@anteros/core 0.0.40 → 0.0.42

package/tests/replication-meta.test.ts

@@ -0,0 +1,243 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import os from "node:os";
+import { MongoClient } from "mongodb";
+import { useRest } from "../database/rest";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { syncCollections } from "../database/collection";
+import { syncWorkflows } from "../lib/workflow";
+import { startReplication, stopReplication, replicateTenant } from "../database/replication";
+import { syncAgents } from "../lib/agents";
+import { MongoAgentMemory } from "../lib/agentMemory";
+import { AGENT_THREADS } from "./fixtures/replication-meta/agents/chat.agent";
+import type { ReplicationMetaName } from "../types/replication";
+
+const DIR = "packages/core/tests/fixtures/replication-meta";
+
+/** Everything replicated: declared collection + the six framework collections */
+const ALL_T = "rm-default";
+const ALL_T_DB = "mongodb://localhost:27017/_RM_DEFAULT_SRC";
+const ALL_T_DEST = "mongodb://localhost:27017/_RM_DEFAULT_DEST";
+
+/** Nothing but the declared collection */
+const OFF_T = "rm-alloff";
+const OFF_T_DB = "mongodb://localhost:27017/_RM_ALLOFF_SRC";
+const OFF_T_DEST = "mongodb://localhost:27017/_RM_ALLOFF_DEST";
+
+let rest: InstanceType<typeof useRest>;
+let dest: MongoClient;
+let destOff: MongoClient;
+
+const target = (slug: string) => dest.db().collection(slug);
+const targetOff = (slug: string) => destOff.db().collection(slug);
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [
+            {
+                id: ALL_T,
+                dir: DIR,
+                database: { uri: ALL_T_DB },
+                // Opt-in retention, so the destination's copy is pruned the same way
+                audit: { retention: "30d" },
+                replication: {
+                    runOnBoot: false,
+                    schedule: { interval: "1h" },
+                    destinations: [{ id: "backup", uri: ALL_T_DEST }],
+                },
+            },
+            {
+                id: OFF_T,
+                dir: DIR,
+                database: { uri: OFF_T_DB },
+                replication: {
+                    runOnBoot: false,
+                    schedule: { interval: "1h" },
+                    exclude: ["audit", "workflows", "locks", "replication", "vars", "memory"],
+                    destinations: [{ id: "backup", uri: OFF_T_DEST }],
+                },
+            },
+        ],
+    });
+
+    await syncTenants();
+    await syncCollections();
+    await syncWorkflows();
+    await syncAgents(); // publishes the agent memory collections (`cfg.agentMemories`)
+    await startReplication();
+
+    rest = new useRest({ tenant_id: ALL_T });
+    dest = new MongoClient(ALL_T_DEST, { serverSelectionTimeoutMS: 3000 });
+    destOff = new MongoClient(OFF_T_DEST, { serverSelectionTimeoutMS: 3000 });
+    await dest.connect();
+    await destOff.connect();
+});
+
+afterAll(async () => {
+    await stopReplication();
+    for (const uri of [ALL_T_DB, ALL_T_DEST, OFF_T_DB, OFF_T_DEST]) {
+        try {
+            const client = new MongoClient(uri);
+            await client.connect();
+            await client.db().dropDatabase();
+            await client.close();
+        } catch (_) {}
+    }
+    cfg.agents = [];
+    cfg.agentMemories = [];
+    try { await dest.close(); } catch (_) {}
+    try { await destOff.close(); } catch (_) {}
+});
+
+describe("replication — framework collections", () => {
+    it("replicates them by default (audit, workflows, locks, replication, vars, memory)", async () => {
+        const marker = `meta-${crypto.randomUUID()}`;
+
+        await rest.audit.addActivities([{
+            internal: true,
+            trace: { id: crypto.randomUUID() },
+            meta: {},
+            operation: {
+                tenant: ALL_T, action: marker, collection: "orders",
+                status: "success", input: null, result: null, error: null, duration: 0, transaction: false,
+            },
+            ts: new Date(),
+        } as any]);
+        await rest.workflow.run("run", { marker });
+        await rest.vars.set("config", marker, "META-1");
+        await rest.lock(`meta-${marker}`);
+        await rest.insertOne("orders", { title: marker });
+        // An agent conversation — the collection this tenant named for its memory
+        await new MongoAgentMemory({ collection: AGENT_THREADS }).save(
+            "chat-1",
+            [{ role: "user", content: marker }] as any,
+            { rest, tenant: ALL_T, resourceId: "u1" },
+        );
+
+        // A first run picks the state document it writes, hence the second one
+        await replicateTenant(ALL_T);
+        await replicateTenant(ALL_T);
+
+        expect(await target("_audit_").findOne({ "operation.action": marker })).toBeDefined();
+        expect(await target("_workflows_").findOne({ workflowId: "run" })).toBeDefined();
+        expect(await target("_vars_").findOne({ ns: "config", key: marker })).toBeDefined();
+        expect(await target("_locks_").findOne({ name: `meta-${marker}` })).toBeDefined();
+        expect(await target("_replication_").findOne({ type: "state", tenant: ALL_T })).toBeDefined();
+        expect(await target(AGENT_THREADS).findOne({ _id: "u1:chat-1" as any })).toBeDefined();
+        expect(await target("orders").findOne({ title: marker })).toBeDefined();
+
+        await rest.unlock(`meta-${marker}`);
+    }, 30_000);
+
+    it("propagates a cleared thread to the destination (tombstone)", async () => {
+        // The thread replicated by the previous test is deleted at the source: no
+        // date cursor can see a deletion, so the store leaves a tombstone.
+        await new MongoAgentMemory({ collection: AGENT_THREADS }).clear("chat-1", { rest, tenant: ALL_T, resourceId: "u1" });
+
+        await replicateTenant(ALL_T);
+
+        expect(await target(AGENT_THREADS).findOne({ _id: "u1:chat-1" as any })).toBeNull();
+        // The tombstone is consumed and purged
+        expect(await rest.db.collection("_replication_").countDocuments({ type: "delete", collection: AGENT_THREADS })).toBe(0);
+    }, 30_000);
+
+    it("uses each collection's own date key (audit is read on `ts`)", async () => {
+        const state: any = await rest.db.collection("_replication_")
+            .findOne({ type: "state", tenant: ALL_T, collection: "_audit_" });
+        expect(state).toBeDefined();
+        expect(state.key).toBe("ts");
+        // The state says which process is doing the work (`reusePort` / forked workers)
+        expect(state.pid).toBe(process.pid);
+        expect(state.hostname).toBe(os.hostname());
+    });
+
+    it("mirrors the audit retention on the destination", async () => {
+        const ttl: any = (await target("_audit_").listIndexes().toArray())
+            .find((i: any) => i.name === "_audit_ttl_");
+        expect(ttl).toBeDefined();
+        expect(ttl.expireAfterSeconds).toBe(30 * 86400);
+    }, 30_000);
+
+    it("leaves out only what `exclude` names", async () => {
+        const tenant: any = cfg.tenants?.find((t) => t.id === ALL_T);
+        const marker = `noaudit-${crypto.randomUUID()}`;
+        tenant.replication.exclude = ["audit", "memory"];
+
+        await rest.audit.addActivities([{
+            internal: true, trace: { id: crypto.randomUUID() }, meta: {},
+            operation: {
+                tenant: ALL_T, action: marker, collection: "orders",
+                status: "success", input: null, result: null, error: null, duration: 0, transaction: false,
+            },
+            ts: new Date(),
+        } as any]);
+        await rest.vars.set("config", marker, "still-replicated");
+        await new MongoAgentMemory({ collection: AGENT_THREADS }).save(
+            "chat-2",
+            [{ role: "user", content: marker }] as any,
+            { rest, tenant: ALL_T, resourceId: "u1" },
+        );
+
+        await replicateTenant(ALL_T);
+
+        expect(await target("_audit_").findOne({ "operation.action": marker })).toBeNull();      // excluded
+        expect(await target(AGENT_THREADS).findOne({ _id: "u1:chat-2" as any })).toBeNull();     // excluded
+        expect(await target("_vars_").findOne({ ns: "config", key: marker })).toBeDefined();     // still there
+
+        delete tenant.replication.exclude;
+    }, 30_000);
+
+    it("replicates nothing from the framework when every name is excluded", async () => {
+        const offRest = new useRest({ tenant_id: OFF_T });
+        const marker = `alloff-${crypto.randomUUID()}`;
+
+        await offRest.audit.addActivities([{
+            internal: true, trace: { id: crypto.randomUUID() }, meta: {},
+            operation: {
+                tenant: OFF_T, action: marker, collection: "orders",
+                status: "success", input: null, result: null, error: null, duration: 0, transaction: false,
+            },
+            ts: new Date(),
+        } as any]);
+        await offRest.vars.set("config", marker, "not-replicated");
+        await offRest.insertOne("orders", { title: marker });
+        await new MongoAgentMemory({ collection: AGENT_THREADS }).save(
+            "chat-3",
+            [{ role: "user", content: marker }] as any,
+            { rest: offRest, tenant: OFF_T, resourceId: "u1" },
+        );
+
+        await replicateTenant(OFF_T);
+        await replicateTenant(OFF_T);
+
+        // The declared collection still replicates…
+        expect(await targetOff("orders").findOne({ title: marker })).toBeDefined();
+        // …but the framework collections do not exist on that destination
+        expect(await targetOff("_audit_").countDocuments({})).toBe(0);
+        expect(await targetOff("_vars_").countDocuments({})).toBe(0);
+        expect(await targetOff("_workflows_").countDocuments({})).toBe(0);
+        expect(await targetOff(AGENT_THREADS).countDocuments({})).toBe(0);
+    }, 30_000);
+
+    it("propagates a delete on a collection whose key is a number", async () => {
+        const doc: any = await rest.insertOne("counters", { seq: 100, title: "numeric-key" });
+        await replicateTenant(ALL_T);
+        expect(await target("counters").findOne({ title: "numeric-key" })).toBeDefined();
+
+        await rest.deleteOne("counters", doc._id);
+        await replicateTenant(ALL_T);
+        // The tombstone guard compares the key to a date by default: a numeric key
+        // used to silently skip the delete
+        expect(await target("counters").findOne({ title: "numeric-key" })).toBeNull();
+    }, 30_000);
+
+    it("keeps the `exclude` list typed", () => {
+        const names: ReplicationMetaName[] = ["audit", "workflows", "locks", "replication", "vars", "memory"];
+        expect(names.length).toBe(6);
+
+        // @ts-expect-error — a declared collection slug is not a framework collection
+        const wrong: ReplicationMetaName[] = ["orders"];
+        expect(wrong.length).toBe(1);
+    });
+});

package/tests/replication-only.test.ts

@@ -0,0 +1,358 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import fs from "node:fs";
+import path from "node:path";
+import { MongoClient } from "mongodb";
+import { parseBootFlags, resolveCapabilities, capabilitiesLabel, conflictingBootFlags, FULL_CAPABILITIES } from "../server/flags";
+
+const FIXTURE = "packages/core/tests/fixtures/repl-only";
+const MARKERS = path.join(FIXTURE, "tenant", ".markers");
+const SRC = "mongodb://localhost:27017/_RO_SRC";
+const DST = "mongodb://localhost:27017/_RO_DST";
+const PORT = 5556;
+
+let proc: any;
+let src: MongoClient;
+let dst: MongoClient;
+let output = "";
+
+/** Poll `check` until it returns true (or throw after `timeout`) */
+async function waitFor(check: () => Promise<boolean>, timeout = 20_000, step = 250): Promise<boolean> {
+    const deadline = Date.now() + timeout;
+    while (Date.now() < deadline) {
+        if (await check()) return true;
+        await Bun.sleep(step);
+    }
+    return false;
+}
+
+describe("boot capabilities", () => {
+    const flags = (over: Partial<ReturnType<typeof parseBootFlags>> = {}) => ({
+        replicationOnly: false, noReplication: false, apiOnly: false, noScripts: false, noSockets: false,
+        ...over,
+    });
+
+    it("reads every flag (and its camelCase spelling)", () => {
+        expect(parseBootFlags(["bun", "index.ts", "--replication-only"]).replicationOnly).toBe(true);
+        expect(parseBootFlags(["bun", "index.ts", "--replicationOnly"]).replicationOnly).toBe(true);
+        expect(parseBootFlags(["bun", "index.ts", "--no-replication"]).noReplication).toBe(true);
+        expect(parseBootFlags(["bun", "index.ts", "--api-only"]).apiOnly).toBe(true);
+        expect(parseBootFlags(["bun", "index.ts", "--noScripts"]).noScripts).toBe(true);
+        expect(parseBootFlags(["bun", "index.ts", "--no-sockets"]).noSockets).toBe(true);
+
+        expect(parseBootFlags(["bun", "index.ts"])).toEqual(flags());
+    });
+
+    it("resolves the named modes", () => {
+        expect(resolveCapabilities(flags())).toEqual(FULL_CAPABILITIES);
+
+        expect(resolveCapabilities(flags(), "replication-only")).toEqual({
+            api: false, replication: true, scripts: false, sockets: false,
+        });
+        expect(resolveCapabilities(flags(), "api-only")).toEqual({
+            api: true, replication: false, scripts: false, sockets: false,
+        });
+        expect(resolveCapabilities(flags(), "no-replication")).toEqual({
+            api: true, replication: false, scripts: true, sockets: true,
+        });
+    });
+
+    it("lets the flags win over the configured mode", () => {
+        expect(resolveCapabilities(flags({ apiOnly: true }), "full")).toEqual({
+            api: true, replication: false, scripts: false, sockets: false,
+        });
+        expect(resolveCapabilities(flags({ replicationOnly: true }), "no-replication")).toEqual({
+            api: false, replication: true, scripts: false, sockets: false,
+        });
+        // the most restrictive flag wins
+        expect(resolveCapabilities(flags({ replicationOnly: true, apiOnly: true })).api).toBe(false);
+    });
+
+    it("disables one capability at a time", () => {
+        expect(resolveCapabilities(flags({ noScripts: true }))).toEqual({
+            api: true, replication: true, scripts: false, sockets: true,
+        });
+        expect(resolveCapabilities(flags({ noSockets: true }))).toEqual({
+            api: true, replication: true, scripts: true, sockets: false,
+        });
+        expect(resolveCapabilities(flags({ noReplication: true }))).toEqual({
+            api: true, replication: false, scripts: true, sockets: true,
+        });
+    });
+
+    it("labels the mode for the banner", () => {
+        expect(capabilitiesLabel(FULL_CAPABILITIES)).toBe("full");
+        expect(capabilitiesLabel({ api: false, replication: true, scripts: false, sockets: false })).toBe("replication-only");
+        expect(capabilitiesLabel({ api: true, replication: false, scripts: false, sockets: false })).toBe("api-only");
+        // granular flags stay in `full` — the banner lists what is off
+        expect(capabilitiesLabel({ api: true, replication: true, scripts: false, sockets: true })).toBe("full");
+    });
+
+    it("reports contradictory flags", () => {
+        expect(conflictingBootFlags(flags({ replicationOnly: true, noReplication: true }))).toBe(true);
+        expect(conflictingBootFlags(flags({ replicationOnly: true, apiOnly: true }))).toBe(true);
+        expect(conflictingBootFlags(flags({ replicationOnly: true }))).toBe(false);
+        expect(conflictingBootFlags(flags({ apiOnly: true, noScripts: true }))).toBe(false);
+    });
+});
+
+describe("replication-only boot", () => {
+    beforeAll(async () => {
+        fs.rmSync(MARKERS, { recursive: true, force: true });
+
+        src = new MongoClient(SRC);
+        dst = new MongoClient(DST);
+        await src.connect();
+        await dst.connect();
+        await src.db().collection("orders").drop().catch(() => {});
+        await dst.db().collection("orders").drop().catch(() => {});
+        await dst.db().collection("_replication_").drop().catch(() => {});
+
+        proc = Bun.spawn(["bun", `${FIXTURE}/app.ts`, "--replication-only"], {
+            cwd: process.cwd(),
+            stdout: "pipe",
+            stderr: "pipe",
+            env: { ...process.env, RO_PORT: String(PORT), RO_SRC: SRC, RO_DST: DST },
+        });
+
+        // Drain the pipes (a full buffer would block the child)
+        for (const stream of [proc.stdout, proc.stderr]) {
+            (async () => {
+                const reader = (stream as ReadableStream<Uint8Array>).getReader();
+                const decoder = new TextDecoder();
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done) break;
+                    output += decoder.decode(value, { stream: true });
+                }
+            })().catch(() => {});
+        }
+
+        // A document written to the source must reach the destination on its own
+        await src.db().collection("orders").insertOne({ ref: "RO-1", total: 42 } as any);
+    });
+
+    afterAll(async () => {
+        try { proc?.kill(); } catch {}
+        try { await src?.close(); } catch {}
+        try { await dst?.close(); } catch {}
+        fs.rmSync(MARKERS, { recursive: true, force: true });
+    });
+
+    it("replicates the tenant data", async () => {
+        const replicated = await waitFor(async () =>
+            (await dst.db().collection("orders").countDocuments({ ref: "RO-1" })) === 1,
+        );
+        expect(replicated, `no replication after 20s — app output:\n${output}`).toBe(true);
+
+        const onTarget: any = await dst.db().collection("orders").findOne({ ref: "RO-1" });
+        expect(onTarget.total).toBe(42);
+    }, 30_000);
+
+    it("exposes no HTTP API", async () => {
+        // `/health` is registered by the framework — if anything were listening, it would answer
+        const refused = await fetch(`http://localhost:${PORT}/health`)
+            .then(() => false)
+            .catch(() => true);
+        expect(refused, "a server is listening on the configured port").toBe(true);
+    });
+
+    it("still runs the lifecycle hooks", async () => {
+        const ran = await waitFor(async () => fs.existsSync(path.join(MARKERS, "lifecycle.txt")));
+        expect(ran, `beforeBoot did not run — app output:\n${output}`).toBe(true);
+    }, 30_000);
+
+    it("does not run the tenant scripts", async () => {
+        // give the (skipped) scripts path a chance to fire
+        await Bun.sleep(500);
+        expect(fs.existsSync(path.join(MARKERS, "script.txt"))).toBe(false);
+    });
+
+    it("keeps the process alive (replication timers are unref'd)", async () => {
+        await Bun.sleep(300);
+        expect(proc.exitCode, `the process exited — output:\n${output}`).toBeNull();
+    });
+
+    it("stops replication cleanly on SIGTERM (onDestroy runs)", async () => {
+        proc.kill("SIGTERM");
+
+        const exited = await waitFor(async () => proc.exitCode !== null, 10_000, 100);
+        expect(exited, `the process did not exit — output:\n${output}`).toBe(true);
+        expect(proc.exitCode).toBe(0);
+
+        const destroyed = await waitFor(async () => fs.existsSync(path.join(MARKERS, "onDestroy.txt")));
+        expect(destroyed, `onDestroy did not run — output:\n${output}`).toBe(true);
+    }, 30_000);
+});
+
+describe("no-replication boot", () => {
+    const PORT = 5557;
+    const SRC = "mongodb://localhost:27017/_NOREP_SRC";
+    const DST = "mongodb://localhost:27017/_NOREP_DST";
+
+    let procNo: any;
+    let srcNo: MongoClient;
+    let dstNo: MongoClient;
+    let outputNo = "";
+
+    beforeAll(async () => {
+        fs.rmSync(MARKERS, { recursive: true, force: true });
+
+        srcNo = new MongoClient(SRC);
+        dstNo = new MongoClient(DST);
+        await srcNo.connect();
+        await dstNo.connect();
+        await srcNo.db().collection("orders").drop().catch(() => {});
+        await dstNo.db().collection("orders").drop().catch(() => {});
+
+        procNo = Bun.spawn(["bun", `${FIXTURE}/app.ts`, "--no-replication"], {
+            cwd: process.cwd(),
+            stdout: "pipe",
+            stderr: "pipe",
+            env: { ...process.env, RO_PORT: String(PORT), RO_SRC: SRC, RO_DST: DST },
+        });
+
+        for (const stream of [procNo.stdout, procNo.stderr]) {
+            (async () => {
+                const reader = (stream as ReadableStream<Uint8Array>).getReader();
+                const decoder = new TextDecoder();
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done) break;
+                    outputNo += decoder.decode(value, { stream: true });
+                }
+            })().catch(() => {});
+        }
+
+        // Wait for the server to listen before writing to the source
+        await waitFor(async () => {
+            try {
+                await fetch(`http://localhost:${PORT}/health`);
+                return true;
+            } catch {
+                return false;
+            }
+        }, 20_000);
+
+        await srcNo.db().collection("orders").insertOne({ ref: "NOREP-1", total: 7 } as any);
+    });
+
+    afterAll(async () => {
+        try { procNo?.kill(); } catch {}
+        try { await srcNo?.close(); } catch {}
+        try { await dstNo?.close(); } catch {}
+        fs.rmSync(MARKERS, { recursive: true, force: true });
+    });
+
+    it("serves the HTTP API", async () => {
+        const res = await fetch(`http://localhost:${PORT}/health`);
+        expect(res.status).toBe(200);
+        expect(await res.json()).toBeDefined();
+    });
+
+    it("never starts the replication engine", async () => {
+        // give it more than enough time to replicate, if it were going to
+        await Bun.sleep(2_000);
+
+        expect(await dstNo.db().collection("orders").countDocuments({})).toBe(0);
+        // …and no replication state was created either
+        const state = await srcNo.db().listCollections({ name: "_replication_" }).toArray();
+        expect(state.length).toBe(0);
+    }, 15_000);
+
+    it("still serves the Socket.IO endpoint", async () => {
+        const res = await fetch(`http://localhost:${PORT}/socket.io/?EIO=4&transport=polling`);
+        expect(res.status).toBe(200);
+    }, 15_000);
+
+    it("is otherwise a full server (scripts run, lifecycle hooks run)", async () => {
+        const scripted = await waitFor(async () => fs.existsSync(path.join(MARKERS, "script.txt")));
+        const lifecycle = await waitFor(async () => fs.existsSync(path.join(MARKERS, "lifecycle.txt")));
+
+        expect(lifecycle, `beforeBoot did not run — output:\n${outputNo}`).toBe(true);
+        expect(scripted, `scripts did not run — output:\n${outputNo}`).toBe(true);
+    }, 20_000);
+});
+
+describe("api-only boot", () => {
+    const PORT = 5558;
+    const SRC = "mongodb://localhost:27017/_APIONLY_SRC";
+    const DST = "mongodb://localhost:27017/_APIONLY_DST";
+
+    let procApi: any;
+    let srcApi: MongoClient;
+    let dstApi: MongoClient;
+    let outputApi = "";
+
+    beforeAll(async () => {
+        fs.rmSync(MARKERS, { recursive: true, force: true });
+
+        srcApi = new MongoClient(SRC);
+        dstApi = new MongoClient(DST);
+        await srcApi.connect();
+        await dstApi.connect();
+        await srcApi.db().collection("orders").drop().catch(() => {});
+        await dstApi.db().collection("orders").drop().catch(() => {});
+
+        procApi = Bun.spawn(["bun", `${FIXTURE}/app.ts`, "--api-only"], {
+            cwd: process.cwd(),
+            stdout: "pipe",
+            stderr: "pipe",
+            env: { ...process.env, RO_PORT: String(PORT), RO_SRC: SRC, RO_DST: DST },
+        });
+
+        for (const stream of [procApi.stdout, procApi.stderr]) {
+            (async () => {
+                const reader = (stream as ReadableStream<Uint8Array>).getReader();
+                const decoder = new TextDecoder();
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done) break;
+                    outputApi += decoder.decode(value, { stream: true });
+                }
+            })().catch(() => {});
+        }
+
+        await waitFor(async () => {
+            try {
+                await fetch(`http://localhost:${PORT}/health`);
+                return true;
+            } catch {
+                return false;
+            }
+        }, 20_000);
+
+        await srcApi.db().collection("orders").insertOne({ ref: "APIONLY-1", total: 3 } as any);
+    });
+
+    afterAll(async () => {
+        try { procApi?.kill(); } catch {}
+        try { await srcApi?.close(); } catch {}
+        try { await dstApi?.close(); } catch {}
+        fs.rmSync(MARKERS, { recursive: true, force: true });
+    });
+
+    it("serves the HTTP API", async () => {
+        const res = await fetch(`http://localhost:${PORT}/health`);
+        expect(res.status).toBe(200);
+    });
+
+    it("does not serve the Socket.IO endpoint", async () => {
+        const res = await fetch(`http://localhost:${PORT}/socket.io/?EIO=4&transport=polling`);
+        expect(res.status, `the socket endpoint answered — output:\n${outputApi}`).not.toBe(200);
+    }, 15_000);
+
+    it("does not run the tenant scripts", async () => {
+        // the scripts path would have fired ~150ms after boot — give it more
+        await Bun.sleep(1_500);
+        expect(fs.existsSync(path.join(MARKERS, "script.txt"))).toBe(false);
+        // …while the lifecycle still runs (it is part of a normal boot)
+        expect(fs.existsSync(path.join(MARKERS, "lifecycle.txt"))).toBe(true);
+    }, 15_000);
+
+    it("never starts the replication engine", async () => {
+        await Bun.sleep(1_500);
+        expect(await dstApi.db().collection("orders").countDocuments({})).toBe(0);
+        const state = await srcApi.db().listCollections({ name: "_replication_" }).toArray();
+        expect(state.length).toBe(0);
+    }, 15_000);
+});