@bod.ee/db 0.11.1 → 0.12.2

package/src/client/BodClientCached.ts

@@ -182,7 +182,7 @@ export class BodClientCached {
 
   vfs(): CachedVFSClient {
     if (!this._vfs) {
-      this._vfs = new CachedVFSClient(this.client.vfs(), this.options.maxAge);
+      this._vfs = new CachedVFSClient(this.client.vfs(), this.options.maxAge, this.idb);
       this._vfsUnsub = this.client.onChild('_vfs', () => {
         // _vfs events are coarse (top-level key only), clear all VFS caches
         this._vfs?.clear();
@@ -252,18 +252,34 @@ export class CachedVFSClient {
   constructor(
     private raw: VFSClient,
     private maxAge: number,
+    private idb: IDBDatabase | null = null,
   ) {}
 
   async stat(path: string): Promise<FileStat | null> {
     const cached = this.statCache.get(path);
     if (cached && Date.now() - cached.cachedAt < this.maxAge) {
       this._stats.hits++;
-      this.raw.stat(path).then(r => this.statCache.set(path, { data: r, cachedAt: Date.now() })).catch(() => {});
+      this.raw.stat(path).then(r => {
+        this.statCache.set(path, { data: r, cachedAt: Date.now() });
+        this.idbSetVfs(`vfs:stat:${path}`, { data: r, cachedAt: Date.now() });
+      }).catch(() => {});
       return cached.data;
     }
+    // Check IDB before network
+    const idbEntry = await this.idbGetVfs(`vfs:stat:${path}`);
+    if (idbEntry && Date.now() - idbEntry.cachedAt < this.maxAge) {
+      this._stats.hits++;
+      this.statCache.set(path, idbEntry);
+      this.raw.stat(path).then(r => {
+        this.statCache.set(path, { data: r, cachedAt: Date.now() });
+        this.idbSetVfs(`vfs:stat:${path}`, { data: r, cachedAt: Date.now() });
+      }).catch(() => {});
+      return idbEntry.data as FileStat | null;
+    }
     this._stats.misses++;
     const result = await this.raw.stat(path);
     this.statCache.set(path, { data: result, cachedAt: Date.now() });
+    this.idbSetVfs(`vfs:stat:${path}`, { data: result, cachedAt: Date.now() });
     return result;
   }
 
@@ -271,15 +287,34 @@ export class CachedVFSClient {
     const cached = this.listCache.get(path);
     if (cached && Date.now() - cached.cachedAt < this.maxAge) {
       this._stats.hits++;
-      this.raw.list(path).then(r => this.listCache.set(path, { data: r, cachedAt: Date.now() })).catch(() => {});
+      this.raw.list(path).then(r => {
+        this.listCache.set(path, { data: r, cachedAt: Date.now() });
+        this.idbSetVfs(`vfs:list:${path}`, { data: r, cachedAt: Date.now() });
+      }).catch(() => {});
       return cached.data;
     }
+    // Check IDB before network
+    const idbEntry = await this.idbGetVfs(`vfs:list:${path}`);
+    if (idbEntry && Date.now() - idbEntry.cachedAt < this.maxAge) {
+      this._stats.hits++;
+      this.listCache.set(path, idbEntry as { data: FileStat[]; cachedAt: number });
+      this.raw.list(path).then(r => {
+        this.listCache.set(path, { data: r, cachedAt: Date.now() });
+        this.idbSetVfs(`vfs:list:${path}`, { data: r, cachedAt: Date.now() });
+      }).catch(() => {});
+      return idbEntry.data as FileStat[];
+    }
     this._stats.misses++;
     const result = await this.raw.list(path);
     this.listCache.set(path, { data: result, cachedAt: Date.now() });
+    this.idbSetVfs(`vfs:list:${path}`, { data: result, cachedAt: Date.now() });
     return result;
   }
 
+  async tree(path: string, opts?: { hiddenPaths?: string[]; hideDotfiles?: boolean }): Promise<any[]> {
+    return this.raw.tree(path, opts);
+  }
+
   async upload(path: string, data: Uint8Array, mime?: string): Promise<FileStat> {
     const r = await this.raw.upload(path, data, mime);
     this.invalidatePath(path);
@@ -296,6 +331,7 @@ export class CachedVFSClient {
     this.invalidatePath(path);
     // Also invalidate the dir's own list (was empty/nonexistent before)
     this.listCache.delete(path);
+    this.idbDeleteVfs(`vfs:list:${path}`);
     return r;
   }
 
@@ -313,14 +349,17 @@ export class CachedVFSClient {
   invalidatePath(filePath: string) {
     this._stats.invalidations++;
     this.statCache.delete(filePath);
+    this.idbDeleteVfs(`vfs:stat:${filePath}`);
     const parent = filePath.includes('/') ? filePath.slice(0, filePath.lastIndexOf('/')) : '';
     this.listCache.delete(parent);
+    this.idbDeleteVfs(`vfs:list:${parent}`);
   }
 
   clear() {
     this._stats.pushClears++;
     this.listCache.clear();
     this.statCache.clear();
+    this.idbClearVfs();
   }
 
   /** Cache stats for diagnostics. Use in browser: `__bodCache.vfs().stats` */
@@ -334,4 +373,53 @@ export class CachedVFSClient {
       statCacheSize: this.statCache.size,
     };
   }
+
+  // --- IDB helpers for VFS cache ---
+
+  private idbGetVfs(key: string): Promise<{ data: unknown; cachedAt: number } | null> {
+    if (!this.idb) return Promise.resolve(null);
+    try {
+      const tx = this.idb.transaction('entries', 'readonly');
+      const req = tx.objectStore('entries').get(key);
+      return new Promise(resolve => {
+        req.onsuccess = () => {
+          const entry = req.result;
+          resolve(entry ? { data: entry.data, cachedAt: entry.cachedAt } : null);
+        };
+        req.onerror = () => resolve(null);
+      });
+    } catch { return Promise.resolve(null); }
+  }
+
+  private idbSetVfs(key: string, value: { data: unknown; cachedAt: number }): void {
+    if (!this.idb) return;
+    try {
+      const tx = this.idb.transaction('entries', 'readwrite');
+      tx.objectStore('entries').put({ path: key, data: value.data, cachedAt: value.cachedAt, updatedAt: Date.now() });
+    } catch {}
+  }
+
+  private idbDeleteVfs(key: string): void {
+    if (!this.idb) return;
+    try {
+      const tx = this.idb.transaction('entries', 'readwrite');
+      tx.objectStore('entries').delete(key);
+    } catch {}
+  }
+
+  private idbClearVfs(): void {
+    if (!this.idb) return;
+    try {
+      // Delete all vfs: prefixed entries
+      const tx = this.idb.transaction('entries', 'readwrite');
+      const store = tx.objectStore('entries');
+      const req = store.openCursor();
+      req.onsuccess = () => {
+        const cursor = req.result;
+        if (!cursor) return;
+        if (typeof cursor.key === 'string' && cursor.key.startsWith('vfs:')) cursor.delete();
+        cursor.continue();
+      };
+    } catch {}
+  }
 }

package/src/server/BodDB.ts

@@ -145,12 +145,12 @@ export class BodDB {
     // Init replication
     if (this.options.replication) {
       this.replication = new ReplicationEngine(this, this.options.replication);
-      // Auto-add _repl compaction for primary
-      if (this.replication.isPrimary) {
+      // Auto-add _repl compaction for any node that emits to _repl
+      if (this.replication.emitsToRepl) {
         const compactOpts = this.options.replication.compact ?? { keepKey: 'path', maxCount: 10000 };
         this.stream.options.compact = { ...this.stream.options.compact, _repl: compactOpts };
       }
-      _log.info(`Replication enabled (role: ${this.replication.isPrimary ? 'primary' : 'replica'})`);
+      _log.info(`Replication enabled (role: ${this.options.replication.role}${this.replication.router ? ', per-path topology' : ''})`);
     }
 
     _log.info('BodDB ready');

package/src/server/ReplicationEngine.ts

@@ -2,6 +2,7 @@ import type { BodDB } from './BodDB.ts';
 import { BodClient } from '../client/BodClient.ts';
 import type { ClientMessage } from '../shared/protocol.ts';
 import type { CompactOptions } from './StreamEngine.ts';
+import type { ComponentLogger } from '../shared/logger.ts';
 
 export interface ReplEvent {
   op: 'set' | 'delete' | 'push';
@@ -20,6 +21,94 @@ export interface WriteEvent {
   ttl?: number;
 }
 
+// --- Per-path topology types ---
+
+/**
+ * Per-path replication mode:
+ * - `primary`: local-authoritative, emits to _repl, not pulled from remote
+ * - `replica`: remote-authoritative, pulled from remote, client writes proxied to primary
+ * - `sync`: emits + pulls (one-directional pull — remote must also configure a source pointing back for true bidirectional)
+ * - `readonly`: pulled from remote, client writes rejected
+ * - `writeonly`: emits only, not pulled from remote, client writes allowed locally
+ */
+export type PathMode = 'primary' | 'replica' | 'sync' | 'readonly' | 'writeonly';
+
+export interface PathTopology {
+  path: string;
+  mode: PathMode;
+  /** Override write behavior: 'reject' rejects writes even on replica paths (default: proxy for replica, reject for readonly) */
+  writeProxy?: 'proxy' | 'optimistic' | 'reject';
+}
+
+/** Resolves per-path replication mode via longest-prefix match */
+export class PathTopologyRouter {
+  private entries: PathTopology[];
+  private fallbackMode: PathMode;
+
+  constructor(paths: Array<string | PathTopology>, fallbackRole: 'primary' | 'replica') {
+    this.fallbackMode = fallbackRole === 'primary' ? 'primary' : 'replica';
+    this.entries = paths.map(p =>
+      typeof p === 'string' ? { path: p, mode: 'sync' as PathMode } : p
+    );
+    // Sort longest-first for prefix matching
+    this.entries.sort((a, b) => b.path.length - a.path.length);
+  }
+
+  /** Longest-prefix match, falls back to role-based mode */
+  resolve(path: string): PathTopology {
+    for (const e of this.entries) {
+      if (path === e.path || path.startsWith(e.path + '/')) {
+        return e;
+      }
+    }
+    return { path: '', mode: this.fallbackMode };
+  }
+
+  /** Should this path's writes be emitted to _repl? */
+  shouldEmit(path: string): boolean {
+    const { mode } = this.resolve(path);
+    return mode === 'primary' || mode === 'sync' || mode === 'writeonly';
+  }
+
+  /** Should incoming repl events for this path be applied? */
+  shouldApply(path: string): boolean {
+    const { mode } = this.resolve(path);
+    return mode === 'replica' || mode === 'sync' || mode === 'readonly';
+  }
+
+  /** Should client writes to this path be proxied to primary? */
+  shouldProxy(path: string): boolean {
+    const { mode, writeProxy } = this.resolve(path);
+    if (writeProxy === 'reject') return false;
+    if (mode === 'readonly') return false; // readonly rejects, not proxies
+    return mode === 'replica';
+  }
+
+  /** Should client writes to this path be rejected? */
+  shouldReject(path: string): boolean {
+    const { mode, writeProxy } = this.resolve(path);
+    if (writeProxy === 'reject') return true;
+    return mode === 'readonly';
+  }
+
+  /** Get all configured entries */
+  getEntries(): readonly PathTopology[] { return this.entries; }
+
+  /** Get paths that need pulling from primary (ongoing stream subscription) */
+  getReplicaPaths(): string[] {
+    return this.entries
+      .filter(e => e.mode === 'replica' || e.mode === 'readonly' || e.mode === 'sync')
+      .map(e => e.path);
+  }
+
+  /** Get paths that need full bootstrap from primary (excludes sync — sync paths get ongoing events only, avoiding overwrite of local state) */
+  getBootstrapPaths(): string[] {
+    return this.entries
+      .filter(e => e.mode === 'replica' || e.mode === 'readonly')
+      .map(e => e.path);
+  }
+}
+
 export class ReplicationSource {
   url: string = '';
   auth?: () => string | Promise<string>;
@@ -34,17 +123,21 @@ export class ReplicationOptions {
   primaryUrl?: string;
   primaryAuth?: () => string | Promise<string>;
   replicaId?: string;
+  /** Paths excluded from replication. Note: when `paths` explicitly configures a prefix (e.g. `_auth`), it overrides this exclusion. */
   excludePrefixes: string[] = ['_repl', '_streams', '_mq', '_admin', '_auth'];
   /** Bootstrap replica from primary's full state before applying _repl stream */
   fullBootstrap: boolean = true;
   compact?: CompactOptions;
   sources?: ReplicationSource[];
+  /** Per-path topology: strings default to 'sync', objects specify mode. When absent, role governs all paths. */
+  paths?: Array<string | PathTopology>;
 }
 
 type ProxyableMessage = Extract<ClientMessage, { op: 'set' | 'delete' | 'update' | 'push' | 'batch' }>;
 
 export class ReplicationEngine {
   readonly options: ReplicationOptions;
+  readonly router: PathTopologyRouter | null = null;
   private client: BodClient | null = null;
   private unsubWrite: (() => void) | null = null;
   private unsubStream: (() => void) | null = null;
@@ -53,9 +146,15 @@ export class ReplicationEngine {
   private _seq = 0;
   private _emitting = false;
   private _pendingReplEvents: WriteEvent[] | null = null;
-
-  get isReplica(): boolean { return this.options.role === 'replica'; }
-  get isPrimary(): boolean { return this.options.role === 'primary'; }
+  private log: ComponentLogger;
+
+  /** When no router, falls back to role-based check. With router, both return false — use emitsToRepl/pullsFromPrimary instead. */
+  get isReplica(): boolean { return !this.router && this.options.role === 'replica'; }
+  get isPrimary(): boolean { return !this.router && this.options.role === 'primary'; }
+  /** True if this node emits write events to _repl (primary, router with emitting paths, or any node with startPrimary called) */
+  get emitsToRepl(): boolean { return this.isPrimary || !!this.router; }
+  /** True if this node pulls events from a primary */
+  get pullsFromPrimary(): boolean { return this.isReplica || (!!this.router && this.router.getReplicaPaths().length > 0); }
   get started(): boolean { return this._started; }
   get seq(): number { return this._seq; }
 
@@ -65,6 +164,7 @@ export class ReplicationEngine {
       role: this.options.role,
       started: this._started,
       seq: this._seq,
+      topology: this.router ? this.router.getEntries().map(e => ({ path: e.path, mode: e.mode })) : null,
       sources: (this.options.sources ?? []).map((s, i) => {
         const conn = this.sourceConns[i];
         return {
@@ -84,9 +184,42 @@ export class ReplicationEngine {
     options?: Partial<ReplicationOptions>,
   ) {
     this.options = { ...new ReplicationOptions(), ...options };
+    this.log = db.log.forComponent('repl');
+    if (this.options.paths?.length) {
+      this.router = new PathTopologyRouter(this.options.paths, this.options.role);
+    }
     if (!this.options.replicaId) {
-      this.options.replicaId = `replica_${Math.random().toString(36).slice(2, 10)}`;
+      // Derive stable ID from config when possible, fall back to random
+      if (this.options.primaryUrl) {
+        const seed = `${this.options.primaryUrl}:${(this.options.paths ?? []).map(p => typeof p === 'string' ? p : p.path).sort().join('+')}`;
+        // Simple hash for stability across restarts
+        let h = 0;
+        for (let i = 0; i < seed.length; i++) h = ((h << 5) - h + seed.charCodeAt(i)) | 0;
+        this.options.replicaId = `replica_${(h >>> 0).toString(36)}`;
+      } else {
+        this.options.replicaId = `replica_${Math.random().toString(36).slice(2, 10)}`;
+      }
+    }
+  }
+
+  /** Should client writes to this path be proxied to primary? */
+  shouldProxyPath(path: string): boolean {
+    if (this.router) {
+      // Only proxy if we have a client connection to proxy through
+      return this.router.shouldProxy(path) && !!this.client;
     }
+    return this.options.role === 'replica';
+  }
+
+  /** Should client writes to this path be rejected? */
+  shouldRejectPath(path: string): boolean {
+    if (this.router) {
+      const shouldProxy = this.router.shouldProxy(path);
+      // If path wants proxy but no client → reject instead of crashing
+      if (shouldProxy && !this.client) return true;
+      return this.router.shouldReject(path);
+    }
+    return false;
   }
 
   /** Start replication — primary listens for writes, replica connects and consumes */
@@ -94,9 +227,19 @@ export class ReplicationEngine {
     if (this._started) return;
     this._started = true;
 
-    if (this.isPrimary) {
+    // Always hook writes for emit (router or primary will filter)
+    if (this.router || this.isPrimary) {
       this.startPrimary();
-    } else {
+    }
+
+    // Connect to primary for replica/readonly/sync paths
+    if (this.router) {
+      const pullPaths = this.router.getReplicaPaths();
+      if (pullPaths.length) {
+        if (!this.options.primaryUrl) throw new Error('primaryUrl is required when paths include replica/readonly/sync modes');
+        await this.startReplicaForPaths(pullPaths);
+      }
+    } else if (this.options.role === 'replica') {
       await this.startReplica();
     }
 
@@ -108,6 +251,7 @@ export class ReplicationEngine {
   /** Stop replication */
   stop(): void {
     this._started = false;
+    if (this._compactTimer) { clearInterval(this._compactTimer); this._compactTimer = null; }
     this.unsubWrite?.();
     this.unsubWrite = null;
     this.unsubStream?.();
@@ -123,7 +267,7 @@ export class ReplicationEngine {
 
   /** Proxy a write operation to the primary (replica mode) */
   async proxyWrite(msg: ProxyableMessage): Promise<unknown> {
-    if (!this.client) throw new Error('Replica not connected to primary');
+    if (!this.client) throw new Error('Replica not connected to primary — ensure primaryUrl is set and start() has been called');
     switch (msg.op) {
       case 'set':
         await this.client.set(msg.path, msg.value, msg.ttl ? { ttl: msg.ttl } : undefined);
@@ -145,20 +289,51 @@ export class ReplicationEngine {
 
   // --- Primary mode ---
 
+  private _compactTimer: ReturnType<typeof setInterval> | null = null;
+
   private startPrimary(): void {
     this.unsubWrite = this.db.onWrite((ev: WriteEvent) => {
       this.emit(ev);
     });
+
+    // Auto-compact _repl stream to prevent unbounded growth
+    const compact = this.options.compact ?? { maxCount: 500, keepKey: 'path' };
+    if (compact.maxCount || compact.maxAge) {
+      // Compact on startup
+      try { this.db.stream.compact('_repl', compact); } catch {}
+      // Then periodically (every 5 minutes)
+      this._compactTimer = setInterval(() => {
+        try { this.db.stream.compact('_repl', compact); } catch {}
+      }, 5 * 60_000);
+    }
   }
 
   private isExcluded(path: string): boolean {
-    return this.options.excludePrefixes.some(p => path.startsWith(p));
+    if (this.options.excludePrefixes.some(p => path.startsWith(p))) {
+      // If router explicitly configures this path, don't exclude it
+      if (this.router) {
+        const resolved = this.router.resolve(path);
+        if (resolved.path !== '') return false; // explicitly configured → not excluded
+      }
+      return true;
+    }
+    return false;
   }
 
   /** Buffer replication events during transactions, emit immediately otherwise */
   private emit(ev: WriteEvent): void {
     if (this._emitting) return;
-    if (this.isExcluded(ev.path)) return;
+    if (this.router) {
+      // Single resolve: check exclusion override + shouldEmit together
+      const resolved = this.router.resolve(ev.path);
+      const isConfigured = resolved.path !== '';
+      // If in excludePrefixes but not explicitly configured, skip
+      if (!isConfigured && this.options.excludePrefixes.some(p => ev.path.startsWith(p))) return;
+      const mode = resolved.mode;
+      if (mode !== 'primary' && mode !== 'sync' && mode !== 'writeonly') return;
+    } else {
+      if (this.isExcluded(ev.path)) return;
+    }
 
     // If buffering (transaction in progress), collect events
     if (this._pendingReplEvents) {
@@ -202,6 +377,62 @@ export class ReplicationEngine {
 
   // --- Replica mode ---
 
+  /** Start replica for specific path prefixes (router-based) */
+  private async startReplicaForPaths(pathPrefixes: string[]): Promise<void> {
+    if (!this.options.primaryUrl) throw new Error('primaryUrl required for per-path replication');
+
+    this.client = new BodClient({
+      url: this.options.primaryUrl,
+      auth: this.options.primaryAuth,
+    });
+    await this.client.connect();
+    this.log.info(`Connected to primary ${this.options.primaryUrl} (paths: ${pathPrefixes.join(', ')})`);
+
+    // Bootstrap only replica/readonly paths (sync paths get ongoing events only — avoids overwriting local state)
+    const bootstrapPaths = this.router!.getBootstrapPaths();
+    if (this.options.fullBootstrap && bootstrapPaths.length) {
+      await this.bootstrapFullState(bootstrapPaths);
+    }
+
+    // Stream bootstrap filtered
+    const snapshot = await this.client!.streamMaterialize('_repl', { keepKey: 'path' });
+    if (snapshot) {
+      this.db.setReplaying(true);
+      try {
+        for (const [, event] of Object.entries(snapshot)) {
+          const ev = event as ReplEvent;
+          if (this.matchesPathPrefixes(ev.path, pathPrefixes)) {
+            this.applyEvent(ev);
+          }
+        }
+      } finally {
+        this.db.setReplaying(false);
+      }
+    }
+
+    // Subscribe to ongoing events, filter by paths
+    const groupId = this.options.replicaId!;
+    this.unsubStream = this.client.stream('_repl', groupId).on((events) => {
+      this.db.setReplaying(true);
+      try {
+        for (const e of events) {
+          const ev = e.val() as ReplEvent;
+          if (this.matchesPathPrefixes(ev.path, pathPrefixes)) {
+            this.applyEvent(ev);
+          }
+          this.client!.stream('_repl', groupId).ack(e.key).catch(() => {});
+        }
+      } finally {
+        this.db.setReplaying(false);
+      }
+    });
+  }
+
+  /** Check if path matches any of the given prefixes */
+  private matchesPathPrefixes(path: string, prefixes: string[]): boolean {
+    return prefixes.some(p => path === p || path.startsWith(p + '/'));
+  }
+
   private async startReplica(): Promise<void> {
     if (!this.options.primaryUrl) throw new Error('primaryUrl required for replica mode');
 
@@ -211,7 +442,7 @@ export class ReplicationEngine {
     });
 
     await this.client.connect();
-    console.log(`  [REPL] Connected to primary ${this.options.primaryUrl}`);
+    this.log.info(`Connected to primary ${this.options.primaryUrl}`);
 
     // Full state bootstrap: fetch all data from primary (catches pre-replication data)
     if (this.options.fullBootstrap) {
@@ -220,7 +451,7 @@ export class ReplicationEngine {
 
     // Stream bootstrap: apply _repl events on top (catches recent writes, deduped by idempotent set)
     const snapshot = await this.client!.streamMaterialize('_repl', { keepKey: 'path' });
-    console.log(`  [REPL] Stream bootstrap: ${snapshot ? Object.keys(snapshot).length + ' events' : 'no events'}`);
+    this.log.info(`Stream bootstrap: ${snapshot ? Object.keys(snapshot).length + ' events' : 'no events'}`);
     if (snapshot) {
       this.db.setReplaying(true);
       try {
@@ -235,9 +466,9 @@ export class ReplicationEngine {
 
     // Subscribe to ongoing events
     const groupId = this.options.replicaId!;
-    console.log(`  [REPL] Subscribing to stream as '${groupId}'`);
+    this.log.info(`Subscribing to stream as '${groupId}'`);
     this.unsubStream = this.client.stream('_repl', groupId).on((events) => {
-      console.log(`  [REPL] Received ${events.length} events`);
+      this.log.debug(`Received ${events.length} events`);
       this.db.setReplaying(true);
       try {
         for (const e of events) {
@@ -252,13 +483,16 @@ export class ReplicationEngine {
     });
   }
 
-  /** Fetch full DB state from primary and apply locally */
-  private async bootstrapFullState(): Promise<void> {
+  /** Fetch full DB state from primary and apply locally. Optional pathPrefixes filters which top-level keys to pull. */
+  private async bootstrapFullState(pathPrefixes?: string[]): Promise<void> {
     const topLevel = await this.client!.getShallow();
-    const keys = topLevel
+    let keys = topLevel
       .map(e => e.key)
       .filter(k => !this.isExcluded(k));
-    console.log(`  [REPL] Full bootstrap: ${keys.length} top-level keys [${keys.join(', ')}]`);
+    if (pathPrefixes) {
+      keys = keys.filter(k => this.matchesPathPrefixes(k, pathPrefixes));
+    }
+    this.log.info(`Full bootstrap: ${keys.length} top-level keys [${keys.join(', ')}]`);
     if (keys.length === 0) return;
 
     this.db.setReplaying(true);
@@ -283,7 +517,7 @@ export class ReplicationEngine {
     for (let i = 0; i < results.length; i++) {
       if (results[i].status === 'rejected') {
         const src = this.options.sources![i];
-        console.error(`[REPL] source ${src.url} paths=[${src.paths}] failed:`, (results[i] as PromiseRejectedResult).reason);
+        this.log.error(`source ${src.url} paths=[${src.paths}] failed:`, (results[i] as PromiseRejectedResult).reason);
       }
     }
   }
@@ -345,6 +579,8 @@ export class ReplicationEngine {
 
   private applyEvent(ev: ReplEvent, source?: ReplicationSource): void {
     const path = source ? this.remapPath(ev.path, source) : ev.path;
+    // Defense-in-depth: skip events for paths we shouldn't apply (primary/writeonly)
+    if (!source && this.router && !this.router.shouldApply(path)) return;
     switch (ev.op) {
       case 'set':
         this.db.set(path, ev.value, ev.ttl ? { ttl: ev.ttl } : undefined);