@anteros/core 0.0.40 → 0.0.42

package/server/api.ts

@@ -3,6 +3,7 @@ import { cfg, safePublicConfig } from "./config";
 import type { ApiOptions } from "../types/api";
 import { getCollection } from "../database/collection";
 import { getFileCollection } from "../database/file";
+import { getTenant } from "../database/tenant";
 import { AppError, fn } from "../lib/error";
 import * as cookie from "hono/cookie"
 import { useRest } from "../database/rest";
@@ -16,10 +17,17 @@ import type { ActivityInput } from "../types/activity";
 import * as os from 'node:os';
 import { basename } from 'node:path';
 import { handleUpload, handleServe, handleDelete, type FileResult } from "../lib/files";
-const API_PREFIX = '/api/:tenant_id/:collection/:action';
-const SERVICE_PREFIX = '/services/:tenant_id/:service/:action';
-const UPLOAD_PREFIX = '/upload/:tenant_id/:collection';
-const FILES_PREFIX = '/files/:tenant_id/:collection/:file';
+import { getVarsDefinition } from "../database/vars";
+import { endpoints, patterns } from "../lib/endpoints";
+import { getAccessToken, errorResponse, evaluateAccess } from "./access";
+
+// Every surface hangs off `/api/:tenant_id` — the patterns live in `lib/endpoints.ts`,
+// next to the builders a client (and the SDK) uses, so a path is written once.
+const API_PREFIX = patterns.collection;
+const SERVICE_PREFIX = patterns.service;
+const VARS_PREFIX = patterns.vars;
+const UPLOAD_PREFIX = patterns.upload;
+const FILES_PREFIX = patterns.file;
 
 
 const ActionsValues = [
@@ -41,26 +49,6 @@ const ActionsValues = [
 
 // ─── Helpers ───────────────────────────────────────────────────────────────
 
-function getAccessToken(c: any) {
-    const t = c.get('token');
-    return {
-        value: (t?.value ?? null) as string | null,
-        decoded: (t?.decoded ?? null) as Record<string, unknown> | null,
-        provided: (t?.provided ?? false) as boolean,
-        expired: (t?.expired ?? false) as boolean,
-    };
-}
-
-function errorResponse(c: any, err: any) {
-    const isAppError = err instanceof AppError;
-    const status = isAppError ? Number(err.status) : 500;
-    return c.json({
-        message: isAppError ? err.message : 'Internal server error',
-        code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
-        meta: isAppError ? err.meta : undefined,
-    }, status);
-}
-
 function stripReadOnlyData(col: any, body: any) {
     if (col?.api?.readOnlyFields?.length && body?.data) {
         body.data = func.omit(body.data, col.api.readOnlyFields);
@@ -73,52 +61,9 @@ function stripReadOnlyUpdate(col: any, body: any) {
     }
 }
 
-// ─── Access control helpers ──────────────────────────────────────────────────
-
-async function evaluateAccess(
-    access: { [key: string]: boolean | ((ctx: any) => boolean | Promise<boolean>) | undefined } | undefined,
-    operation: string,
-    rest: InstanceType<typeof useRest>,
-    label: string,
-    c: any,
-): Promise<void> {
-    if (!access) {
-        throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-    }
-
-    const hasWildcard = access['*'] !== undefined;
-    const hasSpecific = access[operation] !== undefined;
-
-    if (!hasWildcard && !hasSpecific) {
-        throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-    }
-
-    const rule = hasSpecific ? access[operation] : access['*'];
-    if (rule === undefined) return;
-
-    // Boolean `true` → allow without requiring a token
-    if (typeof rule === 'boolean') {
-        if (!rule) {
-            throw new AppError(`${label} not allowed`, { status: 401, code: 'ACCESS_DENIED' });
-        }
-        return;
-    }
-
-    // Function → requires a valid token
-    const accessToken = getAccessToken(c);
-
-    if (accessToken.expired) {
-        throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
-    }
-    if (!accessToken.value) {
-        throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
-    }
-
-    const allowed = await (rule as Function)({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-    if (!allowed) {
-        throw new AppError(`${label} not allowed`, { status: 401, code: 'ACCESS_DENIED' });
-    }
-}
+// ─── Access control ─────────────────────────────────────────────────────────
+// `evaluateAccess` / `errorResponse` / `getAccessToken` live in `./access`
+// (shared with the agents API).
 
 async function checkFileAccess(
     access: { [key: string]: boolean | ((ctx: any) => boolean | Promise<boolean>) | undefined } | undefined,
@@ -346,15 +291,14 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
 
             // ── Access control ──
-            // Faille 7: single implementation via evaluateAccess (checks expired/forged tokens)
+            // Flaw 7: single implementation via evaluateAccess (checks expired/forged tokens)
             await evaluateAccess(col?.api?.access as any, action, rest, 'Action', c);
 
             // ── Execute action ──
             if (col.actions?.[action]) {
-                response = await col.actions[action]({
-                    rest, data: body?.data, error: fn.error,
-                    io, jwt: func.jwt, token: accessToken,
-                });
+                // Delegated to `rest.runAction` so the invocation is audited once,
+                // with the same context (`rest`, `io`, `data`, `token`, …)
+                response = await rest.runAction(collection, action, body?.data);
             } else {
                 const handler = crudHandlers[action];
                 if (!handler) throw new AppError('Action `' + action + '` not found', { status: 400, code: 'ACTION_NOT_FOUND' });
@@ -382,6 +326,97 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
         }
     });
 
+    // ─── Vars API ───────────────────────────────────────────────────────
+    app.post(VARS_PREFIX, async (c) => {
+        let rest: InstanceType<typeof useRest> | undefined;
+        let tenant_id = '';
+        let action = '';
+        let ns = '';
+        let body: any;
+        const logStart = Date.now();
+        try {
+            const ContentType = c.req.header('Content-Type');
+            if (ContentType?.includes('application/json')) {
+                try { body = await c.req.json(); } catch {
+                    throw new AppError('Invalid JSON body', { status: 400, code: 'INVALID_JSON_BODY' });
+                }
+            } else {
+                body = {};
+            }
+
+            const params = c.req.param() as { tenant_id: string; action: string };
+            tenant_id = params.tenant_id;
+            action = params.action;
+            ns = body?.ns;
+
+            if (!tenant_id) throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
+            if (!action) throw new AppError('Action is required', { status: 400, code: 'ACTION_REQUIRED' });
+            if (!ns) throw new AppError('Variables namespace is required', { status: 400, code: 'NAMESPACE_REQUIRED' });
+            if (!getTenant(tenant_id)) throw new AppError('Tenant not found', { status: 400, code: 'TENANT_NOT_FOUND' });
+
+            requestCtxStorage.set('tenant_id', tenant_id);
+
+            // Only namespaces declared with `define.Vars` are reachable, and their
+            // `api.access` gates every action (no rules = denied).
+            const definition = getVarsDefinition(tenant_id, ns);
+            if (!definition) throw new AppError(`Variables namespace '${ns}' not found`, { status: 400, code: 'NAMESPACE_NOT_FOUND' });
+
+            rest = new useRest({ internal: false, tenant_id });
+            await evaluateAccess(definition.api?.access as any, action, rest, `vars:${ns}`, c);
+
+            const vars = rest.vars;
+            const { key, value, meta, ttl, scope, where, entries, by } = body ?? {};
+            let response: any;
+
+            switch (action) {
+                case 'set': await vars.set(ns, key, value, { meta, ttl, scope }); response = { ok: true }; break;
+                case 'setMany': await vars.setMany(ns, entries ?? {}, { meta, ttl, scope }); response = { ok: true }; break;
+                case 'get': response = { value: await vars.get(ns, key, { scope }) }; break;
+                case 'entry': response = { entry: await vars.entry(ns, key, { scope }) }; break;
+                case 'entries': response = { entries: await vars.entries(ns, { scope, where }) }; break;
+                case 'all': response = { vars: await vars.all(ns, { scope, where }) }; break;
+                case 'del': response = { ok: await vars.del(ns, key, { scope }) }; break;
+                case 'has': response = { exists: await vars.has(ns, key, { scope }) }; break;
+                case 'incr': response = { value: await vars.incr(ns, key, by, { scope, ttl }) }; break;
+                case 'expire': response = { ok: await vars.expire(ns, key, ttl, { scope }) }; break;
+                case 'clear': response = { deleted: await vars.clear(ns, { scope }) }; break;
+                default: throw new AppError(`Action '${action}' not found`, { status: 400, code: 'ACTION_NOT_FOUND' });
+            }
+
+            // Audit — never store `value` / `meta` (they may hold secrets).
+            const accessToken = getAccessToken(c);
+            await logActivity({
+                rest,
+                tenant_id,
+                action,
+                collection: `_vars_:${ns}`,
+                status: 'success',
+                input: { ns, key, scope, ttl },
+                result: ['get', 'all', 'entry', 'entries'].includes(action) ? response : undefined,
+                duration: Date.now() - logStart,
+                token: { decoded: accessToken.decoded, value: null, provided: true, expired: false },
+            });
+            return c.json(response);
+        } catch (err: any) {
+            if (cfg?.debug) console.error(err);
+            if (rest && tenant_id && ns) {
+                const accessToken = getAccessToken(c);
+                await logActivity({
+                    rest,
+                    tenant_id,
+                    action,
+                    collection: `_vars_:${ns}`,
+                    status: 'error',
+                    input: { ns },
+                    error: { message: err?.message, code: err?.code || 'INTERNAL_VARS_ERROR' },
+                    duration: Date.now() - logStart,
+                    token: { decoded: accessToken.decoded, value: null, provided: true, expired: false },
+                }).catch(() => {});
+            }
+            return errorResponse(c, err);
+        }
+    });
+
     // ─── Service API ────────────────────────────────────────────────────
     app.post(SERVICE_PREFIX, async (c) => {
         try {
@@ -415,21 +450,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             const serviceAccess = serviceInstance.api?.access as Record<string, boolean | Function> | undefined;
             await evaluateAccess(serviceAccess as any, action, rest, action, c);
 
-            // Re-read accessToken for the action handler
-            const accessToken = getAccessToken(c);
-
-            const logStart = Date.now();
-            try {
-                const response = await serviceInstance.actions[action]({
-                    data: body?.data, error: fn.error, io, jwt: func.jwt, token: accessToken, rest,
-                });
-
-                await logActivity({ rest, tenant_id, action, collection: service, status: 'success', input: body?.data, result: response, duration: Date.now() - logStart, token: { decoded: accessToken.decoded, value: null, provided: true, expired: false } });
-                return c.json(response);
-            } catch (err: any) {
-                await logActivity({ rest, tenant_id, action, collection: service, status: 'error', input: body?.data, error: { message: err?.message, code: err?.code || 'INTERNAL_SERVICE_ERROR' }, duration: Date.now() - logStart, token: { decoded: accessToken.decoded, value: null, provided: true, expired: false } }).catch(() => {});
-                throw err;
-            }
+            // No `logActivity` here: the call is delegated to `rest.runService()`, which
+            // audits it once (`action: 'runService'`, `internal: false`, params only)
+            const response = await rest.runService(service, action, body?.data);
+            return c.json(response);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
             return errorResponse(c, err);
@@ -469,12 +493,14 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 });
             }
 
-            const formData = await c.req.parseBody({ all: true }); // all: true → every value is an array (several files can share the same field name)
+            const formData = await c.req.parseBody({ all: true }); // repeated fields → arrays; a single occurrence stays a single value
 
             // Collect files from both accepted field names (single or multiple)
             const files: File[] = [];
             for (const key of ['file', 'upload']) {
-                for (const value of formData[key] ?? []) {
+                const raw = formData[key];
+                const values = Array.isArray(raw) ? raw : raw ? [raw] : [];
+                for (const value of values) {
                     if (value instanceof File) files.push(value);
                 }
             }
@@ -521,7 +547,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
             await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
 
-            // Faille 18: validate the RAW path before basename (checks were dead code)
+            // Flaw 18: validate the RAW path before basename (checks were dead code)
             const rawFile = c.req.param('file') as string;
             if (!rawFile || rawFile.startsWith('.') || rawFile.includes('..') || rawFile.includes('/') || rawFile.includes('\\')) {
                 throw new AppError('Invalid filename', { status: 400, code: 'INVALID_FILENAME' });
@@ -547,7 +573,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             c.header('Content-Type', result.mimetype);
             if (result.size) c.header('Content-Length', String(result.size));
             c.header('Cache-Control', 'public, max-age=31536000, immutable');
-            // Faille 4: SVG served as attachment (no inline execution)
+            // Flaw 4: SVG served as attachment (no inline execution)
             if (result.attachment) {
                 c.header('Content-Disposition', `attachment; filename="${filename}"`);
             }
@@ -590,7 +616,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     // ─── Public config ──────────────────────────────────────────────────
     app.get('/_dnax/config/:tenant_id', (c) => {
         const t = c.get('token');
-        // Faille 6: require a VERIFIED, non-expired token (not just any provided value)
+        // Flaw 6: require a VERIFIED, non-expired token (not just any provided value)
         if (!t?.decoded || t?.expired || !t?.provided) {
             return c.json({ message: 'Authentication required', code: 'AUTH_REQUIRED' }, 401);
         }

package/server/boot.ts

@@ -1,5 +1,7 @@
 
 import { createApp, collectHeaders } from './hono'
+import { parseBootFlags, resolveCapabilities, conflictingBootFlags, offCapabilities, capabilitiesLabel, FULL_CAPABILITIES } from './flags'
+import type { BootCapabilities } from './flags'
 import type { ServerConfig } from '../types/config'
 import dayjs from 'dayjs';
 import pkg from '../package.json';
@@ -9,6 +11,10 @@ import { cfg, formatConfig } from './config' // import the config
 import { syncTenants } from '../database/tenant'
 import { syncCollections } from '../database/collection'
 import { syncFileCollections } from '../database/file'
+import { syncVars } from '../database/vars'
+import { startReplication, stopReplication } from '../database/replication'
+import { loadLifecycles, runBeforeBoot, runAfterBoot, runOnDestroy } from '../lib/lifecycle'
+import { workflowStats } from '../lib/workflow'
 
 import { loadRoutes } from '../lib/routes'
 import { runScripts } from '../lib/scripts'
@@ -17,6 +23,7 @@ import { loadServices } from '../lib/services'
 import { loadSockets } from '../lib/sockets'
 import { syncWorkflows } from '../lib/workflow'
 import { syncMcpTools } from '../lib/mcp'
+import { syncAgents, agentsStats } from '../lib/agents'
 import { loadTenantsMiddlewares } from '../lib/middleware'
 import crypto from 'node:crypto';
 import os from 'node:os';
@@ -28,6 +35,88 @@ import { logger } from '../utils/logger';
 type BootAppOptions = ServerConfig & {
 
 }
+
+/**
+ * Console banner — name / PID / role, env, reusePort, cache, replication.
+ * `url` is omitted in replication-only mode (nothing is listening).
+ */
+function renderBanner(opts: {
+    name: string;
+    role: string;
+    env: string;
+    reusePort: boolean;
+    url?: string;
+    caps?: BootCapabilities;
+}): string {
+    const { name, role, env, reusePort, url } = opts;
+    const caps = opts.caps ?? FULL_CAPABILITIES;
+    const off = offCapabilities(caps);
+
+    let box = '';
+    box += `${name}`.gray.underline + ` (PID: ${process.pid}) — ${role}\n\n`
+    box += `Env: ${env || 'dev'}`.green.bold + '\n'
+    box += `reusePort: ${reusePort ? 'On'.green.bold : 'Off'.red.bold}\n`.gray.bold
+
+    // DB query cache status (server.cache) — driver: memory | filesystem | redis
+    const cacheCfg = cfg.server.cache;
+    // any: @colors/colors types chained styles (.red.bold) as Color functions
+    let cacheInfo: any = 'Off'.red.bold;
+    if (cacheCfg?.enabled) {
+        const driver = cacheCfg.driver ?? 'memory';
+        const detail = driver === 'filesystem'
+            ? ` ${cacheCfg.directory ?? './.cache'}`
+            : driver === 'redis'
+                ? ` ${cacheCfg.redis?.host ?? 'localhost'}${cacheCfg.redis?.port ? `:${cacheCfg.redis.port}` : ''}`
+                : '';
+        cacheInfo = `On`.green.bold + ` (${driver}${detail})`;
+    }
+    box += `Cache: ${cacheInfo}`.gray.bold + '\n'
+
+    // Replication status — tenants with active replication + their destinations
+    const replTenants = (cfg.tenants ?? []).filter(
+        (t) => t.replication?.enabled !== false && (t.replication?.destinations?.length ?? 0) > 0,
+    );
+    let replicationInfo: any = 'Off'.red.bold;
+    if (!caps.replication) {
+        // The engine is never started, whatever the tenants declare
+        replicationInfo = 'Off'.red.bold + ` (${capabilitiesLabel(caps)})`.gray;
+    } else if (replTenants.length) {
+        const parts = replTenants.map((t) => {
+            const dests = (t.replication?.destinations ?? []).map((d) => d.id).join(', ');
+            return `${t.id} → ${dests}`;
+        });
+        replicationInfo = `On`.green.bold + ` (${parts.join('; ')})`;
+    }
+    box += `Replication: ${replicationInfo}`.gray.bold + '\n'
+
+    // Workflows loaded from `{tenant.dir}/workflows/**/*.workflow.ts`
+    const wf = workflowStats();
+    box += `Workflows: ${wf.total ? `${wf.total}`.green.bold + ` (${wf.tenants.join(', ')})`.gray : 'none'.gray}\n`.gray.bold
+
+    // Agents loaded from `{tenant.dir}/agents/**/*.agent.ts`
+    const ag = agentsStats();
+    box += `Agents: ${ag.total ? `${ag.total}`.green.bold + ` (${ag.tenants.join(', ')})`.gray : 'none'.gray}\n`.gray.bold
+
+    // Only shown when something is disabled — the default banner stays compact
+    if (off.length) {
+        box += `Mode: ${capabilitiesLabel(caps)}`.gray.bold + ` (${off.join(', ')} off)`.yellow + '\n';
+    }
+
+    box += url ? `Url: ${url}`.gray.bold : `Url: none — no API`.yellow.bold;
+    box += '\n\n';
+    box += `Last boot: 🔄 ${dayjs().format('YYYY-MM-DD HH:mm:ss')}`.gray;
+
+    return boxen(box, {
+        title: ` @anteros/core ${pkg.version}`,
+        padding: 1,
+        float: 'left',
+        borderColor: 'gray',
+        titleAlignment: 'center',
+        borderStyle: 'double',
+        textAlignment: 'left',
+        dimBorder: true
+    })
+}
 async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
     try {
@@ -36,6 +125,15 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         //******************************* */
         options = formatConfig(options);
 
+        // Boot capabilities — `--replication-only`, `--no-replication`, `--api-only`,
+        // `--no-scripts`, `--no-sockets` (CLI, wins) on top of `server.mode`.
+        const bootFlags = parseBootFlags();
+        const caps = resolveCapabilities(bootFlags, cfg.server?.mode);
+        cfg.server.mode = capabilitiesLabel(caps);
+        if (conflictingBootFlags(bootFlags)) {
+            console.log('⚠ --replication-only conflicts with --no-replication/--api-only — running replication-only'.yellow);
+        }
+
         // Logging: configure from cfg.server.logging (console + file, e.g. logs/anteros.log)
         logger.configure(cfg.server.logging);
         // File-only: the boxen banner already shows name / PID / URL / env on the console
@@ -48,14 +146,78 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         await syncTenants(); // sync tenants and connect to database
         await syncCollections(); // sync collections and create collections on database
         await syncFileCollections(); // sync file collections
-        await loadServices(); // load services
-        await loadSockets(); // load websocket handlers
-        await syncWorkflows();
-        await syncMcpTools(); // load MCP tools per tenant (mcp/**/*.tool.ts)
-        await loadTenantsMiddlewares();
-        loadRoutes(); // load routes
+        await syncVars(); // load define.Vars + seed default variables (`_vars_` replication filters on them)
+
+        // Loaders only needed when an API is served — skipped when the API is off
+        if (caps.api) {
+            await loadServices(); // load services
+            if (caps.sockets) await loadSockets(); // load websocket handlers
+            await syncWorkflows();
+            await syncMcpTools(); // load MCP tools per tenant (mcp/**/*.tool.ts)
+            await syncAgents(); // load agents per tenant (agents/**/*.agent.ts)
+            await loadTenantsMiddlewares();
+            await loadRoutes(); // load routes
+        }
+
+        await loadLifecycles(); // load {tenant.dir}/lifecycle.ts
+        await runBeforeBoot(); // blocking lifecycle hooks (migrations, seeding…) — fail-fast
+        if (caps.replication) {
+            await startReplication(); // connect replication destinations and schedule
+        } else {
+            logger.file('Replication engine disabled', { serverMode: cfg.server.mode });
+        }
         //******************************* */
 
+        // Uncaught errors → log file (MongoDB-style), then exit
+        process.on('uncaughtException', (err) => {
+            logger.error('Uncaught exception', { message: err?.message, stack: err?.stack });
+            process.exit(1);
+        });
+        process.on('unhandledRejection', (reason: any) => {
+            logger.error('Unhandled rejection', { message: reason?.message ?? String(reason), stack: reason?.stack });
+        });
+
+        // ── NO API: replication-only process ──
+        if (!caps.api) {
+            const NAME = cfg.server.name || process.env.APP_NAME || 'SERVER';
+            const env: string = process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev';
+
+            // Nothing else keeps the event loop alive — replication timers are unref'd
+            const keepAlive = setInterval(() => { }, 60 * 60 * 1000);
+
+            const shutdownReplicationOnly = async (signal: string) => {
+                console.log(`\n${signal} received — stopping replication…`.gray);
+                clearInterval(keepAlive);
+                try { await runOnDestroy(signal as 'SIGINT' | 'SIGTERM'); } catch {}
+                try { await stopReplication(); } catch {}
+                for (const tenant of cfg.tenants ?? []) {
+                    try { tenant.database?.client?.close(); } catch {}
+                }
+                process.exit(0);
+            };
+            process.once('SIGINT', () => shutdownReplicationOnly('SIGINT'));
+            process.once('SIGTERM', () => shutdownReplicationOnly('SIGTERM'));
+
+            console.log(renderBanner({
+                name: NAME,
+                role: 'replication-only',
+                env,
+                reusePort: false,
+                caps,
+            }));
+
+            logger.file('Replication-only process started', {
+                name: NAME,
+                pid: process.pid,
+                role: 'replication-only',
+                env,
+                tenants: cfg.tenants?.map((t) => t.id),
+                logFile: logger.filePath || undefined,
+            });
+
+            return null;
+        }
+
 
         // JWT_SECRET check: auto-generate if missing and auth is enabled
         const hasAuth = cfg.collections?.some((c: any) => c.api?.auth?.enabled);
@@ -117,12 +279,17 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
             console.log(`[cluster] Aggregated /health → http://localhost:${metricsPort}/health`.gray);
 
+            // Master owns the boot: run the tenant lifecycles once here (workers skip).
+            await runAfterBoot(metricsServer, io);
+
             // Graceful shutdown: stop workers + metrics server so a restart
             // (e.g. bun --watch) never leaves the port occupied
-            const shutdownCluster = (signal: string) => {
+            const shutdownCluster = async (signal: string) => {
                 console.log(`\n${signal} received — shutting down workers…`.gray);
                 try { master.shutdown(); } catch {}
                 try { metricsServer.stop(true); } catch {}
+                try { await runOnDestroy(signal as 'SIGINT' | 'SIGTERM'); } catch {}
+                try { await stopReplication(); } catch {}
                 for (const tenant of cfg.tenants ?? []) {
                     try { tenant.database?.client?.close(); } catch {}
                 }
@@ -170,7 +337,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
                         return res;
                     });
 
-                if (url.pathname === "/socket.io/") {
+                if (caps.sockets && url.pathname === "/socket.io/") {
                     const start = performance.now();
                     return respond(engineIo.handleRequest(req, server)).then((res) => {
                         // Access log for the Socket.IO upgrade path (handled outside Hono) —
@@ -208,6 +375,8 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
                 }
                 return respond(app.fetch(req, server));
             },
+            // Sockets are disabled by not serving `/socket.io/` (below): without an
+            // explicit `server.upgrade()` call no client can ever open a websocket.
             websocket: websocket,
             maxRequestBodySize: 1024 * 1024 * 100, // 100MB
         })
@@ -215,11 +384,16 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         // Register server for built-in metrics (GET /health)
         registerMetrics(server);
 
+        // The server is listening — run the tenant lifecycles (standalone only).
+        if (!isWorker) await runAfterBoot(server, io);
+
         // Graceful shutdown: release the port & DB connections so restarts
         // (e.g. bun --watch) never hit a zombie / EADDRINUSE
-        const shutdownServer = (signal: string) => {
+        const shutdownServer = async (signal: string) => {
             console.log(`\n${signal} received — shutting down…`.gray);
             try { server.stop(true); } catch {}
+            try { await runOnDestroy(signal as 'SIGINT' | 'SIGTERM'); } catch {}
+            try { await stopReplication(); } catch {}
             for (const tenant of cfg.tenants ?? []) {
                 try { tenant.database?.client?.close(); } catch {}
             }
@@ -241,47 +415,25 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
             }, 5000);
         }
 
-        let box = '';
         const role = isWorker ? 'worker' : (reusePort ? 'master' : 'standalone');
-        box += `${NAME}`.gray.underline + ` (PID: ${process.pid}) — ${role}\n\n`
-        box += `Env: ${env || 'dev'}`.green.bold + '\n'
-        box += `reusePort: ${(reusePort || isWorker) ? 'On'.green.bold : 'Off'.red.bold}\n`.gray.bold
-
-        // DB query cache status (server.cache) — driver: memory | filesystem | redis
-        const cacheCfg = cfg.server.cache;
-        // any: @colors/colors types chained styles (.red.bold) as Color functions
-        let cacheInfo: any = 'Off'.red.bold;
-        if (cacheCfg?.enabled) {
-            const driver = cacheCfg.driver ?? 'memory';
-            const detail = driver === 'filesystem'
-                ? ` ${cacheCfg.directory ?? './.cache'}`
-                : driver === 'redis'
-                    ? ` ${cacheCfg.redis?.host ?? 'localhost'}${cacheCfg.redis?.port ? `:${cacheCfg.redis.port}` : ''}`
-                    : '';
-            cacheInfo = `On`.green.bold + ` (${driver}${detail})`;
-        }
-        box += `Cache: ${cacheInfo}`.gray.bold + '\n'
-        box += `Url: http://localhost:${PORT}`.gray.bold;
-        box += '\n\n';
-        box += `Last boot: 🔄 ${dayjs().format('YYYY-MM-DD HH:mm:ss')}`.gray;
-
-        console.log(boxen(box, {
-            title: ` @anteros/core ${pkg.version}`,
-            padding: 1,
-            float: 'left',
-            borderColor: 'gray',
-            titleAlignment: 'center',
-            borderStyle: 'double',
-            textAlignment: 'left',
-            dimBorder: true
+
+        console.log(renderBanner({
+            name: NAME,
+            role,
+            env,
+            reusePort: reusePort || isWorker,
+            url: `http://localhost:${PORT}`,
+            caps,
         }))
 
 
         // After boot and App ready.
-        setTimeout(() => {
-            runScripts().catch(); // run scripts
+        if (caps.scripts) {
+            setTimeout(() => {
+                runScripts().catch(); // run scripts
 
-        }, 150);
+            }, 150);
+        }
 
         // Boot event — recorded in the log file only (the console banner already
         // shows name / PID / role / URL, so this line would be redundant on screen)
@@ -294,15 +446,6 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
             logFile: logger.filePath || undefined,
         });
 
-        // Uncaught errors → log file (MongoDB-style), then exit
-        process.on('uncaughtException', (err) => {
-            logger.error('Uncaught exception', { message: err?.message, stack: err?.stack });
-            process.exit(1);
-        });
-        process.on('unhandledRejection', (reason: any) => {
-            logger.error('Unhandled rejection', { message: reason?.message ?? String(reason), stack: reason?.stack });
-        });
-
         return server;
     } catch (err: any) {
         logger.error('Failed to boot server', cfg.debug ? { error: err, message: err?.message } : { message: err?.message });