@anteros/core 0.0.19 → 0.0.21

package/tests/api.test.ts

@@ -11,6 +11,7 @@ let rest: InstanceType<typeof useRest>;
 
 beforeAll(async () => {
     formatConfig({
+        server: { port: 4000 },
         tenants: [{ id: TEST_TENANT, dir: "src", database: { uri: TEST_DB } }],
     });
     await syncTenants();
@@ -45,7 +46,7 @@ describe("insertOne", () => {
         expect(doc._id.length).toBe(24);
     });
     it("sets createdAt and updatedAt", async () => {
-        const doc = await rest.insertOne("items", { title: "ts" });
+        const doc: any = await rest.insertOne("items", { title: "ts" });
         expect(doc.createdAt).toBeString();
         expect(doc.updatedAt).toBeString();
     });
@@ -84,8 +85,8 @@ describe("findOne", () => {
 
 describe("updateOne", () => {
     it("$set title and changes updatedAt", async () => {
-        const doc = await rest.insertOne("items", { title: "old" });
-        const upd = await rest.updateOne("items", doc._id, { $set: { title: "new" } });
+        const doc: any = await rest.insertOne("items", { title: "old" });
+        const upd: any = await rest.updateOne("items", doc._id, { $set: { title: "new" } });
         expect(upd.title).toBe("new");
         expect(upd.updatedAt).not.toBe(doc.updatedAt);
     });
@@ -93,17 +94,18 @@ describe("updateOne", () => {
 
 describe("deleteOne", () => {
     it("deletes and returns _id", async () => {
-        const doc = await rest.insertOne("items", { title: "del-me" });
-        expect((await rest.deleteOne("items", doc._id))._id).toBe(doc._id);
+        const doc: any = await rest.insertOne("items", { title: "del-me" });
+        const deleted: any = await rest.deleteOne("items", doc._id);
+        expect(deleted?._id).toBe(doc._id);
     });
 });
 
 describe("insertMany", () => {
     it("inserts and returns array with _id", async () => {
-        const docs = await rest.insertMany("items", [{ title: "m1" }, { title: "m2" }]);
+        const docs: any[] = await rest.insertMany("items", [{ title: "m1" }, { title: "m2" }]);
         expect(docs.length).toBe(2);
-        expect(docs[0]._id).toBeString();
-        expect(docs[1]._id).toBeString();
+        expect(docs[0]!._id).toBeString();
+        expect(docs[1]!._id).toBeString();
     });
 });
 
@@ -173,7 +175,7 @@ describe("bulkUpdate", () => {
 
 describe("stats", () => {
     it("returns collection stats", async () => {
-        const s = await rest.stats("items");
+        const s: any = await rest.stats();
         expect(s).toBeDefined();
         expect(typeof s).toBe("object");
     });
@@ -184,7 +186,7 @@ describe("audit", () => {
         await rest.audit.addActivities([{
             internal: false,
             trace: { id: crypto.randomUUID() },
-            request: null,
+            request: undefined,
             meta: {},
             operation: {
                 tenant: TEST_TENANT,
@@ -199,7 +201,7 @@ describe("audit", () => {
             },
             ts: new Date(),
         }]);
-        const activities = await rest.audit.getActivities({ $limit: 10 });
+        const activities = await rest.audit.getActivities({ $match: {}, $limit: 10 });
         expect(Array.isArray(activities)).toBe(true);
         expect(activities.length).toBeGreaterThanOrEqual(1);
     });
@@ -266,7 +268,7 @@ describe("transactions", () => {
 
 describe("watch", () => {
     it("returns a change stream", async () => {
-        const stream = await rest.watch("items", [{ $match: { operationType: "insert" } }]);
+        const stream = await rest.watch("items", [{ $match: { operationType: "insert" } }], {} as any);
         expect(stream).toBeDefined();
         await stream.close();
     });

package/tests/cache.test.ts

@@ -0,0 +1,124 @@
+import { describe, it, expect, beforeEach } from "bun:test";
+import { Cache, useMemoryCache, useFilesystemCache } from "../utils/cache";
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+describe("Cache (memory)", () => {
+    let c: Cache;
+
+    beforeEach(() => {
+        c = useMemoryCache();
+    });
+
+    it("set + get round-trip", async () => {
+        await c.set({ key: "k", value: { id: 1 }, ttl: "5m" });
+        expect(await c.get({ key: "k" })).toEqual({ id: 1 });
+    });
+
+    it("setForever never expires", async () => {
+        await c.setForever({ key: "cfg", value: { theme: "dark" } });
+        expect(await c.get({ key: "cfg" })).toEqual({ theme: "dark" });
+    });
+
+    it("get returns null on miss", async () => {
+        expect(await c.get({ key: "nope" })).toBeUndefined();
+    });
+
+    it("has / missing", async () => {
+        await c.set({ key: "a", value: 1 });
+        expect(await c.has({ key: "a" })).toBe(true);
+        expect(await c.missing({ key: "a" })).toBe(false);
+        expect(await c.missing({ key: "b" })).toBe(true);
+    });
+
+    it("ttl expiry (ms)", async () => {
+        await c.set({ key: "x", value: 1, ttl: 50 });
+        expect(await c.get({ key: "x" })).toBe(1);
+        await sleep(80);
+        expect(await c.get({ key: "x" })).toBeUndefined();
+    });
+
+    it("getOrSet uses factory and caches", async () => {
+        let calls = 0;
+        const factory = async () => {
+            calls++;
+            return { n: calls };
+        };
+        expect(await c.getOrSet({ key: "g", factory })).toEqual({ n: 1 });
+        expect(await c.getOrSet({ key: "g", factory })).toEqual({ n: 1 });
+        expect(calls).toBe(1);
+    });
+
+    it("getOrSetForever", async () => {
+        const value = await c.getOrSetForever({ key: "f", factory: () => 42 });
+        expect(value).toBe(42);
+        expect(await c.get({ key: "f" })).toBe(42);
+    });
+
+    it("delete removes entry", async () => {
+        await c.set({ key: "d", value: 1 });
+        await c.delete({ key: "d" });
+        expect(await c.get({ key: "d" })).toBeUndefined();
+    });
+
+    it("deleteMany removes several keys", async () => {
+        await c.set({ key: "d1", value: 1 });
+        await c.set({ key: "d2", value: 2 });
+        await c.deleteMany({ keys: ["d1", "d2"] });
+        expect(await c.missing({ key: "d1" })).toBe(true);
+        expect(await c.missing({ key: "d2" })).toBe(true);
+    });
+
+    it("pull returns and removes", async () => {
+        await c.set({ key: "p", value: 7 });
+        expect(await c.pull("p")).toBe(7);
+        expect(await c.get({ key: "p" })).toBeUndefined();
+    });
+
+    it("clear empties everything", async () => {
+        await c.set({ key: "a", value: 1 });
+        await c.set({ key: "b", value: 2 });
+        await c.clear();
+        expect(await c.get({ key: "a" })).toBeUndefined();
+        expect(await c.get({ key: "b" })).toBeUndefined();
+    });
+
+    it("getOrSet recovers after ttl expiry (grace accepted)", async () => {
+        // miss → factory
+        const v1 = await c.getOrSet({ key: "e", factory: () => "fresh", ttl: 30, grace: 500 });
+        expect(v1).toBe("fresh");
+
+        await sleep(60); // past ttl
+        expect(await c.get({ key: "e" })).toBeUndefined(); // expired
+
+        // getOrSet re-runs the factory after expiry
+        const v2 = await c.getOrSet({ key: "e", factory: () => "fresh2" });
+        expect(v2).toBe("fresh2");
+    });
+
+    it("namespace groups keys", async () => {
+        const users = c.namespace("users");
+        await users.set({ key: "1", value: { name: "John" }, ttl: "5m" });
+        await users.set({ key: "2", value: { name: "Jane" } });
+        expect(await users.get({ key: "1" })).toEqual({ name: "John" });
+        expect(await c.get({ key: "1" })).toBeUndefined(); // not in root
+        await users.clear();
+        expect(await users.missing({ key: "1" })).toBe(true);
+        expect(await users.missing({ key: "2" })).toBe(true);
+    });
+});
+
+describe("Cache (filesystem)", () => {
+    it("persists across instances", async () => {
+        const dir = "/tmp/anteros-cache-test";
+        const a = useFilesystemCache({ directory: dir });
+        await a.set({ key: "persist", value: { ok: true }, ttl: "10m" });
+        await a.disconnect();
+
+        const b = useFilesystemCache({ directory: dir });
+        expect(await b.get({ key: "persist" })).toEqual({ ok: true });
+        await b.delete({ key: "persist" });
+        expect(await b.get({ key: "persist" })).toBeUndefined();
+        await b.disconnect();
+    });
+});

package/tests/crypto.test.ts

@@ -0,0 +1,101 @@
+import { describe, it, expect } from "bun:test";
+import { useSymCrypt, useAsymCrypt } from "../utils/crypto";
+
+describe("crypto — symmetric AES-256-GCM", () => {
+    it("round-trips a string", async () => {
+        const c = useSymCrypt({ secret: "test-secret" });
+        const enc = await c.encrypt("hello world");
+        const dec = await c.decrypt(enc);
+        expect(dec).toBe("hello world");
+    });
+
+    it("round-trips an object (parseJson)", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        const enc = await c.encrypt({ a: 1, b: "x", nested: { ok: true } });
+        const dec = await c.decrypt<{ a: number; b: string; nested: { ok: boolean } }>(enc, true);
+        expect(dec).toEqual({ a: 1, b: "x", nested: { ok: true } });
+    });
+
+    it("produces different ciphertexts each time (random IV)", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        const a = await c.encrypt("same");
+        const b = await c.encrypt("same");
+        expect(a).not.toBe(b);
+    });
+
+    it("rejects tampered ciphertext (AES-GCM tag)", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        const enc = await c.encrypt("data");
+        const buf = Buffer.from(enc, "base64");
+        buf[buf.length - 1]! ^= 0xff; // corrupt the tag
+        await expect(c.decrypt(buf.toString("base64"))).rejects.toThrow();
+    });
+
+    it("cannot decrypt with a different secret", async () => {
+        const c1 = useSymCrypt({ secret: "one" });
+        const c2 = useSymCrypt({ secret: "two" });
+        const enc = await c1.encrypt("secret");
+        await expect(c2.decrypt(enc)).rejects.toThrow();
+    });
+
+    it("binds ciphertext to its context via AAD (substitution-proof)", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        // Alice encrypts with her context
+        const enc = await c.encrypt({ apiKey: "sk-alice" }, "users:alice:apiKey");
+
+        // Same context → OK
+        const dec = await c.decrypt<{ apiKey: string }>(enc, true, "users:alice:apiKey");
+        expect(dec.apiKey).toBe("sk-alice");
+
+        // Swapped into Bob's context (substitution) → rejected
+        await expect(c.decrypt(enc, true, "users:bob:apiKey")).rejects.toThrow();
+        // Missing context → rejected
+        await expect(c.decrypt(enc, true)).rejects.toThrow();
+    });
+
+    it("rejects truncated ciphertext with a clear error", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        await expect(c.decrypt("YWJjZA==")).rejects.toThrow();
+    });
+});
+
+describe("crypto — asymmetric RSA-OAEP envelope", () => {
+    it("round-trips via exportPrivateKey / reuse", async () => {
+        const a = useAsymCrypt();
+        const enc = await a.encrypt({ secret: 42, list: [1, 2] });
+        const priv = await a.exportPrivateKey();
+        const b = useAsymCrypt({ privateKey: priv });
+        const dec = await b.decrypt<{ secret: number; list: number[] }>(enc, true);
+        expect(dec).toEqual({ secret: 42, list: [1, 2] });
+    });
+
+    it("encrypts with an external public key and decrypts with the private key", async () => {
+        const a = useAsymCrypt();
+        const pubJwk = await a.exportPublicKey();
+        const pubKey = await a.importPublicKey(pubJwk);
+        const enc = await a.encrypt("external-msg", pubKey);
+        const dec = await a.decrypt(enc);
+        expect(dec).toBe("external-msg");
+    });
+
+    it("rejects tampered ciphertext", async () => {
+        const a = useAsymCrypt();
+        const enc = await a.encrypt("data");
+        const buf = Buffer.from(enc, "base64");
+        buf[0]! ^= 0xff; // corrupt the wrapped key
+        await expect(a.decrypt(buf.toString("base64"))).rejects.toThrow();
+    });
+
+    it("binds ciphertext to its context via AAD (asym)", async () => {
+        const a = useAsymCrypt();
+        const enc = await a.encrypt({ doc: "sensitive" }, undefined, "tenant:acme:record:42");
+
+        const ok = await a.decrypt<{ doc: string }>(enc, true, "tenant:acme:record:42");
+        expect(ok.doc).toBe("sensitive");
+
+        // Wrong context → rejected
+        await expect(a.decrypt(enc, true, "tenant:acme:record:43")).rejects.toThrow();
+        // Missing context → rejected
+        await expect(a.decrypt(enc, true)).rejects.toThrow();
+    });
+});

package/tests/fixtures/heavy/collections/items.model.ts

@@ -0,0 +1,8 @@
+export default {
+    _isCollection_: true,
+    slug: 'items',
+    type: 'document',
+    fields: [
+        { name: 'name', type: 'string', required: true },
+    ],
+};

package/tests/fixtures/heavy/scripts/heavy-import.run.ts

@@ -0,0 +1,14 @@
+export default {
+    _isScript_: true,
+    enabled: true,
+    heavy: true,
+    exec: async ({ rest, progress }: any) => {
+        const items = Array.from({ length: 10 }, (_, i) => ({ name: `item-${i}` }));
+        await rest.insertMany('items', items);
+        progress?.(50, { inserted: 10 });
+
+        await rest.insertMany('items', items.map((it) => ({ ...it, name: it.name + '-b' })));
+        progress?.(100, { inserted: 20 });
+        return { ok: true, total: 20 };
+    },
+};

package/tests/fixtures/mcp-tenant/mcp/resources/orders.summary.resource.ts

@@ -0,0 +1,17 @@
+import { define } from "../../../../../index";
+
+// Static resource — fixed URI
+export default define.McpResource({
+    name: "orders-summary",
+    description: "Summary of orders",
+    uri: "orders://summary",
+    read: async ({ params }) => {
+        return {
+            contents: [{
+                uri: "orders://summary",
+                mimeType: "application/json",
+                text: JSON.stringify({ total: 42, pending: 7, params }),
+            }],
+        };
+    },
+});

package/tests/fixtures/mcp-tenant/mcp/resources/users.id.resource.ts

@@ -0,0 +1,18 @@
+import { define, v } from "../../../../../index";
+
+// Template resource — dynamic URI (params extracted from the URI)
+export default define.McpResource({
+    name: "users-by-id",
+    description: "Fetch a user by id",
+    uri: "users://{id}",
+    mimeType: "application/json",
+    read: async ({ params, uri }) => {
+        return {
+            contents: [{
+                uri,
+                mimeType: "application/json",
+                text: JSON.stringify({ id: params.id, name: `User ${params.id}` }),
+            }],
+        };
+    },
+});

package/tests/fixtures/mcp-tenant/mcp/tools/badge.tool.ts

@@ -0,0 +1,16 @@
+import { define, v } from "../../../../../index";
+
+export default define.McpTool({
+    name: "badge",
+    description: "Returns an image content block (protocol passthrough)",
+    inputSchema: v.object({}),
+    exec: async () => {
+        return {
+            content: [{
+                type: "image",
+                data: "aGVsbG8=", // "hello" base64
+                mimeType: "image/png",
+            }],
+        };
+    },
+});

package/tests/fixtures/mcp-tenant/mcp/tools/echo.tool.ts

@@ -0,0 +1,19 @@
+import { define, v } from "../../../../../index";
+
+export default define.McpTool({
+    name: "echo",
+    description: "Echoes the message back to the caller",
+    inputSchema: v.object({
+        msg: v.string().required().description("The message to echo"),
+        times: v.number().integer().min(1).max(5).default(1),
+    }),
+    exec: async ({ args }) => {
+        // Protocol format: { content: [...] }
+        return {
+            content: [{
+                type: "text",
+                text: JSON.stringify({ echoed: args.msg, times: args.times, at: new Date().toISOString() }),
+            }],
+        };
+    },
+});

package/tests/fixtures/metrics-worker.ts

@@ -0,0 +1,21 @@
+// Fixture: minimal worker that reports a fake metrics snapshot over IPC,
+// then stays alive so the master can supervise it.
+const payload = {
+  type: "metrics",
+  pid: process.pid,
+  metrics: {
+    pid: process.pid,
+    startedAt: Date.now(),
+    uptime: 3,
+    env: "test",
+    connections: 0,
+    pendingRequests: 0,
+    pendingWebSockets: 0,
+    requests: { total: 7, active: 0, errors: 1, byMethod: { GET: 5, POST: 2 }, byStatus: { "200": 6, "500": 1 } },
+    memory: { rss: 1024, heapUsed: 512, heapTotal: 1024, external: 64 },
+    cpu: { percent: 12.5, cores: 8, user: 100, system: 50 },
+  },
+};
+
+process.send?.(payload);
+setInterval(() => {}, 1000); // stay alive until killed

package/tests/hono.test.ts

@@ -0,0 +1,211 @@
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { createApp } from "../server/hono";
+import { cfg } from "../server/config";
+import { AppError } from "../lib/error";
+import { HTTPException } from "hono/http-exception";
+
+const base = (server: any) => server.url.href.replace(/\/$/, "");
+
+function resetServerConfig() {
+    cfg.server = {
+        ...cfg.server,
+        cors: undefined,
+        ipRestriction: undefined,
+        trustProxy: undefined,
+        rateLimit: undefined,
+    };
+}
+
+beforeEach(() => {
+    resetServerConfig();
+    delete process.env.REDIS_URL;
+    delete process.env.REDIS_HOST;
+    delete process.env.REDIS_PORT;
+    delete process.env.REDIS_PASSWORD;
+});
+
+afterEach(() => {
+    resetServerConfig();
+});
+
+// ─── Error handling (C2) ─────────────────────────────────────────────────
+// Note: these use a real Bun.serve — ipRestriction returns 403 when there is
+// no real socket address (app.request() without a server).
+
+async function bootAppWith(register: (app: any) => void) {
+    const app = createApp();
+    register(app);
+    const server = Bun.serve({ port: 0, fetch: app.fetch });
+    return { url: `${base(server)}`, server };
+}
+
+describe("onError", () => {
+    it("maps AppError to its status + code + message", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/app-error", () => {
+                throw new AppError("Validation failed", { status: 400, code: "VALIDATION_ERROR" });
+            });
+        });
+        const res = await fetch(`${url}/app-error`);
+        expect(res.status).toBe(400);
+        const body: any = await res.json();
+        expect(body.code).toBe("VALIDATION_ERROR");
+        expect(body.message).toBe("Validation failed");
+        server.stop(true);
+    });
+
+    it("lets HTTPException respond with its own status", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/exc", () => {
+                throw new HTTPException(401, { message: "Unauthorized" });
+            });
+        });
+        const res = await fetch(`${url}/exc`);
+        expect(res.status).toBe(401);
+        server.stop(true);
+    });
+
+    it("returns 500 INTERNAL_SERVER_ERROR for unexpected errors", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/crash", () => {
+                throw new Error("boom");
+            });
+        });
+        const res = await fetch(`${url}/crash`);
+        expect(res.status).toBe(500);
+        const body: any = await res.json();
+        expect(body.code).toBe("INTERNAL_SERVER_ERROR");
+        server.stop(true);
+    });
+});
+
+// ─── CORS (C1) ───────────────────────────────────────────────────────────
+
+describe("CORS origin", () => {
+    it("throws on credentials + wildcard", () => {
+        cfg.server.cors = { origin: "*", credentials: true };
+        expect(() => createApp()).toThrow(/CORS misconfiguration/);
+    });
+
+    it("accepts a string origin with credentials", () => {
+        cfg.server.cors = { origin: "https://example.com", credentials: true };
+        expect(() => createApp()).not.toThrow();
+    });
+
+    it("accepts a string[] origin", () => {
+        cfg.server.cors = { origin: ["https://a.com", "https://b.com"], credentials: true };
+        expect(() => createApp()).not.toThrow();
+    });
+
+    it("accepts a function origin", () => {
+        cfg.server.cors = {
+            origin: (ctx) => (ctx.origin === "https://ok.com" ? "https://ok.com" : "https://fallback.com"),
+            credentials: true,
+        };
+        expect(() => createApp()).not.toThrow();
+    });
+});
+
+// ─── Client IP / trustProxy (S1) ─────────────────────────────────────────
+
+describe("client IP resolution", () => {
+    it("ignores proxy headers by default (spoof-proof)", async () => {
+        const app = createApp();
+        app.get("/echo-ip", (c) => c.json({ ip: c.get("clientIp") }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+
+        cfg.server.trustProxy = false;
+        const res = await fetch(`${base(server)}/echo-ip`, { headers: { "X-Forwarded-For": "1.2.3.4" } });
+        const body: any = await res.json();
+        expect(body.ip).not.toBe("1.2.3.4");
+
+        server.stop(true);
+    });
+
+    it("uses the header when trustProxy is enabled", async () => {
+        const app = createApp();
+        app.get("/echo-ip", (c) => c.json({ ip: c.get("clientIp") }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+
+        cfg.server.trustProxy = true;
+        const res = await fetch(`${base(server)}/echo-ip`, { headers: { "X-Forwarded-For": "1.2.3.4" } });
+        const body: any = await res.json();
+        expect(body.ip).toBe("1.2.3.4");
+
+        server.stop(true);
+    });
+});
+
+// ─── Health ──────────────────────────────────────────────────────────────
+
+describe("GET /health", () => {
+    it("returns metrics + client ip", async () => {
+        const { url, server } = await bootAppWith(() => {});
+        const res = await fetch(`${url}/health`);
+        expect(res.status).toBe(200);
+        const body: any = await res.json();
+        expect(typeof body.pid).toBe("number");
+        expect(typeof body.ip).toBe("string");
+        expect(body.requests).toBeDefined();
+        expect(body.memory).toBeDefined();
+        expect(body.cpu).toBeDefined();
+        server.stop(true);
+    });
+});
+
+// ─── Rate limiting ───────────────────────────────────────────────────────
+
+describe("rate limiting (in-memory)", () => {
+    it("serves X-RateLimit-* headers and blocks after max", async () => {
+        cfg.server.rateLimit = { enabled: true, windowMs: 60_000, max: 3 };
+        const app = createApp();
+        app.get("/echo", (c) => c.json({ ok: true }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+        const url = `${base(server)}/echo`;
+
+        const statuses: number[] = [];
+        let first: Response | undefined;
+        for (let i = 0; i < 4; i++) {
+            const r = await fetch(url);
+            if (i === 0) first = r;
+            statuses.push(r.status);
+        }
+        expect(statuses).toEqual([200, 200, 200, 429]);
+
+        // headers present on the first request
+        expect(first!.headers.get("X-RateLimit-Limit")).toBe("3");
+        expect(first!.headers.get("X-RateLimit-Remaining")).toBe("2");
+
+        server.stop(true);
+    });
+
+    it("login limiter uses a distinct counter (not blocked by global)", async () => {
+        cfg.server.rateLimit = { enabled: true, windowMs: 60_000, max: 100, login: { max: 2 } };
+        const app = createApp();
+        app.post("/api/x/login", (c) => c.json({ ok: true }));
+        app.get("/echo", (c) => c.json({ ok: true }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+        const url = `${base(server)}`;
+
+        const statuses: number[] = [];
+        for (let i = 0; i < 3; i++) {
+            statuses.push((await fetch(`${url}/api/x/login`, { method: "POST" })).status);
+        }
+        expect(statuses).toEqual([200, 200, 429]);
+
+        // same IP on a normal route → still allowed (distinct key)
+        expect((await fetch(`${url}/echo`)).status).toBe(200);
+
+        server.stop(true);
+    });
+
+    it("falls back to in-memory when Redis is configured but unreachable (auto-detect)", async () => {
+        cfg.server.rateLimit = { enabled: true, max: 100, redis: { host: "localhost", port: 1 } };
+        const app = createApp();
+        app.get("/echo", (c) => c.json({ ok: true }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+        const res = await fetch(`${base(server)}/echo`);
+        expect(res.status).toBe(200);
+        server.stop(true);
+    });
+});