clean workspace: remove supervisor packe + add instructions about how AGE redis commands work

Cargo.toml

@@ -1,23 +1,9 @@
-[package]
-name = "redis-rs"
-version = "0.0.1"
-authors = ["Pin Fang <fpfangpin@hotmail.com>"]
-edition = "2021"
+[workspace]
+members = ["herodb"]
+resolver = "2"
 
-[dependencies]
-anyhow = "1.0.59"
-bytes = "1.3.0"
-thiserror = "1.0.32"
-tokio = { version = "1.23.0", features = ["full"] }
-clap = { version = "4.5.20", features = ["derive"] }
-byteorder = "1.4.3"
-futures = "0.3"
-redb = "2.1.3"
-serde = { version = "1.0", features = ["derive"] }
-bincode = "1.3.3"
-chacha20poly1305 = "0.10.1"
-rand = "0.8"
-sha2 = "0.10"
-
-[dev-dependencies]
-redis = { version = "0.24", features = ["aio", "tokio-comp"] }
+# You can define shared profiles for all workspace members here
+[profile.release]
+lto = true
+codegen-units = 1
+strip = true

README.md

@@ -1,267 +0,0 @@
-# Build Your Own Redis in Rust
-
-This project is to build a toy Redis-Server clone that's capable of parsing Redis protocol and handling basic Redis commands, parsing and initializing Redis from RDB file,
-supporting leader-follower replication, redis streams (queue), redis batch commands in transaction.
-
-You can find all the source code and commit history in [my github repo](https://github.com/fangpin/redis-rs).
-
-## Main features
-+ Parse Redis protocol
-+ Handle basic Redis commands
-+ Parse and initialize Redis from RDB file
-+ Leader-follower Replication
-
-## Prerequisites
-install `redis-cli` first (an implementation of redis client for test purpose)
-```sh
-cargo install mini-redis
-```
-
-Learn about:
-- [Redis protocoal](https://redis.io/docs/latest/develop/reference/protocol-spec)
-- [RDB file format](https://rdb.fnordig.de/file_format.html)
-- [Redis replication](https://redis.io/docs/management/replication/)
-
-## Start the Redis-rs server
-```sh
-# start as master
-cargo run -- --dir /some/db/path --dbfilename dump.rdb
-# start as slave
-cargo run -- --dir /some/db/path --dbfilename dump.rdb --port 6380 --replicaof "localhost 6379"
-```
-
-
-## Supported Commands
-```sh
-# basic commands
-redis-cli PING
-redis-cli ECHO hey
-redis-cli SET foo bar
-redis-cli SET foo bar px/ex 100
-redis-cli GET foo
-redis-cli SET foo 2
-redis-cli INCR foo
-redis-cli INCR missing_key
-redis-cli TYPE some_key
-redis-cli KEYS "*"
-
-# leader-follower replication related commands
-redis-cli CONFIG GET dbfilename
-redis-cli INFO replication
-
-# streams related commands
-redis-cli XADD stream_key 1526919030474-0 temperature 36 humidity 95
-redis-cli XADD stream_key 1526919030474-* temperature 37 humidity 94
-redis-cli XADD stream_key "*" foo bar
-## read stream
-redis-cli XRANGE stream_key 0-2 0-3
-## query with + -
-redis-cli XRANGE some_key - 1526985054079
-## query single stream using xread
-redis-cli XREAD streams some_key 1526985054069-0
-## query multiple stream using xread
-redis-cli XREAD streams stream_key other_stream_key 0-0 0-1
-## blocking reads without timeout
-redis-cli XREAD block 0 streams some_key 1526985054069-0
-
-
-# transactions related commands
-## start a transaction and exec all queued commands in a transaction
-redis-cli
-> MULTI
-> set foo 1
-> incr foo
-> exec
-## start a transaction and queued commands and cancel transaction then
-redis-cli
-> MULTI
-> set foo 1
-> incr foo
-> discard
-
-```
-
-## RDB Persistence
-Get Redis-rs server config
-```sh
-redis-cli CONFIG GET dbfilename
-```
-### RDB file format overview
-Here are the different sections of the [RDB file](https://rdb.fnordig.de/file_format.html), in order:
-+ Header section
-+ Metadata section
-+ Database section
-+ End of file section
-#### Header section
-start with some magic number
-```sh
-52 45 44 49 53 30 30 31 31  // Magic string + version number (ASCII): "REDIS0011".
-```
-#### Metadata section
-contains zero or more "metadata subsections", which each specify a single metadata attribute
-e.g.
-```sh
-FA                             // Indicates the start of a metadata subsection.
-09 72 65 64 69 73 2D 76 65 72  // The name of the metadata attribute (string encoded): "redis-ver".
-06 36 2E 30 2E 31 36           // The value of the metadata attribute (string encoded): "6.0.16".
-```
-#### Database section
-contains zero or more "database subsections," which each describe a single database.
-e.g.
-```sh
-FE                       // Indicates the start of a database subsection.
-00                       /* The index of the database (size encoded). Here, the index is 0. */
-
-FB                       // Indicates that hash table size information follows.
-03                       /* The size of the hash table that stores the keys and values (size encoded).  Here, the total key-value hash table size is 3. */
-02                       /* The size of the hash table that stores the expires of the keys (size encoded).  Here, the number of keys with an expiry is 2. */
-```
-
-```sh
-00                       /* The 1-byte flag that specifies the value’s type and encoding.  Here, the flag is 0, which means "string." */
-06 66 6F 6F 62 61 72     // The name of the key (string encoded). Here, it's "foobar".
-06 62 61 7A 71 75 78     // The value (string encoded). Here, it's "bazqux".
-```
-
-```sh
-FC                       /* Indicates that this key ("foo") has an expire, and that the expire timestamp is expressed in milliseconds. */
-15 72 E7 07 8F 01 00 00  /* The expire timestamp, expressed in Unix time, stored as an 8-byte unsigned long, in little-endian (read right-to-left).  Here, the expire timestamp is 1713824559637. */
-00                       // Value type is string.
-03 66 6F 6F              // Key name is "foo".
-03 62 61 72              // Value is "bar".
-```
-
-```sh
-FD                       /* Indicates that this key ("baz") has an expire, and that the expire timestamp is expressed in seconds. */
-52 ED 2A 66              /* The expire timestamp, expressed in Unix time, stored as an 4-byte unsigned integer, in little-endian (read right-to-left).  Here, the expire timestamp is 1714089298. */
-00                       // Value type is string.
-03 62 61 7A              // Key name is "baz".
-03 71 75 78              // Value is "qux".
-```
-
-In summary, 
-- Optional expire information (one of the following):
-  - Timestamp in seconds:
-    - FD
-    - Expire timestamp in seconds (4-byte unsigned integer)
-  - Timestamp in milliseconds:
-    - FC
-    - Expire timestamp in milliseconds (8-byte unsigned long)
-- Value type (1-byte flag)
-- Key (string encoded)
-- Value (encoding depends on value type)
-
-#### End of file section
-```sh
-FF                       /* Indicates that the file is ending, and that the checksum follows. */
-89 3b b7 4e f8 0f 77 19  // An 8-byte CRC64 checksum of the entire file.
-```
-
-#### Size encoding
-```sh
-/* If the first two bits are 0b00:
-   The size is the remaining 6 bits of the byte.
-   In this example, the size is 10: */
-0A
-00001010
-
-/* If the first two bits are 0b01:
-   The size is the next 14 bits
-   (remaining 6 bits in the first byte, combined with the next byte),
-   in big-endian (read left-to-right).
-   In this example, the size is 700: */
-42 BC
-01000010 10111100
-
-/* If the first two bits are 0b10:
-   Ignore the remaining 6 bits of the first byte.
-   The size is the next 4 bytes, in big-endian (read left-to-right).
-   In this example, the size is 17000: */
-80 00 00 42 68
-10000000 00000000 00000000 01000010 01101000
-
-/* If the first two bits are 0b11:
-   The remaining 6 bits specify a type of string encoding.
-   See string encoding section. */
-```
-
-#### String encoding
-+ The size of the string (size encoded).
-+ The string.
-```sh
-/* The 0x0D size specifies that the string is 13 characters long.  The remaining characters spell out "Hello, World!". */
-0D 48 65 6C 6C 6F 2C 20 57 6F 72 6C 64 21
-```
-For sizes that begin with 0b11, the remaining 6 bits indicate a type of string format:
-```sh
-/* The 0xC0 size indicates the string is an 8-bit integer. In this example, the string is "123". */
-C0 7B
-
-/* The 0xC1 size indicates the string is a 16-bit integer. The remaining bytes are in little-endian (read right-to-left).  In this example, the string is "12345". */
-C1 39 30
-
-/* The 0xC2 size indicates the string is a 32-bit integer.  The remaining bytes are in little-endian (read right-to-left), In this example, the string is "1234567". */
-C2 87 D6 12 00
-
-/* The 0xC3 size indicates that the string is compressed with the LZF algorithm.  You will not encounter LZF-compressed strings in this challenge. */
-C3 ...
-```
-
-## Replication
-Redis server [leader-follower replication](https://redis.io/docs/management/replication/).
-Run multiple Redis servers with one acting as the "master" and the others as "replicas". Changes made to the master will be automatically replicated to replicas.
-
-### Send Handshake (follower -> master)
-1. When the follower starts, it will send a PING command to the master as RESP Array.
-2. Then 2 REPLCONF (replication config) commands are sent to master from follower to communicate the port and the sync protocol. One is *REPLCONF listening-port <PORT>* and the other is *REPLCONF capa psync2*. psnync2 is an example sync protocol supported in this project.
-3. The follower sends the *PSYNC* command to master with replication id and offset to start the replication process.
-
-### Receive Handshake (master -> follower)
-1. Response a PONG message to follower.
-2. Response an OK message to follower for both REPLCONF commands.
-3. Response a *+FULLRESYNC <REPL_ID> 0\r\n* to follower with the replication id and offset.
-
-### RDB file transfer
-When the follower starts, it sends a *PSYNC ? -1* command to tell master that it doesn't have any data yet, and needs a full resync.
-
-Then the master send a *FULLRESYNC* response to the follower as an acknowledgement.
-
-Finally, the master send the RDB file to represent its current state to the follower. The follower should load the RDB file received to the memory, replacing its current state.
-
-### Receive write commands (master -> follower)
-The master sends following write commands to the follower with the offset info.
-The sending is to reuse the same TCP connection of handshake and RDB file transfer.
-As the all the commands are encoded as RESP Array just like a normal client command, so the follower could reuse the same logic to handler the replicate commands from master. The only difference is the commands are coming from the master and no need response back.
-
-
-## Streams
-A stream is identified by a key, and it contains multiple entries.
-Each entry consists of one or more key-value pairs, and is assigned a unique ID.
-[More about redis streams](https://redis.io/docs/latest/develop/data-types/streams/)
-[Radix tree](https://en.wikipedia.org/wiki/Radix_tree)
-
-
-It looks like a list of key-value pairs.
-```sh
-entries:
-  - id: 1526985054069-0 # (ID of the first entry)
-    temperature: 36 # (A key value pair in the first entry)
-    humidity: 95 # (Another key value pair in the first entry)
-
-  - id: 1526985054079-0 # (ID of the second entry)
-    temperature: 37 # (A key value pair in the first entry)
-    humidity: 94 # (Another key value pair in the first entry)
-
-  # ... (and so on)
-
-```
-
-Examples of Redis stream use cases include:
-- Event sourcing (e.g., tracking user actions, clicks, etc.)
-- Sensor monitoring (e.g., readings from devices in the field)
-- Notifications (e.g., storing a record of each user's notifications in a separate stream)
-
-## Transaction
-When *MULTI* command is called in a connection, redis just queued all following commands until *EXEC* or *DISCARD* command is called.
-*EXEC* command will execute all queued commands and return an array representation of all execution result (including), instead the *DISCARD* command just clear all queued commands.
-The transactions among each client connection are independent.

herodb/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+name = "herodb"
+version = "0.0.1"
+authors = ["Pin Fang <fpfangpin@hotmail.com>"]
+edition = "2021"
+
+[dependencies]
+anyhow = "1.0.59"
+bytes = "1.3.0"
+thiserror = "1.0.32"
+tokio = { version = "1.23.0", features = ["full"] }
+clap = { version = "4.5.20", features = ["derive"] }
+byteorder = "1.4.3"
+futures = "0.3"
+redb = "2.1.3"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+bincode = "1.3.3"
+chacha20poly1305 = "0.10.1"
+rand = "0.8"
+sha2 = "0.10"
+age = "0.10"
+secrecy = "0.8"
+ed25519-dalek = "2"
+base64 = "0.22"
+
+[dev-dependencies]
+redis = { version = "0.24", features = ["aio", "tokio-comp"] }

herodb/build.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -euo pipefail
+export SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+echo "I am in $SCRIPT_DIR"
+cd "$SCRIPT_DIR"
+
+cargo build
+

herodb/examples/age_bash_demo.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+
+# Start the herodb server in the background
+echo "Starting herodb server..."
+cargo run -p herodb -- --dir /tmp/herodb_age_test --port 6382 --debug --encryption-key "testkey" &
+SERVER_PID=$!
+sleep 2 # Give the server a moment to start
+
+REDIS_CLI="redis-cli -p 6382"
+
+echo "--- Generating and Storing Encryption Keys ---"
+# The new AGE commands are 'AGE KEYGEN <name>' etc., based on src/cmd.rs
+# This script uses older commands like 'AGE.GENERATE_KEYPAIR alice'
+# The demo script needs to be updated to match the implemented commands.
+# Let's assume the commands in the script are what's expected for now,
+# but note this discrepancy. The new commands are AGE KEYGEN etc.
+# The script here uses a different syntax not found in src/cmd.rs like 'AGE.GENERATE_KEYPAIR'.
+# For now, I will modify the script to fit the actual implementation.
+
+echo "--- Generating and Storing Encryption Keys ---"
+$REDIS_CLI AGE KEYGEN alice
+$REDIS_CLI AGE KEYGEN bob
+
+echo "--- Encrypting and Decrypting a Message ---"
+MESSAGE="Hello, AGE encryption!"
+# The new logic stores keys internally and does not expose a command to get the public key.
+# We will encrypt by name.
+ALICE_PUBKEY_REPLY=$($REDIS_CLI AGE KEYGEN alice | head -n 2 | tail -n 1)
+echo "Alice's Public Key: $ALICE_PUBKEY_REPLY"
+
+echo "Encrypting message: '$MESSAGE' with Alice's identity..."
+# AGE.ENCRYPT recipient message. But since we use persistent keys, let's use ENCRYPTNAME
+CIPHERTEXT=$($REDIS_CLI AGE ENCRYPTNAME alice "$MESSAGE")
+echo "Ciphertext: $CIPHERTEXT"
+
+echo "Decrypting ciphertext with Alice's private key..."
+DECRYPTED_MESSAGE=$($REDIS_CLI AGE DECRYPTNAME alice "$CIPHERTEXT")
+echo "Decrypted Message: $DECRYPTED_MESSAGE"
+
+echo "--- Generating and Storing Signing Keys ---"
+$REDIS_CLI AGE SIGNKEYGEN signer1
+
+echo "--- Signing and Verifying a Message ---"
+SIGN_MESSAGE="This is a message to be signed."
+# Similar to above, we don't have GET_SIGN_PUBKEY. We will verify by name.
+
+echo "Signing message: '$SIGN_MESSAGE' with signer1's private key..."
+SIGNATURE=$($REDIS_CLI AGE SIGNNAME "$SIGN_MESSAGE" signer1)
+echo "Signature: $SIGNATURE"
+
+echo "Verifying signature with signer1's public key..."
+VERIFY_RESULT=$($REDIS_CLI AGE VERIFYNAME signer1 "$SIGN_MESSAGE" "$SIGNATURE")
+echo "Verification Result: $VERIFY_RESULT"
+
+
+# There is no DELETE_KEYPAIR command in the implementation
+echo "--- Cleaning up keys (manual in herodb) ---"
+# We would use DEL for age:key:alice, etc.
+$REDIS_CLI DEL age:key:alice
+$REDIS_CLI DEL age:privkey:alice
+$REDIS_CLI DEL age:key:bob
+$REDIS_CLI DEL age:privkey:bob
+$REDIS_CLI DEL age:signpub:signer1
+$REDIS_CLI DEL age:signpriv:signer1
+
+echo "--- Stopping herodb server ---"
+kill $SERVER_PID
+wait $SERVER_PID 2>/dev/null
+echo "Server stopped."
+
+echo "Bash demo complete."

herodb/examples/age_persist_demo.rs

@@ -0,0 +1,83 @@
+use std::io::{Read, Write};
+use std::net::TcpStream;
+
+// Minimal RESP helpers
+fn arr(parts: &[&str]) -> String {
+    let mut out = format!("*{}\r\n", parts.len());
+    for p in parts {
+        out.push_str(&format!("${}\r\n{}\r\n", p.len(), p));
+    }
+    out
+}
+fn read_reply(s: &mut TcpStream) -> String {
+    let mut buf = [0u8; 65536];
+    let n = s.read(&mut buf).unwrap();
+    String::from_utf8_lossy(&buf[..n]).to_string()
+}
+fn parse_two_bulk(reply: &str) -> Option<(String,String)> {
+    let mut lines = reply.split("\r\n");
+    if lines.next()? != "*2" { return None; }
+    let _n = lines.next()?;
+    let a = lines.next()?.to_string();
+    let _m = lines.next()?;
+    let b = lines.next()?.to_string();
+    Some((a,b))
+}
+fn parse_bulk(reply: &str) -> Option<String> {
+    let mut lines = reply.split("\r\n");
+    let hdr = lines.next()?;
+    if !hdr.starts_with('$') { return None; }
+    Some(lines.next()?.to_string())
+}
+fn parse_simple(reply: &str) -> Option<String> {
+    let mut lines = reply.split("\r\n");
+    let hdr = lines.next()?;
+    if !hdr.starts_with('+') { return None; }
+    Some(hdr[1..].to_string())
+}
+
+fn main() {
+    let mut args = std::env::args().skip(1);
+    let host = args.next().unwrap_or_else(|| "127.0.0.1".into());
+    let port = args.next().unwrap_or_else(|| "6379".into());
+    let addr = format!("{host}:{port}");
+    println!("Connecting to {addr}...");
+    let mut s = TcpStream::connect(addr).expect("connect");
+
+    // Generate & persist X25519 enc keys under name "alice"
+    s.write_all(arr(&["age","keygen","alice"]).as_bytes()).unwrap();
+    let (_alice_recip, _alice_ident) = parse_two_bulk(&read_reply(&mut s)).expect("gen enc");
+
+    // Generate & persist Ed25519 signing key under name "signer"
+    s.write_all(arr(&["age","signkeygen","signer"]).as_bytes()).unwrap();
+    let (_verify, _secret) = parse_two_bulk(&read_reply(&mut s)).expect("gen sign");
+
+    // Encrypt by name
+    let msg = "hello from persistent keys";
+    s.write_all(arr(&["age","encryptname","alice", msg]).as_bytes()).unwrap();
+    let ct_b64 = parse_bulk(&read_reply(&mut s)).expect("ct b64");
+    println!("ciphertext b64: {}", ct_b64);
+
+    // Decrypt by name
+    s.write_all(arr(&["age","decryptname","alice", &ct_b64]).as_bytes()).unwrap();
+    let pt = parse_bulk(&read_reply(&mut s)).expect("pt");
+    assert_eq!(pt, msg);
+    println!("decrypted ok");
+
+    // Sign by name
+    s.write_all(arr(&["age","signname","signer", msg]).as_bytes()).unwrap();
+    let sig_b64 = parse_bulk(&read_reply(&mut s)).expect("sig b64");
+
+    // Verify by name
+    s.write_all(arr(&["age","verifyname","signer", msg, &sig_b64]).as_bytes()).unwrap();
+    let ok = parse_simple(&read_reply(&mut s)).expect("verify");
+    assert_eq!(ok, "1");
+    println!("signature verified");
+
+    // List names
+    s.write_all(arr(&["age","list"]).as_bytes()).unwrap();
+    let list = read_reply(&mut s);
+    println!("LIST -> {list}");
+
+    println!("✔ persistent AGE workflow complete.");
+}

herodb/instructions/age_usage.md

@@ -0,0 +1,173 @@
+# HeroDB AGE usage: Stateless vs Key‑Managed
+
+This document explains how to use the AGE cryptography commands exposed by HeroDB over the Redis protocol in two modes:
+- Stateless (ephemeral keys; nothing stored on the server)
+- Key‑managed (server‑persisted, named keys)
+
+If you are new to the codebase, the exact tests that exercise these behaviors are:
+- [rust.test_07_age_stateless_suite()](herodb/tests/usage_suite.rs:495)
+- [rust.test_08_age_persistent_named_suite()](herodb/tests/usage_suite.rs:555)
+
+Implementation entry points:
+- [herodb/src/age.rs](herodb/src/age.rs)
+- Dispatch from [herodb/src/cmd.rs](herodb/src/cmd.rs)
+
+Note: Database-at-rest encryption flags in the test harness are unrelated to AGE commands; those flags control storage-level encryption of DB files. See the harness near [rust.start_test_server()](herodb/tests/usage_suite.rs:10).
+
+## Quick start
+
+Assuming the server is running on localhost on some PORT:
+
+```bash
+# Generate an ephemeral keypair and encrypt/decrypt a message (stateless mode)
+redis-cli -p PORT AGE GENENC
+# → returns an array: [recipient, identity]
+
+redis-cli -p PORT AGE ENCRYPT <recipient> "hello world"
+# → returns ciphertext (base64 in a bulk string)
+
+redis-cli -p PORT AGE DECRYPT <identity> <ciphertext_b64>
+# → returns "hello world"
+```
+
+For key‑managed mode, generate a named key once and reference it by name afterwards:
+
+```bash
+redis-cli -p PORT AGE KEYGEN app1
+# → persists encryption keypair under name "app1"
+
+redis-cli -p PORT AGE ENCRYPTNAME app1 "hello"
+redis-cli -p PORT AGE DECRYPTNAME app1 <ciphertext_b64>
+```
+
+## Stateless AGE (ephemeral)
+
+Characteristics
+- No server‑side storage of keys.
+- You pass the actual key material with every call.
+- Not listable via AGE LIST.
+
+Commands and examples
+
+1) Ephemeral encryption keys
+
+```bash
+# Generate an ephemeral encryption keypair
+redis-cli -p PORT AGE GENENC
+# Example output (abridged):
+# 1) "age1qz..."          # recipient (public)
+# 2) "AGE-SECRET-KEY-1..." # identity (secret)
+
+# Encrypt with the recipient
+redis-cli -p PORT AGE ENCRYPT "age1qz..." "hello world"
+# → returns bulk string payload: base64 ciphertext
+
+# Decrypt with the identity (secret)
+redis-cli -p PORT AGE DECRYPT "AGE-SECRET-KEY-1..." "<ciphertext_b64>"
+# → "hello world"
+```
+
+2) Ephemeral signing keys
+
+```bash
+# Generate an ephemeral signing keypair
+redis-cli -p PORT AGE GENSIGN
+# Example output:
+# 1) "<verify_pub_b64>"
+# 2) "<sign_secret_b64>"
+
+# Sign a message with the secret
+redis-cli -p PORT AGE SIGN "<sign_secret_b64>" "msg"
+# → returns "<signature_b64>"
+
+# Verify with the public key
+redis-cli -p PORT AGE VERIFY "<verify_pub_b64>" "msg" "<signature_b64>"
+# → 1 (valid) or 0 (invalid)
+```
+
+When to use
+- You do not want the server to store private keys.
+- You already manage key material on the client side.
+- You need ad‑hoc operations without persistence.
+
+Reference test: [rust.test_07_age_stateless_suite()](herodb/tests/usage_suite.rs:495)
+
+## Key‑managed AGE (persistent, named)
+
+Characteristics
+- Server generates and persists keypairs under a chosen name.
+- Clients refer to keys by name; raw secrets are not supplied on each call.
+- Keys are discoverable via AGE LIST.
+
+Commands and examples
+
+1) Named encryption keys
+
+```bash
+# Create/persist a named encryption keypair
+redis-cli -p PORT AGE KEYGEN app1
+# → returns [recipient, identity] but also stores them under name "app1"
+
+# Encrypt using the stored public key
+redis-cli -p PORT AGE ENCRYPTNAME app1 "hello"
+# → returns bulk string payload: base64 ciphertext
+
+# Decrypt using the stored secret
+redis-cli -p PORT AGE DECRYPTNAME app1 "<ciphertext_b64>"
+# → "hello"
+```
+
+2) Named signing keys
+
+```bash
+# Create/persist a named signing keypair
+redis-cli -p PORT AGE SIGNKEYGEN app1
+# → returns [verify_pub_b64, sign_secret_b64] and stores under name "app1"
+
+# Sign using the stored secret
+redis-cli -p PORT AGE SIGNNAME app1 "msg"
+# → returns "<signature_b64>"
+
+# Verify using the stored public key
+redis-cli -p PORT AGE VERIFYNAME app1 "msg" "<signature_b64>"
+# → 1 (valid) or 0 (invalid)
+```
+
+3) List stored AGE keys
+
+```bash
+redis-cli -p PORT AGE LIST
+# Example output includes labels such as "encpub" and your key names (e.g., "app1")
+```
+
+When to use
+- You want centralized key storage/rotation and fewer secrets on the client.
+- You need names/labels for workflows and can trust the server with secrets.
+- You want discoverability (AGE LIST) and simpler client commands.
+
+Reference test: [rust.test_08_age_persistent_named_suite()](herodb/tests/usage_suite.rs:555)
+
+## Choosing a mode
+
+- Prefer Stateless when:
+  - Minimizing server trust for secret material is the priority.
+  - Clients already have a secure mechanism to store/distribute keys.
+- Prefer Key‑managed when:
+  - Centralized lifecycle, naming, and discoverability are beneficial.
+  - You plan to integrate rotation, ACLs, or auditability on the server side.
+
+## Security notes
+
+- Treat identities and signing secrets as sensitive; avoid logging them.
+- For key‑managed mode, ensure server storage (and backups) are protected.
+- AGE operations here are application‑level crypto and are distinct from database-at-rest encryption configured in the test harness.
+
+## Repository pointers
+
+- Stateless examples in tests: [rust.test_07_age_stateless_suite()](herodb/tests/usage_suite.rs:495)
+- Key‑managed examples in tests: [rust.test_08_age_persistent_named_suite()](herodb/tests/usage_suite.rs:555)
+- AGE implementation: [herodb/src/age.rs](herodb/src/age.rs)
+- Command dispatch: [herodb/src/cmd.rs](herodb/src/cmd.rs)
+- Bash demo: [herodb/examples/age_bash_demo.sh](herodb/examples/age_bash_demo.sh)
+- Rust persistent demo: [herodb/examples/age_persist_demo.rs](herodb/examples/age_persist_demo.rs)
+- Additional notes: [herodb/instructions/encrypt.md](herodb/instructions/encrypt.md)

herodb/instructions/encrypt.md

@@ -1,4 +1,3 @@
-Perfect — here’s a tiny “factory” you can drop in.
 
 ### Cargo.toml
 

herodb/run_tests.sh

@@ -6,20 +6,19 @@ echo "=========================================="
 echo ""
 echo "1️⃣  Running Simple Redis Tests (4 tests)..."
 echo "----------------------------------------------"
-cargo test --test simple_redis_test -- --nocapture
+cargo test -p herodb --test simple_redis_test -- --nocapture
 
 echo ""
 echo "2️⃣  Running Comprehensive Redis Integration Tests (13 tests)..."
 echo "----------------------------------------------------------------"
-cargo test --test redis_integration_tests -- --nocapture
-cargo test --test redis_basic_client -- --nocapture
-cargo test --test debug_hset -- --nocapture
-cargo test --test debug_hset_simple -- --nocapture
+cargo test -p herodb --test redis_integration_tests -- --nocapture
+cargo test -p herodb --test debug_hset -- --nocapture
+cargo test -p herodb --test debug_hset_simple -- --nocapture
 
 echo ""
-echo "3️⃣  Running All Tests..."
-echo "------------------------"
-cargo test -- --nocapture
+echo "3️⃣  Running All Workspace Tests..."
+echo "--------------------------------"
+cargo test --workspace -- --nocapture
 
 echo ""
 echo "✅ Test execution completed!"

herodb/src/age.rs

@@ -0,0 +1,308 @@
+//! age.rs — AGE (rage) helpers + persistent key management for your mini-Redis.
+//
+// Features:
+// - X25519 encryption/decryption (age style)
+// - Ed25519 detached signatures + verification
+// - Persistent named keys in DB (strings):
+//      age:key:{name}       -> X25519 recipient (public encryption key, "age1...")
+//      age:privkey:{name}   -> X25519 identity (secret encryption key, "AGE-SECRET-KEY-1...")
+//      age:signpub:{name}   -> Ed25519 verify pubkey (public, used to verify signatures)
+//      age:signpriv:{name}  -> Ed25519 signing secret key (private, used to sign)
+// - Base64 wrapping for ciphertext/signature binary blobs.
+
+use std::str::FromStr;
+
+use secrecy::ExposeSecret;
+use age::{Decryptor, Encryptor};
+use age::x25519;
+
+use ed25519_dalek::{Signature, Signer, Verifier, SigningKey, VerifyingKey};
+
+use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
+
+use crate::protocol::Protocol;
+use crate::server::Server;
+use crate::error::DBError;
+
+// ---------- Internal helpers ----------
+
+#[derive(Debug)]
+pub enum AgeWireError {
+    ParseKey,
+    Crypto(String),
+    Utf8,
+    SignatureLen,
+    NotFound(&'static str),     // which kind of key was missing
+    Storage(String),
+}
+
+impl AgeWireError {
+    fn to_protocol(self) -> Protocol {
+        match self {
+            AgeWireError::ParseKey => Protocol::err("ERR age: invalid key"),
+            AgeWireError::Crypto(e) => Protocol::err(&format!("ERR age: {e}")),
+            AgeWireError::Utf8 => Protocol::err("ERR age: invalid UTF-8 plaintext"),
+            AgeWireError::SignatureLen => Protocol::err("ERR age: bad signature length"),
+            AgeWireError::NotFound(w) => Protocol::err(&format!("ERR age: missing {w}")),
+            AgeWireError::Storage(e) => Protocol::err(&format!("ERR storage: {e}")),
+        }
+    }
+}
+
+fn parse_recipient(s: &str) -> Result<x25519::Recipient, AgeWireError> {
+    x25519::Recipient::from_str(s).map_err(|_| AgeWireError::ParseKey)
+}
+fn parse_identity(s: &str) -> Result<x25519::Identity, AgeWireError> {
+    x25519::Identity::from_str(s).map_err(|_| AgeWireError::ParseKey)
+}
+fn parse_ed25519_signing_key(s: &str) -> Result<SigningKey, AgeWireError> {
+    // Parse base64-encoded signing key
+    let bytes = B64.decode(s).map_err(|_| AgeWireError::ParseKey)?;
+    if bytes.len() != 32 {
+        return Err(AgeWireError::ParseKey);
+    }
+    let key_bytes: [u8; 32] = bytes.try_into().map_err(|_| AgeWireError::ParseKey)?;
+    Ok(SigningKey::from_bytes(&key_bytes))
+}
+fn parse_ed25519_verifying_key(s: &str) -> Result<VerifyingKey, AgeWireError> {
+    // Parse base64-encoded verifying key
+    let bytes = B64.decode(s).map_err(|_| AgeWireError::ParseKey)?;
+    if bytes.len() != 32 {
+        return Err(AgeWireError::ParseKey);
+    }
+    let key_bytes: [u8; 32] = bytes.try_into().map_err(|_| AgeWireError::ParseKey)?;
+    VerifyingKey::from_bytes(&key_bytes).map_err(|_| AgeWireError::ParseKey)
+}
+
+// ---------- Stateless crypto helpers (string in/out) ----------
+
+pub fn gen_enc_keypair() -> (String, String) {
+    let id = x25519::Identity::generate();
+    let pk = id.to_public();
+    (pk.to_string(), id.to_string().expose_secret().to_string()) // (recipient, identity)
+}
+
+pub fn gen_sign_keypair() -> (String, String) {
+    use rand::RngCore;
+    use rand::rngs::OsRng;
+    
+    // Generate random 32 bytes for the signing key
+    let mut secret_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut secret_bytes);
+    
+    let signing_key = SigningKey::from_bytes(&secret_bytes);
+    let verifying_key = signing_key.verifying_key();
+    
+    // Encode as base64 for storage
+    let signing_key_b64 = B64.encode(signing_key.to_bytes());
+    let verifying_key_b64 = B64.encode(verifying_key.to_bytes());
+    
+    (verifying_key_b64, signing_key_b64) // (verify_pub, signing_secret)
+}
+
+/// Encrypt `msg` for `recipient_str` (X25519). Returns base64(ciphertext).
+pub fn encrypt_b64(recipient_str: &str, msg: &str) -> Result<String, AgeWireError> {
+    let recipient = parse_recipient(recipient_str)?;
+    let enc = Encryptor::with_recipients(vec![Box::new(recipient)])
+        .expect("failed to create encryptor"); // Handle Option<Encryptor>
+    let mut out = Vec::new();
+    {
+        use std::io::Write;
+        let mut w = enc.wrap_output(&mut out).map_err(|e| AgeWireError::Crypto(e.to_string()))?;
+        w.write_all(msg.as_bytes()).map_err(|e| AgeWireError::Crypto(e.to_string()))?;
+        w.finish().map_err(|e| AgeWireError::Crypto(e.to_string()))?;
+    }
+    Ok(B64.encode(out))
+}
+
+/// Decrypt base64(ciphertext) with `identity_str`. Returns plaintext String.
+pub fn decrypt_b64(identity_str: &str, ct_b64: &str) -> Result<String, AgeWireError> {
+    let id = parse_identity(identity_str)?;
+    let ct = B64.decode(ct_b64.as_bytes()).map_err(|e| AgeWireError::Crypto(e.to_string()))?;
+    let dec = Decryptor::new(&ct[..]).map_err(|e| AgeWireError::Crypto(e.to_string()))?;
+    
+    // The decrypt method returns a Result<StreamReader, DecryptError>
+    let mut r = match dec {
+        Decryptor::Recipients(d) => d.decrypt(std::iter::once(&id as &dyn age::Identity))
+            .map_err(|e| AgeWireError::Crypto(e.to_string()))?,
+        Decryptor::Passphrase(_) => return Err(AgeWireError::Crypto("Expected recipients, got passphrase".to_string())),
+    };
+    
+    let mut pt = Vec::new();
+    use std::io::Read;
+    r.read_to_end(&mut pt).map_err(|e| AgeWireError::Crypto(e.to_string()))?;
+    String::from_utf8(pt).map_err(|_| AgeWireError::Utf8)
+}
+
+/// Sign bytes of `msg` (detached). Returns base64(signature bytes, 64 bytes).
+pub fn sign_b64(signing_secret_str: &str, msg: &str) -> Result<String, AgeWireError> {
+    let signing_key = parse_ed25519_signing_key(signing_secret_str)?;
+    let sig = signing_key.sign(msg.as_bytes());
+    Ok(B64.encode(sig.to_bytes()))
+}
+
+/// Verify detached signature (base64) for `msg` with pubkey.
+pub fn verify_b64(verify_pub_str: &str, msg: &str, sig_b64: &str) -> Result<bool, AgeWireError> {
+    let verifying_key = parse_ed25519_verifying_key(verify_pub_str)?;
+    let sig_bytes = B64.decode(sig_b64.as_bytes()).map_err(|e| AgeWireError::Crypto(e.to_string()))?;
+    if sig_bytes.len() != 64 {
+        return Err(AgeWireError::SignatureLen);
+    }
+    let sig = Signature::from_bytes(sig_bytes[..].try_into().unwrap());
+    Ok(verifying_key.verify(msg.as_bytes(), &sig).is_ok())
+}
+
+// ---------- Storage helpers ----------
+
+fn sget(server: &Server, key: &str) -> Result<Option<String>, AgeWireError> {
+    let st = server.current_storage().map_err(|e| AgeWireError::Storage(e.0))?;
+    st.get(key).map_err(|e| AgeWireError::Storage(e.0))
+}
+fn sset(server: &Server, key: &str, val: &str) -> Result<(), AgeWireError> {
+    let st = server.current_storage().map_err(|e| AgeWireError::Storage(e.0))?;
+    st.set(key.to_string(), val.to_string()).map_err(|e| AgeWireError::Storage(e.0))
+}
+
+fn enc_pub_key_key(name: &str) -> String { format!("age:key:{name}") }
+fn enc_priv_key_key(name: &str) -> String { format!("age:privkey:{name}") }
+fn sign_pub_key_key(name: &str) -> String { format!("age:signpub:{name}") }
+fn sign_priv_key_key(name: &str) -> String { format!("age:signpriv:{name}") }
+
+// ---------- Command handlers (RESP Protocol) ----------
+// Basic (stateless) ones kept for completeness
+
+pub async fn cmd_age_genenc() -> Protocol {
+    let (recip, ident) = gen_enc_keypair();
+    Protocol::Array(vec![Protocol::BulkString(recip), Protocol::BulkString(ident)])
+}
+
+pub async fn cmd_age_gensign() -> Protocol {
+    let (verify, secret) = gen_sign_keypair();
+    Protocol::Array(vec![Protocol::BulkString(verify), Protocol::BulkString(secret)])
+}
+
+pub async fn cmd_age_encrypt(recipient: &str, message: &str) -> Protocol {
+    match encrypt_b64(recipient, message) {
+        Ok(b64) => Protocol::BulkString(b64),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+pub async fn cmd_age_decrypt(identity: &str, ct_b64: &str) -> Protocol {
+    match decrypt_b64(identity, ct_b64) {
+        Ok(pt) => Protocol::BulkString(pt),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+pub async fn cmd_age_sign(secret: &str, message: &str) -> Protocol {
+    match sign_b64(secret, message) {
+        Ok(b64sig) => Protocol::BulkString(b64sig),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+pub async fn cmd_age_verify(verify_pub: &str, message: &str, sig_b64: &str) -> Protocol {
+    match verify_b64(verify_pub, message, sig_b64) {
+        Ok(true) => Protocol::SimpleString("1".to_string()),
+        Ok(false) => Protocol::SimpleString("0".to_string()),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+// ---------- NEW: Persistent, named-key commands ----------
+
+pub async fn cmd_age_keygen(server: &Server, name: &str) -> Protocol {
+    let (recip, ident) = gen_enc_keypair();
+    if let Err(e) = sset(server, &enc_pub_key_key(name), &recip) { return e.to_protocol(); }
+    if let Err(e) = sset(server, &enc_priv_key_key(name), &ident) { return e.to_protocol(); }
+    Protocol::Array(vec![Protocol::BulkString(recip), Protocol::BulkString(ident)])
+}
+
+pub async fn cmd_age_signkeygen(server: &Server, name: &str) -> Protocol {
+    let (verify, secret) = gen_sign_keypair();
+    if let Err(e) = sset(server, &sign_pub_key_key(name), &verify) { return e.to_protocol(); }
+    if let Err(e) = sset(server, &sign_priv_key_key(name), &secret) { return e.to_protocol(); }
+    Protocol::Array(vec![Protocol::BulkString(verify), Protocol::BulkString(secret)])
+}
+
+pub async fn cmd_age_encrypt_name(server: &Server, name: &str, message: &str) -> Protocol {
+    let recip = match sget(server, &enc_pub_key_key(name)) {
+        Ok(Some(v)) => v,
+        Ok(None) => return AgeWireError::NotFound("recipient (age:key:{name})").to_protocol(),
+        Err(e) => return e.to_protocol(),
+    };
+    match encrypt_b64(&recip, message) {
+        Ok(ct) => Protocol::BulkString(ct),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+pub async fn cmd_age_decrypt_name(server: &Server, name: &str, ct_b64: &str) -> Protocol {
+    let ident = match sget(server, &enc_priv_key_key(name)) {
+        Ok(Some(v)) => v,
+        Ok(None) => return AgeWireError::NotFound("identity (age:privkey:{name})").to_protocol(),
+        Err(e) => return e.to_protocol(),
+    };
+    match decrypt_b64(&ident, ct_b64) {
+        Ok(pt) => Protocol::BulkString(pt),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+pub async fn cmd_age_sign_name(server: &Server, name: &str, message: &str) -> Protocol {
+    let sec = match sget(server, &sign_priv_key_key(name)) {
+        Ok(Some(v)) => v,
+        Ok(None) => return AgeWireError::NotFound("signing secret (age:signpriv:{name})").to_protocol(),
+        Err(e) => return e.to_protocol(),
+    };
+    match sign_b64(&sec, message) {
+        Ok(sig) => Protocol::BulkString(sig),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+pub async fn cmd_age_verify_name(server: &Server, name: &str, message: &str, sig_b64: &str) -> Protocol {
+    let pubk = match sget(server, &sign_pub_key_key(name)) {
+        Ok(Some(v)) => v,
+        Ok(None) => return AgeWireError::NotFound("verify pubkey (age:signpub:{name})").to_protocol(),
+        Err(e) => return e.to_protocol(),
+    };
+    match verify_b64(&pubk, message, sig_b64) {
+        Ok(true) => Protocol::SimpleString("1".to_string()),
+        Ok(false) => Protocol::SimpleString("0".to_string()),
+        Err(e) => e.to_protocol(),
+    }
+}
+
+pub async fn cmd_age_list(server: &Server) -> Protocol {
+    // Returns 4 arrays: ["encpub", <names...>], ["encpriv", ...], ["signpub", ...], ["signpriv", ...]
+    let st = match server.current_storage() { Ok(s) => s, Err(e) => return Protocol::err(&e.0) };
+
+    let pull = |pat: &str, prefix: &str| -> Result<Vec<String>, DBError> {
+        let keys = st.keys(pat)?;
+        let mut names: Vec<String> = keys.into_iter()
+            .filter_map(|k| k.strip_prefix(prefix).map(|x| x.to_string()))
+            .collect();
+        names.sort();
+        Ok(names)
+    };
+
+    let encpub  = match pull("age:key:*",      "age:key:")      { Ok(v) => v, Err(e)=> return Protocol::err(&e.0) };
+    let encpriv = match pull("age:privkey:*",  "age:privkey:")  { Ok(v) => v, Err(e)=> return Protocol::err(&e.0) };
+    let signpub = match pull("age:signpub:*",  "age:signpub:")  { Ok(v) => v, Err(e)=> return Protocol::err(&e.0) };
+    let signpriv= match pull("age:signpriv:*", "age:signpriv:") { Ok(v) => v, Err(e)=> return Protocol::err(&e.0) };
+
+    let to_arr = |label: &str, v: Vec<String>| {
+        let mut out = vec![Protocol::BulkString(label.to_string())];
+        out.push(Protocol::Array(v.into_iter().map(Protocol::BulkString).collect()));
+        Protocol::Array(out)
+    };
+
+    Protocol::Array(vec![
+        to_arr("encpub", encpub),
+        to_arr("encpriv", encpriv),
+        to_arr("signpub", signpub),
+        to_arr("signpriv", signpriv),
+    ])
+}

herodb/src/cmd.rs

@@ -1,5 +1,7 @@
 use crate::{error::DBError, protocol::Protocol, server::Server};
 use serde::Serialize;
+use tokio::time::{timeout, Duration};
+use futures::future::select_all;
 
 #[derive(Debug, Clone)]
 pub enum Cmd {
@@ -10,7 +12,12 @@ pub enum Cmd {
     Set(String, String),
     SetPx(String, String, u128),
     SetEx(String, String, u128),
+    // Advanced SET with options: (key, value, ex_ms, nx, xx, get)
+    SetOpts(String, String, Option<u128>, bool, bool, bool),
+    MGet(Vec<String>),
+    MSet(Vec<(String, String)>),
     Keys,
+    DbSize,
     ConfigGet(String),
     Info(Option<String>),
     Del(String),
@@ -30,19 +37,31 @@ pub enum Cmd {
     HLen(String),
     HMGet(String, Vec<String>),
     HSetNx(String, String, String),
+    HIncrBy(String, String, i64),
+    HIncrByFloat(String, String, f64),
     HScan(String, u64, Option<String>, Option<u64>), // key, cursor, pattern, count
     Scan(u64, Option<String>, Option<u64>), // cursor, pattern, count
     Ttl(String),
+    Expire(String, i64),
+    PExpire(String, i64),
+    ExpireAt(String, i64),
+    PExpireAt(String, i64),
+    Persist(String),
     Exists(String),
+    ExistsMulti(Vec<String>),
+    DelMulti(Vec<String>),
     Quit,
     Client(Vec<String>),
     ClientSetName(String),
     ClientGetName,
+    Command(Vec<String>),
     // List commands
     LPush(String, Vec<String>),
     RPush(String, Vec<String>),
     LPop(String, Option<u64>),
     RPop(String, Option<u64>),
+    BLPop(Vec<String>, f64),
+    BRPop(Vec<String>, f64),
     LLen(String),
     LRem(String, i64, String),
     LTrim(String, i64, i64),
@@ -50,6 +69,22 @@ pub enum Cmd {
     LRange(String, i64, i64),
     FlushDb,
     Unknow(String),
+    // AGE (rage) commands — stateless
+    AgeGenEnc,
+    AgeGenSign,
+    AgeEncrypt(String, String),            // recipient, message
+    AgeDecrypt(String, String),            // identity, ciphertext_b64
+    AgeSign(String, String),               // signing_secret, message
+    AgeVerify(String, String, String),     // verify_pub, message, signature_b64
+
+    // NEW: persistent named-key commands
+    AgeKeygen(String),                     // name
+    AgeSignKeygen(String),                 // name
+    AgeEncryptName(String, String),        // name, message
+    AgeDecryptName(String, String),        // name, ciphertext_b64
+    AgeSignName(String, String),           // name, message
+    AgeVerifyName(String, String, String), // name, message, signature_b64
+    AgeList,
 }
 
 impl Cmd {
@@ -74,22 +109,77 @@ impl Cmd {
                         "ping" => Cmd::Ping,
                         "get" => Cmd::Get(cmd[1].clone()),
                         "set" => {
-                            if cmd.len() == 5 && cmd[3].to_lowercase() == "px" {
-                                Cmd::SetPx(cmd[1].clone(), cmd[2].clone(), cmd[4].parse().unwrap())
-                            } else if cmd.len() == 5 && cmd[3].to_lowercase() == "ex" {
-                                Cmd::SetEx(cmd[1].clone(), cmd[2].clone(), cmd[4].parse().unwrap())
-                            } else if cmd.len() == 3 {
-                                Cmd::Set(cmd[1].clone(), cmd[2].clone())
-                            } else {
+                            if cmd.len() < 3 {
+                                return Err(DBError("wrong number of arguments for SET".to_string()));
+                            }
+                            let key = cmd[1].clone();
+                            let val = cmd[2].clone();
+
+                            // Parse optional flags: EX sec | PX ms | NX | XX | GET
+                            let mut ex_ms: Option<u128> = None;
+                            let mut nx = false;
+                            let mut xx = false;
+                            let mut getflag = false;
+
+                            let mut i = 3;
+                            while i < cmd.len() {
+                                match cmd[i].to_lowercase().as_str() {
+                                    "ex" => {
+                                        if i + 1 >= cmd.len() {
+                                            return Err(DBError("ERR syntax error".to_string()));
+                                        }
+                                        let secs: u128 = cmd[i + 1].parse().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?;
+                                        ex_ms = Some(secs * 1000);
+                                        i += 2;
+                                    }
+                                    "px" => {
+                                        if i + 1 >= cmd.len() {
+                                            return Err(DBError("ERR syntax error".to_string()));
+                                        }
+                                        let ms: u128 = cmd[i + 1].parse().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?;
+                                        ex_ms = Some(ms);
+                                        i += 2;
+                                    }
+                                    "nx" => { nx = true; i += 1; }
+                                    "xx" => { xx = true; i += 1; }
+                                    "get" => { getflag = true; i += 1; }
+                                    _ => {
                                         return Err(DBError(format!("unsupported cmd {:?}", cmd)));
                                     }
                                 }
+                            }
+
+                            // If no options, keep legacy behavior
+                            if ex_ms.is_none() && !nx && !xx && !getflag {
+                                Cmd::Set(key, val)
+                            } else {
+                                Cmd::SetOpts(key, val, ex_ms, nx, xx, getflag)
+                            }
+                        }
                         "setex" => {
                             if cmd.len() != 4 {
                                 return Err(DBError(format!("wrong number of arguments for SETEX command")));
                             }
                             Cmd::SetEx(cmd[1].clone(), cmd[3].clone(), cmd[2].parse().unwrap())
                         }
+                        "mget" => {
+                            if cmd.len() < 2 {
+                                return Err(DBError("wrong number of arguments for MGET command".to_string()));
+                            }
+                            Cmd::MGet(cmd[1..].to_vec())
+                        }
+                        "mset" => {
+                            if cmd.len() < 3 || ((cmd.len() - 1) % 2 != 0) {
+                                return Err(DBError("wrong number of arguments for MSET command".to_string()));
+                            }
+                            let mut pairs = Vec::new();
+                            let mut i = 1;
+                            while i + 1 < cmd.len() {
+                                pairs.push((cmd[i].clone(), cmd[i + 1].clone()));
+                                i += 2;
+                            }
+                            Cmd::MSet(pairs)
+                        }
                         "config" => {
                             if cmd.len() != 3 || cmd[1].to_lowercase() != "get" {
                                 return Err(DBError(format!("unsupported cmd {:?}", cmd)));
@@ -104,6 +194,12 @@ impl Cmd {
                                 Cmd::Keys
                             }
                         }
+                        "dbsize" => {
+                            if cmd.len() != 1 {
+                                return Err(DBError(format!("wrong number of arguments for DBSIZE command")));
+                            }
+                            Cmd::DbSize
+                        }
                         "info" => {
                             let section = if cmd.len() == 2 {
                                 Some(cmd[1].clone())
@@ -113,10 +209,14 @@ impl Cmd {
                             Cmd::Info(section)
                         }
                         "del" => {
-                            if cmd.len() != 2 {
-                                return Err(DBError(format!("unsupported cmd {:?}", cmd)));
+                            if cmd.len() < 2 {
+                                return Err(DBError(format!("wrong number of arguments for DEL command")));
                             }
+                            if cmd.len() == 2 {
                                 Cmd::Del(cmd[1].clone())
+                            } else {
+                                Cmd::DelMulti(cmd[1..].to_vec())
+                            }
                         }
                         "type" => {
                             if cmd.len() != 2 {
@@ -210,6 +310,20 @@ impl Cmd {
                             }
                             Cmd::HSetNx(cmd[1].clone(), cmd[2].clone(), cmd[3].clone())
                         }
+                        "hincrby" => {
+                            if cmd.len() != 4 {
+                                return Err(DBError(format!("wrong number of arguments for HINCRBY command")));
+                            }
+                            let delta = cmd[3].parse::<i64>().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?;
+                            Cmd::HIncrBy(cmd[1].clone(), cmd[2].clone(), delta)
+                        }
+                        "hincrbyfloat" => {
+                            if cmd.len() != 4 {
+                                return Err(DBError(format!("wrong number of arguments for HINCRBYFLOAT command")));
+                            }
+                            let delta = cmd[3].parse::<f64>().map_err(|_| DBError("ERR value is not a valid float".to_string()))?;
+                            Cmd::HIncrByFloat(cmd[1].clone(), cmd[2].clone(), delta)
+                        }
                         "hscan" => {
                             if cmd.len() < 3 {
                                 return Err(DBError(format!("wrong number of arguments for HSCAN command")));
@@ -291,11 +405,49 @@ impl Cmd {
                             }
                             Cmd::Ttl(cmd[1].clone())
                         }
-                        "exists" => {
+                        "expire" => {
+                            if cmd.len() != 3 {
+                                return Err(DBError("wrong number of arguments for EXPIRE command".to_string()));
+                            }
+                            let secs = cmd[2].parse::<i64>().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?;
+                            Cmd::Expire(cmd[1].clone(), secs)
+                        }
+                        "pexpire" => {
+                            if cmd.len() != 3 {
+                                return Err(DBError("wrong number of arguments for PEXPIRE command".to_string()));
+                            }
+                            let ms = cmd[2].parse::<i64>().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?;
+                            Cmd::PExpire(cmd[1].clone(), ms)
+                        }
+                        "expireat" => {
+                            if cmd.len() != 3 {
+                                return Err(DBError("wrong number of arguments for EXPIREAT command".to_string()));
+                            }
+                            let ts = cmd[2].parse::<i64>().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?;
+                            Cmd::ExpireAt(cmd[1].clone(), ts)
+                        }
+                        "pexpireat" => {
+                            if cmd.len() != 3 {
+                                return Err(DBError("wrong number of arguments for PEXPIREAT command".to_string()));
+                            }
+                            let ts_ms = cmd[2].parse::<i64>().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?;
+                            Cmd::PExpireAt(cmd[1].clone(), ts_ms)
+                        }
+                        "persist" => {
                             if cmd.len() != 2 {
+                                return Err(DBError("wrong number of arguments for PERSIST command".to_string()));
+                            }
+                            Cmd::Persist(cmd[1].clone())
+                        }
+                        "exists" => {
+                            if cmd.len() < 2 {
                                 return Err(DBError(format!("wrong number of arguments for EXISTS command")));
                             }
+                            if cmd.len() == 2 {
                                 Cmd::Exists(cmd[1].clone())
+                            } else {
+                                Cmd::ExistsMulti(cmd[1..].to_vec())
+                            }
                         }
                         "quit" => {
                             if cmd.len() != 1 {
@@ -326,6 +478,10 @@ impl Cmd {
                                 Cmd::Client(vec![])
                             }
                         }
+                        "command" => {
+                            let args = if cmd.len() > 1 { cmd[1..].to_vec() } else { vec![] };
+                            Cmd::Command(args)
+                        }
                         "lpush" => {
                             if cmd.len() < 3 {
                                 return Err(DBError(format!("wrong number of arguments for LPUSH command")));
@@ -360,6 +516,28 @@ impl Cmd {
                             };
                             Cmd::RPop(cmd[1].clone(), count)
                         }
+                        "blpop" => {
+                            if cmd.len() < 3 {
+                                return Err(DBError(format!("wrong number of arguments for BLPOP command")));
+                            }
+                            // keys are all but the last argument
+                            let keys = cmd[1..cmd.len()-1].to_vec();
+                            let timeout_f = cmd[cmd.len()-1]
+                                .parse::<f64>()
+                                .map_err(|_| DBError("ERR timeout is not a number".to_string()))?;
+                            Cmd::BLPop(keys, timeout_f)
+                        }
+                        "brpop" => {
+                            if cmd.len() < 3 {
+                                return Err(DBError(format!("wrong number of arguments for BRPOP command")));
+                            }
+                            // keys are all but the last argument
+                            let keys = cmd[1..cmd.len()-1].to_vec();
+                            let timeout_f = cmd[cmd.len()-1]
+                                .parse::<f64>()
+                                .map_err(|_| DBError("ERR timeout is not a number".to_string()))?;
+                            Cmd::BRPop(keys, timeout_f)
+                        }
                         "llen" => {
                             if cmd.len() != 2 {
                                 return Err(DBError(format!("wrong number of arguments for LLEN command")));
@@ -402,6 +580,43 @@ impl Cmd {
                             }
                             Cmd::FlushDb
                         }
+                        "age" => {
+                            if cmd.len() < 2 {
+                                return Err(DBError("wrong number of arguments for AGE".to_string()));
+                            }
+                            match cmd[1].to_lowercase().as_str() {
+                                // stateless
+                                "genenc"   => { if cmd.len() != 2 { return Err(DBError("AGE GENENC takes no args".to_string())); }
+                                                Cmd::AgeGenEnc }
+                                "gensign"  => { if cmd.len() != 2 { return Err(DBError("AGE GENSIGN takes no args".to_string())); }
+                                                Cmd::AgeGenSign }
+                                "encrypt"  => { if cmd.len() != 4 { return Err(DBError("AGE ENCRYPT <recipient> <message>".to_string())); }
+                                                Cmd::AgeEncrypt(cmd[2].clone(), cmd[3].clone()) }
+                                "decrypt"  => { if cmd.len() != 4 { return Err(DBError("AGE DECRYPT <identity> <ciphertext_b64>".to_string())); }
+                                                Cmd::AgeDecrypt(cmd[2].clone(), cmd[3].clone()) }
+                                "sign"     => { if cmd.len() != 4 { return Err(DBError("AGE SIGN <signing_secret> <message>".to_string())); }
+                                                Cmd::AgeSign(cmd[2].clone(), cmd[3].clone()) }
+                                "verify"   => { if cmd.len() != 5 { return Err(DBError("AGE VERIFY <verify_pub> <message> <signature_b64>".to_string())); }
+                                                Cmd::AgeVerify(cmd[2].clone(), cmd[3].clone(), cmd[4].clone()) }
+
+                                // persistent names
+                                "keygen"       => { if cmd.len() != 3 { return Err(DBError("AGE KEYGEN <name>".to_string())); }
+                                                     Cmd::AgeKeygen(cmd[2].clone()) }
+                                "signkeygen"   => { if cmd.len() != 3 { return Err(DBError("AGE SIGNKEYGEN <name>".to_string())); }
+                                                     Cmd::AgeSignKeygen(cmd[2].clone()) }
+                                "encryptname"  => { if cmd.len() != 4 { return Err(DBError("AGE ENCRYPTNAME <name> <message>".to_string())); }
+                                                     Cmd::AgeEncryptName(cmd[2].clone(), cmd[3].clone()) }
+                                "decryptname"  => { if cmd.len() != 4 { return Err(DBError("AGE DECRYPTNAME <name> <ciphertext_b64>".to_string())); }
+                                                     Cmd::AgeDecryptName(cmd[2].clone(), cmd[3].clone()) }
+                                "signname"     => { if cmd.len() != 4 { return Err(DBError("AGE SIGNNAME <name> <message>".to_string())); }
+                                                     Cmd::AgeSignName(cmd[2].clone(), cmd[3].clone()) }
+                                "verifyname"   => { if cmd.len() != 5 { return Err(DBError("AGE VERIFYNAME <name> <message> <signature_b64>".to_string())); }
+                                                     Cmd::AgeVerifyName(cmd[2].clone(), cmd[3].clone(), cmd[4].clone()) }
+                                "list"         => { if cmd.len() != 2 { return Err(DBError("AGE LIST".to_string())); }
+                                                     Cmd::AgeList }
+                                _ => return Err(DBError(format!("unsupported AGE subcommand {:?}", cmd))),
+                            }
+                        }
                         _ => Cmd::Unknow(cmd[0].clone()),
                     },
                     protocol,
@@ -435,9 +650,14 @@ impl Cmd {
             Cmd::Set(k, v) => set_cmd(server, &k, &v).await,
             Cmd::SetPx(k, v, x) => set_px_cmd(server, &k, &v, &x).await,
             Cmd::SetEx(k, v, x) => set_ex_cmd(server, &k, &v, &x).await,
+            Cmd::SetOpts(k, v, ex_ms, nx, xx, getflag) => set_with_opts_cmd(server, &k, &v, ex_ms, nx, xx, getflag).await,
+            Cmd::MGet(keys) => mget_cmd(server, &keys).await,
+            Cmd::MSet(pairs) => mset_cmd(server, &pairs).await,
             Cmd::Del(k) => del_cmd(server, &k).await,
+            Cmd::DelMulti(keys) => del_multi_cmd(server, &keys).await,
             Cmd::ConfigGet(name) => config_get_cmd(&name, server),
             Cmd::Keys => keys_cmd(server).await,
+            Cmd::DbSize => dbsize_cmd(server).await,
             Cmd::Info(section) => info_cmd(server, &section).await,
             Cmd::Type(k) => type_cmd(server, &k).await,
             Cmd::Incr(key) => incr_cmd(server, &key).await,
@@ -465,25 +685,52 @@ impl Cmd {
             Cmd::HLen(key) => hlen_cmd(server, &key).await,
             Cmd::HMGet(key, fields) => hmget_cmd(server, &key, &fields).await,
             Cmd::HSetNx(key, field, value) => hsetnx_cmd(server, &key, &field, &value).await,
+            Cmd::HIncrBy(key, field, delta) => hincrby_cmd(server, &key, &field, delta).await,
+            Cmd::HIncrByFloat(key, field, delta) => hincrbyfloat_cmd(server, &key, &field, delta).await,
             Cmd::HScan(key, cursor, pattern, count) => hscan_cmd(server, &key, &cursor, pattern.as_deref(), &count).await,
             Cmd::Scan(cursor, pattern, count) => scan_cmd(server, &cursor, pattern.as_deref(), &count).await,
             Cmd::Ttl(key) => ttl_cmd(server, &key).await,
+            Cmd::Expire(key, secs) => expire_cmd(server, &key, secs).await,
+            Cmd::PExpire(key, ms) => pexpire_cmd(server, &key, ms).await,
+            Cmd::ExpireAt(key, ts_secs) => expireat_cmd(server, &key, ts_secs).await,
+            Cmd::PExpireAt(key, ts_ms) => pexpireat_cmd(server, &key, ts_ms).await,
+            Cmd::Persist(key) => persist_cmd(server, &key).await,
             Cmd::Exists(key) => exists_cmd(server, &key).await,
+            Cmd::ExistsMulti(keys) => exists_multi_cmd(server, &keys).await,
             Cmd::Quit => Ok(Protocol::SimpleString("OK".to_string())),
             Cmd::Client(_) => Ok(Protocol::SimpleString("OK".to_string())),
             Cmd::ClientSetName(name) => client_setname_cmd(server, &name).await,
             Cmd::ClientGetName => client_getname_cmd(server).await,
+            Cmd::Command(args) => command_cmd(&args),
             // List commands
             Cmd::LPush(key, elements) => lpush_cmd(server, &key, &elements).await,
             Cmd::RPush(key, elements) => rpush_cmd(server, &key, &elements).await,
             Cmd::LPop(key, count) => lpop_cmd(server, &key, &count).await,
             Cmd::RPop(key, count) => rpop_cmd(server, &key, &count).await,
+            Cmd::BLPop(keys, timeout) => blpop_cmd(server, &keys, timeout).await,
+            Cmd::BRPop(keys, timeout) => brpop_cmd(server, &keys, timeout).await,
             Cmd::LLen(key) => llen_cmd(server, &key).await,
             Cmd::LRem(key, count, element) => lrem_cmd(server, &key, count, &element).await,
             Cmd::LTrim(key, start, stop) => ltrim_cmd(server, &key, start, stop).await,
             Cmd::LIndex(key, index) => lindex_cmd(server, &key, index).await,
             Cmd::LRange(key, start, stop) => lrange_cmd(server, &key, start, stop).await,
             Cmd::FlushDb => flushdb_cmd(server).await,
+            // AGE (rage): stateless
+            Cmd::AgeGenEnc => Ok(crate::age::cmd_age_genenc().await),
+            Cmd::AgeGenSign => Ok(crate::age::cmd_age_gensign().await),
+            Cmd::AgeEncrypt(recipient, message) => Ok(crate::age::cmd_age_encrypt(&recipient, &message).await),
+            Cmd::AgeDecrypt(identity, ct_b64) => Ok(crate::age::cmd_age_decrypt(&identity, &ct_b64).await),
+            Cmd::AgeSign(secret, message) => Ok(crate::age::cmd_age_sign(&secret, &message).await),
+            Cmd::AgeVerify(vpub, msg, sig_b64) => Ok(crate::age::cmd_age_verify(&vpub, &msg, &sig_b64).await),
+
+            // AGE (rage): persistent named keys
+            Cmd::AgeKeygen(name) => Ok(crate::age::cmd_age_keygen(server, &name).await),
+            Cmd::AgeSignKeygen(name) => Ok(crate::age::cmd_age_signkeygen(server, &name).await),
+            Cmd::AgeEncryptName(name, message) => Ok(crate::age::cmd_age_encrypt_name(server, &name, &message).await),
+            Cmd::AgeDecryptName(name, ct_b64) => Ok(crate::age::cmd_age_decrypt_name(server, &name, &ct_b64).await),
+            Cmd::AgeSignName(name, message) => Ok(crate::age::cmd_age_sign_name(server, &name, &message).await),
+            Cmd::AgeVerifyName(name, message, sig_b64) => Ok(crate::age::cmd_age_verify_name(server, &name, &message, &sig_b64).await),
+            Cmd::AgeList => Ok(crate::age::cmd_age_list(server).await),
             Cmd::Unknow(s) => Ok(Protocol::err(&format!("ERR unknown command `{}`", s))),
         }
     }
@@ -553,55 +800,227 @@ async fn llen_cmd(server: &Server, key: &str) -> Result<Protocol, DBError> {
 }
 
 async fn lpop_cmd(server: &Server, key: &str, count: &Option<u64>) -> Result<Protocol, DBError> {
-    match server.current_storage()?.lpop(key, *count) {
-        Ok(Some(elements)) => {
-            if count.is_some() {
-                Ok(Protocol::Array(elements.into_iter().map(Protocol::BulkString).collect()))
-            } else {
-                Ok(Protocol::BulkString(elements[0].clone()))
-            }
-        },
-        Ok(None) => {
+    let count_val = count.unwrap_or(1);
+    match server.current_storage()?.lpop(key, count_val) {
+        Ok(elements) => {
+            if elements.is_empty() {
                 if count.is_some() {
                     Ok(Protocol::Array(vec![]))
                 } else {
                     Ok(Protocol::Null)
                 }
+            } else if count.is_some() {
+                Ok(Protocol::Array(elements.into_iter().map(Protocol::BulkString).collect()))
+            } else {
+                Ok(Protocol::BulkString(elements[0].clone()))
+            }
         },
         Err(e) => Ok(Protocol::err(&e.0)),
     }
 }
 
 async fn rpop_cmd(server: &Server, key: &str, count: &Option<u64>) -> Result<Protocol, DBError> {
-    match server.current_storage()?.rpop(key, *count) {
-        Ok(Some(elements)) => {
-            if count.is_some() {
-                Ok(Protocol::Array(elements.into_iter().map(Protocol::BulkString).collect()))
-            } else {
-                Ok(Protocol::BulkString(elements[0].clone()))
-            }
-        },
-        Ok(None) => {
+    let count_val = count.unwrap_or(1);
+    match server.current_storage()?.rpop(key, count_val) {
+        Ok(elements) => {
+            if elements.is_empty() {
                 if count.is_some() {
                     Ok(Protocol::Array(vec![]))
                 } else {
                     Ok(Protocol::Null)
                 }
+            } else if count.is_some() {
+                Ok(Protocol::Array(elements.into_iter().map(Protocol::BulkString).collect()))
+            } else {
+                Ok(Protocol::BulkString(elements[0].clone()))
+            }
         },
         Err(e) => Ok(Protocol::err(&e.0)),
     }
 }
 
+// BLPOP implementation
+async fn blpop_cmd(server: &Server, keys: &[String], timeout_secs: f64) -> Result<Protocol, DBError> {
+    // Immediate, non-blocking attempt in key order
+    for k in keys {
+        let elems = server.current_storage()?.lpop(k, 1)?;
+        if !elems.is_empty() {
+            return Ok(Protocol::Array(vec![
+                Protocol::BulkString(k.clone()),
+                Protocol::BulkString(elems[0].clone()),
+            ]));
+        }
+    }
+
+    // If timeout is zero, return immediately with Null
+    if timeout_secs <= 0.0 {
+        return Ok(Protocol::Null);
+    }
+
+    // Register waiters for each key
+    let db_index = server.selected_db;
+    let mut ids: Vec<u64> = Vec::with_capacity(keys.len());
+    let mut names: Vec<String> = Vec::with_capacity(keys.len());
+    let mut rxs: Vec<tokio::sync::oneshot::Receiver<(String, String)>> = Vec::with_capacity(keys.len());
+
+    for k in keys {
+        let (id, rx) = server.register_waiter(db_index, k, crate::server::PopSide::Left).await;
+        ids.push(id);
+        names.push(k.clone());
+        rxs.push(rx);
+    }
+
+    // Wait for the first delivery or timeout
+    let wait_fut = async move {
+        let mut futures_vec = rxs;
+        loop {
+            if futures_vec.is_empty() {
+                return None;
+            }
+            let (res, idx, remaining) = select_all(futures_vec).await;
+            match res {
+                Ok((k, elem)) => {
+                    return Some((k, elem, idx, remaining));
+                }
+                Err(_canceled) => {
+                    // That waiter was canceled; continue with the rest
+                    futures_vec = remaining;
+                    continue;
+                }
+            }
+        }
+    };
+
+    match timeout(Duration::from_secs_f64(timeout_secs), wait_fut).await {
+        Ok(Some((k, elem, idx, _remaining))) => {
+            // Unregister other waiters
+            for (i, key_name) in names.iter().enumerate() {
+                if i != idx {
+                    server.unregister_waiter(db_index, key_name, ids[i]).await;
+                }
+            }
+            Ok(Protocol::Array(vec![
+                Protocol::BulkString(k),
+                Protocol::BulkString(elem),
+            ]))
+        }
+        Ok(None) => {
+            // No futures left; unregister all waiters
+            for (i, key_name) in names.iter().enumerate() {
+                server.unregister_waiter(db_index, key_name, ids[i]).await;
+            }
+            Ok(Protocol::Null)
+        }
+        Err(_elapsed) => {
+            // Timeout: unregister all waiters
+            for (i, key_name) in names.iter().enumerate() {
+                server.unregister_waiter(db_index, key_name, ids[i]).await;
+            }
+            Ok(Protocol::Null)
+        }
+    }
+}
+
+// BRPOP implementation (mirror of BLPOP, popping from the right)
+async fn brpop_cmd(server: &Server, keys: &[String], timeout_secs: f64) -> Result<Protocol, DBError> {
+    // Immediate, non-blocking attempt in key order using RPOP
+    for k in keys {
+        let elems = server.current_storage()?.rpop(k, 1)?;
+        if !elems.is_empty() {
+            return Ok(Protocol::Array(vec![
+                Protocol::BulkString(k.clone()),
+                Protocol::BulkString(elems[0].clone()),
+            ]));
+        }
+    }
+
+    // If timeout is zero, return immediately with Null
+    if timeout_secs <= 0.0 {
+        return Ok(Protocol::Null);
+    }
+
+    // Register waiters for each key (Right side)
+    let db_index = server.selected_db;
+    let mut ids: Vec<u64> = Vec::with_capacity(keys.len());
+    let mut names: Vec<String> = Vec::with_capacity(keys.len());
+    let mut rxs: Vec<tokio::sync::oneshot::Receiver<(String, String)>> = Vec::with_capacity(keys.len());
+
+    for k in keys {
+        let (id, rx) = server.register_waiter(db_index, k, crate::server::PopSide::Right).await;
+        ids.push(id);
+        names.push(k.clone());
+        rxs.push(rx);
+    }
+
+    // Wait for the first delivery or timeout
+    let wait_fut = async move {
+        let mut futures_vec = rxs;
+        loop {
+            if futures_vec.is_empty() {
+                return None;
+            }
+            let (res, idx, remaining) = select_all(futures_vec).await;
+            match res {
+                Ok((k, elem)) => {
+                    return Some((k, elem, idx, remaining));
+                }
+                Err(_canceled) => {
+                    // That waiter was canceled; continue with the rest
+                    futures_vec = remaining;
+                    continue;
+                }
+            }
+        }
+    };
+
+    match timeout(Duration::from_secs_f64(timeout_secs), wait_fut).await {
+        Ok(Some((k, elem, idx, _remaining))) => {
+            // Unregister other waiters
+            for (i, key_name) in names.iter().enumerate() {
+                if i != idx {
+                    server.unregister_waiter(db_index, key_name, ids[i]).await;
+                }
+            }
+            Ok(Protocol::Array(vec![
+                Protocol::BulkString(k),
+                Protocol::BulkString(elem),
+            ]))
+        }
+        Ok(None) => {
+            // No futures left; unregister all waiters
+            for (i, key_name) in names.iter().enumerate() {
+                server.unregister_waiter(db_index, key_name, ids[i]).await;
+            }
+            Ok(Protocol::Null)
+        }
+        Err(_elapsed) => {
+            // Timeout: unregister all waiters
+            for (i, key_name) in names.iter().enumerate() {
+                server.unregister_waiter(db_index, key_name, ids[i]).await;
+            }
+            Ok(Protocol::Null)
+        }
+    }
+}
+
 async fn lpush_cmd(server: &Server, key: &str, elements: &[String]) -> Result<Protocol, DBError> {
     match server.current_storage()?.lpush(key, elements.to_vec()) {
-        Ok(len) => Ok(Protocol::SimpleString(len.to_string())),
+        Ok(len) => {
+            // Attempt to deliver to any blocked BLPOP waiters
+            let _ = server.drain_waiters_after_push(key).await;
+            Ok(Protocol::SimpleString(len.to_string()))
+        }
         Err(e) => Ok(Protocol::err(&e.0)),
     }
 }
 
 async fn rpush_cmd(server: &Server, key: &str, elements: &[String]) -> Result<Protocol, DBError> {
     match server.current_storage()?.rpush(key, elements.to_vec()) {
-        Ok(len) => Ok(Protocol::SimpleString(len.to_string())),
+        Ok(len) => {
+            // Attempt to deliver to any blocked BLPOP waiters
+            let _ = server.drain_waiters_after_push(key).await;
+            Ok(Protocol::SimpleString(len.to_string()))
+        }
         Err(e) => Ok(Protocol::err(&e.0)),
     }
 }
@@ -667,6 +1086,13 @@ async fn keys_cmd(server: &Server) -> Result<Protocol, DBError> {
     ))
 }
 
+async fn dbsize_cmd(server: &Server) -> Result<Protocol, DBError> {
+    match server.current_storage()?.dbsize() {
+        Ok(n) => Ok(Protocol::SimpleString(n.to_string())),
+        Err(e) => Ok(Protocol::err(&e.0)),
+    }
+}
+
 #[derive(Serialize)]
 struct ServerInfo {
     redis_version: String,
@@ -688,18 +1114,20 @@ async fn info_cmd(server: &Server, section: &Option<String>) -> Result<Protocol,
     info_string.push_str(&format!("# Keyspace\n"));
     info_string.push_str(&format!("db{}:keys=0,expires=0,avg_ttl=0\n", info.selected_db));
 
-
     match section {
-        Some(s) => match s.as_str() {
-            "replication" => Ok(Protocol::BulkString(
+        Some(s) => {
+            let sl = s.to_lowercase();
+            if sl == "replication" {
+                Ok(Protocol::BulkString(
                     "role:master\nmaster_replid:8371b4fb1155b71f4a04d3e1bc3e18c4a990aeea\nmaster_repl_offset:0\n".to_string()
-            )),
-            _ => Err(DBError(format!("unsupported section {:?}", s))),
-        },
-        None => {
+                ))
+            } else {
+                // Return general info for unknown sections (e.g., SERVER)
                 Ok(Protocol::BulkString(info_string))
             }
         }
+        None => Ok(Protocol::BulkString(info_string)),
+    }
 }
 
 async fn type_cmd(server: &Server, k: &String) -> Result<Protocol, DBError> {
@@ -739,6 +1167,109 @@ async fn set_cmd(server: &Server, k: &str, v: &str) -> Result<Protocol, DBError>
     Ok(Protocol::SimpleString("OK".to_string()))
 }
 
+// Advanced SET with options: EX/PX/NX/XX/GET
+async fn set_with_opts_cmd(
+    server: &Server,
+    key: &str,
+    value: &str,
+    ex_ms: Option<u128>,
+    nx: bool,
+    xx: bool,
+    get_old: bool,
+) -> Result<Protocol, DBError> {
+    let storage = server.current_storage()?;
+
+    // Determine existence (for NX/XX)
+    let exists = storage.exists(key)?;
+
+    // If both NX and XX, condition can never be satisfied -> no-op
+    let mut should_set = true;
+    if nx && exists {
+        should_set = false;
+    }
+    if xx && !exists {
+        should_set = false;
+    }
+
+    // Fetch old value if needed for GET
+    let old_val = if get_old {
+        storage.get(key)?
+    } else {
+        None
+    };
+
+    if should_set {
+        if let Some(ms) = ex_ms {
+            storage.setx(key.to_string(), value.to_string(), ms)?;
+        } else {
+            storage.set(key.to_string(), value.to_string())?;
+        }
+    }
+
+    if get_old {
+        // Return previous value (or Null), regardless of NX/XX outcome only if set executed?
+        // We follow Redis semantics: return old value if set executed, else Null
+        if should_set {
+            Ok(old_val.map_or(Protocol::Null, Protocol::BulkString))
+        } else {
+            Ok(Protocol::Null)
+        }
+    } else {
+        if should_set {
+            Ok(Protocol::SimpleString("OK".to_string()))
+        } else {
+            Ok(Protocol::Null)
+        }
+    }
+}
+
+// MGET: return array of bulk strings or Null for missing
+async fn mget_cmd(server: &Server, keys: &[String]) -> Result<Protocol, DBError> {
+    let mut out: Vec<Protocol> = Vec::with_capacity(keys.len());
+    let storage = server.current_storage()?;
+    for k in keys {
+        match storage.get(k)? {
+            Some(v) => out.push(Protocol::BulkString(v)),
+            None => out.push(Protocol::Null),
+        }
+    }
+    Ok(Protocol::Array(out))
+}
+
+// MSET: set multiple key/value pairs, return OK
+async fn mset_cmd(server: &Server, pairs: &[(String, String)]) -> Result<Protocol, DBError> {
+    let storage = server.current_storage()?;
+    for (k, v) in pairs {
+        storage.set(k.clone(), v.clone())?;
+    }
+    Ok(Protocol::SimpleString("OK".to_string()))
+}
+
+// DEL with multiple keys: return count of keys actually deleted
+async fn del_multi_cmd(server: &Server, keys: &[String]) -> Result<Protocol, DBError> {
+    let storage = server.current_storage()?;
+    let mut deleted = 0i64;
+    for k in keys {
+        if storage.exists(k)? {
+            storage.del(k.clone())?;
+            deleted += 1;
+        }
+    }
+    Ok(Protocol::SimpleString(deleted.to_string()))
+}
+
+// EXISTS with multiple keys: return count existing
+async fn exists_multi_cmd(server: &Server, keys: &[String]) -> Result<Protocol, DBError> {
+    let storage = server.current_storage()?;
+    let mut count = 0i64;
+    for k in keys {
+        if storage.exists(k)? {
+            count += 1;
+        }
+    }
+    Ok(Protocol::SimpleString(count.to_string()))
+}
+
 async fn get_cmd(server: &Server, k: &str) -> Result<Protocol, DBError> {
     let v = server.current_storage()?.get(k)?;
     Ok(v.map_or(Protocol::Null, Protocol::BulkString))
@@ -746,7 +1277,7 @@ async fn get_cmd(server: &Server, k: &str) -> Result<Protocol, DBError> {
 
 // Hash command implementations
 async fn hset_cmd(server: &Server, key: &str, pairs: &[(String, String)]) -> Result<Protocol, DBError> {
-    let new_fields = server.current_storage()?.hset(key, pairs)?;
+    let new_fields = server.current_storage()?.hset(key, pairs.to_vec())?;
     Ok(Protocol::SimpleString(new_fields.to_string()))
 }
 
@@ -773,7 +1304,7 @@ async fn hgetall_cmd(server: &Server, key: &str) -> Result<Protocol, DBError> {
 }
 
 async fn hdel_cmd(server: &Server, key: &str, fields: &[String]) -> Result<Protocol, DBError> {
-    match server.current_storage()?.hdel(key, fields) {
+    match server.current_storage()?.hdel(key, fields.to_vec()) {
         Ok(deleted) => Ok(Protocol::SimpleString(deleted.to_string())),
         Err(e) => Ok(Protocol::err(&e.0)),
     }
@@ -812,7 +1343,7 @@ async fn hlen_cmd(server: &Server, key: &str) -> Result<Protocol, DBError> {
 }
 
 async fn hmget_cmd(server: &Server, key: &str, fields: &[String]) -> Result<Protocol, DBError> {
-    match server.current_storage()?.hmget(key, fields) {
+    match server.current_storage()?.hmget(key, fields.to_vec()) {
         Ok(values) => {
             let result: Vec<Protocol> = values
                 .into_iter()
@@ -831,6 +1362,32 @@ async fn hsetnx_cmd(server: &Server, key: &str, field: &str, value: &str) -> Res
     }
 }
 
+async fn hincrby_cmd(server: &Server, key: &str, field: &str, delta: i64) -> Result<Protocol, DBError> {
+    let storage = server.current_storage()?;
+    let current = storage.hget(key, field)?;
+    let base: i64 = match current {
+        Some(v) => v.parse::<i64>().map_err(|_| DBError("ERR value is not an integer or out of range".to_string()))?,
+        None => 0,
+    };
+    let new_val = base.checked_add(delta).ok_or_else(|| DBError("ERR increment or decrement would overflow".to_string()))?;
+    // Update the field
+    storage.hset(key, vec![(field.to_string(), new_val.to_string())])?;
+    Ok(Protocol::SimpleString(new_val.to_string()))
+}
+
+async fn hincrbyfloat_cmd(server: &Server, key: &str, field: &str, delta: f64) -> Result<Protocol, DBError> {
+    let storage = server.current_storage()?;
+    let current = storage.hget(key, field)?;
+    let base: f64 = match current {
+        Some(v) => v.parse::<f64>().map_err(|_| DBError("ERR value is not a valid float".to_string()))?,
+        None => 0.0,
+    };
+    let new_val = base + delta;
+    // Update the field
+    storage.hset(key, vec![(field.to_string(), new_val.to_string())])?;
+    Ok(Protocol::SimpleString(new_val.to_string()))
+}
+
 async fn scan_cmd(
     server: &Server,
     cursor: &u64,
@@ -838,10 +1395,12 @@ async fn scan_cmd(
     count: &Option<u64>
 ) -> Result<Protocol, DBError> {
     match server.current_storage()?.scan(*cursor, pattern, *count) {
-        Ok((next_cursor, keys)) => {
+        Ok((next_cursor, key_value_pairs)) => {
             let mut result = Vec::new();
             result.push(Protocol::BulkString(next_cursor.to_string()));
-            result.push(Protocol::Array(keys.into_iter().map(Protocol::BulkString).collect()));
+            // For SCAN, we only return the keys, not the values
+            let keys: Vec<Protocol> = key_value_pairs.into_iter().map(|(key, _)| Protocol::BulkString(key)).collect();
+            result.push(Protocol::Array(keys));
             Ok(Protocol::Array(result))
         }
         Err(e) => Ok(Protocol::err(&format!("ERR {}", e.0))),
@@ -856,10 +1415,16 @@ async fn hscan_cmd(
     count: &Option<u64>
 ) -> Result<Protocol, DBError> {
     match server.current_storage()?.hscan(key, *cursor, pattern, *count) {
-        Ok((next_cursor, fields)) => {
+        Ok((next_cursor, field_value_pairs)) => {
             let mut result = Vec::new();
             result.push(Protocol::BulkString(next_cursor.to_string()));
-            result.push(Protocol::Array(fields.into_iter().map(Protocol::BulkString).collect()));
+            // For HSCAN, we return field-value pairs flattened
+            let mut fields_and_values = Vec::new();
+            for (field, value) in field_value_pairs {
+                fields_and_values.push(Protocol::BulkString(field));
+                fields_and_values.push(Protocol::BulkString(value));
+            }
+            result.push(Protocol::Array(fields_and_values));
             Ok(Protocol::Array(result))
         }
         Err(e) => Ok(Protocol::err(&format!("ERR {}", e.0))),
@@ -880,6 +1445,51 @@ async fn exists_cmd(server: &Server, key: &str) -> Result<Protocol, DBError> {
     }
 }
 
+// EXPIRE key seconds -> 1 if timeout set, 0 otherwise
+async fn expire_cmd(server: &Server, key: &str, secs: i64) -> Result<Protocol, DBError> {
+    if secs < 0 {
+        return Ok(Protocol::SimpleString("0".to_string()));
+    }
+    match server.current_storage()?.expire_seconds(key, secs as u64) {
+        Ok(applied) => Ok(Protocol::SimpleString(if applied { "1" } else { "0" }.to_string())),
+        Err(e) => Ok(Protocol::err(&e.0)),
+    }
+}
+
+// PEXPIRE key milliseconds -> 1 if timeout set, 0 otherwise
+async fn pexpire_cmd(server: &Server, key: &str, ms: i64) -> Result<Protocol, DBError> {
+    if ms < 0 {
+        return Ok(Protocol::SimpleString("0".to_string()));
+    }
+    match server.current_storage()?.pexpire_millis(key, ms as u128) {
+        Ok(applied) => Ok(Protocol::SimpleString(if applied { "1" } else { "0" }.to_string())),
+        Err(e) => Ok(Protocol::err(&e.0)),
+    }
+}
+
+// PERSIST key -> 1 if timeout removed, 0 otherwise
+async fn persist_cmd(server: &Server, key: &str) -> Result<Protocol, DBError> {
+    match server.current_storage()?.persist(key) {
+        Ok(removed) => Ok(Protocol::SimpleString(if removed { "1" } else { "0" }.to_string())),
+        Err(e) => Ok(Protocol::err(&e.0)),
+    }
+}
+// EXPIREAT key timestamp-seconds -> 1 if timeout set, 0 otherwise
+async fn expireat_cmd(server: &Server, key: &str, ts_secs: i64) -> Result<Protocol, DBError> {
+    match server.current_storage()?.expire_at_seconds(key, ts_secs) {
+        Ok(applied) => Ok(Protocol::SimpleString(if applied { "1" } else { "0" }.to_string())),
+        Err(e) => Ok(Protocol::err(&e.0)),
+    }
+}
+
+// PEXPIREAT key timestamp-milliseconds -> 1 if timeout set, 0 otherwise
+async fn pexpireat_cmd(server: &Server, key: &str, ts_ms: i64) -> Result<Protocol, DBError> {
+    match server.current_storage()?.pexpire_at_millis(key, ts_ms) {
+        Ok(applied) => Ok(Protocol::SimpleString(if applied { "1" } else { "0" }.to_string())),
+        Err(e) => Ok(Protocol::err(&e.0)),
+    }
+}
+
 async fn client_setname_cmd(server: &mut Server, name: &str) -> Result<Protocol, DBError> {
     server.client_name = Some(name.to_string());
     Ok(Protocol::SimpleString("OK".to_string()))
@@ -891,3 +1501,19 @@ async fn client_getname_cmd(server: &Server) -> Result<Protocol, DBError> {
         None => Ok(Protocol::Null),
     }
 }
+
+// Minimal COMMAND subcommands stub to satisfy redis-cli probes.
+// - COMMAND DOCS ... => return empty array
+// - COMMAND INFO ... => return empty array
+// - Any other => empty array
+fn command_cmd(args: &[String]) -> Result<Protocol, DBError> {
+    if args.is_empty() {
+        return Ok(Protocol::Array(vec![]));
+    }
+    let sub = args[0].to_lowercase();
+    match sub.as_str() {
+        "docs" => Ok(Protocol::Array(vec![])),
+        "info" => Ok(Protocol::Array(vec![])),
+        _ => Ok(Protocol::Array(vec![])),
+    }
+}

herodb/src/error.rs

@@ -80,3 +80,15 @@ impl From<tokio::sync::mpsc::error::SendError<()>> for DBError {
         DBError(item.to_string().clone())
     }
 }
+
+impl From<serde_json::Error> for DBError {
+    fn from(item: serde_json::Error) -> Self {
+        DBError(item.to_string())
+    }
+}
+
+impl From<chacha20poly1305::Error> for DBError {
+    fn from(item: chacha20poly1305::Error) -> Self {
+        DBError(item.to_string())
+    }
+}

herodb/src/lib.rs

@@ -1,3 +1,4 @@
+pub mod age;   // NEW
 pub mod cmd;
 pub mod crypto;
 pub mod error;

herodb/src/main.rs

@@ -2,7 +2,7 @@
 
 use tokio::net::TcpListener;
 
-use redis_rs::server;
+use herodb::server;
 
 use clap::Parser;
 
@@ -45,7 +45,7 @@ async fn main() {
         .unwrap();
 
     // new DB option
-    let option = redis_rs::options::DBOption {
+    let option = herodb::options::DBOption {
         dir: args.dir,
         port,
         debug: args.debug,

herodb/src/protocol.rs

@@ -19,6 +19,10 @@ impl fmt::Display for Protocol {
 
 impl Protocol {
     pub fn from(protocol: &str) -> Result<(Self, &str), DBError> {
+        if protocol.is_empty() {
+            // Incomplete frame; caller should read more bytes
+            return Err(DBError("[incomplete] empty".to_string()));
+        }
         let ret = match protocol.chars().nth(0) {
             Some('+') => Self::parse_simple_string_sfx(&protocol[1..]),
             Some('$') => Self::parse_bulk_string_sfx(&protocol[1..]),
@@ -101,21 +105,20 @@ impl Protocol {
             let size = Self::parse_usize(&protocol[..len_end])?;
             let data_start = len_end + 2;
             let data_end = data_start + size;
-            let s = Self::parse_string(&protocol[data_start..data_end])?;
 
-            if protocol.len() < data_end + 2 || &protocol[data_end..data_end+2] != "\r\n" {
-                 Err(DBError(format!(
-                    "[new bulk string] unmatched string length in prototocl {:?}",
-                    protocol,
-                )))
-            } else {
-                Ok((Protocol::BulkString(s), &protocol[data_end + 2..]))
+            // If we don't yet have the full bulk payload + trailing CRLF, signal INCOMPLETE
+            if protocol.len() < data_end + 2 {
+                return Err(DBError("[incomplete] bulk body".to_string()));
             }
+            if &protocol[data_end..data_end + 2] != "\r\n" {
+                return Err(DBError("[incomplete] bulk terminator".to_string()));
+            }
+
+            let s = Self::parse_string(&protocol[data_start..data_end])?;
+            Ok((Protocol::BulkString(s), &protocol[data_end + 2..]))
         } else {
-            Err(DBError(format!(
-                "[new bulk string] unsupported protocol: {:?}",
-                protocol
-            )))
+            // No CRLF after bulk length header yet
+            Err(DBError("[incomplete] bulk header".to_string()))
         }
     }
 
@@ -125,16 +128,25 @@ impl Protocol {
             let mut remaining = &s[len_end + 2..];
             let mut vec = vec![];
             for _ in 0..array_len {
-                let (p, rem) = Protocol::from(remaining)?;
+                match Protocol::from(remaining) {
+                    Ok((p, rem)) => {
                         vec.push(p);
                         remaining = rem;
                     }
+                    Err(e) => {
+                        // Propagate incomplete so caller can read more bytes
+                        if e.0.starts_with("[incomplete]") {
+                            return Err(e);
+                        } else {
+                            return Err(e);
+                        }
+                    }
+                }
+            }
             Ok((Protocol::Array(vec), remaining))
         } else {
-            Err(DBError(format!(
-                "[new array] unsupported protocol: {:?}",
-                s
-            )))
+            // No CRLF after array header yet
+            Err(DBError("[incomplete] array header".to_string()))
         }
     }
 

herodb/src/server.rs

@@ -0,0 +1,250 @@
+use core::str;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::io::AsyncReadExt;
+use tokio::io::AsyncWriteExt;
+use tokio::sync::{Mutex, oneshot};
+
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use crate::cmd::Cmd;
+use crate::error::DBError;
+use crate::options;
+use crate::protocol::Protocol;
+use crate::storage::Storage;
+
+#[derive(Clone)]
+pub struct Server {
+    pub db_cache: std::sync::Arc<std::sync::RwLock<HashMap<u64, Arc<Storage>>>>,
+    pub option: options::DBOption,
+    pub client_name: Option<String>,
+    pub selected_db: u64, // Changed from usize to u64
+    pub queued_cmd: Option<Vec<(Cmd, Protocol)>>,
+
+    // BLPOP waiter registry: per (db_index, key) FIFO of waiters
+    pub list_waiters: Arc<Mutex<HashMap<u64, HashMap<String, Vec<Waiter>>>>>,
+    pub waiter_seq: Arc<AtomicU64>,
+}
+
+pub struct Waiter {
+    pub id: u64,
+    pub side: PopSide,
+    pub tx: oneshot::Sender<(String, String)>, // (key, element)
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PopSide {
+    Left,
+    Right,
+}
+
+impl Server {
+    pub async fn new(option: options::DBOption) -> Self {
+        Server {
+            db_cache: Arc::new(std::sync::RwLock::new(HashMap::new())),
+            option,
+            client_name: None,
+            selected_db: 0,
+            queued_cmd: None,
+
+            list_waiters: Arc::new(Mutex::new(HashMap::new())),
+            waiter_seq: Arc::new(AtomicU64::new(1)),
+        }
+    }
+
+    pub fn current_storage(&self) -> Result<Arc<Storage>, DBError> {
+        let mut cache = self.db_cache.write().unwrap();
+        
+        if let Some(storage) = cache.get(&self.selected_db) {
+            return Ok(storage.clone());
+        }
+        
+        
+        // Create new database file
+        let db_file_path = std::path::PathBuf::from(self.option.dir.clone())
+            .join(format!("{}.db", self.selected_db));
+        
+        // Ensure the directory exists before creating the database file
+        if let Some(parent_dir) = db_file_path.parent() {
+            std::fs::create_dir_all(parent_dir).map_err(|e| {
+                DBError(format!("Failed to create directory {}: {}", parent_dir.display(), e))
+            })?;
+        }
+        
+        println!("Creating new db file: {}", db_file_path.display());
+        
+        let storage = Arc::new(Storage::new(
+            db_file_path,
+            self.should_encrypt_db(self.selected_db),
+            self.option.encryption_key.as_deref()
+        )?);
+        
+        cache.insert(self.selected_db, storage.clone());
+        Ok(storage)
+    }
+    
+    fn should_encrypt_db(&self, db_index: u64) -> bool {
+        // DB 0-9 are non-encrypted, DB 10+ are encrypted
+        self.option.encrypt && db_index >= 10
+    }
+
+    // ----- BLPOP waiter helpers -----
+
+    pub async fn register_waiter(&self, db_index: u64, key: &str, side: PopSide) -> (u64, oneshot::Receiver<(String, String)>) {
+        let id = self.waiter_seq.fetch_add(1, Ordering::Relaxed);
+        let (tx, rx) = oneshot::channel::<(String, String)>();
+
+        let mut guard = self.list_waiters.lock().await;
+        let per_db = guard.entry(db_index).or_insert_with(HashMap::new);
+        let q = per_db.entry(key.to_string()).or_insert_with(Vec::new);
+        q.push(Waiter { id, side, tx });
+        (id, rx)
+    }
+
+    pub async fn unregister_waiter(&self, db_index: u64, key: &str, id: u64) {
+        let mut guard = self.list_waiters.lock().await;
+        if let Some(per_db) = guard.get_mut(&db_index) {
+            if let Some(q) = per_db.get_mut(key) {
+                q.retain(|w| w.id != id);
+                if q.is_empty() {
+                    per_db.remove(key);
+                }
+            }
+            if per_db.is_empty() {
+                guard.remove(&db_index);
+            }
+        }
+    }
+
+    // Called after LPUSH/RPUSH to deliver to blocked BLPOP waiters.
+    pub async fn drain_waiters_after_push(&self, key: &str) -> Result<(), DBError> {
+        let db_index = self.selected_db;
+
+        loop {
+            // Check if any waiter exists
+            let maybe_waiter = {
+                let mut guard = self.list_waiters.lock().await;
+                if let Some(per_db) = guard.get_mut(&db_index) {
+                    if let Some(q) = per_db.get_mut(key) {
+                        if !q.is_empty() {
+                            // Pop FIFO
+                            Some(q.remove(0))
+                        } else {
+                            None
+                        }
+                    } else {
+                        None
+                    }
+                } else {
+                    None
+                }
+            };
+
+            let waiter = if let Some(w) = maybe_waiter { w } else { break };
+
+            // Pop one element depending on waiter side
+            let elems = match waiter.side {
+                PopSide::Left => self.current_storage()?.lpop(key, 1)?,
+                PopSide::Right => self.current_storage()?.rpop(key, 1)?,
+            };
+            if elems.is_empty() {
+                // Nothing to deliver; re-register waiter at the front to preserve order
+                let mut guard = self.list_waiters.lock().await;
+                let per_db = guard.entry(db_index).or_insert_with(HashMap::new);
+                let q = per_db.entry(key.to_string()).or_insert_with(Vec::new);
+                q.insert(0, waiter);
+                break;
+            } else {
+                let elem = elems[0].clone();
+                // Send to waiter; if receiver dropped, just continue
+                let _ = waiter.tx.send((key.to_string(), elem));
+                // Loop to try to satisfy more waiters if more elements remain
+                continue;
+            }
+        }
+
+        Ok(())
+    }
+
+    pub async fn handle(
+        &mut self,
+        mut stream: tokio::net::TcpStream,
+    ) -> Result<(), DBError> {
+        // Accumulate incoming bytes to handle partial RESP frames
+        let mut acc = String::new();
+        let mut buf = vec![0u8; 8192];
+
+        loop {
+            let n = match stream.read(&mut buf).await {
+                Ok(0) => {
+                    println!("[handle] connection closed");
+                    return Ok(());
+                }
+                Ok(n) => n,
+                Err(e) => {
+                    println!("[handle] read error: {:?}", e);
+                    return Err(e.into());
+                }
+            };
+
+            // Append to accumulator. RESP for our usage is ASCII-safe.
+            acc.push_str(str::from_utf8(&buf[..n])?);
+
+            // Try to parse as many complete commands as are available in 'acc'.
+            loop {
+                let parsed = Cmd::from(&acc);
+                let (cmd, protocol, remaining) = match parsed {
+                    Ok((cmd, protocol, remaining)) => (cmd, protocol, remaining),
+                    Err(_e) => {
+                        // Incomplete or invalid frame; assume incomplete and wait for more data.
+                        // This avoids emitting spurious protocol_error for split frames.
+                        break;
+                    }
+                };
+
+                // Advance the accumulator to the unparsed remainder
+                acc = remaining.to_string();
+
+                if self.option.debug {
+                    println!("\x1b[34;1mgot command: {:?}, protocol: {:?}\x1b[0m", cmd, protocol);
+                } else {
+                    println!("got command: {:?}, protocol: {:?}", cmd, protocol);
+                }
+
+                // Check if this is a QUIT command before processing
+                let is_quit = matches!(cmd, Cmd::Quit);
+
+                let res = match cmd.run(self).await {
+                    Ok(p) => p,
+                    Err(e) => {
+                        if self.option.debug {
+                            eprintln!("[run error] {:?}", e);
+                        }
+                        Protocol::err(&format!("ERR {}", e.0))
+                    }
+                };
+
+                if self.option.debug {
+                    println!("\x1b[34;1mqueued cmd {:?}\x1b[0m", self.queued_cmd);
+                    println!("\x1b[32;1mgoing to send response {}\x1b[0m", res.encode());
+                } else {
+                    print!("queued cmd {:?}", self.queued_cmd);
+                    println!("going to send response {}", res.encode());
+                }
+
+                _ = stream.write(res.encode().as_bytes()).await?;
+
+                // If this was a QUIT command, close the connection
+                if is_quit {
+                    println!("[handle] QUIT command received, closing connection");
+                    return Ok(());
+                }
+
+                // Continue parsing any further complete commands already in 'acc'
+                if acc.is_empty() {
+                    break;
+                }
+            }
+        }
+    }
+}

herodb/src/storage/mod.rs

@@ -0,0 +1,126 @@
+use std::{
+    path::Path,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use redb::{Database, TableDefinition};
+use serde::{Deserialize, Serialize};
+
+use crate::crypto::CryptoFactory;
+use crate::error::DBError;
+
+// Re-export modules
+mod storage_basic;
+mod storage_hset;
+mod storage_lists;
+mod storage_extra;
+
+// Re-export implementations
+// Note: These imports are used by the impl blocks in the submodules
+// The compiler shows them as unused because they're not directly used in this file
+// but they're needed for the Storage struct methods to be available
+pub use storage_extra::*;
+
+// Table definitions for different Redis data types
+const TYPES_TABLE: TableDefinition<&str, &str> = TableDefinition::new("types");
+const STRINGS_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("strings");
+const HASHES_TABLE: TableDefinition<(&str, &str), &[u8]> = TableDefinition::new("hashes");
+const LISTS_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("lists");
+const STREAMS_META_TABLE: TableDefinition<&str, &[u8]> = TableDefinition::new("streams_meta");
+const STREAMS_DATA_TABLE: TableDefinition<(&str, &str), &[u8]> = TableDefinition::new("streams_data");
+const ENCRYPTED_TABLE: TableDefinition<&str, u8> = TableDefinition::new("encrypted");
+const EXPIRATION_TABLE: TableDefinition<&str, u64> = TableDefinition::new("expiration");
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct StreamEntry {
+    pub fields: Vec<(String, String)>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct ListValue {
+    pub elements: Vec<String>,
+}
+
+#[inline]
+pub fn now_in_millis() -> u128 {
+    let start = SystemTime::now();
+    let duration_since_epoch = start.duration_since(UNIX_EPOCH).unwrap();
+    duration_since_epoch.as_millis()
+}
+
+pub struct Storage {
+    db: Database,
+    crypto: Option<CryptoFactory>,
+}
+
+impl Storage {
+    pub fn new(path: impl AsRef<Path>, should_encrypt: bool, master_key: Option<&str>) -> Result<Self, DBError> {
+        let db = Database::create(path)?;
+        
+        // Create tables if they don't exist
+        let write_txn = db.begin_write()?;
+        {
+            let _ = write_txn.open_table(TYPES_TABLE)?;
+            let _ = write_txn.open_table(STRINGS_TABLE)?;
+            let _ = write_txn.open_table(HASHES_TABLE)?;
+            let _ = write_txn.open_table(LISTS_TABLE)?;
+            let _ = write_txn.open_table(STREAMS_META_TABLE)?;
+            let _ = write_txn.open_table(STREAMS_DATA_TABLE)?;
+            let _ = write_txn.open_table(ENCRYPTED_TABLE)?;
+            let _ = write_txn.open_table(EXPIRATION_TABLE)?;
+        }
+        write_txn.commit()?;
+        
+        // Check if database was previously encrypted
+        let read_txn = db.begin_read()?;
+        let encrypted_table = read_txn.open_table(ENCRYPTED_TABLE)?;
+        let was_encrypted = encrypted_table.get("encrypted")?.map(|v| v.value() == 1).unwrap_or(false);
+        drop(read_txn);
+        
+        let crypto = if should_encrypt || was_encrypted {
+            if let Some(key) = master_key {
+                Some(CryptoFactory::new(key.as_bytes()))
+            } else {
+                return Err(DBError("Encryption requested but no master key provided".to_string()));
+            }
+        } else {
+            None
+        };
+        
+        // If we're enabling encryption for the first time, mark it
+        if should_encrypt && !was_encrypted {
+            let write_txn = db.begin_write()?;
+            {
+                let mut encrypted_table = write_txn.open_table(ENCRYPTED_TABLE)?;
+                encrypted_table.insert("encrypted", &1u8)?;
+            }
+            write_txn.commit()?;
+        }
+        
+        Ok(Storage {
+            db,
+            crypto,
+        })
+    }
+    
+    pub fn is_encrypted(&self) -> bool {
+        self.crypto.is_some()
+    }
+
+    // Helper methods for encryption
+    fn encrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
+        if let Some(crypto) = &self.crypto {
+            Ok(crypto.encrypt(data))
+        } else {
+            Ok(data.to_vec())
+        }
+    }
+    
+    fn decrypt_if_needed(&self, data: &[u8]) -> Result<Vec<u8>, DBError> {
+        if let Some(crypto) = &self.crypto {
+            Ok(crypto.decrypt(data)?)
+        } else {
+            Ok(data.to_vec())
+        }
+    }
+}

herodb/src/storage/storage_basic.rs

@@ -0,0 +1,245 @@
+use redb::{ReadableTable};
+use crate::error::DBError;
+use super::*;
+
+impl Storage {
+    pub fn flushdb(&self) -> Result<(), DBError> {
+        let write_txn = self.db.begin_write()?;
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            let mut strings_table = write_txn.open_table(STRINGS_TABLE)?;
+            let mut hashes_table = write_txn.open_table(HASHES_TABLE)?;
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            let mut streams_meta_table = write_txn.open_table(STREAMS_META_TABLE)?;
+            let mut streams_data_table = write_txn.open_table(STREAMS_DATA_TABLE)?;
+            let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+
+            // inefficient, but there is no other way
+            let keys: Vec<String> = types_table.iter()?.map(|item| item.unwrap().0.value().to_string()).collect();
+            for key in keys {
+                types_table.remove(key.as_str())?;
+            }
+            let keys: Vec<String> = strings_table.iter()?.map(|item| item.unwrap().0.value().to_string()).collect();
+            for key in keys {
+                strings_table.remove(key.as_str())?;
+            }
+            let keys: Vec<(String, String)> = hashes_table
+                .iter()?
+                .map(|item| {
+                    let binding = item.unwrap();
+                    let (k, f) = binding.0.value();
+                    (k.to_string(), f.to_string())
+                })
+                .collect();
+            for (key, field) in keys {
+                hashes_table.remove((key.as_str(), field.as_str()))?;
+            }
+            let keys: Vec<String> = lists_table.iter()?.map(|item| item.unwrap().0.value().to_string()).collect();
+            for key in keys {
+                lists_table.remove(key.as_str())?;
+            }
+            let keys: Vec<String> = streams_meta_table.iter()?.map(|item| item.unwrap().0.value().to_string()).collect();
+            for key in keys {
+                streams_meta_table.remove(key.as_str())?;
+            }
+            let keys: Vec<(String,String)> = streams_data_table.iter()?.map(|item| {
+                let binding = item.unwrap();
+                let (key, field) = binding.0.value();
+                (key.to_string(), field.to_string())
+            }).collect();
+            for (key, field) in keys {
+                streams_data_table.remove((key.as_str(), field.as_str()))?;
+            }
+            let keys: Vec<String> = expiration_table.iter()?.map(|item| item.unwrap().0.value().to_string()).collect();
+            for key in keys {
+                expiration_table.remove(key.as_str())?;
+            }
+        }
+        write_txn.commit()?;
+        Ok(())
+    }
+
+    pub fn get_key_type(&self, key: &str) -> Result<Option<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let table = read_txn.open_table(TYPES_TABLE)?;
+        
+        // Before returning type, check for expiration
+        if let Some(type_val) = table.get(key)? {
+            if type_val.value() == "string" {
+                let expiration_table = read_txn.open_table(EXPIRATION_TABLE)?;
+                if let Some(expires_at) = expiration_table.get(key)? {
+                    if now_in_millis() > expires_at.value() as u128 {
+                        // The key is expired, so it effectively has no type
+                        return Ok(None);
+                    }
+                }
+            }
+            Ok(Some(type_val.value().to_string()))
+        } else {
+            Ok(None)
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: Value is encrypted/decrypted
+    pub fn get(&self, key: &str) -> Result<Option<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        match types_table.get(key)? {
+            Some(type_val) if type_val.value() == "string" => {
+                // Check expiration first (unencrypted)
+                let expiration_table = read_txn.open_table(EXPIRATION_TABLE)?;
+                if let Some(expires_at) = expiration_table.get(key)? {
+                    if now_in_millis() > expires_at.value() as u128 {
+                        drop(read_txn);
+                        self.del(key.to_string())?;
+                        return Ok(None);
+                    }
+                }
+                
+                // Get and decrypt value
+                let strings_table = read_txn.open_table(STRINGS_TABLE)?;
+                match strings_table.get(key)? {
+                    Some(data) => {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let value = String::from_utf8(decrypted)?;
+                        Ok(Some(value))
+                    }
+                    None => Ok(None),
+                }
+            }
+            _ => Ok(None),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: Value is encrypted before storage
+    pub fn set(&self, key: String, value: String) -> Result<(), DBError> {
+        let write_txn = self.db.begin_write()?;
+        
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            types_table.insert(key.as_str(), "string")?;
+            
+            let mut strings_table = write_txn.open_table(STRINGS_TABLE)?;
+            // Only encrypt the value, not expiration
+            let encrypted = self.encrypt_if_needed(value.as_bytes())?;
+            strings_table.insert(key.as_str(), encrypted.as_slice())?;
+            
+            // Remove any existing expiration since this is a regular SET
+            let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+            expiration_table.remove(key.as_str())?;
+        }
+        
+        write_txn.commit()?;
+        Ok(())
+    }
+
+    // ✅ ENCRYPTION APPLIED: Value is encrypted before storage
+    pub fn setx(&self, key: String, value: String, expire_ms: u128) -> Result<(), DBError> {
+        let write_txn = self.db.begin_write()?;
+        
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            types_table.insert(key.as_str(), "string")?;
+            
+            let mut strings_table = write_txn.open_table(STRINGS_TABLE)?;
+            // Only encrypt the value
+            let encrypted = self.encrypt_if_needed(value.as_bytes())?;
+            strings_table.insert(key.as_str(), encrypted.as_slice())?;
+            
+            // Store expiration separately (unencrypted)
+            let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+            let expires_at = expire_ms + now_in_millis();
+            expiration_table.insert(key.as_str(), &(expires_at as u64))?;
+        }
+        
+        write_txn.commit()?;
+        Ok(())
+    }
+
+    pub fn del(&self, key: String) -> Result<(), DBError> {
+        let write_txn = self.db.begin_write()?;
+        
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            let mut strings_table = write_txn.open_table(STRINGS_TABLE)?;
+            let mut hashes_table: redb::Table<(&str, &str), &[u8]> = write_txn.open_table(HASHES_TABLE)?;
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            
+            // Remove from type table
+            types_table.remove(key.as_str())?;
+            
+            // Remove from strings table
+            strings_table.remove(key.as_str())?;
+            
+            // Remove all hash fields for this key
+            let mut to_remove = Vec::new();
+            let mut iter = hashes_table.iter()?;
+            while let Some(entry) = iter.next() {
+                let entry = entry?;
+                let (hash_key, field) = entry.0.value();
+                if hash_key == key.as_str() {
+                    to_remove.push((hash_key.to_string(), field.to_string()));
+                }
+            }
+            drop(iter);
+            
+            for (hash_key, field) in to_remove {
+                hashes_table.remove((hash_key.as_str(), field.as_str()))?;
+            }
+
+            // Remove from lists table
+            lists_table.remove(key.as_str())?;
+            
+            // Also remove expiration
+            let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+            expiration_table.remove(key.as_str())?;
+        }
+        
+        write_txn.commit()?;
+        Ok(())
+    }
+
+    pub fn keys(&self, pattern: &str) -> Result<Vec<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let table = read_txn.open_table(TYPES_TABLE)?;
+        
+        let mut keys = Vec::new();
+        let mut iter = table.iter()?;
+        while let Some(entry) = iter.next() {
+            let key = entry?.0.value().to_string();
+            if pattern == "*" || super::storage_extra::glob_match(pattern, &key) {
+                keys.push(key);
+            }
+        }
+        
+        Ok(keys)
+    }
+}
+
+impl Storage {
+    pub fn dbsize(&self) -> Result<i64, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let expiration_table = read_txn.open_table(EXPIRATION_TABLE)?;
+
+        let mut count: i64 = 0;
+        let mut iter = types_table.iter()?;
+        while let Some(entry) = iter.next() {
+            let entry = entry?;
+            let key = entry.0.value();
+            let ty = entry.1.value();
+
+            if ty == "string" {
+                if let Some(expires_at) = expiration_table.get(key)? {
+                    if now_in_millis() > expires_at.value() as u128 {
+                        // Skip logically expired string keys
+                        continue;
+                    }
+                }
+            }
+            count += 1;
+        }
+        Ok(count)
+    }
+}

herodb/src/storage/storage_extra.rs

@@ -0,0 +1,278 @@
+use redb::{ReadableTable};
+use crate::error::DBError;
+use super::*;
+
+impl Storage {
+    // ✅ ENCRYPTION APPLIED: Values are decrypted after retrieval
+    pub fn scan(&self, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let strings_table = read_txn.open_table(STRINGS_TABLE)?;
+        
+        let mut result = Vec::new();
+        let mut current_cursor = 0u64;
+        let limit = count.unwrap_or(10) as usize;
+        
+        let mut iter = types_table.iter()?;
+        while let Some(entry) = iter.next() {
+            let entry = entry?;
+            let key = entry.0.value().to_string();
+            let key_type = entry.1.value().to_string();
+            
+            if current_cursor >= cursor {
+                // Apply pattern matching if specified
+                let matches = if let Some(pat) = pattern {
+                    glob_match(pat, &key)
+                } else {
+                    true
+                };
+                
+                if matches {
+                    // For scan, we return key-value pairs for string types
+                    if key_type == "string" {
+                        if let Some(data) = strings_table.get(key.as_str())? {
+                            let decrypted = self.decrypt_if_needed(data.value())?;
+                            let value = String::from_utf8(decrypted)?;
+                            result.push((key, value));
+                        } else {
+                            result.push((key, String::new()));
+                        }
+                    } else {
+                        // For non-string types, just return the key with type as value
+                        result.push((key, key_type));
+                    }
+                    
+                    if result.len() >= limit {
+                        break;
+                    }
+                }
+            }
+            current_cursor += 1;
+        }
+        
+        let next_cursor = if result.len() < limit { 0 } else { current_cursor };
+        Ok((next_cursor, result))
+    }
+
+    pub fn ttl(&self, key: &str) -> Result<i64, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        
+        match types_table.get(key)? {
+            Some(type_val) if type_val.value() == "string" => {
+                let expiration_table = read_txn.open_table(EXPIRATION_TABLE)?;
+                match expiration_table.get(key)? {
+                    Some(expires_at) => {
+                        let now = now_in_millis();
+                        let expires_at_ms = expires_at.value() as u128;
+                        if now >= expires_at_ms {
+                            Ok(-2) // Key has expired
+                        } else {
+                            Ok(((expires_at_ms - now) / 1000) as i64) // TTL in seconds
+                        }
+                    }
+                    None => Ok(-1), // Key exists but has no expiration
+                }
+            }
+            Some(_) => Ok(-1), // Key exists but is not a string (no expiration support for other types)
+            None => Ok(-2), // Key does not exist
+        }
+    }
+
+    pub fn exists(&self, key: &str) -> Result<bool, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        
+        match types_table.get(key)? {
+            Some(type_val) if type_val.value() == "string" => {
+                // Check if string key has expired
+                let expiration_table = read_txn.open_table(EXPIRATION_TABLE)?;
+                if let Some(expires_at) = expiration_table.get(key)? {
+                    if now_in_millis() > expires_at.value() as u128 {
+                        return Ok(false); // Key has expired
+                    }
+                }
+                Ok(true)
+            }
+            Some(_) => Ok(true), // Key exists and is not a string
+            None => Ok(false), // Key does not exist
+        }
+    }
+
+    // -------- Expiration helpers (string keys only, consistent with TTL/EXISTS) --------
+
+    // Set expiry in seconds; returns true if applied (key exists and is string), false otherwise
+    pub fn expire_seconds(&self, key: &str, secs: u64) -> Result<bool, DBError> {
+        // Determine eligibility first to avoid holding borrows across commit
+        let mut applied = false;
+        let write_txn = self.db.begin_write()?;
+        {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let is_string = types_table
+                .get(key)?
+                .map(|v| v.value() == "string")
+                .unwrap_or(false);
+            if is_string {
+                let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+                let expires_at = now_in_millis() + (secs as u128) * 1000;
+                expiration_table.insert(key, &(expires_at as u64))?;
+                applied = true;
+            }
+        }
+        write_txn.commit()?;
+        Ok(applied)
+    }
+
+    // Set expiry in milliseconds; returns true if applied (key exists and is string), false otherwise
+    pub fn pexpire_millis(&self, key: &str, ms: u128) -> Result<bool, DBError> {
+        let mut applied = false;
+        let write_txn = self.db.begin_write()?;
+        {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let is_string = types_table
+                .get(key)?
+                .map(|v| v.value() == "string")
+                .unwrap_or(false);
+            if is_string {
+                let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+                let expires_at = now_in_millis() + ms;
+                expiration_table.insert(key, &(expires_at as u64))?;
+                applied = true;
+            }
+        }
+        write_txn.commit()?;
+        Ok(applied)
+    }
+
+    // Remove expiry if present; returns true if removed, false otherwise
+    pub fn persist(&self, key: &str) -> Result<bool, DBError> {
+        let mut removed = false;
+        let write_txn = self.db.begin_write()?;
+        {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let is_string = types_table
+                .get(key)?
+                .map(|v| v.value() == "string")
+                .unwrap_or(false);
+            if is_string {
+                let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+                if expiration_table.remove(key)?.is_some() {
+                    removed = true;
+                }
+            }
+        }
+        write_txn.commit()?;
+        Ok(removed)
+    }
+
+    // Absolute EXPIREAT in seconds since epoch
+    // Returns true if applied (key exists and is string), false otherwise
+    pub fn expire_at_seconds(&self, key: &str, ts_secs: i64) -> Result<bool, DBError> {
+        let mut applied = false;
+        let write_txn = self.db.begin_write()?;
+        {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let is_string = types_table
+                .get(key)?
+                .map(|v| v.value() == "string")
+                .unwrap_or(false);
+            if is_string {
+                let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+                let expires_at_ms: u128 = if ts_secs <= 0 { 0 } else { (ts_secs as u128) * 1000 };
+                expiration_table.insert(key, &((expires_at_ms as u64)))?;
+                applied = true;
+            }
+        }
+        write_txn.commit()?;
+        Ok(applied)
+    }
+
+    // Absolute PEXPIREAT in milliseconds since epoch
+    // Returns true if applied (key exists and is string), false otherwise
+    pub fn pexpire_at_millis(&self, key: &str, ts_ms: i64) -> Result<bool, DBError> {
+        let mut applied = false;
+        let write_txn = self.db.begin_write()?;
+        {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let is_string = types_table
+                .get(key)?
+                .map(|v| v.value() == "string")
+                .unwrap_or(false);
+            if is_string {
+                let mut expiration_table = write_txn.open_table(EXPIRATION_TABLE)?;
+                let expires_at_ms: u128 = if ts_ms <= 0 { 0 } else { ts_ms as u128 };
+                expiration_table.insert(key, &((expires_at_ms as u64)))?;
+                applied = true;
+            }
+        }
+        write_txn.commit()?;
+        Ok(applied)
+    }
+}
+
+// Utility function for glob pattern matching
+pub fn glob_match(pattern: &str, text: &str) -> bool {
+    if pattern == "*" {
+        return true;
+    }
+    
+    // Simple glob matching - supports * and ? wildcards
+    let pattern_chars: Vec<char> = pattern.chars().collect();
+    let text_chars: Vec<char> = text.chars().collect();
+    
+    fn match_recursive(pattern: &[char], text: &[char], pi: usize, ti: usize) -> bool {
+        if pi >= pattern.len() {
+            return ti >= text.len();
+        }
+        
+        if ti >= text.len() {
+            // Check if remaining pattern is all '*'
+            return pattern[pi..].iter().all(|&c| c == '*');
+        }
+        
+        match pattern[pi] {
+            '*' => {
+                // Try matching zero or more characters
+                for i in ti..=text.len() {
+                    if match_recursive(pattern, text, pi + 1, i) {
+                        return true;
+                    }
+                }
+                false
+            }
+            '?' => {
+                // Match exactly one character
+                match_recursive(pattern, text, pi + 1, ti + 1)
+            }
+            c => {
+                // Match exact character
+                if text[ti] == c {
+                    match_recursive(pattern, text, pi + 1, ti + 1)
+                } else {
+                    false
+                }
+            }
+        }
+    }
+    
+    match_recursive(&pattern_chars, &text_chars, 0, 0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_glob_match() {
+        assert!(glob_match("*", "anything"));
+        assert!(glob_match("hello", "hello"));
+        assert!(!glob_match("hello", "world"));
+        assert!(glob_match("h*o", "hello"));
+        assert!(glob_match("h*o", "ho"));
+        assert!(!glob_match("h*o", "hi"));
+        assert!(glob_match("h?llo", "hello"));
+        assert!(!glob_match("h?llo", "hllo"));
+        assert!(glob_match("*test*", "this_is_a_test_string"));
+        assert!(!glob_match("*test*", "this_is_a_string"));
+    }
+}

herodb/src/storage/storage_hset.rs

@@ -0,0 +1,377 @@
+use redb::{ReadableTable};
+use crate::error::DBError;
+use super::*;
+
+impl Storage {
+    // ✅ ENCRYPTION APPLIED: Values are encrypted before storage
+    pub fn hset(&self, key: &str, pairs: Vec<(String, String)>) -> Result<i64, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut new_fields = 0i64;
+        
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            let mut hashes_table = write_txn.open_table(HASHES_TABLE)?;
+            
+            let key_type = {
+                let access_guard = types_table.get(key)?;
+                access_guard.map(|v| v.value().to_string())
+            };
+
+            match key_type.as_deref() {
+                Some("hash") | None => { // Proceed if hash or new key
+                    // Set the type to hash (only if new key or existing hash)
+                    types_table.insert(key, "hash")?;
+                    
+                    for (field, value) in pairs {
+                        // Check if field already exists
+                        let exists = hashes_table.get((key, field.as_str()))?.is_some();
+                        
+                        // Encrypt the value before storing
+                        let encrypted = self.encrypt_if_needed(value.as_bytes())?;
+                        hashes_table.insert((key, field.as_str()), encrypted.as_slice())?;
+                        
+                        if !exists {
+                            new_fields += 1;
+                        }
+                    }
+                }
+                Some(_) => return Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            }
+        }
+        
+        write_txn.commit()?;
+        Ok(new_fields)
+    }
+
+    // ✅ ENCRYPTION APPLIED: Value is decrypted after retrieval
+    pub fn hget(&self, key: &str, field: &str) -> Result<Option<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        
+        let key_type = types_table.get(key)?.map(|v| v.value().to_string());
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                match hashes_table.get((key, field))? {
+                    Some(data) => {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let value = String::from_utf8(decrypted)?;
+                        Ok(Some(value))
+                    }
+                    None => Ok(None),
+                }
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok(None),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: All values are decrypted after retrieval
+    pub fn hgetall(&self, key: &str) -> Result<Vec<(String, String)>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let key_type = {
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                let mut result = Vec::new();
+                
+                let mut iter = hashes_table.iter()?;
+                while let Some(entry) = iter.next() {
+                    let entry = entry?;
+                    let (hash_key, field) = entry.0.value();
+                    if hash_key == key {
+                        let decrypted = self.decrypt_if_needed(entry.1.value())?;
+                        let value = String::from_utf8(decrypted)?;
+                        result.push((field.to_string(), value));
+                    }
+                }
+                
+                Ok(result)
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok(Vec::new()),
+        }
+    }
+
+    pub fn hdel(&self, key: &str, fields: Vec<String>) -> Result<i64, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut deleted = 0i64;
+        
+        // First check if key exists and is a hash
+        let key_type = {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+        
+        match key_type.as_deref() {
+            Some("hash") => {
+                let mut hashes_table = write_txn.open_table(HASHES_TABLE)?;
+                
+                for field in fields {
+                    if hashes_table.remove((key, field.as_str()))?.is_some() {
+                        deleted += 1;
+                    }
+                }
+                
+                // Check if hash is now empty and remove type if so
+                let mut has_fields = false;
+                let mut iter = hashes_table.iter()?;
+                while let Some(entry) = iter.next() {
+                    let entry = entry?;
+                    let (hash_key, _) = entry.0.value();
+                    if hash_key == key {
+                        has_fields = true;
+                        break;
+                    }
+                }
+                drop(iter);
+                
+                if !has_fields {
+                    let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+                    types_table.remove(key)?;
+                }
+            }
+            Some(_) => return Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => {} // Key does not exist, nothing to delete, return 0 deleted
+        }
+        
+        write_txn.commit()?;
+        Ok(deleted)
+    }
+
+    pub fn hexists(&self, key: &str, field: &str) -> Result<bool, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let key_type = {
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                Ok(hashes_table.get((key, field))?.is_some())
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok(false),
+        }
+    }
+
+    pub fn hkeys(&self, key: &str) -> Result<Vec<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let key_type = {
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                let mut result = Vec::new();
+                
+                let mut iter = hashes_table.iter()?;
+                while let Some(entry) = iter.next() {
+                    let entry = entry?;
+                    let (hash_key, field) = entry.0.value();
+                    if hash_key == key {
+                        result.push(field.to_string());
+                    }
+                }
+                
+                Ok(result)
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok(Vec::new()),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: All values are decrypted after retrieval
+    pub fn hvals(&self, key: &str) -> Result<Vec<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let key_type = {
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                let mut result = Vec::new();
+                
+                let mut iter = hashes_table.iter()?;
+                while let Some(entry) = iter.next() {
+                    let entry = entry?;
+                    let (hash_key, _) = entry.0.value();
+                    if hash_key == key {
+                        let decrypted = self.decrypt_if_needed(entry.1.value())?;
+                        let value = String::from_utf8(decrypted)?;
+                        result.push(value);
+                    }
+                }
+                
+                Ok(result)
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok(Vec::new()),
+        }
+    }
+
+    pub fn hlen(&self, key: &str) -> Result<i64, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let key_type = {
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                let mut count = 0i64;
+                
+                let mut iter = hashes_table.iter()?;
+                while let Some(entry) = iter.next() {
+                    let entry = entry?;
+                    let (hash_key, _) = entry.0.value();
+                    if hash_key == key {
+                        count += 1;
+                    }
+                }
+                
+                Ok(count)
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok(0),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: Values are decrypted after retrieval
+    pub fn hmget(&self, key: &str, fields: Vec<String>) -> Result<Vec<Option<String>>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let key_type = {
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                let mut result = Vec::new();
+                
+                for field in fields {
+                    match hashes_table.get((key, field.as_str()))? {
+                        Some(data) => {
+                            let decrypted = self.decrypt_if_needed(data.value())?;
+                            let value = String::from_utf8(decrypted)?;
+                            result.push(Some(value));
+                        }
+                        None => result.push(None),
+                    }
+                }
+                
+                Ok(result)
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok(fields.into_iter().map(|_| None).collect()),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: Value is encrypted before storage
+    pub fn hsetnx(&self, key: &str, field: &str, value: &str) -> Result<bool, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut result = false;
+        
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            let mut hashes_table = write_txn.open_table(HASHES_TABLE)?;
+            
+            let key_type = {
+                let access_guard = types_table.get(key)?;
+                access_guard.map(|v| v.value().to_string())
+            };
+
+            match key_type.as_deref() {
+                Some("hash") | None => { // Proceed if hash or new key
+                    // Check if field already exists
+                    if hashes_table.get((key, field))?.is_none() {
+                        // Set the type to hash (only if new key or existing hash)
+                        types_table.insert(key, "hash")?;
+                        
+                        // Encrypt the value before storing
+                        let encrypted = self.encrypt_if_needed(value.as_bytes())?;
+                        hashes_table.insert((key, field), encrypted.as_slice())?;
+                        result = true;
+                    }
+                }
+                Some(_) => return Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            }
+        }
+        
+        write_txn.commit()?;
+        Ok(result)
+    }
+
+    // ✅ ENCRYPTION APPLIED: Values are decrypted after retrieval
+    pub fn hscan(&self, key: &str, cursor: u64, pattern: Option<&str>, count: Option<u64>) -> Result<(u64, Vec<(String, String)>), DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        let key_type = {
+            let access_guard = types_table.get(key)?;
+            access_guard.map(|v| v.value().to_string())
+        };
+
+        match key_type.as_deref() {
+            Some("hash") => {
+                let hashes_table = read_txn.open_table(HASHES_TABLE)?;
+                let mut result = Vec::new();
+                let mut current_cursor = 0u64;
+                let limit = count.unwrap_or(10) as usize;
+                
+                let mut iter = hashes_table.iter()?;
+                while let Some(entry) = iter.next() {
+                    let entry = entry?;
+                    let (hash_key, field) = entry.0.value();
+                    
+                    if hash_key == key {
+                        if current_cursor >= cursor {
+                            let field_str = field.to_string();
+                            
+                            // Apply pattern matching if specified
+                            let matches = if let Some(pat) = pattern {
+                                super::storage_extra::glob_match(pat, &field_str)
+                            } else {
+                                true
+                            };
+                            
+                            if matches {
+                                let decrypted = self.decrypt_if_needed(entry.1.value())?;
+                                let value = String::from_utf8(decrypted)?;
+                                result.push((field_str, value));
+                                
+                                if result.len() >= limit {
+                                    break;
+                                }
+                            }
+                        }
+                        current_cursor += 1;
+                    }
+                }
+                
+                let next_cursor = if result.len() < limit { 0 } else { current_cursor };
+                Ok((next_cursor, result))
+            }
+            Some(_) => Err(DBError("WRONGTYPE Operation against a key holding the wrong kind of value".to_string())),
+            None => Ok((0, Vec::new())),
+        }
+    }
+}

herodb/src/storage/storage_lists.rs

@@ -0,0 +1,403 @@
+use redb::{ReadableTable};
+use crate::error::DBError;
+use super::*;
+
+impl Storage {
+    // ✅ ENCRYPTION APPLIED: Elements are encrypted before storage
+    pub fn lpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut _length = 0i64;
+        
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            
+            // Set the type to list
+            types_table.insert(key, "list")?;
+            
+            // Get current list or create empty one
+            let mut list: Vec<String> = match lists_table.get(key)? {
+                Some(data) => {
+                    let decrypted = self.decrypt_if_needed(data.value())?;
+                    serde_json::from_slice(&decrypted)?
+                }
+                None => Vec::new(),
+            };
+            
+            // Add elements to the front (left)
+            for element in elements.into_iter() {
+                list.insert(0, element);
+            }
+            
+            _length = list.len() as i64;
+            
+            // Encrypt and store the updated list
+            let serialized = serde_json::to_vec(&list)?;
+            let encrypted = self.encrypt_if_needed(&serialized)?;
+            lists_table.insert(key, encrypted.as_slice())?;
+        }
+        
+        write_txn.commit()?;
+        Ok(_length)
+    }
+
+    // ✅ ENCRYPTION APPLIED: Elements are encrypted before storage
+    pub fn rpush(&self, key: &str, elements: Vec<String>) -> Result<i64, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut _length = 0i64;
+        
+        {
+            let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            
+            // Set the type to list
+            types_table.insert(key, "list")?;
+            
+            // Get current list or create empty one
+            let mut list: Vec<String> = match lists_table.get(key)? {
+                Some(data) => {
+                    let decrypted = self.decrypt_if_needed(data.value())?;
+                    serde_json::from_slice(&decrypted)?
+                }
+                None => Vec::new(),
+            };
+            
+            // Add elements to the end (right)
+            list.extend(elements);
+            _length = list.len() as i64;
+            
+            // Encrypt and store the updated list
+            let serialized = serde_json::to_vec(&list)?;
+            let encrypted = self.encrypt_if_needed(&serialized)?;
+            lists_table.insert(key, encrypted.as_slice())?;
+        }
+        
+        write_txn.commit()?;
+        Ok(_length)
+    }
+
+    // ✅ ENCRYPTION APPLIED: Elements are decrypted after retrieval and encrypted before storage
+    pub fn lpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut result = Vec::new();
+        
+        // First check if key exists and is a list, and get the data
+        let list_data = {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let lists_table = write_txn.open_table(LISTS_TABLE)?;
+            
+            let result = match types_table.get(key)? {
+                Some(type_val) if type_val.value() == "list" => {
+                    if let Some(data) = lists_table.get(key)? {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let list: Vec<String> = serde_json::from_slice(&decrypted)?;
+                        Some(list)
+                    } else {
+                        None
+                    }
+                }
+                _ => None,
+            };
+            result
+        };
+        
+        if let Some(mut list) = list_data {
+            let pop_count = std::cmp::min(count as usize, list.len());
+            for _ in 0..pop_count {
+                if !list.is_empty() {
+                    result.push(list.remove(0));
+                }
+            }
+            
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            if list.is_empty() {
+                // Remove the key if list is empty
+                lists_table.remove(key)?;
+                let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+                types_table.remove(key)?;
+            } else {
+                // Encrypt and store the updated list
+                let serialized = serde_json::to_vec(&list)?;
+                let encrypted = self.encrypt_if_needed(&serialized)?;
+                lists_table.insert(key, encrypted.as_slice())?;
+            }
+        }
+        
+        write_txn.commit()?;
+        Ok(result)
+    }
+
+    // ✅ ENCRYPTION APPLIED: Elements are decrypted after retrieval and encrypted before storage
+    pub fn rpop(&self, key: &str, count: u64) -> Result<Vec<String>, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut result = Vec::new();
+        
+        // First check if key exists and is a list, and get the data
+        let list_data = {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let lists_table = write_txn.open_table(LISTS_TABLE)?;
+            
+            let result = match types_table.get(key)? {
+                Some(type_val) if type_val.value() == "list" => {
+                    if let Some(data) = lists_table.get(key)? {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let list: Vec<String> = serde_json::from_slice(&decrypted)?;
+                        Some(list)
+                    } else {
+                        None
+                    }
+                }
+                _ => None,
+            };
+            result
+        };
+        
+        if let Some(mut list) = list_data {
+            let pop_count = std::cmp::min(count as usize, list.len());
+            for _ in 0..pop_count {
+                if !list.is_empty() {
+                    result.push(list.pop().unwrap());
+                }
+            }
+            
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            if list.is_empty() {
+                // Remove the key if list is empty
+                lists_table.remove(key)?;
+                let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+                types_table.remove(key)?;
+            } else {
+                // Encrypt and store the updated list
+                let serialized = serde_json::to_vec(&list)?;
+                let encrypted = self.encrypt_if_needed(&serialized)?;
+                lists_table.insert(key, encrypted.as_slice())?;
+            }
+        }
+        
+        write_txn.commit()?;
+        Ok(result)
+    }
+
+    pub fn llen(&self, key: &str) -> Result<i64, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        
+        match types_table.get(key)? {
+            Some(type_val) if type_val.value() == "list" => {
+                let lists_table = read_txn.open_table(LISTS_TABLE)?;
+                match lists_table.get(key)? {
+                    Some(data) => {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let list: Vec<String> = serde_json::from_slice(&decrypted)?;
+                        Ok(list.len() as i64)
+                    }
+                    None => Ok(0),
+                }
+            }
+            _ => Ok(0),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: Element is decrypted after retrieval
+    pub fn lindex(&self, key: &str, index: i64) -> Result<Option<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        
+        match types_table.get(key)? {
+            Some(type_val) if type_val.value() == "list" => {
+                let lists_table = read_txn.open_table(LISTS_TABLE)?;
+                match lists_table.get(key)? {
+                    Some(data) => {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let list: Vec<String> = serde_json::from_slice(&decrypted)?;
+                        
+                        let actual_index = if index < 0 {
+                            list.len() as i64 + index
+                        } else {
+                            index
+                        };
+                        
+                        if actual_index >= 0 && (actual_index as usize) < list.len() {
+                            Ok(Some(list[actual_index as usize].clone()))
+                        } else {
+                            Ok(None)
+                        }
+                    }
+                    None => Ok(None),
+                }
+            }
+            _ => Ok(None),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: Elements are decrypted after retrieval
+    pub fn lrange(&self, key: &str, start: i64, stop: i64) -> Result<Vec<String>, DBError> {
+        let read_txn = self.db.begin_read()?;
+        let types_table = read_txn.open_table(TYPES_TABLE)?;
+        
+        match types_table.get(key)? {
+            Some(type_val) if type_val.value() == "list" => {
+                let lists_table = read_txn.open_table(LISTS_TABLE)?;
+                match lists_table.get(key)? {
+                    Some(data) => {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let list: Vec<String> = serde_json::from_slice(&decrypted)?;
+                        
+                        if list.is_empty() {
+                            return Ok(Vec::new());
+                        }
+                        
+                        let len = list.len() as i64;
+                        let start_idx = if start < 0 { std::cmp::max(0, len + start) } else { std::cmp::min(start, len) };
+                        let stop_idx = if stop < 0 { std::cmp::max(-1, len + stop) } else { std::cmp::min(stop, len - 1) };
+                        
+                        if start_idx > stop_idx || start_idx >= len {
+                            return Ok(Vec::new());
+                        }
+                        
+                        let start_usize = start_idx as usize;
+                        let stop_usize = (stop_idx + 1) as usize;
+                        
+                        Ok(list[start_usize..std::cmp::min(stop_usize, list.len())].to_vec())
+                    }
+                    None => Ok(Vec::new()),
+                }
+            }
+            _ => Ok(Vec::new()),
+        }
+    }
+
+    // ✅ ENCRYPTION APPLIED: Elements are decrypted after retrieval and encrypted before storage
+    pub fn ltrim(&self, key: &str, start: i64, stop: i64) -> Result<(), DBError> {
+        let write_txn = self.db.begin_write()?;
+        
+        // First check if key exists and is a list, and get the data
+        let list_data = {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let lists_table = write_txn.open_table(LISTS_TABLE)?;
+            
+            let result = match types_table.get(key)? {
+                Some(type_val) if type_val.value() == "list" => {
+                    if let Some(data) = lists_table.get(key)? {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let list: Vec<String> = serde_json::from_slice(&decrypted)?;
+                        Some(list)
+                    } else {
+                        None
+                    }
+                }
+                _ => None,
+            };
+            result
+        };
+        
+        if let Some(list) = list_data {
+            if list.is_empty() {
+                write_txn.commit()?;
+                return Ok(());
+            }
+            
+            let len = list.len() as i64;
+            let start_idx = if start < 0 { std::cmp::max(0, len + start) } else { std::cmp::min(start, len) };
+            let stop_idx = if stop < 0 { std::cmp::max(-1, len + stop) } else { std::cmp::min(stop, len - 1) };
+            
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            if start_idx > stop_idx || start_idx >= len {
+                // Remove the entire list
+                lists_table.remove(key)?;
+                let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+                types_table.remove(key)?;
+            } else {
+                let start_usize = start_idx as usize;
+                let stop_usize = (stop_idx + 1) as usize;
+                let trimmed = list[start_usize..std::cmp::min(stop_usize, list.len())].to_vec();
+                
+                if trimmed.is_empty() {
+                    lists_table.remove(key)?;
+                    let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+                    types_table.remove(key)?;
+                } else {
+                    // Encrypt and store the trimmed list
+                    let serialized = serde_json::to_vec(&trimmed)?;
+                    let encrypted = self.encrypt_if_needed(&serialized)?;
+                    lists_table.insert(key, encrypted.as_slice())?;
+                }
+            }
+        }
+        
+        write_txn.commit()?;
+        Ok(())
+    }
+
+    // ✅ ENCRYPTION APPLIED: Elements are decrypted after retrieval and encrypted before storage
+    pub fn lrem(&self, key: &str, count: i64, element: &str) -> Result<i64, DBError> {
+        let write_txn = self.db.begin_write()?;
+        let mut removed = 0i64;
+        
+        // First check if key exists and is a list, and get the data
+        let list_data = {
+            let types_table = write_txn.open_table(TYPES_TABLE)?;
+            let lists_table = write_txn.open_table(LISTS_TABLE)?;
+            
+            let result = match types_table.get(key)? {
+                Some(type_val) if type_val.value() == "list" => {
+                    if let Some(data) = lists_table.get(key)? {
+                        let decrypted = self.decrypt_if_needed(data.value())?;
+                        let list: Vec<String> = serde_json::from_slice(&decrypted)?;
+                        Some(list)
+                    } else {
+                        None
+                    }
+                }
+                _ => None,
+            };
+            result
+        };
+        
+        if let Some(mut list) = list_data {
+            if count == 0 {
+                // Remove all occurrences
+                let original_len = list.len();
+                list.retain(|x| x != element);
+                removed = (original_len - list.len()) as i64;
+            } else if count > 0 {
+                // Remove first count occurrences
+                let mut to_remove = count as usize;
+                list.retain(|x| {
+                    if x == element && to_remove > 0 {
+                        to_remove -= 1;
+                        removed += 1;
+                        false
+                    } else {
+                        true
+                    }
+                });
+            } else {
+                // Remove last |count| occurrences
+                let mut to_remove = (-count) as usize;
+                for i in (0..list.len()).rev() {
+                    if list[i] == element && to_remove > 0 {
+                        list.remove(i);
+                        to_remove -= 1;
+                        removed += 1;
+                    }
+                }
+            }
+            
+            let mut lists_table = write_txn.open_table(LISTS_TABLE)?;
+            if list.is_empty() {
+                lists_table.remove(key)?;
+                let mut types_table = write_txn.open_table(TYPES_TABLE)?;
+                types_table.remove(key)?;
+            } else {
+                // Encrypt and store the updated list
+                let serialized = serde_json::to_vec(&list)?;
+                let encrypted = self.encrypt_if_needed(&serialized)?;
+                lists_table.insert(key, encrypted.as_slice())?;
+            }
+        }
+        
+        write_txn.commit()?;
+        Ok(removed)
+    }
+}

herodb/test_herodb.sh

@@ -288,7 +288,7 @@ main() {
     
     # Build the project
     print_status "Building HeroDB..."
-    if ! cargo build --release; then
+    if ! cargo build -p herodb --release; then
         print_error "Failed to build HeroDB"
         exit 1
     fi
@@ -298,7 +298,7 @@ main() {
     
     # Start the server
     print_status "Starting HeroDB server..."
-    ./target/release/redis-rs --dir "$DB_DIR" --port $PORT &
+    ./target/release/herodb --dir "$DB_DIR" --port $PORT &
     SERVER_PID=$!
     
     # Wait for server to start

herodb/tests/debug_hset.rs

@@ -1,4 +1,4 @@
-use redis_rs::{server::Server, options::DBOption};
+use herodb::{server::Server, options::DBOption};
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;

herodb/tests/debug_hset_simple.rs

@@ -1,4 +1,4 @@
-use redis_rs::{server::Server, options::DBOption};
+use herodb::{server::Server, options::DBOption};
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;

herodb/tests/debug_protocol.rs

@@ -1,5 +1,5 @@
-use redis_rs::protocol::Protocol;
-use redis_rs::cmd::Cmd;
+use herodb::protocol::Protocol;
+use herodb::cmd::Cmd;
 
 #[test]
 fn test_protocol_parsing() {

herodb/tests/redis_integration_tests.rs

@@ -16,9 +16,9 @@ fn get_redis_connection(port: u16) -> Connection {
                 }
             }
             Err(e) => {
-                if attempts >= 20 {
+                if attempts >= 120 {
                     panic!(
-                        "Failed to connect to Redis server after 20 attempts: {}",
+                        "Failed to connect to Redis server after 120 attempts: {}",
                         e
                     );
                 }
@@ -88,8 +88,8 @@ fn setup_server() -> (ServerProcessGuard, u16) {
         test_dir,
     };
     
-    // Give the server a moment to start
-    std::thread::sleep(Duration::from_millis(500));
+    // Give the server time to build and start (cargo run may compile first)
+    std::thread::sleep(Duration::from_millis(2500));
 
     (guard, port)
 }

herodb/tests/redis_tests.rs

@@ -1,4 +1,4 @@
-use redis_rs::{server::Server, options::DBOption};
+use herodb::{server::Server, options::DBOption};
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;

herodb/tests/simple_integration_test.rs

@@ -1,4 +1,4 @@
-use redis_rs::{server::Server, options::DBOption};
+use herodb::{server::Server, options::DBOption};
 use std::time::Duration;
 use tokio::time::sleep;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
@@ -93,9 +93,16 @@ async fn test_basic_redis_functionality() {
     assert!(response.contains("string"));
     
     // Test QUIT to close connection gracefully
-    let response = send_redis_command(port, "*1\r\n$4\r\nQUIT\r\n").await;
+    let mut stream = TcpStream::connect(format!("127.0.0.1:{}", port)).await.unwrap();
+    stream.write_all("*1\r\n$4\r\nQUIT\r\n".as_bytes()).await.unwrap();
+    let mut buffer = [0; 1024];
+    let n = stream.read(&mut buffer).await.unwrap();
+    let response = String::from_utf8_lossy(&buffer[..n]);
     assert!(response.contains("OK"));
     
+    // Ensure the stream is closed
+    stream.shutdown().await.unwrap();
+
     // Stop the server
     server_handle.abort();
     
@@ -149,6 +156,8 @@ async fn test_hash_operations() {
     assert!(response.contains("value2"));
     
     // Stop the server
+    // For hash operations, we don't have a persistent stream, so we'll just abort the server.
+    // The server should handle closing its connections.
     server_handle.abort();
     
     println!("✅ All hash operations tests passed!");
@@ -202,9 +211,16 @@ async fn test_transaction_operations() {
     assert!(response.contains("OK")); // Should contain array of OK responses
     
     // Verify commands were executed
-    let response = send_redis_command(port, "*2\r\n$3\r\nGET\r\n$4\r\nkey1\r\n").await;
+    stream.write_all("*2\r\n$3\r\nGET\r\n$4\r\nkey1\r\n".as_bytes()).await.unwrap();
+    let n = stream.read(&mut buffer).await.unwrap();
+    let response = String::from_utf8_lossy(&buffer[..n]);
     assert!(response.contains("value1"));
     
+    stream.write_all("*2\r\n$3\r\nGET\r\n$4\r\nkey2\r\n".as_bytes()).await.unwrap();
+    let n = stream.read(&mut buffer).await.unwrap();
+    let response = String::from_utf8_lossy(&buffer[..n]);
+    assert!(response.contains("value2"));
+
     // Stop the server
     server_handle.abort();
     

herodb/tests/simple_redis_test.rs

@@ -1,4 +1,4 @@
-use redis_rs::{server::Server, options::DBOption};
+use herodb::{server::Server, options::DBOption};
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;

herodb/tests/usage_suite.rs

@@ -0,0 +1,892 @@
+use herodb::{options::DBOption, server::Server};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::{sleep, Duration};
+
+// =========================
+// Helpers
+// =========================
+
+async fn start_test_server(test_name: &str) -> (Server, u16) {
+    use std::sync::atomic::{AtomicU16, Ordering};
+    static PORT_COUNTER: AtomicU16 = AtomicU16::new(17100);
+    let port = PORT_COUNTER.fetch_add(1, Ordering::SeqCst);
+
+    let test_dir = format!("/tmp/herodb_usage_suite_{}", test_name);
+    let _ = std::fs::remove_dir_all(&test_dir);
+    std::fs::create_dir_all(&test_dir).unwrap();
+
+    let option = DBOption {
+        dir: test_dir,
+        port,
+        debug: false,
+        encrypt: false,
+        encryption_key: None,
+    };
+
+    let server = Server::new(option).await;
+    (server, port)
+}
+
+async fn spawn_listener(server: Server, port: u16) {
+    tokio::spawn(async move {
+        let listener = tokio::net::TcpListener::bind(format!("127.0.0.1:{}", port))
+            .await
+            .expect("bind listener");
+        loop {
+            match listener.accept().await {
+                Ok((stream, _)) => {
+                    let mut s_clone = server.clone();
+                    tokio::spawn(async move {
+                        let _ = s_clone.handle(stream).await;
+                    });
+                }
+                Err(_e) => break,
+            }
+        }
+    });
+}
+
+/// Build RESP array for args ["PING"] -> "*1\r\n$4\r\nPING\r\n"
+fn build_resp(args: &[&str]) -> String {
+    let mut s = format!("*{}\r\n", args.len());
+    for a in args {
+        s.push_str(&format!("${}\r\n{}\r\n", a.len(), a));
+    }
+    s
+}
+
+async fn connect(port: u16) -> TcpStream {
+    let mut attempts = 0;
+    loop {
+        match TcpStream::connect(format!("127.0.0.1:{}", port)).await {
+            Ok(s) => return s,
+            Err(_) if attempts < 30 => {
+                attempts += 1;
+                sleep(Duration::from_millis(100)).await;
+            }
+            Err(e) => panic!("Failed to connect: {}", e),
+        }
+    }
+}
+
+fn find_crlf(buf: &[u8], start: usize) -> Option<usize> {
+    let mut i = start;
+    while i + 1 < buf.len() {
+        if buf[i] == b'\r' && buf[i + 1] == b'\n' {
+            return Some(i);
+        }
+        i += 1;
+    }
+    None
+}
+
+fn parse_number_i64(buf: &[u8], start: usize, end: usize) -> Option<i64> {
+    let s = std::str::from_utf8(&buf[start..end]).ok()?;
+    s.parse::<i64>().ok()
+}
+
+// Return number of bytes that make up a complete RESP element starting at 'i', or None if incomplete.
+fn parse_elem(buf: &[u8], i: usize) -> Option<usize> {
+    if i >= buf.len() {
+        return None;
+    }
+    match buf[i] {
+        b'+' | b'-' | b':' => {
+            let end = find_crlf(buf, i + 1)?;
+            Some(end + 2 - i)
+        }
+        b'$' => {
+            let hdr_end = find_crlf(buf, i + 1)?;
+            let n = parse_number_i64(buf, i + 1, hdr_end)?;
+            if n < 0 {
+                // Null bulk string: only header
+                Some(hdr_end + 2 - i)
+            } else {
+                let need = hdr_end + 2 + (n as usize) + 2;
+                if need <= buf.len() {
+                    Some(need - i)
+                } else {
+                    None
+                }
+            }
+        }
+        b'*' => {
+            let hdr_end = find_crlf(buf, i + 1)?;
+            let n = parse_number_i64(buf, i + 1, hdr_end)?;
+            if n < 0 {
+                // Null array: only header
+                Some(hdr_end + 2 - i)
+            } else {
+                let mut j = hdr_end + 2;
+                for _ in 0..(n as usize) {
+                    let consumed = parse_elem(buf, j)?;
+                    j += consumed;
+                }
+                Some(j - i)
+            }
+        }
+        _ => None,
+    }
+}
+
+fn resp_frame_len(buf: &[u8]) -> Option<usize> {
+    parse_elem(buf, 0)
+}
+
+async fn read_full_resp(stream: &mut TcpStream) -> String {
+    let mut buf: Vec<u8> = Vec::with_capacity(8192);
+    let mut tmp = vec![0u8; 4096];
+
+    loop {
+        if let Some(total) = resp_frame_len(&buf) {
+            if buf.len() >= total {
+                return String::from_utf8_lossy(&buf[..total]).to_string();
+            }
+        }
+
+        match tokio::time::timeout(Duration::from_secs(2), stream.read(&mut tmp)).await {
+            Ok(Ok(n)) => {
+                if n == 0 {
+                    if let Some(total) = resp_frame_len(&buf) {
+                        if buf.len() >= total {
+                            return String::from_utf8_lossy(&buf[..total]).to_string();
+                        }
+                    }
+                    return String::from_utf8_lossy(&buf).to_string();
+                }
+                buf.extend_from_slice(&tmp[..n]);
+            }
+            Ok(Err(e)) => panic!("read error: {}", e),
+            Err(_) => panic!("timeout waiting for reply"),
+        }
+
+        if buf.len() > 8 * 1024 * 1024 {
+            panic!("reply too large");
+        }
+    }
+}
+
+async fn send_cmd(stream: &mut TcpStream, args: &[&str]) -> String {
+    let req = build_resp(args);
+    stream.write_all(req.as_bytes()).await.unwrap();
+    read_full_resp(stream).await
+}
+
+// Assert helpers with clearer output
+fn assert_contains(haystack: &str, needle: &str, ctx: &str) {
+    assert!(
+        haystack.contains(needle),
+        "ASSERT CONTAINS failed: '{}' not found in response.\nContext: {}\nResponse:\n{}",
+        needle,
+        ctx,
+        haystack
+    );
+}
+
+fn assert_eq_resp(actual: &str, expected: &str, ctx: &str) {
+    assert!(
+        actual == expected,
+        "ASSERT EQUAL failed.\nContext: {}\nExpected:\n{:?}\nActual:\n{:?}",
+        ctx,
+        expected,
+        actual
+    );
+}
+
+/// Extract the payload of a single RESP Bulk String reply.
+/// Example input:
+///   "$5\r\nhello\r\n" -> Some("hello".to_string())
+fn extract_bulk_payload(resp: &str) -> Option<String> {
+    // find first CRLF after "$len"
+    let first = resp.find("\r\n")?;
+    let after = &resp[(first + 2)..];
+    // find next CRLF ending payload
+    let second = after.find("\r\n")?;
+    Some(after[..second].to_string())
+}
+
+// =========================
+// Test suites
+// =========================
+
+#[tokio::test]
+async fn test_01_connection_and_info() {
+    let (server, port) = start_test_server("conn_info").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // redis-cli may send COMMAND DOCS, our server replies empty array; harmless.
+    let pong = send_cmd(&mut s, &["PING"]).await;
+    assert_contains(&pong, "PONG", "PING should return PONG");
+
+    let echo = send_cmd(&mut s, &["ECHO", "hello"]).await;
+    assert_contains(&echo, "hello", "ECHO hello");
+
+    // INFO (general)
+    let info = send_cmd(&mut s, &["INFO"]).await;
+    assert_contains(&info, "redis_version", "INFO should include redis_version");
+
+    // INFO REPLICATION (static stub)
+    let repl = send_cmd(&mut s, &["INFO", "replication"]).await;
+    assert_contains(&repl, "role:master", "INFO replication role");
+
+    // CONFIG GET subset
+    let cfg = send_cmd(&mut s, &["CONFIG", "GET", "databases"]).await;
+    assert_contains(&cfg, "databases", "CONFIG GET databases");
+    assert_contains(&cfg, "16", "CONFIG GET databases value");
+
+    // CLIENT name
+    let setname = send_cmd(&mut s, &["CLIENT", "SETNAME", "myapp"]).await;
+    assert_contains(&setname, "OK", "CLIENT SETNAME");
+
+    let getname = send_cmd(&mut s, &["CLIENT", "GETNAME"]).await;
+    assert_contains(&getname, "myapp", "CLIENT GETNAME");
+
+    // SELECT db
+    let sel = send_cmd(&mut s, &["SELECT", "0"]).await;
+    assert_contains(&sel, "OK", "SELECT 0");
+
+    // QUIT should close connection after sending OK
+    let quit = send_cmd(&mut s, &["QUIT"]).await;
+    assert_contains(&quit, "OK", "QUIT should return OK");
+}
+
+#[tokio::test]
+async fn test_02_strings_and_expiry() {
+    let (server, port) = start_test_server("strings").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // SET / GET
+    let set = send_cmd(&mut s, &["SET", "user:1", "alice"]).await;
+    assert_contains(&set, "OK", "SET user:1 alice");
+
+    let get = send_cmd(&mut s, &["GET", "user:1"]).await;
+    assert_contains(&get, "alice", "GET user:1");
+
+    // EXISTS / DEL
+    let ex1 = send_cmd(&mut s, &["EXISTS", "user:1"]).await;
+    assert_contains(&ex1, "1", "EXISTS user:1");
+
+    let del = send_cmd(&mut s, &["DEL", "user:1"]).await;
+    assert_contains(&del, "1", "DEL user:1");
+
+    let ex0 = send_cmd(&mut s, &["EXISTS", "user:1"]).await;
+    assert_contains(&ex0, "0", "EXISTS after DEL");
+
+    // INCR behavior
+    let i1 = send_cmd(&mut s, &["INCR", "count"]).await;
+    assert_contains(&i1, "1", "INCR new key -> 1");
+    let i2 = send_cmd(&mut s, &["INCR", "count"]).await;
+    assert_contains(&i2, "2", "INCR existing -> 2");
+    let _ = send_cmd(&mut s, &["SET", "notnum", "abc"]).await;
+    let ierr = send_cmd(&mut s, &["INCR", "notnum"]).await;
+    assert_contains(&ierr, "ERR", "INCR on non-numeric should ERR");
+
+    // Expiration via SET EX
+    let setex = send_cmd(&mut s, &["SET", "tmp:1", "boom", "EX", "1"]).await;
+    assert_contains(&setex, "OK", "SET tmp:1 EX 1");
+
+    let g_immediate = send_cmd(&mut s, &["GET", "tmp:1"]).await;
+    assert_contains(&g_immediate, "boom", "GET tmp:1 immediately");
+
+    let ttl = send_cmd(&mut s, &["TTL", "tmp:1"]).await;
+    // Implementation returns a SimpleString, accept any numeric content
+    assert!(
+        ttl.contains("1") || ttl.contains("0"),
+        "TTL should be 1 or 0, got: {}",
+        ttl
+    );
+
+    sleep(Duration::from_millis(1100)).await;
+    let g_after = send_cmd(&mut s, &["GET", "tmp:1"]).await;
+    assert_contains(&g_after, "$-1", "GET tmp:1 after expiry -> Null");
+
+    // TYPE
+    let _ = send_cmd(&mut s, &["SET", "t", "v"]).await;
+    let ty = send_cmd(&mut s, &["TYPE", "t"]).await;
+    assert_contains(&ty, "string", "TYPE string key");
+    let ty_none = send_cmd(&mut s, &["TYPE", "noexist"]).await;
+    assert_contains(&ty_none, "none", "TYPE nonexistent");
+}
+
+#[tokio::test]
+async fn test_03_scan_and_keys() {
+    let (server, port) = start_test_server("scan").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    for i in 0..5 {
+        let _ = send_cmd(&mut s, &["SET", &format!("key{}", i), &format!("value{}", i)]).await;
+    }
+
+    let scan = send_cmd(&mut s, &["SCAN", "0", "MATCH", "key*", "COUNT", "10"]).await;
+    assert_contains(&scan, "key0", "SCAN should return keys with MATCH");
+    assert_contains(&scan, "key4", "SCAN should return last key");
+
+    let keys = send_cmd(&mut s, &["KEYS", "*"]).await;
+    assert_contains(&keys, "key0", "KEYS * includes key0");
+    assert_contains(&keys, "key4", "KEYS * includes key4");
+}
+
+#[tokio::test]
+async fn test_04_hashes_suite() {
+    let (server, port) = start_test_server("hashes").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // HSET (single, returns number of new fields)
+    let h1 = send_cmd(&mut s, &["HSET", "profile:1", "name", "alice"]).await;
+    assert_contains(&h1, "1", "HSET new field -> 1");
+
+    // HGET
+    let hg = send_cmd(&mut s, &["HGET", "profile:1", "name"]).await;
+    assert_contains(&hg, "alice", "HGET existing field");
+
+    // HSET multiple
+    let h2 = send_cmd(&mut s, &["HSET", "profile:1", "age", "30", "city", "paris"]).await;
+    assert_contains(&h2, "2", "HSET added 2 new fields");
+
+    // HMGET
+    let hmg = send_cmd(&mut s, &["HMGET", "profile:1", "name", "age", "city", "nope"]).await;
+    assert_contains(&hmg, "alice", "HMGET name");
+    assert_contains(&hmg, "30", "HMGET age");
+    assert_contains(&hmg, "paris", "HMGET city");
+    assert_contains(&hmg, "$-1", "HMGET non-existent -> Null");
+
+    // HGETALL
+    let hga = send_cmd(&mut s, &["HGETALL", "profile:1"]).await;
+    assert_contains(&hga, "name", "HGETALL contains name");
+    assert_contains(&hga, "alice", "HGETALL contains alice");
+
+    // HLEN
+    let hlen = send_cmd(&mut s, &["HLEN", "profile:1"]).await;
+    assert_contains(&hlen, "3", "HLEN is 3");
+
+    // HEXISTS
+    let hex1 = send_cmd(&mut s, &["HEXISTS", "profile:1", "age"]).await;
+    assert_contains(&hex1, "1", "HEXISTS age true");
+    let hex0 = send_cmd(&mut s, &["HEXISTS", "profile:1", "nope"]).await;
+    assert_contains(&hex0, "0", "HEXISTS nope false");
+
+    // HKEYS / HVALS
+    let hkeys = send_cmd(&mut s, &["HKEYS", "profile:1"]).await;
+    assert_contains(&hkeys, "name", "HKEYS includes name");
+    let hvals = send_cmd(&mut s, &["HVALS", "profile:1"]).await;
+    assert_contains(&hvals, "alice", "HVALS includes alice");
+
+    // HSETNX
+    let hnx0 = send_cmd(&mut s, &["HSETNX", "profile:1", "name", "bob"]).await;
+    assert_contains(&hnx0, "0", "HSETNX existing field -> 0");
+    let hnx1 = send_cmd(&mut s, &["HSETNX", "profile:1", "nickname", "ali"]).await;
+    assert_contains(&hnx1, "1", "HSETNX new field -> 1");
+
+    // HSCAN
+    let hscan = send_cmd(&mut s, &["HSCAN", "profile:1", "0", "MATCH", "n*", "COUNT", "10"]).await;
+    assert_contains(&hscan, "name", "HSCAN matches fields starting with n");
+    assert_contains(&hscan, "nickname", "HSCAN nickname present");
+
+    // HDEL
+    let hdel = send_cmd(&mut s, &["HDEL", "profile:1", "city", "age"]).await;
+    assert_contains(&hdel, "2", "HDEL removed two fields");
+}
+
+#[tokio::test]
+async fn test_05_lists_suite_including_blpop() {
+    let (server, port) = start_test_server("lists").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut a = connect(port).await;
+
+    // LPUSH / RPUSH / LLEN
+    let lp = send_cmd(&mut a, &["LPUSH", "q:jobs", "a", "b"]).await;
+    assert_contains(&lp, "2", "LPUSH added 2, length 2");
+
+    let rp = send_cmd(&mut a, &["RPUSH", "q:jobs", "c"]).await;
+    assert_contains(&rp, "3", "RPUSH now length 3");
+
+    let llen = send_cmd(&mut a, &["LLEN", "q:jobs"]).await;
+    assert_contains(&llen, "3", "LLEN 3");
+
+    // LINDEX / LRANGE
+    let lidx = send_cmd(&mut a, &["LINDEX", "q:jobs", "0"]).await;
+    assert_eq_resp(&lidx, "$1\r\nb\r\n", "LINDEX q:jobs 0 should be b");
+
+    let lr = send_cmd(&mut a, &["LRANGE", "q:jobs", "0", "-1"]).await;
+    assert_eq_resp(&lr, "*3\r\n$1\r\nb\r\n$1\r\na\r\n$1\r\nc\r\n", "LRANGE q:jobs 0 -1 should be [b,a,c]");
+
+    // LTRIM
+    let ltrim = send_cmd(&mut a, &["LTRIM", "q:jobs", "0", "1"]).await;
+    assert_contains(&ltrim, "OK", "LTRIM OK");
+    let lr_post = send_cmd(&mut a, &["LRANGE", "q:jobs", "0", "-1"]).await;
+    assert_eq_resp(&lr_post, "*2\r\n$1\r\nb\r\n$1\r\na\r\n", "After LTRIM, list [b,a]");
+
+    // LREM remove first occurrence of b
+    let lrem = send_cmd(&mut a, &["LREM", "q:jobs", "1", "b"]).await;
+    assert_contains(&lrem, "1", "LREM removed 1");
+
+    // LPOP and RPOP
+    let lpop1 = send_cmd(&mut a, &["LPOP", "q:jobs"]).await;
+    assert_contains(&lpop1, "$1\r\na\r\n", "LPOP returns a");
+    let rpop_empty = send_cmd(&mut a, &["RPOP", "q:jobs"]).await; // empty now
+    assert_contains(&rpop_empty, "$-1", "RPOP on empty -> Null");
+
+    // LPOP with count on empty -> []
+    let lpop0 = send_cmd(&mut a, &["LPOP", "q:jobs", "2"]).await;
+    assert_eq_resp(&lpop0, "*0\r\n", "LPOP with count on empty returns empty array");
+
+    // BLPOP: block on one client, push from another
+    let c1 = connect(port).await;
+    let mut c2 = connect(port).await;
+
+    // Start BLPOP on c1
+    let blpop_task = tokio::spawn(async move {
+        let mut c1_local = c1;
+        send_cmd(&mut c1_local, &["BLPOP", "q:block", "5"]).await
+    });
+
+    // Give it time to register waiter
+    sleep(Duration::from_millis(150)).await;
+
+    // Push from c2 to wake BLPOP
+    let _ = send_cmd(&mut c2, &["LPUSH", "q:block", "x"]).await;
+
+    // Await BLPOP result
+    let blpop_res = blpop_task.await.expect("BLPOP task join");
+    assert_contains(&blpop_res, "q:block", "BLPOP returned key");
+    assert_contains(&blpop_res, "x", "BLPOP returned element");
+}
+
+#[tokio::test]
+async fn test_06_flushdb_suite() {
+    let (server, port) = start_test_server("flushdb").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    let _ = send_cmd(&mut s, &["SET", "k1", "v1"]).await;
+    let _ = send_cmd(&mut s, &["HSET", "h1", "f", "v"]).await;
+    let _ = send_cmd(&mut s, &["LPUSH", "l1", "a"]).await;
+
+    let keys_before = send_cmd(&mut s, &["KEYS", "*"]).await;
+    assert_contains(&keys_before, "k1", "have string key before FLUSHDB");
+    assert_contains(&keys_before, "h1", "have hash key before FLUSHDB");
+    assert_contains(&keys_before, "l1", "have list key before FLUSHDB");
+
+    let fl = send_cmd(&mut s, &["FLUSHDB"]).await;
+    assert_contains(&fl, "OK", "FLUSHDB OK");
+
+    let keys_after = send_cmd(&mut s, &["KEYS", "*"]).await;
+    assert_eq_resp(&keys_after, "*0\r\n", "DB should be empty after FLUSHDB");
+}
+
+#[tokio::test]
+async fn test_07_age_stateless_suite() {
+    let (server, port) = start_test_server("age_stateless").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // GENENC -> [recipient, identity]
+    let gen = send_cmd(&mut s, &["AGE", "GENENC"]).await;
+    assert!(
+        gen.starts_with("*2\r\n$"),
+        "AGE GENENC should return array [recipient, identity], got:\n{}",
+        gen
+    );
+
+    // Parse simple RESP array of two bulk strings to extract keys
+    fn parse_two_bulk_array(resp: &str) -> (String, String) {
+        // naive parse for tests
+        let mut lines = resp.lines();
+        let _ = lines.next(); // *2
+        // $len
+        let _ = lines.next();
+        let recip = lines.next().unwrap_or("").to_string();
+        let _ = lines.next();
+        let ident = lines.next().unwrap_or("").to_string();
+        (recip, ident)
+    }
+    let (recipient, identity) = parse_two_bulk_array(&gen);
+    assert!(
+        recipient.starts_with("age1") && identity.starts_with("AGE-SECRET-KEY-1"),
+        "Unexpected AGE key formats.\nrecipient: {}\nidentity: {}",
+        recipient,
+        identity
+    );
+
+    // ENCRYPT / DECRYPT
+    let ct = send_cmd(&mut s, &["AGE", "ENCRYPT", &recipient, "hello world"]).await;
+    let ct_b64 = extract_bulk_payload(&ct).expect("Failed to parse bulk payload from ENCRYPT");
+    let pt = send_cmd(&mut s, &["AGE", "DECRYPT", &identity, &ct_b64]).await;
+    assert_contains(&pt, "hello world", "AGE DECRYPT round-trip");
+
+    // GENSIGN -> [verify_pub_b64, sign_secret_b64]
+    let gensign = send_cmd(&mut s, &["AGE", "GENSIGN"]).await;
+    let (verify_pub, sign_secret) = parse_two_bulk_array(&gensign);
+    assert!(
+        !verify_pub.is_empty() && !sign_secret.is_empty(),
+        "GENSIGN returned empty keys"
+    );
+
+    // SIGN / VERIFY
+    let sig = send_cmd(&mut s, &["AGE", "SIGN", &sign_secret, "msg"]).await;
+    let sig_b64 = extract_bulk_payload(&sig).expect("Failed to parse bulk payload from SIGN");
+    let v_ok = send_cmd(&mut s, &["AGE", "VERIFY", &verify_pub, "msg", &sig_b64]).await;
+    assert_contains(&v_ok, "1", "VERIFY should be 1 for valid signature");
+
+    let v_bad = send_cmd(&mut s, &["AGE", "VERIFY", &verify_pub, "tampered", &sig_b64]).await;
+    assert_contains(&v_bad, "0", "VERIFY should be 0 for invalid message/signature");
+}
+
+#[tokio::test]
+async fn test_08_age_persistent_named_suite() {
+    let (server, port) = start_test_server("age_persistent").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // KEYGEN + ENCRYPTNAME/DECRYPTNAME
+    let kg = send_cmd(&mut s, &["AGE", "KEYGEN", "app1"]).await;
+    assert!(
+        kg.starts_with("*2\r\n"),
+        "AGE KEYGEN should return [recipient, identity], got:\n{}",
+        kg
+    );
+
+    let ct = send_cmd(&mut s, &["AGE", "ENCRYPTNAME", "app1", "hello"]).await;
+    let ct_b64 = extract_bulk_payload(&ct).expect("Failed to parse bulk payload from ENCRYPTNAME");
+    let pt = send_cmd(&mut s, &["AGE", "DECRYPTNAME", "app1", &ct_b64]).await;
+    assert_contains(&pt, "hello", "DECRYPTNAME round-trip");
+
+    // SIGNKEYGEN + SIGNNAME/VERIFYNAME
+    let skg = send_cmd(&mut s, &["AGE", "SIGNKEYGEN", "app1"]).await;
+    assert!(
+        skg.starts_with("*2\r\n"),
+        "AGE SIGNKEYGEN should return [verify_pub, sign_secret], got:\n{}",
+        skg
+    );
+
+    let sig = send_cmd(&mut s, &["AGE", "SIGNNAME", "app1", "m"] ).await;
+    let sig_b64 = extract_bulk_payload(&sig).expect("Failed to parse bulk payload from SIGNNAME");
+    let v1 = send_cmd(&mut s, &["AGE", "VERIFYNAME", "app1", "m", &sig_b64]).await;
+    assert_contains(&v1, "1", "VERIFYNAME valid => 1");
+
+    let v0 = send_cmd(&mut s, &["AGE", "VERIFYNAME", "app1", "bad", &sig_b64]).await;
+    assert_contains(&v0, "0", "VERIFYNAME invalid => 0");
+
+    // AGE LIST
+    let lst = send_cmd(&mut s, &["AGE", "LIST"]).await;
+    assert_contains(&lst, "encpub", "AGE LIST label encpub");
+    assert_contains(&lst, "app1", "AGE LIST includes app1");
+}
+
+#[tokio::test]
+async fn test_10_expire_pexpire_persist() {
+   let (server, port) = start_test_server("expire_suite").await;
+   spawn_listener(server, port).await;
+   sleep(Duration::from_millis(150)).await;
+
+   let mut s = connect(port).await;
+
+   // EXPIRE: seconds
+   let _ = send_cmd(&mut s, &["SET", "exp:s", "v"]).await;
+   let ex = send_cmd(&mut s, &["EXPIRE", "exp:s", "1"]).await;
+   assert_contains(&ex, "1", "EXPIRE exp:s 1 -> 1 (applied)");
+   let ttl1 = send_cmd(&mut s, &["TTL", "exp:s"]).await;
+   assert!(
+       ttl1.contains("1") || ttl1.contains("0"),
+       "TTL exp:s should be 1 or 0, got: {}",
+       ttl1
+   );
+   sleep(Duration::from_millis(1100)).await;
+   let get_after = send_cmd(&mut s, &["GET", "exp:s"]).await;
+   assert_contains(&get_after, "$-1", "GET after expiry should be Null");
+   let ttl_after = send_cmd(&mut s, &["TTL", "exp:s"]).await;
+   assert_contains(&ttl_after, "-2", "TTL after expiry -> -2");
+   let exists_after = send_cmd(&mut s, &["EXISTS", "exp:s"]).await;
+   assert_contains(&exists_after, "0", "EXISTS after expiry -> 0");
+
+   // PEXPIRE: milliseconds
+   let _ = send_cmd(&mut s, &["SET", "exp:ms", "v"]).await;
+   let pex = send_cmd(&mut s, &["PEXPIRE", "exp:ms", "1500"]).await;
+   assert_contains(&pex, "1", "PEXPIRE exp:ms 1500 -> 1 (applied)");
+   let ttl_ms1 = send_cmd(&mut s, &["TTL", "exp:ms"]).await;
+   assert!(
+       ttl_ms1.contains("1") || ttl_ms1.contains("0"),
+       "TTL exp:ms should be 1 or 0 soon after PEXPIRE, got: {}",
+       ttl_ms1
+   );
+   sleep(Duration::from_millis(1600)).await;
+   let exists_ms_after = send_cmd(&mut s, &["EXISTS", "exp:ms"]).await;
+   assert_contains(&exists_ms_after, "0", "EXISTS exp:ms after ms expiry -> 0");
+
+   // PERSIST: remove expiration
+   let _ = send_cmd(&mut s, &["SET", "exp:persist", "v"]).await;
+   let _ = send_cmd(&mut s, &["EXPIRE", "exp:persist", "5"]).await;
+   let ttl_pre = send_cmd(&mut s, &["TTL", "exp:persist"]).await;
+   assert!(
+       ttl_pre.contains("5") || ttl_pre.contains("4") || ttl_pre.contains("3") || ttl_pre.contains("2") || ttl_pre.contains("1") || ttl_pre.contains("0"),
+       "TTL exp:persist should be >=0 before persist, got: {}",
+       ttl_pre
+   );
+   let persist1 = send_cmd(&mut s, &["PERSIST", "exp:persist"]).await;
+   assert_contains(&persist1, "1", "PERSIST should remove expiration");
+   let ttl_post = send_cmd(&mut s, &["TTL", "exp:persist"]).await;
+   assert_contains(&ttl_post, "-1", "TTL after PERSIST -> -1 (no expiration)");
+   // Second persist should return 0 (nothing to remove)
+   let persist2 = send_cmd(&mut s, &["PERSIST", "exp:persist"]).await;
+   assert_contains(&persist2, "0", "PERSIST again -> 0 (no expiration to remove)");
+}
+
+#[tokio::test]
+async fn test_11_set_with_options() {
+    let (server, port) = start_test_server("set_opts").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // SET with GET on non-existing key -> returns Null, sets value
+    let set_get1 = send_cmd(&mut s, &["SET", "s1", "v1", "GET"]).await;
+    assert_contains(&set_get1, "$-1", "SET s1 v1 GET returns Null when key didn't exist");
+    let g1 = send_cmd(&mut s, &["GET", "s1"]).await;
+    assert_contains(&g1, "v1", "GET s1 after first SET");
+
+    // SET with GET should return old value, then set to new
+    let set_get2 = send_cmd(&mut s, &["SET", "s1", "v2", "GET"]).await;
+    assert_contains(&set_get2, "v1", "SET s1 v2 GET returns previous value v1");
+    let g2 = send_cmd(&mut s, &["GET", "s1"]).await;
+    assert_contains(&g2, "v2", "GET s1 now v2");
+
+    // NX prevents update when key exists; with GET should return Null and not change
+    let set_nx = send_cmd(&mut s, &["SET", "s1", "v3", "NX", "GET"]).await;
+    assert_contains(&set_nx, "$-1", "SET s1 v3 NX GET returns Null when not set");
+    let g3 = send_cmd(&mut s, &["GET", "s1"]).await;
+    assert_contains(&g3, "v2", "GET s1 remains v2 after NX prevented write");
+
+    // NX allows set when key does not exist
+    let set_nx2 = send_cmd(&mut s, &["SET", "s2", "v10", "NX"]).await;
+    assert_contains(&set_nx2, "OK", "SET s2 v10 NX -> OK for new key");
+    let g4 = send_cmd(&mut s, &["GET", "s2"]).await;
+    assert_contains(&g4, "v10", "GET s2 is v10");
+
+    // XX requires existing key; with GET returns old value and sets new
+    let set_xx = send_cmd(&mut s, &["SET", "s2", "v11", "XX", "GET"]).await;
+    assert_contains(&set_xx, "v10", "SET s2 v11 XX GET returns previous v10");
+    let g5 = send_cmd(&mut s, &["GET", "s2"]).await;
+    assert_contains(&g5, "v11", "GET s2 is now v11");
+
+    // PX expiration path via SET options
+    let set_px = send_cmd(&mut s, &["SET", "s3", "vpx", "PX", "500"]).await;
+    assert_contains(&set_px, "OK", "SET s3 vpx PX 500 -> OK");
+    let ttl_px1 = send_cmd(&mut s, &["TTL", "s3"]).await;
+    assert!(
+        ttl_px1.contains("0") || ttl_px1.contains("1"),
+        "TTL s3 immediately after PX should be 1 or 0, got: {}",
+        ttl_px1
+    );
+    sleep(Duration::from_millis(650)).await;
+    let g6 = send_cmd(&mut s, &["GET", "s3"]).await;
+    assert_contains(&g6, "$-1", "GET s3 after PX expiry -> Null");
+}
+
+#[tokio::test]
+async fn test_09_mget_mset_and_variadic_exists_del() {
+   let (server, port) = start_test_server("mget_mset_variadic").await;
+   spawn_listener(server, port).await;
+   sleep(Duration::from_millis(150)).await;
+
+   let mut s = connect(port).await;
+
+   // MSET multiple keys
+   let mset = send_cmd(&mut s, &["MSET", "k1", "v1", "k2", "v2", "k3", "v3"]).await;
+   assert_contains(&mset, "OK", "MSET k1 v1 k2 v2 k3 v3 -> OK");
+
+   // MGET should return values and Null for missing
+   let mget = send_cmd(&mut s, &["MGET", "k1", "k2", "nope", "k3"]).await;
+   // Expect an array with 4 entries; verify payloads
+   assert_contains(&mget, "v1", "MGET k1");
+   assert_contains(&mget, "v2", "MGET k2");
+   assert_contains(&mget, "v3", "MGET k3");
+   assert_contains(&mget, "$-1", "MGET missing returns Null");
+
+   // EXISTS variadic: count how many exist
+   let exists_multi = send_cmd(&mut s, &["EXISTS", "k1", "nope", "k3"]).await;
+   // Server returns SimpleString numeric, e.g. +2
+   assert_contains(&exists_multi, "2", "EXISTS k1 nope k3 -> 2");
+
+   // DEL variadic: delete multiple keys, return count deleted
+   let del_multi = send_cmd(&mut s, &["DEL", "k1", "k3", "nope"]).await;
+   assert_contains(&del_multi, "2", "DEL k1 k3 nope -> 2");
+
+   // Verify deletion
+   let exists_after = send_cmd(&mut s, &["EXISTS", "k1", "k3"]).await;
+   assert_contains(&exists_after, "0", "EXISTS k1 k3 after DEL -> 0");
+
+   // MGET after deletion should include Nulls for deleted keys
+   let mget_after = send_cmd(&mut s, &["MGET", "k1", "k2", "k3"]).await;
+   assert_contains(&mget_after, "$-1", "MGET k1 after DEL -> Null");
+   assert_contains(&mget_after, "v2", "MGET k2 remains");
+   assert_contains(&mget_after, "$-1", "MGET k3 after DEL -> Null");
+}
+#[tokio::test]
+async fn test_12_hash_incr() {
+    let (server, port) = start_test_server("hash_incr").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // Integer increments
+    let _ = send_cmd(&mut s, &["HSET", "hinc", "a", "1"]).await;
+    let r1 = send_cmd(&mut s, &["HINCRBY", "hinc", "a", "2"]).await;
+    assert_contains(&r1, "3", "HINCRBY hinc a 2 -&gt; 3");
+
+    let r2 = send_cmd(&mut s, &["HINCRBY", "hinc", "a", "-1"]).await;
+    assert_contains(&r2, "2", "HINCRBY hinc a -1 -&gt; 2");
+
+    let r3 = send_cmd(&mut s, &["HINCRBY", "hinc", "b", "5"]).await;
+    assert_contains(&r3, "5", "HINCRBY hinc b 5 -&gt; 5");
+
+    // HINCRBY error on non-integer field
+    let _ = send_cmd(&mut s, &["HSET", "hinc", "s", "x"]).await;
+    let r_err = send_cmd(&mut s, &["HINCRBY", "hinc", "s", "1"]).await;
+    assert_contains(&r_err, "ERR", "HINCRBY on non-integer field should ERR");
+
+    // Float increments
+    let r4 = send_cmd(&mut s, &["HINCRBYFLOAT", "hinc", "f", "1.5"]).await;
+    assert_contains(&r4, "1.5", "HINCRBYFLOAT hinc f 1.5 -&gt; 1.5");
+
+    let r5 = send_cmd(&mut s, &["HINCRBYFLOAT", "hinc", "f", "2.5"]).await;
+    // Could be "4", "4.0", or "4.000000", accept "4" substring
+    assert_contains(&r5, "4", "HINCRBYFLOAT hinc f 2.5 -&gt; 4");
+
+    // HINCRBYFLOAT error on non-float field
+    let _ = send_cmd(&mut s, &["HSET", "hinc", "notf", "abc"]).await;
+    let r6 = send_cmd(&mut s, &["HINCRBYFLOAT", "hinc", "notf", "1"]).await;
+    assert_contains(&r6, "ERR", "HINCRBYFLOAT on non-float field should ERR");
+}
+#[tokio::test]
+async fn test_05b_brpop_suite() {
+    let (server, port) = start_test_server("lists_brpop").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut a = connect(port).await;
+
+    // RPUSH some initial data, BRPOP should take from the right
+    let _ = send_cmd(&mut a, &["RPUSH", "q:rjobs", "1", "2"]).await;
+    let br_nonblock = send_cmd(&mut a, &["BRPOP", "q:rjobs", "0"]).await;
+    // Should pop the rightmost element "2"
+    assert_contains(&br_nonblock, "q:rjobs", "BRPOP returns key");
+    assert_contains(&br_nonblock, "2", "BRPOP returns rightmost element");
+
+    // Now test blocking BRPOP: start blocked client, then RPUSH from another client
+    let c1 = connect(port).await;
+    let mut c2 = connect(port).await;
+
+    // Start BRPOP on c1
+    let brpop_task = tokio::spawn(async move {
+        let mut c1_local = c1;
+        send_cmd(&mut c1_local, &["BRPOP", "q:blockr", "5"]).await
+    });
+
+    // Give it time to register waiter
+    sleep(Duration::from_millis(150)).await;
+
+    // Push from right to wake BRPOP
+    let _ = send_cmd(&mut c2, &["RPUSH", "q:blockr", "X"]).await;
+
+    // Await BRPOP result
+    let brpop_res = brpop_task.await.expect("BRPOP task join");
+    assert_contains(&brpop_res, "q:blockr", "BRPOP returned key");
+    assert_contains(&brpop_res, "X", "BRPOP returned element");
+}
+#[tokio::test]
+async fn test_13_dbsize() {
+    let (server, port) = start_test_server("dbsize").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // Initially empty
+    let n0 = send_cmd(&mut s, &["DBSIZE"]).await;
+    assert_contains(&n0, "0", "DBSIZE initial should be 0");
+
+    // Add a string, a hash, and a list -> dbsize = 3
+    let _ = send_cmd(&mut s, &["SET", "s", "v"]).await;
+    let _ = send_cmd(&mut s, &["HSET", "h", "f", "v"]).await;
+    let _ = send_cmd(&mut s, &["LPUSH", "l", "a", "b"]).await;
+
+    let n3 = send_cmd(&mut s, &["DBSIZE"]).await;
+    assert_contains(&n3, "3", "DBSIZE after adding s,h,l should be 3");
+
+    // Expire the string and wait, dbsize should drop to 2
+    let _ = send_cmd(&mut s, &["PEXPIRE", "s", "400"]).await;
+    sleep(Duration::from_millis(500)).await;
+
+    let n2 = send_cmd(&mut s, &["DBSIZE"]).await;
+    assert_contains(&n2, "2", "DBSIZE after string expiry should be 2");
+
+    // Delete remaining keys and confirm 0
+    let _ = send_cmd(&mut s, &["DEL", "h"]).await;
+    let _ = send_cmd(&mut s, &["DEL", "l"]).await;
+
+    let n_final = send_cmd(&mut s, &["DBSIZE"]).await;
+    assert_contains(&n_final, "0", "DBSIZE after deleting all keys should be 0");
+}
+#[tokio::test]
+async fn test_14_expireat_pexpireat() {
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    let (server, port) = start_test_server("expireat_suite").await;
+    spawn_listener(server, port).await;
+    sleep(Duration::from_millis(150)).await;
+
+    let mut s = connect(port).await;
+
+    // EXPIREAT: seconds since epoch
+    let now_secs = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64;
+    let _ = send_cmd(&mut s, &["SET", "exp:at:s", "v"]).await;
+    let exat = send_cmd(&mut s, &["EXPIREAT", "exp:at:s", &format!("{}", now_secs + 1)]).await;
+    assert_contains(&exat, "1", "EXPIREAT exp:at:s now+1s -> 1 (applied)");
+    let ttl1 = send_cmd(&mut s, &["TTL", "exp:at:s"]).await;
+    assert!(
+        ttl1.contains("1") || ttl1.contains("0"),
+        "TTL exp:at:s should be 1 or 0 shortly after EXPIREAT, got: {}",
+        ttl1
+    );
+    sleep(Duration::from_millis(1200)).await;
+    let exists_after_exat = send_cmd(&mut s, &["EXISTS", "exp:at:s"]).await;
+    assert_contains(&exists_after_exat, "0", "EXISTS exp:at:s after EXPIREAT expiry -> 0");
+
+    // PEXPIREAT: milliseconds since epoch
+    let now_ms = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_millis() as i64;
+    let _ = send_cmd(&mut s, &["SET", "exp:at:ms", "v"]).await;
+    let pexat = send_cmd(&mut s, &["PEXPIREAT", "exp:at:ms", &format!("{}", now_ms + 450)]).await;
+    assert_contains(&pexat, "1", "PEXPIREAT exp:at:ms now+450ms -> 1 (applied)");
+    let ttl2 = send_cmd(&mut s, &["TTL", "exp:at:ms"]).await;
+    assert!(
+        ttl2.contains("0") || ttl2.contains("1"),
+        "TTL exp:at:ms should be 0..1 soon after PEXPIREAT, got: {}",
+        ttl2
+    );
+    sleep(Duration::from_millis(600)).await;
+    let exists_after_pexat = send_cmd(&mut s, &["EXISTS", "exp:at:ms"]).await;
+    assert_contains(&exists_after_pexat, "0", "EXISTS exp:at:ms after PEXPIREAT expiry -> 0");
+}

src/server.rs

@@ -1,135 +0,0 @@
-use core::str;
-use std::collections::HashMap;
-use std::sync::Arc;
-use tokio::io::AsyncReadExt;
-use tokio::io::AsyncWriteExt;
-
-use crate::cmd::Cmd;
-use crate::error::DBError;
-use crate::options;
-use crate::protocol::Protocol;
-use crate::storage::Storage;
-
-#[derive(Clone)]
-pub struct Server {
-    pub db_cache: std::sync::Arc<std::sync::RwLock<HashMap<u64, Arc<Storage>>>>,
-    pub option: options::DBOption,
-    pub client_name: Option<String>,
-    pub selected_db: u64, // Changed from usize to u64
-    pub queued_cmd: Option<Vec<(Cmd, Protocol)>>,
-}
-
-impl Server {
-    pub async fn new(option: options::DBOption) -> Self {
-        Server {
-            db_cache: Arc::new(std::sync::RwLock::new(HashMap::new())),
-            option,
-            client_name: None,
-            selected_db: 0,
-            queued_cmd: None,
-        }
-    }
-
-    pub fn current_storage(&self) -> Result<Arc<Storage>, DBError> {
-        let mut cache = self.db_cache.write().unwrap();
-        
-        if let Some(storage) = cache.get(&self.selected_db) {
-            return Ok(storage.clone());
-        }
-        
-        
-        // Create new database file
-        let db_file_path = std::path::PathBuf::from(self.option.dir.clone())
-            .join(format!("{}.db", self.selected_db));
-        
-        // Ensure the directory exists before creating the database file
-        if let Some(parent_dir) = db_file_path.parent() {
-            std::fs::create_dir_all(parent_dir).map_err(|e| {
-                DBError(format!("Failed to create directory {}: {}", parent_dir.display(), e))
-            })?;
-        }
-        
-        println!("Creating new db file: {}", db_file_path.display());
-        
-        let storage = Arc::new(Storage::new(
-            db_file_path,
-            self.should_encrypt_db(self.selected_db),
-            self.option.encryption_key.as_deref()
-        )?);
-        
-        cache.insert(self.selected_db, storage.clone());
-        Ok(storage)
-    }
-    
-    fn should_encrypt_db(&self, _db_index: u64) -> bool {
-        self.option.encrypt
-    }
-
-    pub async fn handle(
-        &mut self,
-        mut stream: tokio::net::TcpStream,
-    ) -> Result<(), DBError> {
-        let mut buf = [0; 512];
-        
-        loop {
-            let len = match stream.read(&mut buf).await {
-                Ok(0) => {
-                    println!("[handle] connection closed");
-                    return Ok(());
-                }
-                Ok(len) => len,
-                Err(e) => {
-                    println!("[handle] read error: {:?}", e);
-                    return Err(e.into());
-                }
-            };
-
-            let mut s = str::from_utf8(&buf[..len])?;
-            while !s.is_empty() {
-                let (cmd, protocol, remaining) = match Cmd::from(s) {
-                    Ok((cmd, protocol, remaining)) => (cmd, protocol, remaining),
-                    Err(e) => {
-                        println!("\x1b[31;1mprotocol error: {:?}\x1b[0m", e);
-                        (Cmd::Unknow("protocol_error".to_string()), Protocol::err(&format!("protocol error: {}", e.0)), "")
-                    }
-                };
-                s = remaining;
-
-                if self.option.debug {
-                    println!("\x1b[34;1mgot command: {:?}, protocol: {:?}\x1b[0m", cmd, protocol);
-                } else {
-                    println!("got command: {:?}, protocol: {:?}", cmd, protocol);
-                }
-
-                // Check if this is a QUIT command before processing
-                let is_quit = matches!(cmd, Cmd::Quit);
-
-                let res = match cmd.run(self).await {
-                    Ok(p) => p,
-                    Err(e) => {
-                        if self.option.debug {
-                            eprintln!("[run error] {:?}", e);
-                        }
-                        Protocol::err(&format!("ERR {}", e.0))
-                    }
-                };
-                
-                if self.option.debug {
-                    println!("\x1b[34;1mqueued cmd {:?}\x1b[0m", self.queued_cmd);
-                    println!("\x1b[32;1mgoing to send response {}\x1b[0m", res.encode());
-                } else {
-                    print!("queued cmd {:?}", self.queued_cmd);
-                    println!("going to send response {}", res.encode());
-                }
-
-                _ = stream.write(res.encode().as_bytes()).await?;
-
-                // If this was a QUIT command, close the connection
-                if is_quit {
-                    println!("[handle] QUIT command received, closing connection");
-                    return Ok(());
-                }
-            }
-        }
-    }
-}