@bod.ee/db 0.7.0 → 0.8.0

package/src/server/Transport.ts

@@ -5,11 +5,18 @@ import type { ClientMessage } from '../shared/protocol.ts';
 import { Errors } from '../shared/errors.ts';
 import { normalizePath, pathKey } from '../shared/pathUtils.ts';
 
-interface WsData {
+interface VfsTransfer {
+  path: string;
+  mime?: string;
+  chunks: string[];
+}
+
+export interface WsData {
   auth: Record<string, unknown> | null;
   valueSubs: Map<string, () => void>;
   childSubs: Map<string, () => void>;
   streamSubs: Map<string, () => void>;
+  vfsTransfers: Map<string, VfsTransfer>;
 }
 
 export class TransportOptions {
@@ -33,437 +40,647 @@ export class Transport {
     this.options = { ...new TransportOptions(), ...options };
   }
 
-  start(): Server {
-    const self = this;
-    const extractAuth = async (req: Request): Promise<Record<string, unknown> | null> => {
-      const header = req.headers.get('authorization');
-      if (!header?.startsWith('Bearer ')) return null;
-      const token = header.slice(7);
-      if (self.options.auth) return await self.options.auth(token);
-      return { token };
-    };
-    this.server = Bun.serve({
-      port: this.options.port,
-      fetch(req, server) {
-        const url = new URL(req.url);
+  private async extractAuth(req: Request): Promise<Record<string, unknown> | null> {
+    const header = req.headers.get('authorization');
+    if (!header?.startsWith('Bearer ')) return null;
+    const token = header.slice(7);
+    if (this.options.auth) return await this.options.auth(token);
+    return { token };
+  }
 
-        // WebSocket upgrade (only if client actually requests it)
-        if (req.headers.get('upgrade')?.toLowerCase() === 'websocket') {
-          if (server.upgrade(req, { data: { auth: null, valueSubs: new Map(), childSubs: new Map(), streamSubs: new Map() } as WsData })) {
-            return;
-          }
-        }
+  /** Create fresh WsData for a new WebSocket connection */
+  newWsData(): WsData {
+    return { auth: null, valueSubs: new Map(), childSubs: new Map(), streamSubs: new Map(), vfsTransfers: new Map() };
+  }
 
-        // REST: GET /path → get
-        if (req.method === 'GET' && url.pathname.startsWith('/db/')) {
-          return (async () => {
-            const path = normalizePath(url.pathname.slice(4));
-            const auth = await extractAuth(req);
-            if (self.rules && !self.rules.check('read', path, auth)) {
-              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
-            }
-            const data = self.db.get(path);
-            return Response.json({ ok: true, data });
-          })();
+  /**
+   * Handle an HTTP request. Returns a Response, or undefined if the request
+   * was upgraded to WebSocket (caller should return immediately in that case).
+   * Pass `server` to enable WebSocket upgrades.
+   */
+  handleFetch(req: Request, server?: Server): Response | Promise<Response | undefined> | undefined {
+    const url = new URL(req.url);
+
+    // WebSocket upgrade (only if server provided and client requests it)
+    if (server && req.headers.get('upgrade')?.toLowerCase() === 'websocket') {
+      if (server.upgrade(req, { data: this.newWsData() })) {
+        return;
+      }
+    }
+
+    // REST: GET /db/<path> → get
+    if (req.method === 'GET' && url.pathname.startsWith('/db/')) {
+      return (async () => {
+        const path = normalizePath(url.pathname.slice(4));
+        const auth = await this.extractAuth(req);
+        if (this.rules && !this.rules.check('read', path, auth)) {
+          return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
         }
-
-        // REST: PUT /path → set
-        if (req.method === 'PUT' && url.pathname.startsWith('/db/')) {
-          return (async () => {
-            const path = normalizePath(url.pathname.slice(4));
-            const auth = await extractAuth(req);
-            if (self.rules && !self.rules.check('write', path, auth)) {
-              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
-            }
+        const meta = this.db.storage.getWithMeta(path);
+        return Response.json({ ok: true, data: meta?.data ?? null, updatedAt: meta?.updatedAt });
+      })();
+    }
+
+    // REST: PUT /db/<path> → set
+    if (req.method === 'PUT' && url.pathname.startsWith('/db/')) {
+      return (async () => {
+        const path = normalizePath(url.pathname.slice(4));
+        if (this.db.replication?.isReplica) {
+          try {
             const body = await req.json();
-            self.db.set(path, body);
+            await this.db.replication.proxyWrite({ op: 'set', path, value: body });
             return Response.json({ ok: true });
-          })();
+          } catch (e: any) {
+            return Response.json({ ok: false, error: e.message, code: Errors.INTERNAL }, { status: 500 });
+          }
         }
-
-        // REST: DELETE /path → delete
-        if (req.method === 'DELETE' && url.pathname.startsWith('/db/')) {
-          return (async () => {
-            const path = normalizePath(url.pathname.slice(4));
-            const auth = await extractAuth(req);
-            if (self.rules && !self.rules.check('write', path, auth)) {
-              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
-            }
-            self.db.delete(path);
+        const auth = await this.extractAuth(req);
+        if (this.rules && !this.rules.check('write', path, auth)) {
+          return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+        }
+        const body = await req.json();
+        this.db.set(path, body);
+        return Response.json({ ok: true });
+      })();
+    }
+
+    // REST: DELETE /db/<path> → delete
+    if (req.method === 'DELETE' && url.pathname.startsWith('/db/')) {
+      return (async () => {
+        const path = normalizePath(url.pathname.slice(4));
+        if (this.db.replication?.isReplica) {
+          try {
+            await this.db.replication.proxyWrite({ op: 'delete', path });
             return Response.json({ ok: true });
-          })();
+          } catch (e: any) {
+            return Response.json({ ok: false, error: e.message, code: Errors.INTERNAL }, { status: 500 });
+          }
+        }
+        const auth = await this.extractAuth(req);
+        if (this.rules && !this.rules.check('write', path, auth)) {
+          return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+        }
+        this.db.delete(path);
+        return Response.json({ ok: true });
+      })();
+    }
+
+    // SSE: GET /sse/<path>?event=value|child
+    if (req.method === 'GET' && url.pathname.startsWith('/sse/')) {
+      return (async () => {
+        const path = normalizePath(url.pathname.slice(5));
+        const event = url.searchParams.get('event') || 'value';
+        const auth = await this.extractAuth(req);
+
+        if (this.rules && !this.rules.check('read', path, auth)) {
+          return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
         }
 
-        // SSE: GET /sse/path?event=value|child
-        if (req.method === 'GET' && url.pathname.startsWith('/sse/')) {
-          return (async () => {
-            const path = normalizePath(url.pathname.slice(5));
-            const event = url.searchParams.get('event') || 'value';
-            const auth = await extractAuth(req);
-
-            if (self.rules && !self.rules.check('read', path, auth)) {
-              return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
-            }
-
-          let cleanup: (() => void) | null = null;
-          const stream = new ReadableStream({
-            start(controller) {
-              const encoder = new TextEncoder();
-              // Initial SSE comment to establish the stream
-              controller.enqueue(encoder.encode(': ok\n\n'));
-              const send = (data: string) => {
-                try { controller.enqueue(encoder.encode(`data: ${data}\n\n`)); } catch {}
-              };
-
-              if (event === 'child') {
-                cleanup = self.db.onChild(path, (e) => {
-                  send(JSON.stringify({ type: 'child', path, key: e.key, data: e.val(), event: e.type }));
-                });
-              } else {
-                cleanup = self.db.on(path, (snap) => {
-                  send(JSON.stringify({ type: 'value', path: snap.path, data: snap.val() }));
-                });
-              }
-            },
-            cancel() {
-              cleanup?.();
-            },
-          });
-
-            return new Response(stream, {
-              headers: {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                'Connection': 'keep-alive',
-              },
+      let cleanup: (() => void) | null = null;
+      const stream = new ReadableStream({
+        start: (controller) => {
+          const encoder = new TextEncoder();
+          controller.enqueue(encoder.encode(': ok\n\n'));
+          const send = (data: string) => {
+            try { controller.enqueue(encoder.encode(`data: ${data}\n\n`)); } catch {}
+          };
+
+          if (event === 'child') {
+            cleanup = this.db.onChild(path, (e) => {
+              send(JSON.stringify({ type: 'child', path, key: e.key, data: e.val(), event: e.type }));
             });
-          })();
+          } else {
+            cleanup = this.db.on(path, (snap) => {
+              send(JSON.stringify({ type: 'value', path: snap.path, data: snap.val() }));
+            });
+          }
+        },
+        cancel() {
+          cleanup?.();
+        },
+      });
+
+        return new Response(stream, {
+          headers: {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            'Connection': 'keep-alive',
+          },
+        });
+      })();
+    }
+
+    // VFS REST routes
+    if (this.db.vfs && url.pathname.startsWith('/files/')) {
+      const vfsPath = normalizePath(url.pathname.slice(7));
+      return (async () => {
+        const auth = await this.extractAuth(req);
+
+        if (req.method === 'GET' && url.searchParams.has('stat')) {
+          if (this.rules && !this.rules.check('read', `_vfs/${vfsPath}`, auth)) {
+            return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+          }
+          const stat = this.db.vfs!.stat(vfsPath);
+          if (!stat) return Response.json({ ok: false, error: 'Not found', code: Errors.NOT_FOUND }, { status: 404 });
+          return Response.json({ ok: true, data: stat });
         }
 
-        // Static routes
-        if (self.options.staticRoutes) {
-          const filePath = self.options.staticRoutes[url.pathname];
-          if (filePath) return new Response(Bun.file(filePath));
+        if (req.method === 'GET' && url.searchParams.has('list')) {
+          if (this.rules && !this.rules.check('read', `_vfs/${vfsPath}`, auth)) {
+            return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+          }
+          return Response.json({ ok: true, data: this.db.vfs!.list(vfsPath) });
         }
 
-        return new Response('Not Found', { status: 404 });
-      },
-      websocket: {
-        open(ws: ServerWebSocket<WsData>) { self._clients.add(ws); },
-        close(ws: ServerWebSocket<WsData>) {
-          self._clients.delete(ws);
-          // Cleanup all subscriptions
-          for (const off of ws.data.valueSubs.values()) off();
-          for (const off of ws.data.childSubs.values()) off();
-          for (const off of ws.data.streamSubs.values()) off();
-          ws.data.valueSubs.clear();
-          ws.data.childSubs.clear();
-          ws.data.streamSubs.clear();
-        },
-        async message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
-          let msg: ClientMessage;
+        if (req.method === 'GET') {
+          if (this.rules && !this.rules.check('read', `_vfs/${vfsPath}`, auth)) {
+            return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+          }
           try {
-            msg = JSON.parse(typeof raw === 'string' ? raw : raw.toString());
+            const data = await this.db.vfs!.read(vfsPath);
+            const stat = this.db.vfs!.stat(vfsPath);
+            return new Response(data, {
+              headers: { 'Content-Type': stat?.mime || 'application/octet-stream' },
+            });
           } catch {
-            ws.send(JSON.stringify({ id: '?', ok: false, error: 'Invalid JSON', code: Errors.INTERNAL }));
-            return;
+            return Response.json({ ok: false, error: 'Not found', code: Errors.NOT_FOUND }, { status: 404 });
           }
+        }
 
-          const { id } = msg;
-          const reply = (data: unknown) => ws.send(JSON.stringify({ id, ok: true, data }));
-          const error = (err: string, code: string) => ws.send(JSON.stringify({ id, ok: false, error: err, code }));
+        if (req.method === 'POST' && url.searchParams.has('mkdir')) {
+          if (this.rules && !this.rules.check('write', `_vfs/${vfsPath}`, auth)) {
+            return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+          }
+          const stat = this.db.vfs!.mkdir(vfsPath);
+          return Response.json({ ok: true, data: stat });
+        }
 
-          try {
-            switch (msg.op) {
-              case 'auth': {
-                if (!self.options.auth) {
-                  ws.data.auth = { token: msg.token };
-                } else {
-                  const result = await self.options.auth(msg.token);
-                  if (!result) return error('Authentication failed', Errors.AUTH_REQUIRED);
-                  ws.data.auth = result;
-                }
-                return reply(null);
+        if (req.method === 'POST') {
+          if (this.rules && !this.rules.check('write', `_vfs/${vfsPath}`, auth)) {
+            return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+          }
+          const buf = await req.arrayBuffer();
+          const mime = req.headers.get('content-type') || undefined;
+          const stat = await this.db.vfs!.write(vfsPath, new Uint8Array(buf), mime);
+          return Response.json({ ok: true, data: stat });
+        }
+
+        if (req.method === 'PUT' && url.searchParams.has('move')) {
+          if (this.rules && !this.rules.check('write', `_vfs/${vfsPath}`, auth)) {
+            return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+          }
+          const dst = url.searchParams.get('move')!;
+          const stat = await this.db.vfs!.move(vfsPath, dst);
+          return Response.json({ ok: true, data: stat });
+        }
+
+        if (req.method === 'DELETE') {
+          if (this.rules && !this.rules.check('write', `_vfs/${vfsPath}`, auth)) {
+            return Response.json({ ok: false, error: 'Permission denied', code: Errors.PERMISSION_DENIED }, { status: 403 });
+          }
+          await this.db.vfs!.remove(vfsPath);
+          return Response.json({ ok: true });
+        }
+
+        return new Response('Method not allowed', { status: 405 });
+      })();
+    }
+
+    // Static routes
+    if (this.options.staticRoutes) {
+      const filePath = this.options.staticRoutes[url.pathname];
+      if (filePath) return new Response(Bun.file(filePath));
+    }
+
+    return new Response('Not Found', { status: 404 });
+  }
+
+  /** WebSocket handler config for Bun.serve() */
+  get websocketConfig() {
+    const self = this;
+    return {
+      open(ws: ServerWebSocket<WsData>) { self._clients.add(ws); },
+      close(ws: ServerWebSocket<WsData>) {
+        self._clients.delete(ws);
+        for (const off of ws.data.valueSubs.values()) off();
+        for (const off of ws.data.childSubs.values()) off();
+        for (const off of ws.data.streamSubs.values()) off();
+        ws.data.valueSubs.clear();
+        ws.data.childSubs.clear();
+        ws.data.streamSubs.clear();
+      },
+      async message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
+        let msg: ClientMessage;
+        try {
+          msg = JSON.parse(typeof raw === 'string' ? raw : raw.toString());
+        } catch {
+          ws.send(JSON.stringify({ id: '?', ok: false, error: 'Invalid JSON', code: Errors.INTERNAL }));
+          return;
+        }
+
+        const { id } = msg;
+        const reply = (data: unknown, extra?: Record<string, unknown>) => ws.send(JSON.stringify({ id, ok: true, data, ...extra }));
+        const error = (err: string, code: string) => ws.send(JSON.stringify({ id, ok: false, error: err, code }));
+
+        try {
+          switch (msg.op) {
+            case 'auth': {
+              if (!self.options.auth) {
+                ws.data.auth = { token: msg.token };
+              } else {
+                const result = await self.options.auth(msg.token);
+                if (!result) return error('Authentication failed', Errors.AUTH_REQUIRED);
+                ws.data.auth = result;
               }
+              return reply(null);
+            }
 
-              case 'get': {
-                if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                if (msg.shallow) return reply(self.db.getShallow(msg.path || undefined));
-                return reply(self.db.get(msg.path));
+            case 'get': {
+              if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              if (msg.shallow) return reply(self.db.getShallow(msg.path || undefined));
+              const meta = self.db.storage.getWithMeta(msg.path);
+              return reply(meta?.data ?? null, { updatedAt: meta?.updatedAt });
+            }
 
-              case 'set': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth, self.db.get(msg.path), msg.value)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                self.db.set(msg.path, msg.value, msg.ttl ? { ttl: msg.ttl } : undefined);
-                return reply(null);
+            case 'set': {
+              if (self.db.replication?.isReplica) {
+                try { return reply(await self.db.replication.proxyWrite(msg)); }
+                catch (e: any) { return error(e.message, Errors.INTERNAL); }
               }
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth, self.db.get(msg.path), msg.value)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              self.db.set(msg.path, msg.value, msg.ttl ? { ttl: msg.ttl } : undefined);
+              return reply(null);
+            }
 
-              case 'update': {
-                for (const path of Object.keys(msg.updates)) {
-                  if (self.rules && !self.rules.check('write', path, ws.data.auth)) {
-                    return error(`Permission denied for ${path}`, Errors.PERMISSION_DENIED);
-                  }
+            case 'update': {
+              if (self.db.replication?.isReplica) {
+                try { return reply(await self.db.replication.proxyWrite(msg)); }
+                catch (e: any) { return error(e.message, Errors.INTERNAL); }
+              }
+              for (const path of Object.keys(msg.updates)) {
+                if (self.rules && !self.rules.check('write', path, ws.data.auth)) {
+                  return error(`Permission denied for ${path}`, Errors.PERMISSION_DENIED);
                 }
-                self.db.update(msg.updates);
-                return reply(null);
               }
+              self.db.update(msg.updates);
+              return reply(null);
+            }
 
-              case 'delete': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                self.db.delete(msg.path);
-                return reply(null);
+            case 'delete': {
+              if (self.db.replication?.isReplica) {
+                try { return reply(await self.db.replication.proxyWrite(msg)); }
+                catch (e: any) { return error(e.message, Errors.INTERNAL); }
+              }
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              self.db.delete(msg.path);
+              return reply(null);
+            }
 
-              case 'query': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                let q = self.db.query(msg.path);
-                if (msg.filters) for (const f of msg.filters) q = q.where(f.field, f.op, f.value);
-                if (msg.order) q = q.order(msg.order.field, msg.order.dir);
-                if (msg.limit) q = q.limit(msg.limit);
-                if (msg.offset) q = q.offset(msg.offset);
-                return reply(q.get());
+            case 'query': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              let q = self.db.query(msg.path);
+              if (msg.filters) for (const f of msg.filters) q = q.where(f.field, f.op, f.value);
+              if (msg.order) q = q.order(msg.order.field, msg.order.dir);
+              if (msg.limit) q = q.limit(msg.limit);
+              if (msg.offset) q = q.offset(msg.offset);
+              return reply(q.get());
+            }
 
-              case 'sub': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                const subKey = `${msg.event}:${msg.path}`;
-                if (msg.event === 'value') {
-                  if (ws.data.valueSubs.has(subKey)) return reply(null); // already subscribed
-                  const off = self.db.on(msg.path, (snap) => {
-                    ws.send(JSON.stringify({ type: 'value', path: snap.path, data: snap.val() }));
-                  });
-                  ws.data.valueSubs.set(subKey, off);
-                } else if (msg.event === 'child') {
-                  if (ws.data.childSubs.has(subKey)) return reply(null);
-                  const subPath = msg.path;
-                  const off = self.db.onChild(subPath, (event) => {
-                    ws.send(JSON.stringify({ type: 'child', path: subPath, key: event.key, data: event.val(), event: event.type }));
-                  });
-                  ws.data.childSubs.set(subKey, off);
-                }
-                return reply(null);
+            case 'sub': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              const subKey = `${msg.event}:${msg.path}`;
+              if (msg.event === 'value') {
+                if (ws.data.valueSubs.has(subKey)) return reply(null);
+                const off = self.db.on(msg.path, (snap) => {
+                  const meta = self.db.storage.getWithMeta(snap.path);
+                  ws.send(JSON.stringify({ type: 'value', path: snap.path, data: snap.val(), updatedAt: meta?.updatedAt }));
+                });
+                ws.data.valueSubs.set(subKey, off);
+              } else if (msg.event === 'child') {
+                if (ws.data.childSubs.has(subKey)) return reply(null);
+                const subPath = msg.path;
+                const off = self.db.onChild(subPath, (event) => {
+                  ws.send(JSON.stringify({ type: 'child', path: subPath, key: event.key, data: event.val(), event: event.type }));
+                });
+                ws.data.childSubs.set(subKey, off);
+              }
+              return reply(null);
+            }
 
-              case 'unsub': {
-                const unsubKey = `${msg.event}:${msg.path}`;
-                if (msg.event === 'value') {
-                  ws.data.valueSubs.get(unsubKey)?.();
-                  ws.data.valueSubs.delete(unsubKey);
-                } else if (msg.event === 'child') {
-                  ws.data.childSubs.get(unsubKey)?.();
-                  ws.data.childSubs.delete(unsubKey);
-                }
-                return reply(null);
+            case 'unsub': {
+              const unsubKey = `${msg.event}:${msg.path}`;
+              if (msg.event === 'value') {
+                ws.data.valueSubs.get(unsubKey)?.();
+                ws.data.valueSubs.delete(unsubKey);
+              } else if (msg.event === 'child') {
+                ws.data.childSubs.get(unsubKey)?.();
+                ws.data.childSubs.delete(unsubKey);
               }
+              return reply(null);
+            }
 
-              case 'batch': {
-                const results: unknown[] = [];
-                self.db.transaction((tx) => {
-                  for (const batchOp of msg.operations) {
-                    switch (batchOp.op) {
-                      case 'set':
-                        if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
-                          throw new Error(`Permission denied for ${batchOp.path}`);
-                        }
-                        tx.set(batchOp.path, batchOp.value);
-                        break;
-                      case 'update':
-                        for (const path of Object.keys(batchOp.updates)) {
-                          if (self.rules && !self.rules.check('write', path, ws.data.auth)) {
-                            throw new Error(`Permission denied for ${path}`);
-                          }
-                        }
-                        tx.update(batchOp.updates);
-                        break;
-                      case 'delete':
-                        if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
-                          throw new Error(`Permission denied for ${batchOp.path}`);
-                        }
-                        tx.delete(batchOp.path);
-                        break;
-                      case 'push': {
-                        if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
-                          throw new Error(`Permission denied for ${batchOp.path}`);
+            case 'batch': {
+              if (self.db.replication?.isReplica) {
+                try { return reply(await self.db.replication.proxyWrite(msg)); }
+                catch (e: any) { return error(e.message, Errors.INTERNAL); }
+              }
+              const results: unknown[] = [];
+              self.db.transaction((tx) => {
+                for (const batchOp of msg.operations) {
+                  switch (batchOp.op) {
+                    case 'set':
+                      if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
+                        throw new Error(`Permission denied for ${batchOp.path}`);
+                      }
+                      tx.set(batchOp.path, batchOp.value);
+                      break;
+                    case 'update':
+                      for (const path of Object.keys(batchOp.updates)) {
+                        if (self.rules && !self.rules.check('write', path, ws.data.auth)) {
+                          throw new Error(`Permission denied for ${path}`);
                         }
-                        const key = self.db.push(batchOp.path, batchOp.value);
-                        results.push(key);
-                        break;
                       }
+                      tx.update(batchOp.updates);
+                      break;
+                    case 'delete':
+                      if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
+                        throw new Error(`Permission denied for ${batchOp.path}`);
+                      }
+                      tx.delete(batchOp.path);
+                      break;
+                    case 'push': {
+                      if (self.rules && !self.rules.check('write', batchOp.path, ws.data.auth)) {
+                        throw new Error(`Permission denied for ${batchOp.path}`);
+                      }
+                      const key = self.db.push(batchOp.path, batchOp.value);
+                      results.push(key);
+                      break;
                     }
                   }
-                });
-                return reply(results.length ? results : null);
-              }
-
-              case 'push': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
                 }
-                const key = self.db.push(msg.path, msg.value, msg.idempotencyKey ? { idempotencyKey: msg.idempotencyKey } : undefined);
-                return reply(key);
-              }
+              });
+              return reply(results.length ? results : null);
+            }
 
-              case 'stream-read': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                const events = self.db.stream.read(msg.path, msg.groupId, msg.limit);
-                return reply(events);
+            case 'push': {
+              if (self.db.replication?.isReplica) {
+                try { return reply(await self.db.replication.proxyWrite(msg)); }
+                catch (e: any) { return error(e.message, Errors.INTERNAL); }
+              }
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              const key = self.db.push(msg.path, msg.value, msg.idempotencyKey ? { idempotencyKey: msg.idempotencyKey } : undefined);
+              return reply(key);
+            }
 
-              case 'stream-ack': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                self.db.stream.ack(msg.path, msg.groupId, msg.key);
-                return reply(null);
+            case 'stream-read': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              const events = self.db.stream.read(msg.path, msg.groupId, msg.limit);
+              return reply(events);
+            }
 
-              case 'stream-sub': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                const streamKey = `${msg.path}:${msg.groupId}`;
-                // Unsub existing if any
-                ws.data.streamSubs.get(streamKey)?.();
-                const unsub = self.db.stream.subscribe(msg.path, msg.groupId, (events) => {
-                  ws.send(JSON.stringify({ type: 'stream', path: msg.path, groupId: msg.groupId, events }));
-                });
-                ws.data.streamSubs.set(streamKey, unsub);
-                return reply(null);
+            case 'stream-ack': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              self.db.stream.ack(msg.path, msg.groupId, msg.key);
+              return reply(null);
+            }
 
-              case 'stream-unsub': {
-                const streamUnsubKey = `${msg.path}:${msg.groupId}`;
-                ws.data.streamSubs.get(streamUnsubKey)?.();
-                ws.data.streamSubs.delete(streamUnsubKey);
-                return reply(null);
+            case 'stream-sub': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              const streamKey = `${msg.path}:${msg.groupId}`;
+              ws.data.streamSubs.get(streamKey)?.();
+              const unsub = self.db.stream.subscribe(msg.path, msg.groupId, (events) => {
+                ws.send(JSON.stringify({ type: 'stream', path: msg.path, groupId: msg.groupId, events }));
+              });
+              ws.data.streamSubs.set(streamKey, unsub);
+              return reply(null);
+            }
 
-              // MQ ops
-              case 'mq-push': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                const mqKey = self.db.mq.push(msg.path, msg.value, msg.idempotencyKey ? { idempotencyKey: msg.idempotencyKey } : undefined);
-                return reply(mqKey);
+            case 'stream-unsub': {
+              const streamUnsubKey = `${msg.path}:${msg.groupId}`;
+              ws.data.streamSubs.get(streamUnsubKey)?.();
+              ws.data.streamSubs.delete(streamUnsubKey);
+              return reply(null);
+            }
+
+            case 'mq-push': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'mq-fetch': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.mq.fetch(msg.path, msg.count));
+              const mqKey = self.db.mq.push(msg.path, msg.value, msg.idempotencyKey ? { idempotencyKey: msg.idempotencyKey } : undefined);
+              return reply(mqKey);
+            }
+            case 'mq-fetch': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'mq-ack': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                self.db.mq.ack(msg.path, msg.key);
-                return reply(null);
+              return reply(self.db.mq.fetch(msg.path, msg.count));
+            }
+            case 'mq-ack': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'mq-nack': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                self.db.mq.nack(msg.path, msg.key);
-                return reply(null);
+              self.db.mq.ack(msg.path, msg.key);
+              return reply(null);
+            }
+            case 'mq-nack': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'mq-peek': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.mq.peek(msg.path, msg.count));
+              self.db.mq.nack(msg.path, msg.key);
+              return reply(null);
+            }
+            case 'mq-peek': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'mq-dlq': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.mq.dlq(msg.path));
+              return reply(self.db.mq.peek(msg.path, msg.count));
+            }
+            case 'mq-dlq': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'mq-purge': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.mq.purge(msg.path, { all: msg.all }));
+              return reply(self.db.mq.dlq(msg.path));
+            }
+            case 'mq-purge': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              return reply(self.db.mq.purge(msg.path, { all: msg.all }));
+            }
 
-              // FTS ops
-              case 'fts-search': {
-                if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.search({ text: msg.text, path: msg.path, limit: msg.limit }));
+            case 'fts-search': {
+              if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'fts-index': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                if (msg.fields) self.db.index(msg.path, msg.fields);
-                else if (msg.content) self.db.index(msg.path, msg.content);
-                return reply(null);
+              return reply(self.db.search({ text: msg.text, path: msg.path, limit: msg.limit }));
+            }
+            case 'fts-index': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              if (msg.fields) self.db.index(msg.path, msg.fields);
+              else if (msg.content) self.db.index(msg.path, msg.content);
+              return reply(null);
+            }
 
-              // Vector ops
-              case 'vector-search': {
-                if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.vectorSearch({ query: msg.query, path: msg.path, limit: msg.limit, threshold: msg.threshold }));
+            case 'vector-search': {
+              if (self.rules && !self.rules.check('read', msg.path || '', ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'vector-store': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                self.db.vectors!.store(msg.path, msg.embedding);
-                return reply(null);
+              return reply(self.db.vectorSearch({ query: msg.query, path: msg.path, limit: msg.limit, threshold: msg.threshold }));
+            }
+            case 'vector-store': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              self.db.vectors!.store(msg.path, msg.embedding);
+              return reply(null);
+            }
 
-              // Stream extended ops
-              case 'stream-snapshot': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.stream.snapshot(msg.path));
+            case 'stream-snapshot': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'stream-materialize': {
-                if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.stream.materialize(msg.path, msg.keepKey ? { keepKey: msg.keepKey } : undefined));
+              return reply(self.db.stream.snapshot(msg.path));
+            }
+            case 'stream-materialize': {
+              if (self.rules && !self.rules.check('read', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'stream-compact': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                return reply(self.db.stream.compact(msg.path, { maxAge: msg.maxAge, maxCount: msg.maxCount, keepKey: msg.keepKey }));
+              return reply(self.db.stream.materialize(msg.path, msg.keepKey ? { keepKey: msg.keepKey } : undefined));
+            }
+            case 'stream-compact': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
-              case 'stream-reset': {
-                if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
-                  return error('Permission denied', Errors.PERMISSION_DENIED);
-                }
-                self.db.stream.reset(msg.path);
-                return reply(null);
+              return reply(self.db.stream.compact(msg.path, { maxAge: msg.maxAge, maxCount: msg.maxCount, keepKey: msg.keepKey }));
+            }
+            case 'stream-reset': {
+              if (self.rules && !self.rules.check('write', msg.path, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
               }
+              self.db.stream.reset(msg.path);
+              return reply(null);
+            }
 
-              default:
-                return error('Unknown operation', Errors.INTERNAL);
+            case 'vfs-upload-init': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              if (self.rules && !self.rules.check('write', `_vfs/${msg.path}`, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              const transferId = String(Date.now()) + Math.random().toString(36).slice(2, 6);
+              ws.data.vfsTransfers.set(transferId, { path: msg.path, mime: msg.mime, chunks: [] });
+              return reply(transferId);
+            }
+            case 'vfs-upload-chunk': {
+              const transfer = ws.data.vfsTransfers.get(msg.transferId);
+              if (!transfer) return error('Invalid transfer', Errors.INTERNAL);
+              transfer.chunks[msg.seq] = msg.data;
+              return reply(null);
+            }
+            case 'vfs-upload-done': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              const t = ws.data.vfsTransfers.get(msg.transferId);
+              if (!t) return error('Invalid transfer', Errors.INTERNAL);
+              ws.data.vfsTransfers.delete(msg.transferId);
+              const combined = Buffer.from(t.chunks.join(''), 'base64');
+              const stat = await self.db.vfs.write(t.path, new Uint8Array(combined), t.mime);
+              return reply(stat);
+            }
+            case 'vfs-download-init': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              if (self.rules && !self.rules.check('read', `_vfs/${msg.path}`, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              try {
+                const data = await self.db.vfs.read(msg.path);
+                const b64 = Buffer.from(data).toString('base64');
+                const CHUNK_SIZE = 48000;
+                const totalChunks = Math.ceil(b64.length / CHUNK_SIZE) || 1;
+                const transferId = String(Date.now()) + Math.random().toString(36).slice(2, 6);
+                reply({ transferId, totalChunks });
+                for (let i = 0; i < totalChunks; i++) {
+                  const chunk = b64.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);
+                  ws.send(JSON.stringify({ type: 'vfs-download-chunk', transferId, data: chunk, seq: i, done: i === totalChunks - 1 }));
+                }
+              } catch {
+                return error('File not found', Errors.INTERNAL);
+              }
+              return;
+            }
+            case 'vfs-stat': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              if (self.rules && !self.rules.check('read', `_vfs/${msg.path}`, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              return reply(self.db.vfs.stat(msg.path));
+            }
+            case 'vfs-list': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              if (self.rules && !self.rules.check('read', `_vfs/${msg.path}`, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              return reply(self.db.vfs.list(msg.path));
+            }
+            case 'vfs-delete': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              if (self.rules && !self.rules.check('write', `_vfs/${msg.path}`, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              await self.db.vfs.remove(msg.path);
+              return reply(null);
+            }
+            case 'vfs-mkdir': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              if (self.rules && !self.rules.check('write', `_vfs/${msg.path}`, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              return reply(self.db.vfs.mkdir(msg.path));
+            }
+            case 'vfs-move': {
+              if (!self.db.vfs) return error('VFS not configured', Errors.INTERNAL);
+              if (self.rules && !self.rules.check('write', `_vfs/${msg.path}`, ws.data.auth)) {
+                return error('Permission denied', Errors.PERMISSION_DENIED);
+              }
+              const moved = await self.db.vfs.move(msg.path, msg.dst);
+              return reply(moved);
             }
-          } catch (e: unknown) {
-            const message = e instanceof Error ? e.message : 'Internal error';
-            return error(message, Errors.INTERNAL);
+
+            default:
+              return error('Unknown operation', Errors.INTERNAL);
           }
-        },
+        } catch (e: unknown) {
+          const message = e instanceof Error ? e.message : 'Internal error';
+          return error(message, Errors.INTERNAL);
+        }
       },
+    };
+  }
+
+  /** Start standalone Bun HTTP+WS server */
+  start(): Server {
+    this.server = Bun.serve({
+      port: this.options.port,
+      fetch: (req, server) => this.handleFetch(req, server),
+      websocket: this.websocketConfig,
     });
     return this.server;
   }