option.dir.clone()),
+            size_on_disk,
+            key_count,
+            created_at,
+            last_access,
+        }
+    }
+}
+
+#[jsonrpsee::core::async_trait]
+impl RpcServer for RpcServerImpl {
+    async fn create_database(
+        &self,
+        backend: BackendType,
+        _config: DatabaseConfig,
+        encryption_key: Option<String>,
+    ) -> RpcResult<u64> {
+        // Allocate new ID via admin DB 0
+        let db_id = admin_meta::allocate_next_id(&self.base_dir, self.backend.clone(), &self.admin_secret)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(-32000, e.0, None::<()>))?;
+
+        // Persist per-db encryption key in admin DB 0 if provided
+        if let Some(ref key) = encryption_key {
+            admin_meta::set_enc_key(&self.base_dir, self.backend.clone(), &self.admin_secret, db_id, key)
+                .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(-32000, e.0, None::<()>))?;
+        }
+
+        // Ensure base dir exists
+        if let Err(e) = std::fs::create_dir_all(&self.base_dir) {
+            return Err(jsonrpsee::types::ErrorObjectOwned::owned(-32000, format!("Failed to ensure base dir: {}", e), None::<()>));
+        }
+
+        // Create server instance using base_dir and admin secret
+        let option = DBOption {
+            dir: self.base_dir.clone(),
+            port: 0, // Not used for RPC-managed databases
+            debug: false,
+            encryption_key: None,  // per-db key is stored in admin DB 0
+            encrypt: false,        // encryption decided per-db at open time
+            backend: match backend {
+                BackendType::Redb => crate::options::BackendType::Redb,
+                BackendType::Sled => crate::options::BackendType::Sled,
+            },
+            admin_secret: self.admin_secret.clone(),
+        };
+
+        let mut server = Server::new(option).await;
+        server.selected_db = db_id;
+
+        // Initialize storage to create physical <id>.db with proper encryption from admin meta
+        let _ = server.current_storage();
+
+        // Store the server in cache
+        let mut servers = self.servers.write().await;
+        servers.insert(db_id, Arc::new(server));
+
+        Ok(db_id)
+    }
+
+    async fn set_encryption(&self, db_id: u64, _encryption_key: String) -> RpcResult<bool> {
+        // For now, return false as encryption can only be set during creation
+        let _servers = self.servers.read().await;
+        // TODO: Implement encryption setting for existing databases
+        Ok(false)
+    }
+
+    async fn list_databases(&self) -> RpcResult<Vec<DatabaseInfo>> {
+        let db_ids = self.discover_databases().await;
+        let mut result = Vec::new();
+
+        for db_id in db_ids {
+            if let Ok(server) = self.get_or_create_server(db_id).await {
+                // Build accurate info from storage/meta/fs
+                let info = self.build_database_info(db_id, &server).await;
+                result.push(info);
+            }
+        }
+
+        Ok(result)
+    }
+
+    async fn get_database_info(&self, db_id: u64) -> RpcResult<DatabaseInfo> {
+        let server = self.get_or_create_server(db_id).await?;
+        // Build accurate info from storage/meta/fs
+        let info = self.build_database_info(db_id, &server).await;
+        Ok(info)
+    }
+
+    async fn delete_database(&self, db_id: u64) -> RpcResult<bool> {
+        let mut servers = self.servers.write().await;
+
+        if let Some(_server) = servers.remove(&db_id) {
+            // Clean up database files
+            let db_path = std::path::PathBuf::from(&self.base_dir).join(format!("{}.db", db_id));
+            if db_path.exists() {
+                if db_path.is_dir() {
+                    std::fs::remove_dir_all(&db_path).ok();
+                } else {
+                    std::fs::remove_file(&db_path).ok();
+                }
+            }
+            Ok(true)
+        } else {
+            Ok(false)
+        }
+    }
+
+    async fn get_server_stats(&self) -> RpcResult<HashMap<String, serde_json::Value>> {
+        let db_ids = self.discover_databases().await;
+        let mut stats = HashMap::new();
+
+        stats.insert("total_databases".to_string(), serde_json::json!(db_ids.len()));
+        stats.insert("uptime".to_string(), serde_json::json!(
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_secs()
+        ));
+
+        Ok(stats)
+    }
+
+    async fn add_access_key(&self, db_id: u64, key: String, permissions: String) -> RpcResult<bool> {
+        let perms = match permissions.to_lowercase().as_str() {
+            "read" => Permissions::Read,
+            "readwrite" => Permissions::ReadWrite,
+            _ => return Err(jsonrpsee::types::ErrorObjectOwned::owned(
+                -32000,
+                "Invalid permissions: use 'read' or 'readwrite'",
+                None::<()>
+            )),
+        };
+
+        admin_meta::add_access_key(&self.base_dir, self.backend.clone(), &self.admin_secret, db_id, &key, perms)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(-32000, e.0, None::<()>))?;
+        Ok(true)
+    }
+
+    async fn delete_access_key(&self, db_id: u64, key_hash: String) -> RpcResult<bool> {
+        let ok = admin_meta::delete_access_key(&self.base_dir, self.backend.clone(), &self.admin_secret, db_id, &key_hash)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(-32000, e.0, None::<()>))?;
+        Ok(ok)
+    }
+
+    async fn list_access_keys(&self, db_id: u64) -> RpcResult<Vec<AccessKeyInfo>> {
+        let pairs = admin_meta::list_access_keys(&self.base_dir, self.backend.clone(), &self.admin_secret, db_id)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(-32000, e.0, None::<()>))?;
+        let keys: Vec<AccessKeyInfo> = pairs.into_iter().map(|(hash, perm, ts)| AccessKeyInfo {
+            hash,
+            permissions: perm,
+            created_at: ts,
+        }).collect();
+        Ok(keys)
+    }
+
+    async fn set_database_public(&self, db_id: u64, public: bool) -> RpcResult<bool> {
+        admin_meta::set_database_public(&self.base_dir, self.backend.clone(), &self.admin_secret, db_id, public)
+            .map_err(|e| jsonrpsee::types::ErrorObjectOwned::owned(-32000, e.0, None::<()>))?;
+        Ok(true)
+    }
+}

src/rpc_server.rs

@@ -0,0 +1,49 @@
+use std::net::SocketAddr;
+use jsonrpsee::server::{ServerBuilder, ServerHandle};
+use jsonrpsee::RpcModule;
+
+use crate::rpc::{RpcServer, RpcServerImpl};
+
+/// Start the RPC server on the specified address
+pub async fn start_rpc_server(addr: SocketAddr, base_dir: String, backend: crate::options::BackendType, admin_secret: String) -> Result<ServerHandle, Box<dyn std::error::Error + Send + Sync>> {
+    // Create the RPC server implementation
+    let rpc_impl = RpcServerImpl::new(base_dir, backend, admin_secret);
+
+    // Create the RPC module
+    let mut module = RpcModule::new(());
+    module.merge(RpcServer::into_rpc(rpc_impl))?;
+
+    // Build the server with both HTTP and WebSocket support
+    let server = ServerBuilder::default()
+        .build(addr)
+        .await?;
+
+    // Start the server
+    let handle = server.start(module);
+
+    println!("RPC server started on {}", addr);
+
+    Ok(handle)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::Duration;
+
+    #[tokio::test]
+    async fn test_rpc_server_startup() {
+        let addr = "127.0.0.1:0".parse().unwrap(); // Use port 0 for auto-assignment
+        let base_dir = "/tmp/test_rpc".to_string();
+        let backend = crate::options::BackendType::Redb; // Default for test
+
+        let handle = start_rpc_server(addr, base_dir, backend, "test-admin".to_string()).await.unwrap();
+
+        // Give the server a moment to start
+        tokio::time::sleep(Duration::from_millis(100)).await;
+
+        // Stop the server
+        handle.stop().unwrap();
+        handle.stopped().await;
+    }
+}

src/server.rs

@@ -11,15 +11,17 @@ use crate::cmd::Cmd;
 use crate::error::DBError;
 use crate::options;
 use crate::protocol::Protocol;
-use crate::storage::Storage;
+use crate::storage_trait::StorageBackend;
+use crate::admin_meta;
 
 #[derive(Clone)]
 pub struct Server {
-    pub db_cache: std::sync::Arc<std::sync::RwLock<HashMap<u64, Arc<Storage>>>>,
+    pub db_cache: std::sync::Arc<std::sync::RwLock<HashMap<u64, Arc<dyn StorageBackend>>>>,
     pub option: options::DBOption,
     pub client_name: Option<String>,
     pub selected_db: u64, // Changed from usize to u64
     pub queued_cmd: Option<Vec<(Cmd, Protocol)>>,
+    pub current_permissions: Option<crate::rpc::Permissions>,
 
     // BLPOP waiter registry: per (db_index, key) FIFO of waiters
     pub list_waiters: Arc<Mutex<HashMap<u64, HashMap<String, Vec<Waiter>>>>>,
@@ -46,46 +48,51 @@ impl Server {
             client_name: None,
             selected_db: 0,
             queued_cmd: None,
+            current_permissions: None,
 
             list_waiters: Arc::new(Mutex::new(HashMap::new())),
             waiter_seq: Arc::new(AtomicU64::new(1)),
         }
     }
 
-    pub fn current_storage(&self) -> Result<Arc<Storage>, DBError> {
+    pub fn current_storage(&self) -> Result<Arc<dyn StorageBackend>, DBError> {
         let mut cache = self.db_cache.write().unwrap();
 
         if let Some(storage) = cache.get(&self.selected_db) {
             return Ok(storage.clone());
         }
 
-        
-        // Create new database file
-        let db_file_path = std::path::PathBuf::from(self.option.dir.clone())
-            .join(format!("{}.db", self.selected_db));
-        
-        // Ensure the directory exists before creating the database file
-        if let Some(parent_dir) = db_file_path.parent() {
-            std::fs::create_dir_all(parent_dir).map_err(|e| {
-                DBError(format!("Failed to create directory {}: {}", parent_dir.display(), e))
-            })?;
-        }
-        
-        println!("Creating new db file: {}", db_file_path.display());
-        
-        let storage = Arc::new(Storage::new(
-            db_file_path,
-            self.should_encrypt_db(self.selected_db),
-            self.option.encryption_key.as_deref()
-        )?);
+        // Use process-wide shared handles to avoid sled/reDB double-open lock contention.
+        let storage = if self.selected_db == 0 {
+            // Admin DB 0: always via singleton
+            admin_meta::open_admin_storage(
+                &self.option.dir,
+                self.option.backend.clone(),
+                &self.option.admin_secret,
+            )?
+        } else {
+            // Data DBs: via global registry keyed by id
+            admin_meta::open_data_storage(
+                &self.option.dir,
+                self.option.backend.clone(),
+                &self.option.admin_secret,
+                self.selected_db,
+            )?
+        };
 
         cache.insert(self.selected_db, storage.clone());
         Ok(storage)
     }
     
-    fn should_encrypt_db(&self, db_index: u64) -> bool {
-        // DB 0-9 are non-encrypted, DB 10+ are encrypted
-        self.option.encrypt && db_index >= 10
+
+    /// Check if current permissions allow read operations
+    pub fn has_read_permission(&self) -> bool {
+        matches!(self.current_permissions, Some(crate::rpc::Permissions::Read) | Some(crate::rpc::Permissions::ReadWrite))
+    }
+
+    /// Check if current permissions allow write operations
+    pub fn has_write_permission(&self) -> bool {
+        matches!(self.current_permissions, Some(crate::rpc::Permissions::ReadWrite))
     }
 
     // ----- BLPOP waiter helpers -----

src/storage/mod.rs

@@ -0,0 +1,287 @@
+use std::{
+    path::Path,
+    sync::Arc,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use redb::{Database, TableDefinition};
+use serde::{Deserialize, Serialize};
+
+use crate::crypto::CryptoFactory;
+use crate::error::DBError;
+
+// Re-export modules
+mod storage_basic;
+mod storage_hset;
+mod storage_lists;
+mod storage_extra;
+
+// Re-export implementations
+// Note: These imports are used by the impl blocks in the submodules
+// The compiler shows them as unused because they're not directly used in this file
+// but they're needed for the Storage struct methods to be available
+pub use storage_extra::*;
+
+// Table definitions for different Redis data types
+const TYPES_TABLE: TableDefinition<&str, &str> = TableDefinition::new("types");
+const STRINGS_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("strings");
+const HASHES_TABLE: TableDefinition<(&str, &str), &[u8]> = TableDefinition::new("hashes");
+const LISTS_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("lists");
+const STREAMS_META_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("streams_meta");
+const STREAMS_DATA_TABLE: TableDefinition<(&str, &str), &[u8]> = TableDefinition::new("streams_data");
+const ENCRYPTED_TABLE: TableDefinition<&str, u8> = TableDefinition::new("encrypted");
+const EXPIRATION_TABLE: TableDefinition<&str, u64> = TableDefinition::new("expiration");
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct StreamEntry {
+    pub fields: Vec<(String, String)>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct ListValue {
+    pub elements: Vec<String>,
+}
+
+#[inline]
+pub fn now_in_millis() -> u128 {
+    let start = SystemTime::now();
+    let duration_since_epoch = start.duration_since(UNIX_EPOCH).unwrap();
+    duration_since_epoch.as_millis()
+}
+
+pub struct Storage {
+    db: Database,
+    crypto: Option<CryptoFactory>,
+}
+
+impl Storage {
+    pub fn new(path: impl AsRef<Path>, should_encrypt: bool, master_key: Option<&str>) -> Result<Self, DBError> {
+        let db = Database::create(path)?;
+        
+        // Create tables if they don't exist
+        let write_txn = db.begin_write()?;
+        {
+            let _ = write_txn.open_table(TYPES_TABLE)?;
+            let _ = write_txn.open_table(STRINGS_TABLE)?;
+            let _ = write_txn.open_table(HASHES_TABLE)?;
+            let _ = write_txn.open_table(LISTS_TABLE)?;
+            let _ = write_txn.open_table(STREAMS_META_TABLE)?;
+            let _ = write_txn.open_table(STREAMS_DATA_TABLE)?;
+            let _ = write_txn.open_table(ENCRYPTED_TABLE)?;
+            let _ = write_txn.open_table(EXPIRATION_TABLE)?;
+        }
+        write_txn.commit()?;
+        
+        // Check if database was previously encrypted
+        let read_txn = db.begin_read()?;
+        let encrypted_table = read_txn.open_table(ENCRYPTED_TABLE)?;
+        let was_encrypted = encrypted_table.get("encrypted")?.map(|v| v.value() == 1).unwrap_or(false);
+        drop(read_txn);
+        
+        let crypto = if should_encrypt || was_encrypted {
+            if let Some(key) = master_key {
+                Some(CryptoFactory::new(key.as_bytes()))
+            } else {
+                return Err(DBError("Encryption requested but no master key provided".to_string()));
+            }
+        } else {
+            None
+        };
+        
+        // If we're enabling encryption for the first time, mark it
+        if should_encrypt && !was_encrypted {
+            let write_txn = db.begin_write()?;
+            {
+                let mut encrypted_table = write_txn.open_table(ENCRYPTED_TABLE)?;
+                encrypted_table.insert("encrypted", &1u8)?;
+            }
+            write_txn.commit()?;
+        }
+        
+        Ok(Storage {
+            db,
+            crypto,
+        })
+    }
+    
+    pub fn is_encrypted(&self) -> bool {
+        self.crypto.is_some()
+    }
+
+    // Helper methods for encryption
+    fn encrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
+        if let Some(crypto) = &self.crypto {
+            Ok(crypto.encrypt(data))
+        } else {
+            Ok(data.to_vec())
+        }
+    }
+    
+    fn decrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
+        if let Some(crypto) = &self.crypto {
+            Ok(crypto.decrypt(data)?)
+        } else {
+            Ok(data.to_vec())
+        }
+    }
+}
+
+use crate::storage_trait::StorageBackend;
+
+impl StorageBackend for Storage {
+    fn get(&self, key: &str) -> Result<Option<String>, DBError> {
+        self.get(key)
+    }
+
+    fn set(&self, key: String, value: String) -> Result<(), DBError> {
+        self.set(key, value)
+    }
+
+    fn setx(&self, key: String, value: String, expire_ms: u128) -> Result<(), DBError> {
+        self.setx(key, value, expire_ms)
+    }
+
+    fn del(&self, key: String) -> Result<(), DBError> {
+        self.del(key)
+    }
+
+    fn exists(&self, key: &str) -> Result<bool, DBError> {
+        self.exists(key)
+    }
+
+    fn keys(&self, pattern: &str) -> Result<Vec<String>, DBError> {
+        self.keys(pattern)
+    }
+
+    fn dbsize(&self) -> Result<i64, DBError> {
+        self.dbsize()
+    }
+
+    fn flushdb(&self) -> Result<(), DBError> {
+        self.flushdb()
+    }
+
+    fn get_key_type(&self, key: &str) -> Result<Option<String>, DBError> {
+        self.get_key_type(key)
+    }
+
+    fn scan(&self, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError> {
+        self.scan(cursor, pattern, count)
+    }
+
+    fn hscan(&self, key: &str, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError> {
+        self.hscan(key, cursor, pattern, count)
+    }
+
+    fn hset(&self, key: &str, pairs: Vec<(String, String)>) -> Result<i64, DBError> {
+        self.hset(key, pairs)
+    }
+
+    fn hget(&self, key: &str, field: &str) -> Result<Option<String>, DBError> {
+        self.hget(key, field)
+    }
+
+    fn hgetall(&self, key: &str) -> Result<Vec<(String, String)>, DBError> {
+        self.hgetall(key)
+    }
+
+    fn hdel(&self, key: &str, fields: Vec<String>) -> Result<i64, DBError> {
+        self.hdel(key, fields)
+    }
+
+    fn hexists(&self, key: &str, field: &str) -> Result<bool, DBError> {
+        self.hexists(key, field)
+    }
+
+    fn hkeys(&self, key: &str) -> Result<Vec<String>, DBError> {
+        self.hkeys(key)
+    }
+
+    fn hvals(&self, key: &str) -> Result<Vec<String>, DBError> {
+        self.hvals(key)
+    }
+
+    fn hlen(&self, key: &str) -> Result<i64, DBError> {
+        self.hlen(key)
+    }
+
+    fn hmget(&self, key: &str, fields: Vec<String>) -> Result<Vec<Option<String>>, DBError> {
+        self.hmget(key, fields)
+    }
+
+    fn hsetnx(&self, key: &str, field: &str, value: &str) -> Result<bool, DBError> {
+        self.hsetnx(key, field, value)
+    }
+
+    fn lpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError> {
+        self.lpush(key, elements)
+    }
+
+    fn rpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError> {
+        self.rpush(key, elements)
+    }
+
+    fn lpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError> {
+        self.lpop(key, count)
+    }
+
+    fn rpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError> {
+        self.rpop(key, count)
+    }
+
+    fn llen(&self, key: &str) -> Result<i64, DBError> {
+        self.llen(key)
+    }
+
+    fn lindex(&self, key: &str, index: i64) -> Result<Option<String>, DBError> {
+        self.lindex(key, index)
+    }
+
+    fn lrange(&self, key: &str, start: i64, stop: i64) -> Result<Vec<String>, DBError> {
+        self.lrange(key, start, stop)
+    }
+
+    fn ltrim(&self, key: &str, start: i64, stop: i64) -> Result<(), DBError> {
+        self.ltrim(key, start, stop)
+    }
+
+    fn lrem(&self, key: &str, count: i64, element: &str) -> Result<i64, DBError> {
+        self.lrem(key, count, element)
+    }
+
+    fn ttl(&self, key: &str) -> Result<i64, DBError> {
+        self.ttl(key)
+    }
+
+    fn expire_seconds(&self, key: &str, secs: u64) -> Result<bool, DBError> {
+        self.expire_seconds(key, secs)
+    }
+
+    fn pexpire_millis(&self, key: &str, ms: u128) -> Result<bool, DBError> {
+        self.pexpire_millis(key, ms)
+    }
+
+    fn persist(&self, key: &str) -> Result<bool, DBError> {
+        self.persist(key)
+    }
+
+    fn expire_at_seconds(&self, key: &str, ts_secs: i64) -> Result<bool, DBError> {
+        self.expire_at_seconds(key, ts_secs)
+    }
+
+    fn pexpire_at_millis(&self, key: &str, ts_ms: i64) -> Result<bool, DBError> {
+        self.pexpire_at_millis(key, ts_ms)
+    }
+
+    fn is_encrypted(&self) -> bool {
+        self.is_encrypted()
+    }
+    
+    fn info(&self) -> Result<Vec<(String, String)>, DBError> {
+        self.info()
+    }
+
+    fn clone_arc(&self) -> Arc<dyn StorageBackend> {
+        unimplemented!("Storage cloning not yet implemented for redb backend")
+    }
+}

src/storage/storage_extra.rs

@@ -208,6 +208,14 @@ impl Storage {
         write_txn.commit()?;
         Ok(applied)
     }
+
+    pub fn info(&self) -> Result<Vec<(String, String)>, DBError> {
+        let dbsize = self.dbsize()?;
+        Ok(vec![
+            ("db_size".to_string(), dbsize.to_string()),
+            ("is_encrypted".to_string(), self.is_encrypted().to_string()),
+        ])
+    }
 }
 
 // Utility function for glob pattern matching

src/storage_sled/mod.rs

@@ -0,0 +1,845 @@
+// src/storage_sled/mod.rs
+use std::path::Path;
+use std::sync::Arc;
+use std::collections::HashMap;
+use std::time::{SystemTime, UNIX_EPOCH};
+use serde::{Deserialize, Serialize};
+use crate::error::DBError;
+use crate::storage_trait::StorageBackend;
+use crate::crypto::CryptoFactory;
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+enum ValueType {
+    String(String),
+    Hash(HashMap<String, String>),
+    List(Vec<String>),
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+struct StorageValue {
+    value: ValueType,
+    expires_at: Option<u128>, // milliseconds since epoch
+}
+
+pub struct SledStorage {
+    db: sled::Db,
+    types: sled::Tree,
+    crypto: Option<CryptoFactory>,
+}
+
+impl SledStorage {
+    pub fn new(path: impl AsRef<Path>, should_encrypt: bool, master_key: Option<&str>) -> Result<Self, DBError> {
+        let db = sled::open(path).map_err(|e| DBError(format!("Failed to open sled: {}", e)))?;
+        let types = db.open_tree("types").map_err(|e| DBError(format!("Failed to open types tree: {}", e)))?;
+        
+        // Check if database was previously encrypted
+        let encrypted_tree = db.open_tree("encrypted").map_err(|e| DBError(e.to_string()))?;
+        let was_encrypted = encrypted_tree.get("encrypted")
+            .map_err(|e| DBError(e.to_string()))?
+            .map(|v| v[0] == 1)
+            .unwrap_or(false);
+        
+        let crypto = if should_encrypt || was_encrypted {
+            if let Some(key) = master_key {
+                Some(CryptoFactory::new(key.as_bytes()))
+            } else {
+                return Err(DBError("Encryption requested but no master key provided".to_string()));
+            }
+        } else {
+            None
+        };
+        
+        // Mark database as encrypted if enabling encryption
+        if should_encrypt && !was_encrypted {
+            encrypted_tree.insert("encrypted", &[1u8])
+                .map_err(|e| DBError(e.to_string()))?;
+            encrypted_tree.flush().map_err(|e| DBError(e.to_string()))?;
+        }
+        
+        Ok(SledStorage { db, types, crypto })
+    }
+    
+    fn now_millis() -> u128 {
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_millis()
+    }
+    
+    fn encrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
+        if let Some(crypto) = &self.crypto {
+            Ok(crypto.encrypt(data))
+        } else {
+            Ok(data.to_vec())
+        }
+    }
+    
+    fn decrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
+        if let Some(crypto) = &self.crypto {
+            Ok(crypto.decrypt(data)?)
+        } else {
+            Ok(data.to_vec())
+        }
+    }
+    
+    fn get_storage_value(&self, key: &str) -> Result<Option<StorageValue>, DBError> {
+        match self.db.get(key).map_err(|e| DBError(e.to_string()))? {
+            Some(encrypted_data) => {
+                let decrypted = self.decrypt_if_needed(&encrypted_data)?;
+                let storage_val: StorageValue = bincode::deserialize(&decrypted)
+                    .map_err(|e| DBError(format!("Deserialization error: {}", e)))?;
+                
+                // Check expiration
+                if let Some(expires_at) = storage_val.expires_at {
+                    if Self::now_millis() > expires_at {
+                        // Expired, remove it
+                        self.db.remove(key).map_err(|e| DBError(e.to_string()))?;
+                        self.types.remove(key).map_err(|e| DBError(e.to_string()))?;
+                        return Ok(None);
+                    }
+                }
+                
+                Ok(Some(storage_val))
+            }
+            None => Ok(None)
+        }
+    }
+    
+    fn set_storage_value(&self, key: &str, storage_val: StorageValue) -> Result<(), DBError> {
+        let data = bincode::serialize(&storage_val)
+            .map_err(|e| DBError(format!("Serialization error: {}", e)))?;
+        let encrypted = self.encrypt_if_needed(&data)?;
+        self.db.insert(key, encrypted).map_err(|e| DBError(e.to_string()))?;
+        
+        // Store type info (unencrypted for efficiency)
+        let type_str = match &storage_val.value {
+            ValueType::String(_) => "string",
+            ValueType::Hash(_) => "hash",
+            ValueType::List(_) => "list",
+        };
+        self.types.insert(key, type_str.as_bytes()).map_err(|e| DBError(e.to_string()))?;
+        
+        Ok(())
+    }
+    
+    fn glob_match(pattern: &str, text: &str) -> bool {
+        if pattern == "*" {
+            return true;
+        }
+        
+        let pattern_chars: Vec<char> = pattern.chars().collect();
+        let text_chars: Vec<char> = text.chars().collect();
+        
+        fn match_recursive(pattern: &[char], text: &[char], pi: usize, ti: usize) -> bool {
+            if pi >= pattern.len() {
+                return ti >= text.len();
+            }
+            
+            if ti >= text.len() {
+                return pattern[pi..].iter().all(|&c| c == '*');
+            }
+            
+            match pattern[pi] {
+                '*' => {
+                    for i in ti..=text.len() {
+                        if match_recursive(pattern, text, pi + 1, i) {
+                            return true;
+                        }
+                    }
+                    false
+                }
+                '?' => match_recursive(pattern, text, pi + 1, ti + 1),
+                c => {
+                    if text[ti] == c {
+                        match_recursive(pattern, text, pi + 1, ti + 1)
+                    } else {
+                        false
+                    }
+                }
+            }
+        }
+        
+        match_recursive(&pattern_chars, &text_chars, 0, 0)
+    }
+}
+
+impl StorageBackend for SledStorage {
+    fn get(&self, key: &str) -> Result<Option<String>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::String(s) => Ok(Some(s)),
+                _ => Ok(None)
+            }
+            None => Ok(None)
+        }
+    }
+    
+    fn set(&self, key: String, value: String) -> Result<(), DBError> {
+        let storage_val = StorageValue {
+            value: ValueType::String(value),
+            expires_at: None,
+        };
+        self.set_storage_value(&key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(())
+    }
+    
+    fn setx(&self, key: String, value: String, expire_ms: u128) -> Result<(), DBError> {
+        let storage_val = StorageValue {
+            value: ValueType::String(value),
+            expires_at: Some(Self::now_millis() + expire_ms),
+        };
+        self.set_storage_value(&key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(())
+    }
+    
+    fn del(&self, key: String) -> Result<(), DBError> {
+        self.db.remove(&key).map_err(|e| DBError(e.to_string()))?;
+        self.types.remove(&key).map_err(|e| DBError(e.to_string()))?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(())
+    }
+    
+    fn exists(&self, key: &str) -> Result<bool, DBError> {
+        // Check with expiration
+        Ok(self.get_storage_value(key)?.is_some())
+    }
+    
+    fn keys(&self, pattern: &str) -> Result<Vec<String>, DBError> {
+        let mut keys = Vec::new();
+        for item in self.types.iter() {
+            let (key_bytes, _) = item.map_err(|e| DBError(e.to_string()))?;
+            let key = String::from_utf8_lossy(&key_bytes).to_string();
+            
+            // Check if key is expired
+            if self.get_storage_value(&key)?.is_some() {
+                if Self::glob_match(pattern, &key) {
+                    keys.push(key);
+                }
+            }
+        }
+        Ok(keys)
+    }
+    
+    fn scan(&self, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError> {
+        let mut result = Vec::new();
+        let mut current_cursor = 0u64;
+        let limit = count.unwrap_or(10) as usize;
+        
+        for item in self.types.iter() {
+            if current_cursor >= cursor {
+                let (key_bytes, type_bytes) = item.map_err(|e| DBError(e.to_string()))?;
+                let key = String::from_utf8_lossy(&key_bytes).to_string();
+                
+                // Check pattern match
+                let matches = if let Some(pat) = pattern {
+                    Self::glob_match(pat, &key)
+                } else {
+                    true
+                };
+                
+                if matches {
+                    // Check if key is expired and get value
+                    if let Some(storage_val) = self.get_storage_value(&key)? {
+                        let value = match storage_val.value {
+                            ValueType::String(s) => s,
+                            _ => String::from_utf8_lossy(&type_bytes).to_string(),
+                        };
+                        result.push((key, value));
+                        
+                        if result.len() >= limit {
+                            current_cursor += 1;
+                            break;
+                        }
+                    }
+                }
+            }
+            current_cursor += 1;
+        }
+        
+        let next_cursor = if result.len() < limit { 0 } else { current_cursor };
+        Ok((next_cursor, result))
+    }
+    
+    fn dbsize(&self) -> Result<i64, DBError> {
+        let mut count = 0i64;
+        for item in self.types.iter() {
+            let (key_bytes, _) = item.map_err(|e| DBError(e.to_string()))?;
+            let key = String::from_utf8_lossy(&key_bytes).to_string();
+            if self.get_storage_value(&key)?.is_some() {
+                count += 1;
+            }
+        }
+        Ok(count)
+    }
+    
+    fn flushdb(&self) -> Result<(), DBError> {
+        self.db.clear().map_err(|e| DBError(e.to_string()))?;
+        self.types.clear().map_err(|e| DBError(e.to_string()))?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(())
+    }
+    
+    fn get_key_type(&self, key: &str) -> Result<Option<String>, DBError> {
+        // First check if key exists (handles expiration)
+        if self.get_storage_value(key)?.is_some() {
+            match self.types.get(key).map_err(|e| DBError(e.to_string()))? {
+                Some(data) => Ok(Some(String::from_utf8_lossy(&data).to_string())),
+                None => Ok(None)
+            }
+        } else {
+            Ok(None)
+        }
+    }
+    
+    // Hash operations
+    fn hset(&self, key: &str, pairs: Vec<(String, String)>) -> Result<i64, DBError> {
+        let mut storage_val = self.get_storage_value(key)?.unwrap_or(StorageValue {
+            value: ValueType::Hash(HashMap::new()),
+            expires_at: None,
+        });
+        
+        let hash = match &mut storage_val.value {
+            ValueType::Hash(h) => h,
+            _ => return Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+        };
+        
+        let mut new_fields = 0i64;
+        for (field, value) in pairs {
+            if !hash.contains_key(&field) {
+                new_fields += 1;
+            }
+            hash.insert(field, value);
+        }
+        
+        self.set_storage_value(key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(new_fields)
+    }
+    
+    fn hget(&self, key: &str, field: &str) -> Result<Option<String>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => Ok(h.get(field).cloned()),
+                _ => Ok(None)
+            }
+            None => Ok(None)
+        }
+    }
+    
+    fn hgetall(&self, key: &str) -> Result<Vec<(String, String)>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => Ok(h.into_iter().collect()),
+                _ => Ok(Vec::new())
+            }
+            None => Ok(Vec::new())
+        }
+    }
+    
+    fn hscan(&self, key: &str, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => {
+                    let mut result = Vec::new();
+                    let mut current_cursor = 0u64;
+                    let limit = count.unwrap_or(10) as usize;
+                    
+                    for (field, value) in h.iter() {
+                        if current_cursor >= cursor {
+                            let matches = if let Some(pat) = pattern {
+                                Self::glob_match(pat, field)
+                            } else {
+                                true
+                            };
+                            
+                            if matches {
+                                result.push((field.clone(), value.clone()));
+                                if result.len() >= limit {
+                                    current_cursor += 1;
+                                    break;
+                                }
+                            }
+                        }
+                        current_cursor += 1;
+                    }
+                    
+                    let next_cursor = if result.len() < limit { 0 } else { current_cursor };
+                    Ok((next_cursor, result))
+                }
+                _ => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string()))
+            }
+            None => Ok((0, Vec::new()))
+        }
+    }
+    
+    fn hdel(&self, key: &str, fields: Vec<String>) -> Result<i64, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(0)
+        };
+        
+        let hash = match &mut storage_val.value {
+            ValueType::Hash(h) => h,
+            _ => return Ok(0)
+        };
+        
+        let mut deleted = 0i64;
+        for field in fields {
+            if hash.remove(&field).is_some() {
+                deleted += 1;
+            }
+        }
+        
+        if hash.is_empty() {
+            self.del(key.to_string())?;
+        } else {
+            self.set_storage_value(key, storage_val)?;
+            self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        }
+        
+        Ok(deleted)
+    }
+    
+    fn hexists(&self, key: &str, field: &str) -> Result<bool, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => Ok(h.contains_key(field)),
+                _ => Ok(false)
+            }
+            None => Ok(false)
+        }
+    }
+    
+    fn hkeys(&self, key: &str) -> Result<Vec<String>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => Ok(h.keys().cloned().collect()),
+                _ => Ok(Vec::new())
+            }
+            None => Ok(Vec::new())
+        }
+    }
+    
+    fn hvals(&self, key: &str) -> Result<Vec<String>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => Ok(h.values().cloned().collect()),
+                _ => Ok(Vec::new())
+            }
+            None => Ok(Vec::new())
+        }
+    }
+    
+    fn hlen(&self, key: &str) -> Result<i64, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => Ok(h.len() as i64),
+                _ => Ok(0)
+            }
+            None => Ok(0)
+        }
+    }
+    
+    fn hmget(&self, key: &str, fields: Vec<String>) -> Result<Vec<Option<String>>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::Hash(h) => {
+                    Ok(fields.into_iter().map(|f| h.get(&f).cloned()).collect())
+                }
+                _ => Ok(fields.into_iter().map(|_| None).collect())
+            }
+            None => Ok(fields.into_iter().map(|_| None).collect())
+        }
+    }
+    
+    fn hsetnx(&self, key: &str, field: &str, value: &str) -> Result<bool, DBError> {
+        let mut storage_val = self.get_storage_value(key)?.unwrap_or(StorageValue {
+            value: ValueType::Hash(HashMap::new()),
+            expires_at: None,
+        });
+        
+        let hash = match &mut storage_val.value {
+            ValueType::Hash(h) => h,
+            _ => return Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+        };
+        
+        if hash.contains_key(field) {
+            Ok(false)
+        } else {
+            hash.insert(field.to_string(), value.to_string());
+            self.set_storage_value(key, storage_val)?;
+            self.db.flush().map_err(|e| DBError(e.to_string()))?;
+            Ok(true)
+        }
+    }
+    
+    // List operations
+    fn lpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError> {
+        let mut storage_val = self.get_storage_value(key)?.unwrap_or(StorageValue {
+            value: ValueType::List(Vec::new()),
+            expires_at: None,
+        });
+        
+        let list = match &mut storage_val.value {
+            ValueType::List(l) => l,
+            _ => return Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+        };
+        
+        for element in elements.into_iter().rev() {
+            list.insert(0, element);
+        }
+        
+        let len = list.len() as i64;
+        self.set_storage_value(key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(len)
+    }
+    
+    fn rpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError> {
+        let mut storage_val = self.get_storage_value(key)?.unwrap_or(StorageValue {
+            value: ValueType::List(Vec::new()),
+            expires_at: None,
+        });
+        
+        let list = match &mut storage_val.value {
+            ValueType::List(l) => l,
+            _ => return Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+        };
+        
+        list.extend(elements);
+        let len = list.len() as i64;
+        self.set_storage_value(key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(len)
+    }
+    
+    fn lpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(Vec::new())
+        };
+        
+        let list = match &mut storage_val.value {
+            ValueType::List(l) => l,
+            _ => return Ok(Vec::new())
+        };
+        
+        let mut result = Vec::new();
+        for _ in 0..count.min(list.len() as u64) {
+            if let Some(elem) = list.first() {
+                result.push(elem.clone());
+                list.remove(0);
+            }
+        }
+        
+        if list.is_empty() {
+            self.del(key.to_string())?;
+        } else {
+            self.set_storage_value(key, storage_val)?;
+            self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        }
+        
+        Ok(result)
+    }
+    
+    fn rpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(Vec::new())
+        };
+        
+        let list = match &mut storage_val.value {
+            ValueType::List(l) => l,
+            _ => return Ok(Vec::new())
+        };
+        
+        let mut result = Vec::new();
+        for _ in 0..count.min(list.len() as u64) {
+            if let Some(elem) = list.pop() {
+                result.push(elem);
+            }
+        }
+        
+        if list.is_empty() {
+            self.del(key.to_string())?;
+        } else {
+            self.set_storage_value(key, storage_val)?;
+            self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        }
+        
+        Ok(result)
+    }
+    
+    fn llen(&self, key: &str) -> Result<i64, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::List(l) => Ok(l.len() as i64),
+                _ => Ok(0)
+            }
+            None => Ok(0)
+        }
+    }
+    
+    fn lindex(&self, key: &str, index: i64) -> Result<Option<String>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::List(list) => {
+                    let actual_index = if index < 0 {
+                        list.len() as i64 + index
+                    } else {
+                        index
+                    };
+                    
+                    if actual_index >= 0 && (actual_index as usize) < list.len() {
+                        Ok(Some(list[actual_index as usize].clone()))
+                    } else {
+                        Ok(None)
+                    }
+                }
+                _ => Ok(None)
+            }
+            None => Ok(None)
+        }
+    }
+    
+    fn lrange(&self, key: &str, start: i64, stop: i64) -> Result<Vec<String>, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => match storage_val.value {
+                ValueType::List(list) => {
+                    if list.is_empty() {
+                        return Ok(Vec::new());
+                    }
+                    
+                    let len = list.len() as i64;
+                    let start_idx = if start < 0 { 
+                        std::cmp::max(0, len + start) 
+                    } else { 
+                        std::cmp::min(start, len) 
+                    };
+                    let stop_idx = if stop < 0 { 
+                        std::cmp::max(-1, len + stop) 
+                    } else { 
+                        std::cmp::min(stop, len - 1) 
+                    };
+                    
+                    if start_idx > stop_idx || start_idx >= len {
+                        return Ok(Vec::new());
+                    }
+                    
+                    let start_usize = start_idx as usize;
+                    let stop_usize = (stop_idx + 1) as usize;
+                    
+                    Ok(list[start_usize..std::cmp::min(stop_usize, list.len())].to_vec())
+                }
+                _ => Ok(Vec::new())
+            }
+            None => Ok(Vec::new())
+        }
+    }
+    
+    fn ltrim(&self, key: &str, start: i64, stop: i64) -> Result<(), DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(())
+        };
+        
+        let list = match &mut storage_val.value {
+            ValueType::List(l) => l,
+            _ => return Ok(())
+        };
+        
+        if list.is_empty() {
+            return Ok(());
+        }
+        
+        let len = list.len() as i64;
+        let start_idx = if start < 0 { 
+            std::cmp::max(0, len + start) 
+        } else { 
+            std::cmp::min(start, len) 
+        };
+        let stop_idx = if stop < 0 { 
+            std::cmp::max(-1, len + stop) 
+        } else { 
+            std::cmp::min(stop, len - 1) 
+        };
+        
+        if start_idx > stop_idx || start_idx >= len {
+            self.del(key.to_string())?;
+        } else {
+            let start_usize = start_idx as usize;
+            let stop_usize = (stop_idx + 1) as usize;
+            *list = list[start_usize..std::cmp::min(stop_usize, list.len())].to_vec();
+            
+            if list.is_empty() {
+                self.del(key.to_string())?;
+            } else {
+                self.set_storage_value(key, storage_val)?;
+                self.db.flush().map_err(|e| DBError(e.to_string()))?;
+            }
+        }
+        
+        Ok(())
+    }
+    
+    fn lrem(&self, key: &str, count: i64, element: &str) -> Result<i64, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(0)
+        };
+        
+        let list = match &mut storage_val.value {
+            ValueType::List(l) => l,
+            _ => return Ok(0)
+        };
+        
+        let mut removed = 0i64;
+        
+        if count == 0 {
+            // Remove all occurrences
+            let original_len = list.len();
+            list.retain(|x| x != element);
+            removed = (original_len - list.len()) as i64;
+        } else if count > 0 {
+            // Remove first count occurrences
+            let mut to_remove = count as usize;
+            list.retain(|x| {
+                if x == element && to_remove > 0 {
+                    to_remove -= 1;
+                    removed += 1;
+                    false
+                } else {
+                    true
+                }
+            });
+        } else {
+            // Remove last |count| occurrences
+            let mut to_remove = (-count) as usize;
+            for i in (0..list.len()).rev() {
+                if list[i] == element && to_remove > 0 {
+                    list.remove(i);
+                    to_remove -= 1;
+                    removed += 1;
+                }
+            }
+        }
+        
+        if list.is_empty() {
+            self.del(key.to_string())?;
+        } else {
+            self.set_storage_value(key, storage_val)?;
+            self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        }
+        
+        Ok(removed)
+    }
+    
+    // Expiration
+    fn ttl(&self, key: &str) -> Result<i64, DBError> {
+        match self.get_storage_value(key)? {
+            Some(storage_val) => {
+                if let Some(expires_at) = storage_val.expires_at {
+                    let now = Self::now_millis();
+                    if now >= expires_at {
+                        Ok(-2) // Key has expired
+                    } else {
+                        Ok(((expires_at - now) / 1000) as i64) // TTL in seconds
+                    }
+                } else {
+                    Ok(-1) // Key exists but has no expiration
+                }
+            }
+            None => Ok(-2) // Key does not exist
+        }
+    }
+    
+    fn expire_seconds(&self, key: &str, secs: u64) -> Result<bool, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(false)
+        };
+        
+        storage_val.expires_at = Some(Self::now_millis() + (secs as u128) * 1000);
+        self.set_storage_value(key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(true)
+    }
+    
+    fn pexpire_millis(&self, key: &str, ms: u128) -> Result<bool, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(false)
+        };
+        
+        storage_val.expires_at = Some(Self::now_millis() + ms);
+        self.set_storage_value(key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(true)
+    }
+    
+    fn persist(&self, key: &str) -> Result<bool, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(false)
+        };
+        
+        if storage_val.expires_at.is_some() {
+            storage_val.expires_at = None;
+            self.set_storage_value(key, storage_val)?;
+            self.db.flush().map_err(|e| DBError(e.to_string()))?;
+            Ok(true)
+        } else {
+            Ok(false)
+        }
+    }
+    
+    fn expire_at_seconds(&self, key: &str, ts_secs: i64) -> Result<bool, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(false)
+        };
+        
+        let expires_at_ms: u128 = if ts_secs <= 0 { 0 } else { (ts_secs as u128) * 1000 };
+        storage_val.expires_at = Some(expires_at_ms);
+        self.set_storage_value(key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(true)
+    }
+    
+    fn pexpire_at_millis(&self, key: &str, ts_ms: i64) -> Result<bool, DBError> {
+        let mut storage_val = match self.get_storage_value(key)? {
+            Some(sv) => sv,
+            None => return Ok(false)
+        };
+        
+        let expires_at_ms: u128 = if ts_ms <= 0 { 0 } else { ts_ms as u128 };
+        storage_val.expires_at = Some(expires_at_ms);
+        self.set_storage_value(key, storage_val)?;
+        self.db.flush().map_err(|e| DBError(e.to_string()))?;
+        Ok(true)
+    }
+    
+    fn is_encrypted(&self) -> bool {
+        self.crypto.is_some()
+    }
+    
+    fn info(&self) -> Result<Vec<(String, String)>, DBError> {
+        let dbsize = self.dbsize()?;
+        Ok(vec![
+            ("db_size".to_string(), dbsize.to_string()),
+            ("is_encrypted".to_string(), self.is_encrypted().to_string()),
+        ])
+    }
+
+    fn clone_arc(&self) -> Arc<dyn StorageBackend> {
+        // Note: This is a simplified clone - in production you might want to
+        // handle this differently as sled::Db is already Arc internally
+        Arc::new(SledStorage {
+            db: self.db.clone(),
+            types: self.types.clone(),
+            crypto: self.crypto.clone(),
+        })
+    }
+}

src/storage_trait.rs

@@ -0,0 +1,58 @@
+// src/storage_trait.rs
+use crate::error::DBError;
+use std::sync::Arc;
+
+pub trait StorageBackend: Send + Sync {
+    // Basic key operations
+    fn get(&self, key: &str) -> Result<Option<String>, DBError>;
+    fn set(&self, key: String, value: String) -> Result<(), DBError>;
+    fn setx(&self, key: String, value: String, expire_ms: u128) -> Result<(), DBError>;
+    fn del(&self, key: String) -> Result<(), DBError>;
+    fn exists(&self, key: &str) -> Result<bool, DBError>;
+    fn keys(&self, pattern: &str) -> Result<Vec<String>, DBError>;
+    fn dbsize(&self) -> Result<i64, DBError>;
+    fn flushdb(&self) -> Result<(), DBError>;
+    fn get_key_type(&self, key: &str) -> Result<Option<String>, DBError>;
+    
+    // Scanning
+    fn scan(&self, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError>;
+    fn hscan(&self, key: &str, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError>;
+    
+    // Hash operations
+    fn hset(&self, key: &str, pairs: Vec<(String, String)>) -> Result<i64, DBError>;
+    fn hget(&self, key: &str, field: &str) -> Result<Option<String>, DBError>;
+    fn hgetall(&self, key: &str) -> Result<Vec<(String, String)>, DBError>;
+    fn hdel(&self, key: &str, fields: Vec<String>) -> Result<i64, DBError>;
+    fn hexists(&self, key: &str, field: &str) -> Result<bool, DBError>;
+    fn hkeys(&self, key: &str) -> Result<Vec<String>, DBError>;
+    fn hvals(&self, key: &str) -> Result<Vec<String>, DBError>;
+    fn hlen(&self, key: &str) -> Result<i64, DBError>;
+    fn hmget(&self, key: &str, fields: Vec<String>) -> Result<Vec<Option<String>>, DBError>;
+    fn hsetnx(&self, key: &str, field: &str, value: &str) -> Result<bool, DBError>;
+    
+    // List operations
+    fn lpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError>;
+    fn rpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError>;
+    fn lpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError>;
+    fn rpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError>;
+    fn llen(&self, key: &str) -> Result<i64, DBError>;
+    fn lindex(&self, key: &str, index: i64) -> Result<Option<String>, DBError>;
+    fn lrange(&self, key: &str, start: i64, stop: i64) -> Result<Vec<String>, DBError>;
+    fn ltrim(&self, key: &str, start: i64, stop: i64) -> Result<(), DBError>;
+    fn lrem(&self, key: &str, count: i64, element: &str) -> Result<i64, DBError>;
+    
+    // Expiration
+    fn ttl(&self, key: &str) -> Result<i64, DBError>;
+    fn expire_seconds(&self, key: &str, secs: u64) -> Result<bool, DBError>;
+    fn pexpire_millis(&self, key: &str, ms: u128) -> Result<bool, DBError>;
+    fn persist(&self, key: &str) -> Result<bool, DBError>;
+    fn expire_at_seconds(&self, key: &str, ts_secs: i64) -> Result<bool, DBError>;
+    fn pexpire_at_millis(&self, key: &str, ts_ms: i64) -> Result<bool, DBError>;
+    
+    // Metadata
+    fn is_encrypted(&self) -> bool;
+    fn info(&self) -> Result<Vec<(String, String)>, DBError>;
+    
+    // Clone to Arc for sharing
+    fn clone_arc(&self) -> Arc<dyn StorageBackend>;
+}

test_herodb.sh

@@ -298,7 +298,7 @@ main() {
     
     # Start the server
     print_status "Starting HeroDB server..."
-    ./target/release/herodb --dir "$DB_DIR" --port $PORT &
+    ../target/release/herodb --dir "$DB_DIR" --port $PORT &
     SERVER_PID=$!
     
     # Wait for server to start

tests/debug_hset.rs

@@ -27,6 +27,8 @@ async fn debug_hset_simple() {
         debug: false,
         encrypt: false,
         encryption_key: None,
+        backend: herodb::options::BackendType::Redb,
+        admin_secret: "test-admin".to_string(),
     };
     
     let mut server = Server::new(option).await;
@@ -47,6 +49,12 @@ async fn debug_hset_simple() {
     sleep(Duration::from_millis(200)).await;
     
     let mut stream = TcpStream::connect(format!("127.0.0.1:{}", port)).await.unwrap();
+    // Acquire ReadWrite permissions on this connection
+    let resp = send_command(
+        &mut stream,
+        "*4\r\n$6\r\nSELECT\r\n$1\r\n0\r\n$3\r\nKEY\r\n$10\r\ntest-admin\r\n",
+    ).await;
+    assert!(resp.contains("OK"), "Failed SELECT handshake: {}", resp);
     
     // Test simple HSET
     println!("Testing HSET...");

tests/debug_hset_simple.rs

@@ -18,6 +18,8 @@ async fn debug_hset_return_value() {
         debug: false,
         encrypt: false,
         encryption_key: None,
+        backend: herodb::options::BackendType::Redb,
+        admin_secret: "test-admin".to_string(),
     };
     
     let mut server = Server::new(option).await;
@@ -40,11 +42,18 @@ async fn debug_hset_return_value() {
     // Connect and test HSET
     let mut stream = TcpStream::connect("127.0.0.1:16390").await.unwrap();
 
+    // Acquire ReadWrite permissions for this new connection
+    let handshake = "*4\r\n$6\r\nSELECT\r\n$1\r\n0\r\n$3\r\nKEY\r\n$10\r\ntest-admin\r\n";
+    stream.write_all(handshake.as_bytes()).await.unwrap();
+    let mut buffer = [0; 1024];
+    let n = stream.read(&mut buffer).await.unwrap();
+    let resp = String::from_utf8_lossy(&buffer[..n]);
+    assert!(resp.contains("OK"), "Failed SELECT handshake: {}", resp);
+    
     // Send HSET command
     let cmd = "*4\r\n$4\r\nHSET\r\n$4\r\nhash\r\n$6\r\nfield1\r\n$6\r\nvalue1\r\n";
     stream.write_all(cmd.as_bytes()).await.unwrap();
     
-    let mut buffer = [0; 1024];
     let n = stream.read(&mut buffer).await.unwrap();
     let response = String::from_utf8_lossy(&buffer[..n]);
     

tests/redis_integration_tests.rs

@@ -12,9 +12,17 @@ fn get_redis_connection(port: u16) -> Connection {
         match client.get_connection() {
             Ok(mut conn) => {
                 if redis::cmd("PING").query::<String>(&mut conn).is_ok() {
+                    // Acquire ReadWrite permissions on this connection
+                    let sel: RedisResult<String> = redis::cmd("SELECT")
+                        .arg(0)
+                        .arg("KEY")
+                        .arg("test-admin")
+                        .query(&mut conn);
+                    if sel.is_ok() {
                         return conn;
                     }
                 }
+            }
             Err(e) => {
                 if attempts >= 120 {
                     panic!(
@@ -78,6 +86,8 @@ fn setup_server() -> (ServerProcessGuard, u16) {
             "--port",
             &port.to_string(),
             "--debug",
+            "--admin-secret",
+            "test-admin",
         ])
         .spawn()
         .expect("Failed to start server process");

tests/redis_tests.rs

@@ -22,18 +22,30 @@ async fn start_test_server(test_name: &str) -> (Server, u16) {
         debug: true,
         encrypt: false,
         encryption_key: None,
+        backend: herodb::options::BackendType::Redb,
+        admin_secret: "test-admin".to_string(),
     };
     
     let server = Server::new(option).await;
     (server, port)
 }
 
-// Helper function to connect to the test server
+ // Helper function to connect to the test server
 async fn connect_to_server(port: u16) -> TcpStream {
     let mut attempts = 0;
     loop {
         match TcpStream::connect(format!("127.0.0.1:{}", port)).await {
-            Ok(stream) => return stream,
+            Ok(mut stream) => {
+                // Obtain ReadWrite permissions for this connection by selecting DB 0 with admin key
+                let resp = send_command(
+                    &mut stream,
+                    "*4\r\n$6\r\nSELECT\r\n$1\r\n0\r\n$3\r\nKEY\r\n$10\r\ntest-admin\r\n",
+                ).await;
+                if !resp.contains("OK") {
+                    panic!("Failed to acquire write permissions via SELECT 0 KEY test-admin: {}", resp);
+                }
+                return stream;
+            }
             Err(_) if attempts < 10 => {
                 attempts += 1;
                 sleep(Duration::from_millis(100)).await;

tests/rpc_tests.rs

@@ -0,0 +1,62 @@
+use std::net::SocketAddr;
+use jsonrpsee::http_client::HttpClientBuilder;
+use jsonrpsee::core::client::ClientT;
+use serde_json::json;
+
+use herodb::rpc::{RpcClient, BackendType, DatabaseConfig};
+
+#[tokio::test]
+async fn test_rpc_server_basic() {
+    // This test would require starting the RPC server in a separate thread
+    // For now, we'll just test that the types compile correctly
+
+    // Test serialization of types
+    let backend = BackendType::Redb;
+    let config = DatabaseConfig {
+        name: Some("test_db".to_string()),
+        storage_path: Some("/tmp/test".to_string()),
+        max_size: Some(1024 * 1024),
+        redis_version: Some("7.0".to_string()),
+    };
+
+    let backend_json = serde_json::to_string(&backend).unwrap();
+    let config_json = serde_json::to_string(&config).unwrap();
+
+    assert_eq!(backend_json, "\"Redb\"");
+    assert!(config_json.contains("test_db"));
+}
+
+#[tokio::test]
+async fn test_database_config_serialization() {
+    let config = DatabaseConfig {
+        name: Some("my_db".to_string()),
+        storage_path: None,
+        max_size: Some(1000000),
+        redis_version: Some("7.0".to_string()),
+    };
+
+    let json = serde_json::to_value(&config).unwrap();
+    assert_eq!(json["name"], "my_db");
+    assert_eq!(json["max_size"], 1000000);
+    assert_eq!(json["redis_version"], "7.0");
+}
+
+#[tokio::test]
+async fn test_backend_type_serialization() {
+    // Test that both Redb and Sled backends serialize correctly
+    let redb_backend = BackendType::Redb;
+    let sled_backend = BackendType::Sled;
+
+    let redb_json = serde_json::to_string(&redb_backend).unwrap();
+    let sled_json = serde_json::to_string(&sled_backend).unwrap();
+
+    assert_eq!(redb_json, "\"Redb\"");
+    assert_eq!(sled_json, "\"Sled\"");
+
+    // Test deserialization
+    let redb_deserialized: BackendType = serde_json::from_str(&redb_json).unwrap();
+    let sled_deserialized: BackendType = serde_json::from_str(&sled_json).unwrap();
+
+    assert!(matches!(redb_deserialized, BackendType::Redb));
+    assert!(matches!(sled_deserialized, BackendType::Sled));
+}

tests/simple_integration_test.rs

@@ -24,6 +24,8 @@ async fn start_test_server(test_name: &str) -> (Server, u16) {
         debug: true,
         encrypt: false,
         encryption_key: None,
+        backend: herodb::options::BackendType::Redb,
+        admin_secret: "test-admin".to_string(),
     };
     
     let server = Server::new(option).await;
@@ -33,9 +35,16 @@ async fn start_test_server(test_name: &str) -> (Server, u16) {
 // Helper function to send Redis command and get response
 async fn send_redis_command(port: u16, command: &str) -> String {
     let mut stream = TcpStream::connect(format!("127.0.0.1:{}", port)).await.unwrap();
+    
+    // Acquire ReadWrite permissions on this new connection
+    let handshake = "*4\r\n$6\r\nSELECT\r\n$1\r\n0\r\n$3\r\nKEY\r\n$10\r\ntest-admin\r\n";
+    stream.write_all(handshake.as_bytes()).await.unwrap();
+    let mut buffer = [0; 1024];
+    let _ = stream.read(&mut buffer).await.unwrap(); // Read and ignore the OK for handshake
+    
+    // Now send the intended command
     stream.write_all(command.as_bytes()).await.unwrap();
     
-    let mut buffer = [0; 1024];
     let n = stream.read(&mut buffer).await.unwrap();
     String::from_utf8_lossy(&buffer[..n]).to_string()
 }
@@ -186,9 +195,16 @@ async fn test_transaction_operations() {
      // Use a single connection for the transaction
     let mut stream = TcpStream::connect(format!("127.0.0.1:{}", port)).await.unwrap();
     
+    // Acquire write permissions for this connection
+    let handshake = "*4\r\n$6\r\nSELECT\r\n$1\r\n0\r\n$3\r\nKEY\r\n$10\r\ntest-admin\r\n";
+    stream.write_all(handshake.as_bytes()).await.unwrap();
+    let mut buffer = [0; 1024];
+    let n = stream.read(&mut buffer).await.unwrap();
+    let resp = String::from_utf8_lossy(&buffer[..n]);
+    assert!(resp.contains("OK"));
+    
     // Test MULTI
     stream.write_all("*1\r\n$5\r\nMULTI\r\n".as_bytes()).await.unwrap();
-    let mut buffer = [0; 1024];
     let n = stream.read(&mut buffer).await.unwrap();
     let response = String::from_utf8_lossy(&buffer[..n]);
     assert!(response.contains("OK"));

tests/simple_redis_test.rs

@@ -22,6 +22,8 @@ async fn start_test_server(test_name: &str) -> (Server, u16) {
         debug: false,
         encrypt: false,
         encryption_key: None,
+        backend: herodb::options::BackendType::Redb,
+        admin_secret: "test-admin".to_string(),
     };
     
     let server = Server::new(option).await;
@@ -37,12 +39,22 @@ async fn send_command(stream: &mut TcpStream, command: &str) -> String {
     String::from_utf8_lossy(&buffer[..n]).to_string()
 }
 
-// Helper function to connect to the test server
+ // Helper function to connect to the test server
 async fn connect_to_server(port: u16) -> TcpStream {
     let mut attempts = 0;
     loop {
         match TcpStream::connect(format!("127.0.0.1:{}", port)).await {
-            Ok(stream) => return stream,
+            Ok(mut stream) => {
+                // Acquire ReadWrite permissions for this connection
+                let resp = send_command(
+                    &mut stream,
+                    "*4\r\n$6\r\nSELECT\r\n$1\r\n0\r\n$3\r\nKEY\r\n$10\r\ntest-admin\r\n",
+                ).await;
+                if !resp.contains("OK") {
+                    panic!("Failed to acquire write permissions via SELECT 0 KEY test-admin: {}", resp);
+                }
+                return stream;
+            }
             Err(_) if attempts < 10 => {
                 attempts += 1;
                 sleep(Duration::from_millis(100)).await;
@@ -97,13 +109,20 @@ async fn test_hset_clean_db() {
     
     let mut stream = connect_to_server(port).await;
 
-    // Test HSET - should return 1 for new field
-    let response = send_command(&mut stream, "*4\r\n$4\r\nHSET\r\n$4\r\nhash\r\n$6\r\nfield1\r\n$6\r\nvalue1\r\n").await;
+    // Ensure clean DB state (admin DB 0 may be shared due to global singleton)
+    let flush = send_command(&mut stream, "*1\r\n$7\r\nFLUSHDB\r\n").await;
+    assert!(flush.contains("OK"), "Failed to FLUSHDB: {}", flush);
+
+    // Test HSET - should return 1 for new field (use a unique key name to avoid collisions)
+    let key = "hash_clean";
+    let hset_cmd = format!("*4\r\n$4\r\nHSET\r\n${}\r\n{}\r\n$6\r\nfield1\r\n$6\r\nvalue1\r\n", key.len(), key);
+    let response = send_command(&mut stream, &hset_cmd).await;
     println!("HSET response: {}", response);
     assert!(response.contains("1"), "Expected HSET to return 1, got: {}", response);
     
     // Test HGET
-    let response = send_command(&mut stream, "*3\r\n$4\r\nHGET\r\n$4\r\nhash\r\n$6\r\nfield1\r\n").await;
+    let hget_cmd = format!("*3\r\n$4\r\nHGET\r\n${}\r\n{}\r\n$6\r\nfield1\r\n", key.len(), key);
+    let response = send_command(&mut stream, &hget_cmd).await;
     println!("HGET response: {}", response);
     assert!(response.contains("value1"));
 }

tests/usage_suite.rs

@@ -22,6 +22,8 @@ async fn start_test_server(test_name: &str) -> (Server, u16) {
         debug: false,
         encrypt: false,
         encryption_key: None,
+        backend: herodb::options::BackendType::Redb,
+        admin_secret: "test-admin".to_string(),
     };
 
     let server = Server::new(option).await;
@@ -60,7 +62,17 @@ async fn connect(port: u16) -> TcpStream {
     let mut attempts = 0;
     loop {
         match TcpStream::connect(format!("127.0.0.1:{}", port)).await {
-            Ok(s) => return s,
+            Ok(mut s) => {
+                // Acquire ReadWrite permissions for this connection using admin DB 0
+                let resp = send_cmd(&mut s, &["SELECT", "0", "KEY", "test-admin"]).await;
+                assert_contains(&resp, "OK", "SELECT 0 KEY test-admin handshake");
+
+                // Ensure clean slate per test on DB 0
+                let fl = send_cmd(&mut s, &["FLUSHDB"]).await;
+                assert_contains(&fl, "OK", "FLUSHDB after handshake");
+
+                return s;
+            }
             Err(_) if attempts < 30 => {
                 attempts += 1;
                 sleep(Duration::from_millis(100)).await;
@@ -245,9 +257,9 @@ async fn test_01_connection_and_info() {
     let getname = send_cmd(&mut s, &["CLIENT", "GETNAME"]).await;
     assert_contains(&getname, "myapp", "CLIENT GETNAME");
 
-    // SELECT db
-    let sel = send_cmd(&mut s, &["SELECT", "0"]).await;
-    assert_contains(&sel, "OK", "SELECT 0");
+    // SELECT db (requires key on DB 0)
+    let sel = send_cmd(&mut s, &["SELECT", "0", "KEY", "test-admin"]).await;
+    assert_contains(&sel, "OK", "SELECT 0 with key");
 
     // QUIT should close connection after sending OK
     let quit = send_cmd(&mut s, &["QUIT"]).await;
@@ -500,11 +512,11 @@ async fn test_07_age_stateless_suite() {
     let mut s = connect(port).await;
 
     // GENENC -> [recipient, identity]
-    let gen = send_cmd(&mut s, &["AGE", "GENENC"]).await;
+    let genenc = send_cmd(&mut s, &["AGE", "GENENC"]).await;
     assert!(
-        gen.starts_with("*2\r\n$"),
+        genenc.starts_with("*2\r\n$"),
         "AGE GENENC should return array [recipient, identity], got:\n{}",
-        gen
+        genenc
     );
 
     // Parse simple RESP array of two bulk strings to extract keys
@@ -519,7 +531,7 @@ async fn test_07_age_stateless_suite() {
         let ident = lines.next().unwrap_or("").to_string();
         (recip, ident)
     }
-    let (recipient, identity) = parse_two_bulk_array(&gen);
+    let (recipient, identity) = parse_two_bulk_array(&genenc);
     assert!(
         recipient.starts_with("age1") && identity.starts_with("AGE-SECRET-KEY-1"),
         "Unexpected AGE key formats.\nrecipient: {}\nidentity: {}",