@c9up/ream 0.1.25 → 0.1.26

package/dist/utils/inflect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inflect.d.ts","sourceRoot":"","sources":["../../src/utils/inflect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED,wEAAwE;AACxE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM7C"}

package/dist/utils/inflect.js

@@ -0,0 +1,32 @@
+/**
+ * Minimal zero-dependency string inflection — the two operations resourceful
+ * routing needs from AdonisJS's `@poppinss/utils/string`: `snakeCase` (route
+ * name normalisation) and `singular` (nested-resource param naming, `photos`
+ * → `photo_id`).
+ *
+ * Deviation from AdonisJS (named): `singular` covers regular English plurals
+ * only (`-ies→-y`, `-(s|x|z|ch|sh)es→drop es`, trailing `-s→drop`). Irregular
+ * plurals (`people→person`, `geese→goose`) are NOT handled — resource names in
+ * REST APIs are overwhelmingly regular, and a full inflector (irregular tables,
+ * uncountables) would be a dependency-sized rabbit hole for a niche case.
+ */
+/** Convert `camelCase`/`PascalCase`/`kebab-case`/spaced text to `snake_case`. */
+export function snakeCase(value) {
+    return value
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .replace(/[-\s]+/g, '_')
+        .toLowerCase();
+}
+/** Singularize a regular English plural (see module deviation note). */
+export function singular(word) {
+    if (word.length > 3 && /ies$/i.test(word))
+        return word.replace(/ies$/i, 'y');
+    if (/(?:s|x|z|ch|sh)es$/i.test(word))
+        return word.replace(/es$/i, '');
+    if (/ss$/i.test(word))
+        return word;
+    if (/s$/i.test(word))
+        return word.replace(/s$/i, '');
+    return word;
+}
+//# sourceMappingURL=inflect.js.map

package/dist/utils/inflect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inflect.js","sourceRoot":"","sources":["../../src/utils/inflect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,WAAW,EAAE,CAAA;AAClB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5E,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACpD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/utils/objectPath.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Zero-dependency dot-path object access — the small subset of `lodash`
+ * (`get`/`set`/`has`/`pick`/`omit`/`merge`) that Config and Request need for
+ * AdonisJS-parity nested access (`config.get('database.mysql.host')`,
+ * `request.input('user.address.city')`).
+ *
+ * AdonisJS uses `@poppinss/utils/lodash` for this. Ream stays lean and
+ * dependency-free (same stance as aurora's hand-written `cn`/`clsx`), so we
+ * reimplement exactly the four semantics we rely on — no more.
+ *
+ * Path syntax: `a.b.c` and `a[0].c` / `a.0.c` (bracket + dotted indices) are
+ * both accepted, matching lodash's tokenizer for the shapes config/request
+ * data actually take (plain JSON objects and arrays).
+ */
+/** A JSON-ish record we can index by string key. */
+type UnknownRecord = Record<string, unknown>;
+/**
+ * Read a nested value by dot-path. Returns `defaultValue` when any segment is
+ * missing or the resolved value is `undefined` (lodash.get semantics).
+ */
+export declare function getPath(source: unknown, path: string, defaultValue?: unknown): unknown;
+/**
+ * True when the full dot-path exists on `source` (each segment is an own key),
+ * even if the leaf value is `undefined` (lodash.has semantics).
+ */
+export declare function hasPath(source: unknown, path: string): boolean;
+/**
+ * Set a nested value by dot-path, creating intermediate plain objects as
+ * needed, and return the (mutated) root.
+ *
+ * Deviation from lodash.set (named): integer segments create plain objects,
+ * NOT arrays. Config trees and request-data picks are keyed objects; ream
+ * never sets array indices through a path, so array auto-vivification would be
+ * dead behaviour.
+ */
+export declare function setPath(target: UnknownRecord, path: string, value: unknown): UnknownRecord;
+/**
+ * Return a new object containing only the given dot-paths (lodash.pick).
+ * Missing paths are skipped; nested paths reconstruct their branch, so
+ * `pickPaths({a:{b:1,c:2}}, ['a.b'])` yields `{a:{b:1}}`.
+ */
+export declare function pickPaths(source: unknown, paths: string[]): UnknownRecord;
+/**
+ * Return a deep clone of `source` with the given dot-paths removed
+ * (lodash.omit). Operates on JSON-ish data (body + query), so `structuredClone`
+ * is a safe deep copy that never mutates the caller's input.
+ */
+export declare function omitPaths(source: UnknownRecord, paths: string[]): UnknownRecord;
+/**
+ * Deep-merge `source` over `target` (recursively for nested plain objects;
+ * scalars and arrays from `source` replace `target`). Returns a new object;
+ * neither input is mutated. Backs `Config.defaults` — the AdonisJS semantics
+ * where existing config wins over provided defaults.
+ */
+export declare function mergeDeep(target: unknown, source: unknown): unknown;
+export {};
+//# sourceMappingURL=objectPath.d.ts.map

package/dist/utils/objectPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"objectPath.d.ts","sourceRoot":"","sources":["../../src/utils/objectPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oDAAoD;AACpD,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAwB5C;;;GAGG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAQtF;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,aAAa,CAgB1F;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,CAMzE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,CAY/E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAQnE"}

package/dist/utils/objectPath.js

@@ -0,0 +1,141 @@
+/**
+ * Zero-dependency dot-path object access — the small subset of `lodash`
+ * (`get`/`set`/`has`/`pick`/`omit`/`merge`) that Config and Request need for
+ * AdonisJS-parity nested access (`config.get('database.mysql.host')`,
+ * `request.input('user.address.city')`).
+ *
+ * AdonisJS uses `@poppinss/utils/lodash` for this. Ream stays lean and
+ * dependency-free (same stance as aurora's hand-written `cn`/`clsx`), so we
+ * reimplement exactly the four semantics we rely on — no more.
+ *
+ * Path syntax: `a.b.c` and `a[0].c` / `a.0.c` (bracket + dotted indices) are
+ * both accepted, matching lodash's tokenizer for the shapes config/request
+ * data actually take (plain JSON objects and arrays).
+ */
+/** True for plain objects and arrays (anything indexable by a path segment). */
+function isIndexable(value) {
+    return typeof value === 'object' && value !== null;
+}
+/**
+ * Split a dot/bracket path into segments: `a.b[0].c` → `['a','b','0','c']`.
+ * A single already-simple key (no `.`/`[`) is returned as-is, so keys that
+ * happen to contain neither delimiter cost nothing.
+ */
+function toSegments(path) {
+    if (path.indexOf('.') === -1 && path.indexOf('[') === -1)
+        return [path];
+    const segments = [];
+    const matcher = /[^.[\]]+/g;
+    let match = matcher.exec(path);
+    while (match !== null) {
+        segments.push(match[0]);
+        match = matcher.exec(path);
+    }
+    return segments;
+}
+/**
+ * Read a nested value by dot-path. Returns `defaultValue` when any segment is
+ * missing or the resolved value is `undefined` (lodash.get semantics).
+ */
+export function getPath(source, path, defaultValue) {
+    const segments = toSegments(path);
+    let current = source;
+    for (const segment of segments) {
+        if (!isIndexable(current))
+            return defaultValue;
+        current = current[segment];
+    }
+    return current === undefined ? defaultValue : current;
+}
+/**
+ * True when the full dot-path exists on `source` (each segment is an own key),
+ * even if the leaf value is `undefined` (lodash.has semantics).
+ */
+export function hasPath(source, path) {
+    const segments = toSegments(path);
+    let current = source;
+    for (const segment of segments) {
+        if (!isIndexable(current) || !Object.hasOwn(current, segment))
+            return false;
+        current = current[segment];
+    }
+    return true;
+}
+/**
+ * Set a nested value by dot-path, creating intermediate plain objects as
+ * needed, and return the (mutated) root.
+ *
+ * Deviation from lodash.set (named): integer segments create plain objects,
+ * NOT arrays. Config trees and request-data picks are keyed objects; ream
+ * never sets array indices through a path, so array auto-vivification would be
+ * dead behaviour.
+ */
+export function setPath(target, path, value) {
+    const segments = toSegments(path);
+    let current = target;
+    for (let i = 0; i < segments.length - 1; i += 1) {
+        const key = segments[i];
+        const next = current[key];
+        if (!isIndexable(next)) {
+            const created = {};
+            current[key] = created;
+            current = created;
+        }
+        else {
+            current = next;
+        }
+    }
+    current[segments[segments.length - 1]] = value;
+    return target;
+}
+/**
+ * Return a new object containing only the given dot-paths (lodash.pick).
+ * Missing paths are skipped; nested paths reconstruct their branch, so
+ * `pickPaths({a:{b:1,c:2}}, ['a.b'])` yields `{a:{b:1}}`.
+ */
+export function pickPaths(source, paths) {
+    const result = {};
+    for (const path of paths) {
+        if (hasPath(source, path))
+            setPath(result, path, getPath(source, path));
+    }
+    return result;
+}
+/**
+ * Return a deep clone of `source` with the given dot-paths removed
+ * (lodash.omit). Operates on JSON-ish data (body + query), so `structuredClone`
+ * is a safe deep copy that never mutates the caller's input.
+ */
+export function omitPaths(source, paths) {
+    const result = structuredClone(source);
+    for (const path of paths) {
+        const segments = toSegments(path);
+        let current = result;
+        for (let i = 0; i < segments.length - 1; i += 1) {
+            if (!isIndexable(current))
+                break;
+            current = current[segments[i]];
+        }
+        if (isIndexable(current))
+            delete current[segments[segments.length - 1]];
+    }
+    return result;
+}
+/**
+ * Deep-merge `source` over `target` (recursively for nested plain objects;
+ * scalars and arrays from `source` replace `target`). Returns a new object;
+ * neither input is mutated. Backs `Config.defaults` — the AdonisJS semantics
+ * where existing config wins over provided defaults.
+ */
+export function mergeDeep(target, source) {
+    if (!isIndexable(target) || Array.isArray(target))
+        return source === undefined ? target : source;
+    if (!isIndexable(source) || Array.isArray(source))
+        return source === undefined ? target : source;
+    const out = { ...target };
+    for (const key of Object.keys(source)) {
+        out[key] = mergeDeep(out[key], source[key]);
+    }
+    return out;
+}
+//# sourceMappingURL=objectPath.js.map

package/dist/utils/objectPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objectPath.js","sourceRoot":"","sources":["../../src/utils/objectPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAA;IAC3B,IAAI,KAAK,GAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,MAAe,EAAE,IAAY,EAAE,YAAsB;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAA;QAC9C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,MAAe,EAAE,IAAY;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3E,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,MAAqB,EAAE,IAAY,EAAE,KAAc;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAkB,MAAM,CAAA;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAkB,EAAE,CAAA;YACjC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;YACtB,OAAO,GAAG,OAAO,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;IAC9C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe,EAAE,KAAe;IACxD,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAqB,EAAE,KAAe;IAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,OAAO,GAAY,MAAM,CAAA;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAAE,MAAK;YAChC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe,EAAE,MAAe;IACxD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAChG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAChG,MAAM,GAAG,GAAkB,EAAE,GAAG,MAAM,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/ream",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "Ream — Rust-powered Node.js application framework",
   "license": "MIT",
   "type": "module",
@@ -127,7 +127,9 @@
     "tsconfig.app.json"
   ],
   "dependencies": {
+    "etag": "^1.8.1",
     "file-type": "^22.0.1",
+    "mime-types": "^3.0.1",
     "reflect-metadata": "^0.2"
   },
   "peerDependencies": {
@@ -141,6 +143,8 @@
   "devDependencies": {
     "@biomejs/biome": "^2.4.10",
     "@c9up/comet": "^0.1.0",
+    "@types/etag": "^1.8.4",
+    "@types/mime-types": "^3.0.1",
     "@types/node": "^22.19.15",
     "typescript": "^6.0.2",
     "vitest": "^4.1.6"
@@ -156,6 +160,7 @@
     "url": "git+https://github.com/C9up/ream.git"
   },
   "scripts": {
+    "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsc -p tsconfig.build.json",
     "build:rust": "cargo build --release -p ream-http-napi -p ream-scheduler-napi -p ream-events-napi",
     "build:napi": "pnpm build:rust && node scripts/copy-napi.mjs",

package/src/ConfigLoader.ts

@@ -4,30 +4,64 @@
  * @implements FR18, FR19
  */
 
+import { getPath, hasPath, mergeDeep, setPath } from './utils/objectPath.js'
+
 /**
  * In-memory config store. In production this is populated from config/*.ts
- * files via `defineConfig()`. The class is its own contract — `AppContext.config`
- * is typed against it directly (structural).
+ * files via `defineConfig()` — one top-level key per module (`config/app.ts`
+ * → `app`). The class is its own contract — `AppContext.config` is typed
+ * against it directly (structural).
+ *
+ * Values are held as a nested tree and read with AdonisJS dot-notation
+ * (`config.get('database.mysql.host')`), matching `@adonisjs/config`'s
+ * `lodash`-backed accessors — reimplemented dependency-free via
+ * {@link ../utils/objectPath}.
  */
 export class ConfigStore {
-  private store: Map<string, unknown> = new Map()
+  #tree: Record<string, unknown> = {}
 
-  get<T = unknown>(key: string): T | undefined {
-    return this.store.get(key) as T | undefined
+  /**
+   * Read a value by dot-notation key, returning `defaultValue` when the path
+   * is absent or resolves to `undefined` (AdonisJS `config.get`).
+   */
+  get<T = unknown>(key: string, defaultValue?: T): T | undefined {
+    // Untyped store: the caller declares the shape it configured (same
+    // contract as `@adonisjs/config`, whose `get<T>` returns the loose value).
+    return getPath(this.#tree, key, defaultValue) as T | undefined
   }
 
+  /** Set a value by dot-notation key, creating intermediate objects. */
   set(key: string, value: unknown): void {
-    this.store.set(key, value)
+    setPath(this.#tree, key, value)
   }
 
+  /** True when the dot-notation key exists (AdonisJS `config.has`). */
   has(key: string): boolean {
-    return this.store.has(key)
+    return hasPath(this.#tree, key)
+  }
+
+  /** The full config tree (AdonisJS `config.all`). */
+  all(): Record<string, unknown> {
+    return this.#tree
   }
 
-  /** Load config from an object (used for testing and initial setup). */
+  /**
+   * Merge `value` as defaults for `key` — existing config wins over the
+   * provided defaults (AdonisJS `config.defaults`).
+   */
+  defaults(key: string, value: unknown): void {
+    const existing = this.get(key)
+    this.set(key, existing === undefined ? value : mergeDeep(value, existing))
+  }
+
+  /**
+   * Load config from an object (used for testing and initial setup). Each key
+   * is applied by dot-notation, so both nested modules (`{ app: {...} }`) and
+   * flat dotted keys (`{ 'db.host': '...' }`) land in the tree.
+   */
   loadFromObject(config: Record<string, unknown>): void {
     for (const [key, value] of Object.entries(config)) {
-      this.store.set(key, value)
+      this.set(key, value)
     }
   }
 }
@@ -47,3 +81,32 @@ export function env(key: string, defaultValue?: string): string | undefined {
 export function defineModuleConfig<T>(config: T): T {
   return config
 }
+
+const CONFIG_PROVIDER = Symbol('ream.configProvider')
+
+/** A deferred config value that resolves against the application at boot. */
+interface ConfigProviderMarker<T> {
+  readonly [CONFIG_PROVIDER]: (app: unknown) => T | Promise<T>
+}
+
+function isConfigProvider(value: unknown): value is ConfigProviderMarker<unknown> {
+  return typeof value === 'object' && value !== null && CONFIG_PROVIDER in value
+}
+
+/**
+ * Deferred configuration (AdonisJS `configProvider`). A package exports
+ * `configProvider.create((app) => ...)` when its config needs the application
+ * (env, paths) at boot; the framework calls `configProvider.resolve(app, value)`
+ * to materialise it, passing plain values through untouched.
+ */
+export const configProvider = {
+  /** Wrap a resolver so it's materialised later by {@link resolve}. */
+  create<T>(resolver: (app: unknown) => T | Promise<T>): ConfigProviderMarker<T> {
+    return { [CONFIG_PROVIDER]: resolver }
+  },
+
+  /** Resolve a value: run it if it's a provider, otherwise return it as-is. */
+  async resolve<T>(app: unknown, value: ConfigProviderMarker<T> | T): Promise<T> {
+    return isConfigProvider(value) ? value[CONFIG_PROVIDER](app) : value
+  },
+}

package/src/HttpKernel.ts

@@ -13,7 +13,7 @@
 import type { Container } from './container/Container.js'
 import type { Emitter } from './events/Emitter.js'
 import { E_ROUTE_NOT_FOUND, ExceptionHandler } from './http/Exception.js'
-import { HttpContext } from './http/HttpContext.js'
+import { type ChildLoggerSource, HttpContext } from './http/HttpContext.js'
 import type {
   MiddlewareFunction,
   MiddlewareRegistry,
@@ -21,6 +21,8 @@ import type {
 } from './middleware/Pipeline.js'
 import { compose } from './middleware/Pipeline.js'
 import type { RouteDefinition, Router } from './router/Router.js'
+import type { CookieSigner } from './security/CookieSigner.js'
+import type { SignedUrl } from './security/SignedUrl.js'
 import type { Dict } from './types/helpers.js'
 
 export interface HttpKernelConfig {
@@ -91,16 +93,33 @@ export function createHttpKernel(
   // creation, and `has()` avoids loading the native bus for apps without events.
   let eventsEmitter: Emitter | undefined
   let eventsResolved = false
-  const resolveEvents = (): Emitter | undefined => {
+  const resolveEvents = async (): Promise<Emitter | undefined> => {
     if (!eventsResolved) {
       eventsResolved = true
       if (config.container?.has('events')) {
-        eventsEmitter = config.container.resolve<Emitter>('events')
+        eventsEmitter = await config.container.resolve<Emitter>('events')
       }
     }
     return eventsEmitter
   }
 
+  // APP_KEY-backed services + base logger, resolved once (the container is async
+  // now, so they can't be resolved in the HttpContext constructor) and injected
+  // per request via setters. Best-effort: absent bindings leave the feature off.
+  let servicesResolved = false
+  let encryption: CookieSigner | undefined
+  let signedUrl: SignedUrl | undefined
+  let baseLogger: ChildLoggerSource | undefined
+  const resolveServices = async (): Promise<void> => {
+    if (servicesResolved) return
+    servicesResolved = true
+    const c = config.container
+    if (!c) return
+    if (c.has('encryption')) encryption = await c.resolve<CookieSigner>('encryption')
+    if (c.has('signedUrl')) signedUrl = await c.resolve<SignedUrl>('signedUrl')
+    if (c.has('logger')) baseLogger = await c.resolve<ChildLoggerSource>('logger')
+  }
+
   return async (reqData: HttpKernelRequest): Promise<HttpKernelResponse> => {
     // The Rust HyperServer hands the request as a typed JS object via napi
     // `to_js_value` (no JSON intermediate). Serverless adapters that pass a
@@ -145,7 +164,12 @@ export function createHttpKernel(
       config.container,
     )
     ctx.setRouteUrlResolver((name, params) => config.router.urlFor(name, params))
-    ctx.events = resolveEvents()
+    // Inject the async-resolved APP_KEY services + base logger (resolved once).
+    await resolveServices()
+    if (encryption) ctx.setCookieSigner(encryption)
+    if (signedUrl) ctx.setSignedUrl(signedUrl)
+    if (baseLogger) ctx.setBaseLogger(baseLogger)
+    ctx.events = await resolveEvents()
     // Core lifecycle event: a request entered the kernel. Fire-and-forget through
     // the bus when events are wired (`?.` → zero cost when no provider). The
     // `http:response` counterpart fires before every exit below.
@@ -174,6 +198,18 @@ export function createHttpKernel(
         let cached = pipelineCache.get(match.route)
 
         if (!cached) {
+          // Promote a lazy/string controller to a concrete controller tuple on
+          // first request (imported once, then reused). Done before handler +
+          // guard-metadata resolution so @Guard/@Role/@inject flow through the
+          // normal controller path below.
+          if (match.route.lazyController && !match.route.controller) {
+            const mod = await match.route.lazyController.loader()
+            match.route.controller = {
+              target: mod.default,
+              method: match.route.lazyController.method,
+            }
+          }
+
           // Resolve handler (once per route)
           let routeHandler: (typeof match.route)['handler']
           if (match.route.controller) {
@@ -205,16 +241,18 @@ export function createHttpKernel(
           // A declared validator that isn't registered is a HARD error — never
           // silently skip validation, that's a security footgun (a typo'd
           // `.validate('craeteUser')` must fail loudly, not pass unvalidated).
-          const validators: RuntimeValidator[] = match.route.validators.map((name) => {
-            const token = `validator:${name}`
-            if (!config.container?.has(token)) {
-              throw new Error(
-                `[E_VALIDATOR_NOT_FOUND] Route validator '${name}' is not registered. ` +
-                  `Bind it with container.singleton('${token}', () => schema({ ... })).`,
-              )
-            }
-            return config.container.resolve<RuntimeValidator>(token)
-          })
+          const validators: RuntimeValidator[] = await Promise.all(
+            match.route.validators.map((name) => {
+              const token = `validator:${name}`
+              if (!config.container?.has(token)) {
+                throw new Error(
+                  `[E_VALIDATOR_NOT_FOUND] Route validator '${name}' is not registered. ` +
+                    `Bind it with container.singleton('${token}', () => schema({ ... })).`,
+                )
+              }
+              return config.container.resolve<RuntimeValidator>(token)
+            }),
+          )
 
           // Compile pipeline once
           const chain = config.middleware.buildChain(
@@ -307,7 +345,7 @@ function createControllerHandler(
   container?: Container,
 ): (ctx: HttpContext) => Promise<void> {
   return async (ctx: HttpContext) => {
-    const instance = container ? container.make(controller.target) : new controller.target()
+    const instance = container ? await container.make(controller.target) : new controller.target()
     const method = (instance as Record<string, (ctx: HttpContext) => Promise<void> | void>)[
       controller.method
     ]

package/src/Ignitor.ts

@@ -30,6 +30,8 @@ import { MiddlewareRegistry } from './middleware/Pipeline.js'
 import type { AppContext, ProviderContract } from './Provider.js'
 import { callProviderPhase } from './Provider.js'
 import { Router } from './router/Router.js'
+import { CookieSigner } from './security/CookieSigner.js'
+import { SignedUrl } from './security/SignedUrl.js'
 import { Server } from './server/Server.js'
 import { clearApp, setApp } from './services/app.js'
 import { clearRouter, setRouter } from './services/router.js'
@@ -179,6 +181,26 @@ export class Ignitor {
       this.app.setAppRoot(root)
     }
 
+    // Encryption / cookie-signing service (AdonisJS `APP_KEY` idiom). Registered
+    // only when APP_KEY is set; HttpContext hands it to Response/Request so
+    // `cookie()` can sign, `encryptedCookie()` can encrypt and `request.cookie()`
+    // can verify. Without APP_KEY, cookies stay plain (unsigned).
+    const appKey = process.env.APP_KEY
+    if (appKey) {
+      if (appKey.length < 16) {
+        throw new Error(
+          'APP_KEY is too short — use at least a 16-character (ideally 32-byte) random key for cookie signing/encryption.',
+        )
+      }
+      const signer = new CookieSigner(appKey)
+      this.app.container.singleton('encryption', () => signer)
+      // Signed-URL helper (same APP_KEY): the router signs via makeSignedUrl,
+      // HttpContext hands it to the request so hasValidSignature() can verify.
+      const signedUrl = new SignedUrl({ secret: appKey })
+      this.app.container.singleton('signedUrl', () => signedUrl)
+      this.router.setSignedUrl(signedUrl)
+    }
+
     // Set service singletons so route/kernel files can import them
     setApp(this.app)
     setRouter(this.router)
@@ -495,9 +517,8 @@ export class Ignitor {
     // Core domain event: the app finished booting (all providers ready).
     // Emitted once through the bus when events are wired — zero hot-path cost.
     if (this.app.container.has('events')) {
-      this.app.container
-        .resolve<Emitter>('events')
-        .emit('app:ready', { environment: this.environment })
+      const bus = await this.app.container.resolve<Emitter>('events')
+      bus.emit('app:ready', { environment: this.environment })
     }
 
     // Dev-mode change watcher. IMPORTANT: this does NOT attempt an in-process