@c9up/ream 0.2.4 → 0.2.6

package/dist/Ignitor.js

@@ -31,11 +31,31 @@ import { CookieSigner } from './security/CookieSigner.js';
 import { SignedUrl } from './security/SignedUrl.js';
 import { Server } from './server/Server.js';
 import { clearApp, setApp } from './services/app.js';
+import { clearEncryption, setEncryption } from './services/encryption.js';
 import { clearRouter, setRouter } from './services/router.js';
 import { clearServer, setServer } from './services/server.js';
 import { registerSessionTemplateTags } from './session/templateTags.js';
+/**
+ * Every option the `tests` block accepts.
+ *
+ * Kept beside the interface because it is the same list: TypeScript's
+ * excess-property check only fires on an object literal, so a key that reached
+ * `defineConfig` through a variable or a spread is invisible to it.
+ */
+const TESTS_OPTIONS = ['bootstrap', 'forceExit', 'suites', 'timeout'];
 /** defineConfig helper — like AdonisJS defineConfig(). */
 export function defineConfig(config) {
+    // A key nobody reads is worse than a rejected one: an option that was
+    // renamed, removed between versions, or simply mistyped sits in the rc file
+    // doing nothing, and the run behaves as if it had never been written. Say so
+    // instead, and list what the block does accept — which is also the answer to
+    // "then where did my option go".
+    const unknown = Object.keys(config.tests ?? {}).filter((key) => !TESTS_OPTIONS.includes(key));
+    if (unknown.length > 0) {
+        throw new ReamError('E_REAMRC_UNKNOWN_OPTION', `\`tests\` has no option named ${unknown.map((k) => `\`${k}\``).join(', ')}.`, {
+            hint: `The \`tests\` block accepts: ${TESTS_OPTIONS.join(', ')}. An option removed between versions is gone from the rc file too — the runner is configured in the bootstrap module now.`,
+        });
+    }
     return config;
 }
 /**
@@ -44,30 +64,35 @@ export function defineConfig(config) {
  * Lifecycle: register → boot → start → ready → shutdown
  */
 export class Ignitor {
-    app;
-    router;
-    server;
-    middleware;
+    #app;
+    #router;
+    #server;
+    #middleware;
     /** Where each data package registers its migration runner. See `MigrationRegistry`. */
-    migrations;
-    errorBoundary;
-    _httpServer;
-    config;
-    appRoot;
-    environment = 'unknown';
-    reamrc;
-    providers = [];
-    errorListeners = [];
-    phase = 'created';
-    hotReloadCleanup;
+    #migrations;
+    #errorBoundary;
+    /**
+     * The APP_KEY-backed signer, when there is one. Held so `stop()` can release
+     * the `services/encryption` locator against the exact instance it installed
+     * — an unguarded clear would tear down a newer Ignitor's binding.
+     */
+    #signer;
+    #_httpServer;
+    #config;
+    #appRoot;
+    #reamrc;
+    #providers = [];
+    #errorListeners = [];
+    #phase = 'created';
+    #hotReloadCleanup;
     #shutdownHandle;
     #host;
     #console;
     // Inline configuration (for simple use or testing)
-    inlineRoutes;
-    inlineMiddleware = [];
-    inlineNamedMiddleware = [];
-    inlineProviderFactories = [];
+    #inlineRoutes;
+    #inlineMiddleware = [];
+    #inlineNamedMiddleware = [];
+    #inlineProviderFactories = [];
     /**
      * Create the Ignitor.
      *
@@ -79,46 +104,46 @@ export class Ignitor {
      */
     constructor(appRootOrConfig, config) {
         if (appRootOrConfig instanceof URL) {
-            this.appRoot = appRootOrConfig;
-            this.config = config ?? {};
+            this.#appRoot = appRootOrConfig;
+            this.#config = config ?? {};
         }
         else {
-            this.config = appRootOrConfig ?? {};
+            this.#config = appRootOrConfig ?? {};
         }
-        this.app = new Application();
-        this.router = new Router();
-        this.server = new Server(this.router);
-        this.middleware = new MiddlewareRegistry();
-        this.migrations = new MigrationRegistry();
-        this.errorBoundary = new ErrorBoundary((event) => this.handleError(event), this.isDevMode());
+        this.#app = new Application();
+        this.#router = new Router();
+        this.#server = new Server(this.#router);
+        this.#middleware = new MiddlewareRegistry();
+        this.#migrations = new MigrationRegistry();
+        this.#errorBoundary = new ErrorBoundary((event) => this.#handleError(event), this.isDevMode());
         // Register framework services in container
-        this.app.container.singleton('router', () => this.router);
-        this.app.container.singleton('server', () => this.server);
-        this.app.container.singleton('middleware', () => this.middleware);
+        this.#app.container.singleton('router', () => this.#router);
+        this.#app.container.singleton('server', () => this.#server);
+        this.#app.container.singleton('middleware', () => this.#middleware);
         // Always bound, even with no data package: an EMPTY registry is what lets
         // the CLI tell "this app has no migrations" from "this app predates the
         // registry" and say something useful in each case.
-        this.app.container.singleton('migrations', () => this.migrations);
-        this.app.container.singleton('app', () => this.app);
+        this.#app.container.singleton('migrations', () => this.#migrations);
+        this.#app.container.singleton('app', () => this.#app);
         // AdonisJS binds the config store too, so code that only needs settings can
         // resolve `config` instead of taking the whole application.
-        this.app.container.singleton('config', () => this.app.config);
+        this.#app.container.singleton('config', () => this.#app.config);
         // The HttpContext CLASS, so an integration provider can extend it the way
         // AdonisJS does — `HttpContext.getter('view', …)` is how the view layer
         // attaches `ctx.view`. Exported from the barrel too, but a provider that
         // must stay agnostic reaches it through the container instead of importing
         // ream at runtime.
-        this.app.container.singleton('HttpContext', () => HttpContext);
+        this.#app.container.singleton('HttpContext', () => HttpContext);
         // `appRoot` is the URL passed to `new Ignitor(new URL('../', import.meta.url))`.
         // Providers resolve it through the container so they can interpret
         // relative paths in config files (e.g. `pages.root: './resources/pages'`)
         // against the project root — same convention `modules.path` uses.
-        if (this.appRoot) {
-            const root = this.appRoot;
-            this.app.container.singleton('appRoot', () => root);
+        if (this.#appRoot) {
+            const root = this.#appRoot;
+            this.#app.container.singleton('appRoot', () => root);
             // Also expose it on the Application for the AdonisJS-style path helpers
             // (`app.makePath`, `app.configPath`, `app.migrationsPath`, …).
-            this.app.setAppRoot(root);
+            this.#app.setAppRoot(root);
         }
         // Encryption / cookie-signing service (AdonisJS `APP_KEY` idiom). Registered
         // only when APP_KEY is set; HttpContext hands it to Response/Request so
@@ -130,17 +155,19 @@ export class Ignitor {
                 throw new Error('APP_KEY is too short — use at least a 16-character (ideally 32-byte) random key for cookie signing/encryption.');
             }
             const signer = new CookieSigner(appKey);
-            this.app.container.singleton('encryption', () => signer);
+            this.#app.container.singleton('encryption', () => signer);
+            this.#signer = signer;
+            setEncryption(signer);
             // Signed-URL helper (same APP_KEY): the router signs via makeSignedUrl,
             // HttpContext hands it to the request so hasValidSignature() can verify.
             const signedUrl = new SignedUrl({ secret: appKey });
-            this.app.container.singleton('signedUrl', () => signedUrl);
-            this.router.setSignedUrl(signedUrl);
+            this.#app.container.singleton('signedUrl', () => signedUrl);
+            this.#router.setSignedUrl(signedUrl);
         }
         // Set service singletons so route/kernel files can import them
-        setApp(this.app);
-        setRouter(this.router);
-        setServer(this.server);
+        setApp(this.#app);
+        setRouter(this.#router);
+        setServer(this.#server);
     }
     // ─── Configuration ────────────────────────────────────────
     /**
@@ -148,93 +175,99 @@ export class Ignitor {
      * Like AdonisJS: .tap((app) => { app.booting(...) })
      */
     tap(callback) {
-        callback(this.app);
+        callback(this.#app);
         return this;
     }
-    /** Set the application environment. */
+    /**
+     * Set the application environment.
+     *
+     * Stored on the Application, which is where a provider reads it
+     * (`app.getEnvironment()`, the AdonisJS shape). The Ignitor keeps the setter
+     * because that is where the entry point declares it.
+     */
     setEnvironment(env) {
-        this.environment = env;
+        this.#app.setEnvironment(env);
         return this;
     }
     getEnvironment() {
-        return this.environment;
+        return this.#app.getEnvironment();
     }
     /**
      * Load the reamrc config (equivalent to adonisrc.ts).
      */
     useRcFile(reamrc) {
-        this.reamrc = reamrc;
+        this.#reamrc = reamrc;
         // Hand the app its directory overrides now rather than at boot: a path
         // helper called from a provider's register() must already see them.
-        this.app.rcContents(reamrc);
+        this.#app.rcContents(reamrc);
         return this;
     }
     // === Inline configuration (simple mode / testing) ===
     /** Define routes inline (simple mode). */
     routes(callback) {
-        this.inlineRoutes = callback;
+        this.#inlineRoutes = callback;
         return this;
     }
     /** Add global middleware inline. */
     use(mw) {
-        this.inlineMiddleware.push(mw);
+        this.#inlineMiddleware.push(mw);
         return this;
     }
     /** Register a named middleware inline. */
     named(name, mw) {
-        this.inlineNamedMiddleware.push([name, mw]);
+        this.#inlineNamedMiddleware.push([name, mw]);
         return this;
     }
     /** Register a provider inline (for testing or simple apps). */
     provider(factory) {
-        this.inlineProviderFactories.push(factory);
+        this.#inlineProviderFactories.push(factory);
         return this;
     }
     /** Listen for error events. */
     onError(listener) {
-        this.errorListeners.push(listener);
+        this.#errorListeners.push(listener);
         return this;
     }
     /** Set a config value. */
     configure(key, value) {
-        this.app.config.set(key, value);
+        this.#app.config.set(key, value);
         return this;
     }
     // ─── Mode selection ───────────────────────────────────────
     /** Configure for HTTP server mode. */
     httpServer() {
-        this.environment = 'web';
+        this.#app.setEnvironment('web');
         return this;
     }
     /** Configure for CLI/console mode. Returns a ConsoleKernel for dispatching commands. */
     console() {
-        this.environment = 'console';
+        this.#app.setEnvironment('console');
         return new ConsoleKernel(this);
     }
     /** Configure for test mode. */
     testMode() {
-        this.environment = 'test';
+        this.#app.setEnvironment('test');
         return this;
     }
     // ─── Lifecycle ────────────────────────────────────────────
     async start() {
         // Double-start guard: a second start() would re-run phaseRegister and
         // instantiate + register every reamrc provider a second time.
-        if (this.phase !== 'created') {
-            throw new ReamError('IGNITOR_ALREADY_STARTED', `start() called while in phase '${this.phase}' — an Ignitor boots once`, { hint: 'Create a new Ignitor instance instead of restarting this one.' });
+        if (this.#phase !== 'created') {
+            throw new ReamError('IGNITOR_ALREADY_STARTED', `start() called while in phase '${this.#phase}' — an Ignitor boots once`, { hint: 'Create a new Ignitor instance instead of restarting this one.' });
         }
         this.#loadEnvironmentFiles();
         try {
-            await this.phaseRegister();
-            await this.phaseBoot();
-            await this.phaseStart();
+            await this.#phaseRegister();
+            await this.#phaseBoot();
+            await this.#phaseStart();
             // Console documents its `consoleApp` service as available once the application has
             // booted, so the locator is installed here rather than on first use —
             // `import consoleApp from '@c9up/ream/services/console'` must not throw in a running
             // app. Only the façade is built (three small modules); loading the
             // commands themselves stays lazy, inside `consoleApp.boot()`.
             await this.consoleApp();
-            await this.phaseReady();
+            await this.#phaseReady();
         }
         catch (err) {
             // A throw mid-boot (e.g. a provider ready() failing AFTER the HTTP port
@@ -261,9 +294,9 @@ export class Ignitor {
      * `process.env` win, so the shell / CI always overrides the files.
      */
     #loadEnvironmentFiles() {
-        if (!this.appRoot)
+        if (!this.#appRoot)
             return;
-        loadEnvFiles(this.appRoot, { skipEnvLocal: this.environment === 'test' });
+        loadEnvFiles(this.#appRoot, { skipEnvLocal: this.#app.getEnvironment() === 'test' });
     }
     /**
      * Give the template engine `@error` / `@errors` / `@inputError` /
@@ -272,11 +305,11 @@ export class Ignitor {
      * The engine is duck-typed out of the container so ream carries no dependency
      * on it, and an app with no template layer simply skips this.
      */
-    async registerSessionTemplateTags() {
+    async #registerSessionTemplateTags() {
         for (const token of ['inker', 'view']) {
-            if (!this.app.container.has(token))
+            if (!this.#app.container.has(token))
                 continue;
-            const binding = await this.app.container.resolve(token);
+            const binding = await this.#app.container.resolve(token);
             for (const candidate of [binding, Reflect.get(Object(binding), '_templates')]) {
                 const register = Reflect.get(Object(candidate), 'registerTag');
                 if (typeof register !== 'function')
@@ -290,91 +323,91 @@ export class Ignitor {
             }
         }
     }
-    async phaseRegister() {
+    async #phaseRegister() {
         // Auto-load config/*.ts files into app.config
-        await this.autoloadConfig();
+        await this.#autoloadConfig();
         // Load providers from reamrc
-        if (this.reamrc?.providers) {
-            for (const providerEntry of this.reamrc.providers) {
+        if (this.#reamrc?.providers) {
+            for (const providerEntry of this.#reamrc.providers) {
                 const providerImport = typeof providerEntry === 'function' ? providerEntry : providerEntry.file;
                 const env = typeof providerEntry === 'function' ? undefined : providerEntry.environment;
                 // Skip providers not matching current environment
-                if (env && !env.includes(this.environment))
+                if (env && !env.includes(this.#app.getEnvironment()))
                     continue;
                 const mod = await providerImport();
                 const ProviderClass = mod.default;
-                const instance = new ProviderClass(this.app);
-                this.providers.push(instance);
-                this.app.register(instance);
+                const instance = new ProviderClass(this.#app);
+                this.#providers.push(instance);
+                this.#app.register(instance);
             }
         }
         // Register inline providers
-        for (const factory of this.inlineProviderFactories) {
-            const instance = factory(this.app);
-            this.providers.push(instance);
-            this.app.register(instance);
+        for (const factory of this.#inlineProviderFactories) {
+            const instance = factory(this.#app);
+            this.#providers.push(instance);
+            this.#app.register(instance);
         }
-        this.phase = 'registered';
+        this.#phase = 'registered';
     }
-    async phaseBoot() {
-        await this.app.boot();
-        this.phase = 'booted';
+    async #phaseBoot() {
+        await this.#app.boot();
+        this.#phase = 'booted';
     }
-    async phaseStart() {
+    async #phaseStart() {
         // Import preload files (routes.ts, kernel.ts, etc.)
-        if (this.reamrc?.preloads) {
-            for (const preloadEntry of this.reamrc.preloads) {
+        if (this.#reamrc?.preloads) {
+            for (const preloadEntry of this.#reamrc.preloads) {
                 const preloadImport = typeof preloadEntry === 'function' ? preloadEntry : preloadEntry.file;
                 const env = typeof preloadEntry === 'function'
                     ? undefined
                     : preloadEntry.environment;
-                if (env && !env.includes(this.environment))
+                if (env && !env.includes(this.#app.getEnvironment()))
                     continue;
                 await preloadImport();
             }
         }
         // Auto-load module files (routes.ts, etc.) from modules directory
-        await this.autoloadModules();
+        await this.#autoloadModules();
         // Apply inline configuration
-        for (const mw of this.inlineMiddleware) {
-            this.middleware.use(mw);
+        for (const mw of this.#inlineMiddleware) {
+            this.#middleware.use(mw);
         }
-        for (const [name, mw] of this.inlineNamedMiddleware) {
-            this.middleware.register(name, mw);
+        for (const [name, mw] of this.#inlineNamedMiddleware) {
+            this.#middleware.register(name, mw);
         }
-        if (this.inlineRoutes) {
-            this.inlineRoutes(this.router);
+        if (this.#inlineRoutes) {
+            this.#inlineRoutes(this.#router);
         }
         // Call start() on providers
-        for (const provider of this.providers) {
+        for (const provider of this.#providers) {
             await callProviderPhase(provider, 'start');
         }
-        this.phase = 'started';
+        this.#phase = 'started';
     }
-    async phaseReady() {
+    async #phaseReady() {
         // Boot the Server (resolves lazy error handler etc.)
-        await this.server.boot();
+        await this.#server.boot();
         // Start HTTP server if in web mode
-        if (this.environment === 'web' && this.config.serverFactory) {
+        if (this.#app.getEnvironment() === 'web' && this.#config.serverFactory) {
             // Build the HttpKernel with server middleware + router middleware.
             // The streaming backend is resolved lazily — the HyperServer is
             // created a few lines down, after the kernel — so the kernel
-            // closes over the `this._httpServer` slot and reads it on every
+            // closes over the `this.#_httpServer` slot and reads it on every
             // request through the factory.
             const kernel = createHttpKernel({
-                router: this.router,
-                middleware: this.middleware,
-                container: this.app.container,
-                exceptionHandler: this.server.getErrorHandler() ?? new ExceptionHandler(!this.app.inProduction),
-                serverMiddleware: this.server.getServerMiddleware(),
-                routerMiddleware: this.router.getRouterMiddleware(),
+                router: this.#router,
+                middleware: this.#middleware,
+                container: this.#app.container,
+                exceptionHandler: this.#server.getErrorHandler() ?? new ExceptionHandler(!this.#app.inProduction),
+                serverMiddleware: this.#server.getServerMiddleware(),
+                routerMiddleware: this.#router.getRouterMiddleware(),
                 onError: (error, ctx) => {
-                    this.errorBoundary.serviceError('HttpKernel', error, ctx.id);
+                    this.#errorBoundary.serviceError('HttpKernel', error, ctx.id);
                 },
                 // AdonisJS `config/app.ts` → `http: { allowMethodSpoofing: true }`.
-                allowMethodSpoofing: this.app.config.get('app.http.allowMethodSpoofing') === true,
+                allowMethodSpoofing: this.#app.config.get('app.http.allowMethodSpoofing') === true,
                 streamBackend: () => {
-                    const server = this._httpServer;
+                    const server = this.#_httpServer;
                     if (server &&
                         typeof server.registerStream === 'function' &&
                         typeof server.writeStream === 'function' &&
@@ -393,33 +426,33 @@ export class Ignitor {
                     return undefined;
                 },
             });
-            const desiredPort = this.config.port ?? 3000;
+            const desiredPort = this.#config.port ?? 3000;
             // Port-scan fallback (+1..+19) is a DEV convenience only. In production
             // a silent drift to :3001 while the LB targets :3000 is an outage —
             // bind the configured port and let EADDRINUSE fail loudly. The probe
             // also has an inherent TOCTOU; acceptable in dev, not in prod.
-            const availablePort = this.app.inProduction
+            const availablePort = this.#app.inProduction
                 ? desiredPort
                 : await findAvailablePort(desiredPort);
             this.#host =
-                this.config.host ?? process.env.HOST ?? (this.app.inProduction ? '0.0.0.0' : 'localhost');
-            this._httpServer = this.config.serverFactory(availablePort, this.#host);
-            this._httpServer.onRequest(kernel);
+                this.#config.host ?? process.env.HOST ?? (this.#app.inProduction ? '0.0.0.0' : 'localhost');
+            this.#_httpServer = this.#config.serverFactory(availablePort, this.#host);
+            this.#_httpServer.onRequest(kernel);
             // Pre-resolve client IPs in Rust from the trusted-proxy CIDRs before
             // listen. Security filtering itself lives in @c9up/blackhole.
-            const trustedProxies = this.server.getTrustedProxies();
+            const trustedProxies = this.#server.getTrustedProxies();
             if (trustedProxies.length > 0 &&
-                typeof this._httpServer.configureTrustedProxies === 'function') {
-                this._httpServer.configureTrustedProxies([...trustedProxies]);
+                typeof this.#_httpServer.configureTrustedProxies === 'function') {
+                this.#_httpServer.configureTrustedProxies([...trustedProxies]);
             }
-            await this._httpServer.listen();
+            await this.#_httpServer.listen();
             // Wire OS-signal graceful shutdown. Without it the process never closes
             // the HTTP server on SIGTERM/SIGINT, so live keep-alive / SSE sockets keep
             // the event loop alive — a `ream dev` restart or Ctrl+C ends in a watcher
             // force-kill, and an orchestrator's rolling deploy drops in-flight work.
             // onShutdown = this.stop(), which closes the port (aborting connections),
             // shuts providers down (DB pools), and releases the locators.
-            if (this.config.gracefulShutdown !== false) {
+            if (this.#config.gracefulShutdown !== false) {
                 this.#shutdownHandle = installGracefulShutdown({
                     onShutdown: () => this.stop(),
                     logger: {
@@ -429,26 +462,26 @@ export class Ignitor {
                 });
             }
         }
-        else if (this.environment === 'web' && !this.config.serverFactory) {
+        else if (this.#app.getEnvironment() === 'web' && !this.#config.serverFactory) {
             throw new ReamError('IGNITOR_NO_SERVER_FACTORY', 'httpServer() requires a serverFactory in config', {
                 hint: 'Example: new Ignitor({ serverFactory: (port, host) => new HyperServer(port, host) })',
             });
         }
         // Install error boundary
-        this.errorBoundary.install();
+        this.#errorBoundary.install();
         // Publish the flash-message tags to the template engine, if one is
         // installed. After boot(), so the engine's own provider has bound it;
         // before ready(), so a provider that pre-renders finds the tags in place.
-        await this.registerSessionTemplateTags();
+        await this.#registerSessionTemplateTags();
         // Call ready() on providers
-        for (const provider of this.providers) {
+        for (const provider of this.#providers) {
             await callProviderPhase(provider, 'ready');
         }
         // Core domain event: the app finished booting (all providers ready).
         // Emitted once through the bus when events are wired — zero hot-path cost.
-        if (this.app.container.has('events')) {
-            const bus = await this.app.container.resolve('events');
-            bus.emit('app:ready', { environment: this.environment });
+        if (this.#app.container.has('events')) {
+            const bus = await this.#app.container.resolve('events');
+            bus.emit('app:ready', { environment: this.#app.getEnvironment() });
         }
         // Dev-mode change watcher. IMPORTANT: this does NOT attempt an in-process
         // reload. The previous implementation cleared the router + service registry
@@ -462,11 +495,11 @@ export class Ignitor {
         // the Ignitor without a supervisor. A future true HMR needs a loader-hook
         // (hot-hook style) that can invalidate the ESM cache — plug it in here.
         if (this.isDevMode()) {
-            const watchDirs = this.config.watchDirs ?? ['app', 'start'];
-            this.hotReloadCleanup = startHotReload({
+            const watchDirs = this.#config.watchDirs ?? ['app', 'start'];
+            this.#hotReloadCleanup = startHotReload({
                 watchDirs,
                 onReload: () => {
-                    this.handleError({
+                    this.#handleError({
                         type: 'system.info',
                         source: 'HotReload',
                         message: 'File change detected — a process restart is required to apply it (`ream dev` restarts automatically).',
@@ -475,7 +508,7 @@ export class Ignitor {
                     });
                 },
                 logger: {
-                    info: (msg) => this.handleError({
+                    info: (msg) => this.#handleError({
                         type: 'system.info',
                         source: 'HotReload',
                         message: msg,
@@ -485,19 +518,19 @@ export class Ignitor {
                 },
             });
         }
-        this.phase = 'ready';
+        this.#phase = 'ready';
     }
     /**
      * Auto-load config/*.ts files into app.config store.
      * Each file's default export is stored under its filename (without extension).
      * e.g. config/database.ts → app.config.get('database')
      */
-    async autoloadConfig() {
+    async #autoloadConfig() {
         const { readdirSync, existsSync } = await import('node:fs');
         const { join, basename } = await import('node:path');
         const { fileURLToPath, pathToFileURL } = await import('node:url');
-        const configDir = this.appRoot
-            ? join(fileURLToPath(this.appRoot), 'config')
+        const configDir = this.#appRoot
+            ? join(fileURLToPath(this.#appRoot), 'config')
             : join(process.cwd(), 'config');
         if (!existsSync(configDir))
             return;
@@ -518,15 +551,15 @@ export class Ignitor {
             // is what AdonisJS does (`fsImportAll`). Spread rather than stored as-is:
             // an ESM namespace is sealed and null-prototype, so a later merge into
             // this entry would fail on it.
-            this.app.config.set(key, 'default' in mod ? mod.default : { ...mod });
+            this.#app.config.set(key, 'default' in mod ? mod.default : { ...mod });
         }
     }
     /**
      * Auto-load module files (routes.ts, etc.) from the modules directory.
      * Scans modules.path for subdirectories and imports matching files.
      */
-    async autoloadModules() {
-        const modulesConfig = this.reamrc?.modules;
+    async #autoloadModules() {
+        const modulesConfig = this.#reamrc?.modules;
         if (!modulesConfig?.path)
             return;
         const { readdirSync, existsSync } = await import('node:fs');
@@ -534,8 +567,8 @@ export class Ignitor {
         const { fileURLToPath } = await import('node:url');
         const { pathToFileURL } = await import('node:url');
         // Resolve modules path relative to app root or cwd
-        const basePath = this.appRoot
-            ? join(fileURLToPath(this.appRoot), modulesConfig.path)
+        const basePath = this.#appRoot
+            ? join(fileURLToPath(this.#appRoot), modulesConfig.path)
             : resolve(modulesConfig.path);
         if (!existsSync(basePath))
             return;
@@ -592,22 +625,27 @@ export class Ignitor {
             this.#shutdownHandle = undefined;
         });
         await attempt(() => {
-            if (this.hotReloadCleanup)
-                this.hotReloadCleanup();
+            if (this.#hotReloadCleanup)
+                this.#hotReloadCleanup();
         });
         await attempt(async () => {
-            if (this._httpServer)
-                await this._httpServer.close();
+            if (this.#_httpServer)
+                await this.#_httpServer.close();
         });
-        await attempt(() => this.errorBoundary.uninstall());
-        await attempt(() => this.app.shutdown());
+        await attempt(() => this.#errorBoundary.uninstall());
+        await attempt(() => this.#app.shutdown());
         // Release the process-wide service locators (ownership-guarded): a stopped
         // app must not keep its container/router reachable through the module
         // singletons, and must not clobber a newer Ignitor's bindings.
-        clearApp(this.app);
-        clearRouter(this.router);
-        clearServer(this.server);
-        this.phase = 'shutdown';
+        clearApp(this.#app);
+        clearRouter(this.#router);
+        clearServer(this.#server);
+        // `signedUrl` is what the router was handed; the signer behind
+        // `services/encryption` is the same object, so releasing it here keeps the
+        // locator from outliving the app that built it.
+        if (this.#signer)
+            clearEncryption(this.#signer);
+        this.#phase = 'shutdown';
         if (errors.length === 1)
             throw errors[0];
         if (errors.length > 1) {
@@ -616,7 +654,7 @@ export class Ignitor {
     }
     // ─── Accessors ────────────────────────────────────────────
     async port() {
-        return this._httpServer ? this._httpServer.port() : 0;
+        return this.#_httpServer ? this.#_httpServer.port() : 0;
     }
     /**
      * The address the HTTP server was bound to. Resolved at start; undefined
@@ -628,18 +666,18 @@ export class Ignitor {
         return this.#host;
     }
     getApp() {
-        return this.app;
+        return this.#app;
     }
     /**
      * The application root passed to `new Ignitor(new URL('../', import.meta.url))`.
      * Undefined for inline/test ignitors created without one.
      */
     getAppRoot() {
-        return this.appRoot;
+        return this.#appRoot;
     }
     /** Has the application already been started? */
     isStarted() {
-        return this.phase === 'started' || this.phase === 'ready';
+        return this.#phase === 'started' || this.#phase === 'ready';
     }
     /**
      * The `consoleApp` façade — the programmatic console.
@@ -658,22 +696,22 @@ export class Ignitor {
         const consoleApp = new Console({ kernel, load });
         this.#console = consoleApp;
         setConsole(consoleApp);
-        this.app.container.singleton('console', () => consoleApp);
+        this.#app.container.singleton('console', () => consoleApp);
         return consoleApp;
     }
     /** The loaded rc file, if `useRcFile()` was called. */
     getRcFile() {
-        return this.reamrc;
+        return this.#reamrc;
     }
     /** The custom module importer, when the app provided one. */
     getImporter() {
-        return this.config.importer;
+        return this.#config.importer;
     }
     getRouter() {
-        return this.router;
+        return this.#router;
     }
     getServer() {
-        return this.server;
+        return this.#server;
     }
     /**
      * Get the kernel callback (for serverless / testing). Memoized — building a
@@ -681,24 +719,24 @@ export class Ignitor {
      */
     getKernel() {
         this.#kernel ??= createHttpKernel({
-            router: this.router,
-            middleware: this.middleware,
-            container: this.app.container,
-            exceptionHandler: this.server.getErrorHandler() ?? new ExceptionHandler(!this.app.inProduction),
-            serverMiddleware: this.server.getServerMiddleware(),
-            routerMiddleware: this.router.getRouterMiddleware(),
+            router: this.#router,
+            middleware: this.#middleware,
+            container: this.#app.container,
+            exceptionHandler: this.#server.getErrorHandler() ?? new ExceptionHandler(!this.#app.inProduction),
+            serverMiddleware: this.#server.getServerMiddleware(),
+            routerMiddleware: this.#router.getRouterMiddleware(),
         });
         return this.#kernel;
     }
     #kernel;
     isDevMode() {
-        return this.app.inDev;
+        return this.#app.inDev;
     }
     getPhase() {
-        return this.phase;
+        return this.#phase;
     }
-    handleError(event) {
-        for (const listener of this.errorListeners) {
+    #handleError(event) {
+        for (const listener of this.#errorListeners) {
             try {
                 listener(event);
             }
@@ -713,7 +751,7 @@ export class Ignitor {
      * shutdown logger so drain progress / timeouts are observable.
      */
     #emitSystemInfo(source, message, kind) {
-        this.handleError({
+        this.#handleError({
             type: kind === 'error' ? 'system.error' : 'system.info',
             source,
             message,