@classytic/arc 2.41.1 → 2.44.0

package/dist/{preloadResources-f3boenVZ.mjs → createApp-BGLYtErt.mjs}

@@ -1,15 +1,22 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-eysyzFAF.mjs";
-import { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-CgenB1gv.mjs";
-import { r as initRuntimeCapabilityRegistry, t as auditRuntimeCapabilities } from "./runtimeCapabilities-CkhS6jn6.mjs";
-import { n as isScopeAwareKeyGenerator, t as createTenantKeyGenerator } from "./rateLimitKey-BvOvcBDi.mjs";
-import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-ZRHeDHXH.mjs";
-import { t as parseJsonBody } from "./jsonBody-ELR9lfeU.mjs";
-import { r as wrapWithBoundary } from "./subscribe-helpers-DatDkcuG.mjs";
-import { isProductionEnv } from "@classytic/primitives/environment";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-MYrLNGnq.mjs";
+import { a as enterArcLoggerScope, i as runWithArcLogger, n as configureArcLogger, r as createPinoWriter, t as arcLog } from "./logger-D4V1zGLI.mjs";
+import { n as PUBLIC_SCOPE } from "./types-fvO6Ovzx.mjs";
+import { r as initRuntimeCapabilityRegistry, t as auditRuntimeCapabilities } from "./runtimeCapabilities-DIMKMV2G.mjs";
+import { a as runShutdown, t as initShutdownRegistry } from "./shutdown-LpLMH8T1.mjs";
+import { n as isScopeAwareKeyGenerator, t as createTenantKeyGenerator } from "./rateLimitKey-DVEZ_UpV.mjs";
+import { i as resolveResourceRateLimiter, n as markRateLimitingDisabled } from "./resourceRateLimit-urWPJxrt.mjs";
+import { r as markArcRootValidator, t as arcAjvCustomOptions } from "./routeValidator-DHtpzrzk.mjs";
+import { c as createRequestIdGenerator, r as mergeHealthChecks } from "./health-CrqUp3sz.mjs";
+import { t as parseJsonBody } from "./jsonBody-YIq-vGLv.mjs";
+import { a as portsForModule, b as verifyEventDurability, f as resolveModuleArm, g as crudEventsOf, h as buildModuleGraph, m as analyzeModuleGraph, n as composeModules, x as verifyModuleGraph } from "./plan-CJGMKoui.mjs";
+import { c as wrapWithAttribution, f as defineEvent, l as wrapWithBoundary, r as CRUD_EVENT_SCHEMA } from "./eventTypes-N4-omQFR.mjs";
+import { r as withSubscriberId } from "./subscriberIdentity-DeyppIif.mjs";
+import { r as getOptionalModuleExports } from "./module--L0iBIZz.mjs";
+import { isProductionEnv, readEnv } from "@classytic/primitives/environment";
 import Fastify from "fastify";
 import qs from "qs";
+import { createEventRouter } from "@classytic/primitives/events";
 //#region src/factory/security/pluginLoader.ts
 const PLUGIN_REGISTRY = {
 	cors: {
@@ -205,47 +212,6 @@ async function registerAssetRoots(fastify, roots) {
 	}
 }
 //#endregion
-//#region src/factory/module/resolve.ts
-/**
-* Resolve any module-input form to a concrete `ArcModule`. A thunk is invoked
-* (this is where a dynamic `import()` fires); a promise (or plain module) is
-* awaited. Called once per module at the start of the bootstrap phase.
-*/
-async function resolveModule(input) {
-	const resolved = typeof input === "function" ? await input() : await input;
-	if (!resolved || typeof resolved !== "object" || typeof resolved.name !== "string") throw new Error("[arc] a `modules` entry resolved to something that is not an ArcModule (expected an object with a string `name`). Check dynamic-import thunks return `createXModule(deps)` (or the module object), not the namespace.");
-	if (resolved.name.trim().length === 0) throw new Error("[arc] a `modules` entry has an empty (or whitespace-only) `name`. A module's name is its graph key, its `arc.modules` export key, its `dependsOn` target, and its label in every boot diagnostic — give it a stable, non-empty identifier.");
-	return resolved;
-}
-/** Resolve a `ModuleContribution` to a concrete array (array passthrough or factory call). */
-async function resolveContribution(contribution, fastify) {
-	if (!contribution) return [];
-	return typeof contribution === "function" ? await contribution(fastify) : contribution;
-}
-/**
-* `resolveContribution` with module attribution — the form every arm collector
-* should use.
-*
-* A contribution factory closes over booted engines, so it throws for exactly
-* the reasons a bootstrap does ("connection unavailable", "engine not ready").
-* Bare, that message names neither the module nor the arm, which in a graph of
-* twenty modules turns a one-line fix into a bisect. Every other module
-* boundary (`plugins`, `bootstrap`, `resources`, `afterResources`) already
-* wraps with the owning module's name; this keeps the arms consistent with
-* them. The original error is preserved via `{ cause }`.
-*/
-async function resolveModuleArm(module, arm, contribution, fastify) {
-	let resolved;
-	try {
-		resolved = await resolveContribution(contribution, fastify);
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		throw new Error(`[arc] module "${module.name}" ${arm} factory threw: ${msg}`, { cause: err });
-	}
-	if (!Array.isArray(resolved)) throw new TypeError(`[arc] module "${module.name}" ${arm} factory must return an array — received ${resolved === null ? "null" : typeof resolved}.`);
-	return resolved;
-}
-//#endregion
 //#region src/factory/module/contributions.ts
 /**
 * Collect every module's `healthChecks` in the caller's order. Fails at boot
@@ -321,7 +287,15 @@ function describeResolvedModule(input) {
 }
 //#endregion
 //#region src/factory/module/disposers.ts
-function createDisposerRegistry(fastify) {
+const NO_PORTS = Object.freeze({});
+/**
+* The one typing boundary for ports: `assertModuleRequirements` has already proven every
+* declared required port present, so the module's subset is read as its declared shape.
+*/
+function asModulePorts(ports) {
+	return ports;
+}
+function createDisposerRegistry(fastify, portsOf = () => NO_PORTS) {
 	const stacks = /* @__PURE__ */ new Map();
 	const drained = /* @__PURE__ */ new Set();
 	const contexts = /* @__PURE__ */ new Map();
@@ -329,25 +303,28 @@ function createDisposerRegistry(fastify) {
 		contextFor(moduleName) {
 			const existing = contexts.get(moduleName);
 			if (existing) return existing;
-			const ctx = { defer(disposer) {
-				if (typeof disposer !== "function") throw new TypeError(`[arc] module "${moduleName}" called defer() with a ${typeof disposer} — expected a function.`);
-				if (drained.has(moduleName)) {
-					(async () => {
-						try {
-							await disposer();
-						} catch (err) {
-							fastify.log?.error({
-								err,
-								module: moduleName
-							}, `[arc] module "${moduleName}" deferred a disposer after teardown had already run; it was invoked immediately and threw.`);
-						}
-					})();
-					return;
+			const ctx = {
+				ports: asModulePorts(portsOf(moduleName)),
+				defer(disposer) {
+					if (typeof disposer !== "function") throw new TypeError(`[arc] module "${moduleName}" called defer() with a ${typeof disposer} — expected a function.`);
+					if (drained.has(moduleName)) {
+						(async () => {
+							try {
+								await disposer();
+							} catch (err) {
+								fastify.log?.error({
+									err,
+									module: moduleName
+								}, `[arc] module "${moduleName}" deferred a disposer after teardown had already run; it was invoked immediately and threw.`);
+							}
+						})();
+						return;
+					}
+					const stack = stacks.get(moduleName);
+					if (stack) stack.push(disposer);
+					else stacks.set(moduleName, [disposer]);
 				}
-				const stack = stacks.get(moduleName);
-				if (stack) stack.push(disposer);
-				else stacks.set(moduleName, [disposer]);
-			} };
+			};
 			contexts.set(moduleName, ctx);
 			return ctx;
 		},
@@ -372,7 +349,7 @@ function createDisposerRegistry(fastify) {
 * Resolves factory contributions (after bootstraps) so a handler can close over
 * booted engines rather than a global getter.
 */
-async function subscribeModuleEventHandlers(fastify, modules, countsByModule) {
+async function subscribeModuleEventHandlers(fastify, modules, countsByModule, consumedByModule, handlersByModule) {
 	const unsubscribes = [];
 	const owner = /* @__PURE__ */ new Map();
 	try {
@@ -382,14 +359,24 @@ async function subscribeModuleEventHandlers(fastify, modules, countsByModule) {
 			if (handlers.length === 0) continue;
 			const bus = fastify.events;
 			if (!bus) throw new Error(`[arc] module "${m.name}" declares eventHandlers but the event subsystem is unavailable (fastify.events). Enable arcPlugins.events.`);
-			for (const def of handlers) {
+			for (const [index, def] of handlers.entries()) {
 				if (def.name !== void 0) {
 					const prior = owner.get(def.name);
 					if (prior !== void 0) throw new Error(`[arc] duplicate event-handler name "${def.name}" — declared by module "${prior}" and module "${m.name}". Named event handlers must be unique across the module graph; prefix names with the owning module.`);
 					owner.set(def.name, m.name);
 				}
-				const handler = applyBoundary(def, m.name, fastify);
 				const patterns = Array.isArray(def.event) ? def.event : [def.event];
+				if (def.durability === "retry" && def.boundary) throw new Error(`[arc] event handler "${def.name ?? patterns.join(",")}" in module "${m.name}" declares durability 'retry' and a boundary — a boundary swallows, so it is 'boundary'.`);
+				const label = handlerLabel(def, m.name, patterns, index);
+				const identity = def.name ?? [...patterns].sort().join(",");
+				if (!def.name && handlers.some((other) => other !== def && !other.name && (Array.isArray(other.event) ? [...other.event] : [other.event]).sort().join(",") === identity)) throw new Error(`[arc] module "${m.name}" has ambiguous unnamed event handlers for "${identity}" — give each handler a stable name.`);
+				const handler = withSubscriberId(`${m.name}:${identity}`, applyBoundary(def, m.name, label, fastify));
+				handlersByModule?.set(m.name, [...handlersByModule.get(m.name) ?? [], {
+					label,
+					patterns,
+					...def.durability !== void 0 ? { durability: def.durability } : {}
+				}]);
+				consumedByModule?.set(m.name, [...consumedByModule.get(m.name) ?? [], ...patterns]);
 				for (const pattern of patterns) unsubscribes.push(await bus.subscribe(pattern, handler));
 			}
 		}
@@ -401,18 +388,24 @@ async function subscribeModuleEventHandlers(fastify, modules, countsByModule) {
 	}
 }
 /**
-* Apply the declaration's opt-in error boundary. Without `boundary`, the raw
-* handler is subscribed and a throw reaches the transport — which is what makes
-* the durable path work (unacked → redelivered → DLQ). With it, failures are
-* logged through `fastify.log` and swallowed, for handlers whose retry would
-* only delay the next event's resync.
-*
-* The boundary label falls back to `<module>.<pattern>` so an unnamed handler
-* still produces an attributable log line instead of "anonymous".
+* The name a subscriber's errors and logs carry: its declared `name`, else
+* `<module>:<patterns>#<index in the module's handlers>` — unique, so two unnamed
+* subscribers of one event stay distinguishable in a dead-lettered row.
+*/
+function handlerLabel(def, moduleName, patterns, index) {
+	return def.name ?? `${moduleName}:${patterns.join(",")}#${index}`;
+}
+/**
+* Without a boundary, attribute the handler's errors to `label` and let them reach the transport —
+* that is what makes the durable path work (unacked → redelivered → DLQ), and the label is what
+* names the subscriber in the outbox's `lastError`. With the opt-in boundary, failures are logged
+* under the handler's name (`<module>.<pattern>` when unnamed) and swallowed, so the original error
+* reaches the boundary's `onError` untouched.
 */
-function applyBoundary(def, moduleName, fastify) {
-	if (!def.boundary) return def.handler;
-	const onError = typeof def.boundary === "object" ? def.boundary.onError : void 0;
+function applyBoundary(def, moduleName, label, fastify) {
+	const boundary = def.boundary ?? def.durability === "boundary";
+	if (!boundary) return wrapWithAttribution(def.handler, label);
+	const onError = typeof boundary === "object" ? boundary.onError : void 0;
 	return wrapWithBoundary(def.handler, {
 		logger: fastify.log,
 		name: def.name ?? `${moduleName}.${String(def.event)}`,
@@ -430,98 +423,6 @@ async function unsubscribeModuleEventHandlers(unsubscribes) {
 	return errors;
 }
 //#endregion
-//#region src/factory/module/order.ts
-/**
-* Order modules for composition by their `dependsOn` edges — a STABLE
-* topological sort. Called once at the start of the bootstrap phase; every
-* subsequent phase (bootstrap, resources, afterResources, and reverse-order
-* onClose) iterates the returned list, so a module's declared dependencies are
-* always composed before it.
-*
-* "Stable" = modules with no edge between them keep their original list order,
-* so declaring `dependsOn` on one module never silently reorders an unrelated
-* one. Backward compatible: a `modules` array with NO `dependsOn` anywhere is
-* returned unchanged.
-*
-* Fail-fast — throws (never reorders past a broken contract) on:
-*   - duplicate module names (the name is the graph key)
-*   - a `dependsOn` name not present in the composed set
-*   - a self-reference (`dependsOn` includes the module's own name)
-*   - a dependency cycle (reports the concrete `a → b → … → a` path)
-*/
-function orderModules(modules) {
-	const byName = /* @__PURE__ */ new Map();
-	for (const m of modules) {
-		if (byName.has(m.name)) throw new Error(`[arc] Duplicate module name "${m.name}" — composed twice; check your modules array.`);
-		byName.set(m.name, m);
-	}
-	for (const m of modules) for (const dep of m.dependsOn ?? []) {
-		if (dep === m.name) throw new Error(`[arc] module "${m.name}" dependsOn itself — remove the self-reference.`);
-		if (!byName.has(dep)) throw new Error(`[arc] module "${m.name}" dependsOn "${dep}", which is not composed. Add the "${dep}" module to createApp({ modules }) (before this one is fine — arc orders them), or drop the dependency. Composed modules: ${[...byName.keys()].join(", ") || "(none)"}.`);
-	}
-	if (modules.every((m) => !m.dependsOn || m.dependsOn.length === 0)) return [...modules];
-	const originalIndex = /* @__PURE__ */ new Map();
-	let nextIndex = 0;
-	for (const m of modules) originalIndex.set(m.name, nextIndex++);
-	const pendingDeps = new Map(modules.map((m) => [m.name, (m.dependsOn ?? []).length]));
-	const dependents = /* @__PURE__ */ new Map();
-	for (const m of modules) for (const dep of m.dependsOn ?? []) {
-		const list = dependents.get(dep);
-		if (list) list.push(m.name);
-		else dependents.set(dep, [m.name]);
-	}
-	const ordered = [];
-	const remaining = new Set(modules.map((m) => m.name));
-	while (remaining.size > 0) {
-		let pick;
-		let pickIndex = Number.POSITIVE_INFINITY;
-		for (const name of remaining) {
-			if (pendingDeps.get(name) !== 0) continue;
-			const index = originalIndex.get(name) ?? Number.POSITIVE_INFINITY;
-			if (index < pickIndex) {
-				pick = name;
-				pickIndex = index;
-			}
-		}
-		if (pick === void 0) throw new Error(describeModuleCycle(remaining, byName));
-		const picked = byName.get(pick);
-		if (!picked) throw new Error(`[arc] internal: ordered module "${pick}" is missing from the index`);
-		ordered.push(picked);
-		remaining.delete(pick);
-		for (const dependent of dependents.get(pick) ?? []) pendingDeps.set(dependent, (pendingDeps.get(dependent) ?? 1) - 1);
-	}
-	return ordered;
-}
-/** Walk the still-unordered subgraph for one concrete cycle path. */
-function describeModuleCycle(remaining, byName) {
-	const stack = [];
-	const onStack = /* @__PURE__ */ new Set();
-	const done = /* @__PURE__ */ new Set();
-	let cycle = null;
-	const walk = (name) => {
-		if (cycle) return;
-		stack.push(name);
-		onStack.add(name);
-		for (const dep of byName.get(name)?.dependsOn ?? []) {
-			if (!remaining.has(dep)) continue;
-			if (onStack.has(dep)) {
-				cycle = [...stack.slice(stack.indexOf(dep)), dep];
-				return;
-			}
-			if (!done.has(dep)) walk(dep);
-			if (cycle) return;
-		}
-		onStack.delete(name);
-		stack.pop();
-		done.add(name);
-	};
-	for (const name of remaining) {
-		if (!done.has(name)) walk(name);
-		if (cycle) break;
-	}
-	return `[arc] module dependency cycle: ${cycle ? cycle.join(" → ") : [...remaining].join(", ")}. Modules cannot dependsOn each other circularly — break it with a shared module both point at, or wire the softer direction through an event/port instead of a hard dependsOn.`;
-}
-//#endregion
 //#region src/factory/module/state.ts
 /**
 * The honest read of the state map. `fastify.arc` is optional (see
@@ -578,6 +479,28 @@ function getModuleState(fastify, name) {
 	const states = readStates(fastify);
 	return states !== void 0 && Object.hasOwn(states, name) ? states[name] : void 0;
 }
+/**
+* The `ResourceDefinition`s module `name` mounted, in its declared order — for building that
+* module's MCP tools or docs after boot. Throws when `name` is not a composed module (a typo would
+* otherwise read as "no resources"), and when called before `registerResources` has published the
+* descriptors. A resource declaring `skipRegistry` is absent, as from every introspection surface.
+*/
+function getModuleResources(fastify, name) {
+	const descriptors = fastify.arc?.moduleDescriptors;
+	const registry = fastify.arc?.registry;
+	if (!descriptors || !registry) throw new Error(`[arc] getModuleResources("${name}"): no composed module graph on this instance yet — call it after boot (afterResources, onReady, or after app.ready()).`);
+	const descriptor = descriptors.find((d) => d.name === name);
+	if (!descriptor) {
+		const known = descriptors.map((d) => d.name).join(", ") || "(none)";
+		throw new Error(`[arc] getModuleResources: "${name}" is not a composed module. Composed: ${known}.`);
+	}
+	const out = [];
+	for (const resource of descriptor.resources) {
+		const definition = resource.name === void 0 ? void 0 : registry.getDefinition(resource.name);
+		if (definition) out.push(definition);
+	}
+	return out;
+}
 //#endregion
 //#region src/factory/module/teardown.ts
 function createModuleTeardown(fastify, modules, disposers) {
@@ -851,18 +774,13 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-zZY-unhr.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-BweHAVws.mjs").then((n) => n.r);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			/**
-			* An EXPLICIT `runtime: 'memory'` is the host's single-instance
-			* declaration (its JSDoc says exactly that), so it flows down as the
-			* event plugin's `singleProcess` flag — one topology axis, declared
-			* once, no second knob to keep in sync. The comparison is against the
-			* literal, not the resolved default: `runtime` UNSET also means memory
-			* stores, but an unstated topology must keep the forgotten-default
-			* warn. `eventOpts` spreads after, so a direct
-			* `arcPlugins.events.singleProcess` still wins either way.
+			* Only an EXPLICIT `runtime: 'memory'` declares single-instance — an
+			* UNSET runtime must keep the forgotten-default warn. `eventOpts`
+			* spreads after, so `arcPlugins.events.singleProcess` still wins.
 			*/
 			...config.runtime === "memory" ? { singleProcess: true } : {},
 			...eventOpts,
@@ -911,15 +829,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 		trackPlugin("arc-graceful-shutdown", shutdownOpts);
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-DbCBxlgw.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-Drp68DIS.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-DZHPOm9p.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-BATECpyh.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-Iotz0cCx.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-CTa5pOCW.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -929,7 +847,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.sse) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 		else {
-			const { default: ssePlugin } = await import("./sse-BeqVKQKu.mjs").then((n) => n.r);
+			const { default: ssePlugin } = await import("./sse-BzJFPX_1.mjs").then((n) => n.n);
 			const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 			await fastify.register(ssePlugin, opts);
 			trackPlugin("arc-sse", opts);
@@ -938,20 +856,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-8tIQWZz4.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-xyubMKSB.mjs").then((n) => n.n);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);
 		}
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-NMsmpRmY.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-DsZrvnpB.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-DKkT4hNJ.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-CHhL9P3o.mjs").then((n) => n.n);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -1028,7 +946,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-CkvG0LG2.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-BG4gnMsJ.mjs").then((n) => n.n);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -1043,7 +961,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-D1GHKGlV.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-COHw3N1b.mjs").then((n) => n.r);
 	/**
 	* DISCLOSURE DEFAULTS MERGE — they used to be REPLACED, and that was two bugs.
 	*
@@ -1128,6 +1046,7 @@ function createOptionalAuthenticate(authenticate) {
 }
 //#endregion
 //#region src/factory/registerResources.ts
+/** Resource registration and the module/app lifecycle for createApp. */
 function isResourcesFactory(value) {
 	return typeof value === "function";
 }
@@ -1150,8 +1069,8 @@ async function registerOne(parent, resource, mountRoutes) {
 * infra. Every phase below iterates that order; each module phase runs BEFORE
 * its app-level counterpart:
 *
-* 1.  resolve + orderModules     — validate the graph (dup names, missing/self
-*                                  deps, cycles fail fast) BEFORE side effects
+* 1.  composeModules             — validate the graph (dup names, missing/self
+*                                  deps, cycles, unmet `requires`) BEFORE side effects
 * 2.  plugins()                  — app infra (DB, data, webhooks)
 * 3.  module.plugins             — module infra, dependsOn order, before bootstraps
 * 4a. module.bootstrap           — engine init (return value → arc.modules[name])
@@ -1170,33 +1089,27 @@ async function registerOne(parent, resource, mountRoutes) {
 *                                  THEN app onClose, in ONE hook so module
 *                                  teardown runs before shared infra closes.
 *
-* Boot is TRANSACTIONAL for module-held resources: phases 2–6 run inside one
-* try/catch. On any failure, arc unsubscribes already-active module event
-* handlers, then closes every module that ENTERED an init phase — reverse
-* composition order, best-effort (see module/teardown.ts) — and rethrows the
-* ORIGINAL boot error. Without this, a failure after module A's bootstrap but
-* before the §7b hook registration leaked A's clients/timers/engines with no
-* teardown path.
-*
-* "Entered", not "completed": a module is eligible for teardown from the
-* moment it enters `plugins()`/`bootstrap()`, so the callback that allocates a
-* client and THEN throws — the commonest partial-init shape — gets its closer
-* called too.
+* Boot is TRANSACTIONAL for module-held resources: on any failure in phases
+* 2–6, arc unsubscribes live module event handlers, closes every module that
+* ENTERED an init phase (see module/teardown.ts), and rethrows the ORIGINAL
+* boot error.
 */
-async function registerResources(fastify, config, preResolvedModules) {
+async function registerResources(fastify, config, preResolvedModules, skippedBridges = []) {
+	if (config.strictResources === void 0) config = {
+		...config,
+		strictResources: true
+	};
 	if (config.preset === "production") {
-		if (config.strictResources === void 0) config = {
-			...config,
-			strictResources: true
-		};
 		if (config.strictResourceDir === void 0) config = {
 			...config,
 			strictResourceDir: true
 		};
 	}
-	const modules = preResolvedModules ?? orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
+	if (config.strictResources === false) fastify.arc?.registry?.tolerateDuplicateNames();
+	const modules = preResolvedModules ?? (await composeModules(config.modules ?? [], config.ports)).modules;
 	initModuleStates(fastify, modules.map((m) => m.name));
-	const disposers = createDisposerRegistry(fastify);
+	const portsByModule = new Map(modules.map((m) => [m.name, portsForModule(m, config.ports)]));
+	const disposers = createDisposerRegistry(fastify, (name) => portsByModule.get(name) ?? {});
 	const teardown = createModuleTeardown(fastify, modules, disposers);
 	let eventUnsubscribes = [];
 	try {
@@ -1267,7 +1180,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 		let discoveryPath;
 		let discoveryYieldedZero = false;
 		if (resolvedResources === void 0 && config.resourceDir) {
-			const { loadResources } = await import("./loadResources-BPfWiI5s.mjs").then((n) => n.n);
+			const { loadResources } = await import("./loadResources-6jO52-RR.mjs").then((n) => n.n);
 			const { resolve, dirname } = await import("node:path");
 			const { fileURLToPath } = await import("node:url");
 			const rawDir = config.resourceDir;
@@ -1276,7 +1189,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 			discoveryPath = dir;
 			const discovered = await loadResources(dir, { logger: fastify.log });
 			if (discovered.length === 0) {
-				if (config.strictResourceDir) throw new Error(`[arc] loadResources: resourceDir "${rawDir}" resolved to "${dir}" but yielded 0 resources. Check the path, file naming (*.resource.{ts,js,mts,mjs}), and runtime layout (src/ vs dist/). Use \`strictResourceDir: true\` to fail boot.`);
+				if (config.strictResourceDir) throw new Error(`[arc] loadResources: resourceDir "${rawDir}" resolved to "${dir}" but yielded 0 resources. Check the path, file naming (*.resource.{ts,js,mts,mjs}), and runtime layout (src/ vs dist/).`);
 				discoveryYieldedZero = true;
 			}
 			resolvedResources = discovered;
@@ -1336,9 +1249,9 @@ Resources supplied by "${m.name}": ${provided}.`);
 			const seen = /* @__PURE__ */ new Set();
 			for (const resource of resolvedResources) if (resource.name) {
 				if (seen.has(resource.name)) {
-					const msg = `Duplicate resource name "${resource.name}" detected. This will cause route conflicts. Check your resources array and loadResources() output. Common cause: stale compiled files in dist/ alongside src/. Use \`strictResources: true\` to fail boot.`;
+					const msg = `Duplicate resource name "${resource.name}" detected. This will cause route conflicts. Check your resources array and loadResources() output. Common cause: stale compiled files in dist/ alongside src/.`;
 					if (config.strictResources) throw new Error(msg);
-					fastify.log.warn(msg);
+					fastify.log.warn(`${msg} Boot continues because strictResources is false.`);
 				}
 				seen.add(resource.name);
 			}
@@ -1348,10 +1261,12 @@ Resources supplied by "${m.name}": ${provided}.`);
 			else prefixed.push(resource);
 			for (const resource of root) await registerOne(fastify, resource, config.mountRoutes);
 			if (prefixed.length) {
-				if (config.resourcePrefix) await fastify.register(async (scoped) => {
-					for (const resource of prefixed) await registerOne(scoped, resource, config.mountRoutes);
-				}, { prefix: config.resourcePrefix });
-				else for (const resource of prefixed) await registerOne(fastify, resource, config.mountRoutes);
+				if (config.resourcePrefix) {
+					const registerPrefixed = async (scoped) => {
+						for (const resource of prefixed) await registerOne(scoped, resource, config.mountRoutes);
+					};
+					await fastify.register(registerPrefixed, { prefix: config.resourcePrefix });
+				} else for (const resource of prefixed) await registerOne(fastify, resource, config.mountRoutes);
 			}
 			const names = resolvedResources.map((r) => r.name ?? "?").join(", ");
 			const prefix = config.resourcePrefix ? ` (prefix: ${config.resourcePrefix})` : "";
@@ -1375,11 +1290,8 @@ Resources supplied by "${m.name}": ${provided}.`);
 		const scheduleCounts = /* @__PURE__ */ new Map();
 		const collectedJobs = await collectModuleScheduledJobs(fastify, modules, scheduleCounts);
 		/**
-		* ROLE gate (CreateAppOptions.role). Arms a role does not run are SKIPPED
-		* and logged by name, never fatal: a module legitimately declares arms
-		* that a different deployment of the same codebase executes. 'relay' runs
-		* only kind:'relay' arms (the outbox relays); 'api'/'worker' run none;
-		* 'scheduler'/'all' run everything.
+		* ROLE gate: arms this role does not run are skipped and logged, never
+		* fatal — another deployment of the same codebase runs them.
 		*/
 		const role = config.role ?? "all";
 		const scheduledJobs = role === "scheduler" || role === "all" ? collectedJobs : role === "relay" ? collectedJobs.filter((j) => j.kind === "relay") : [];
@@ -1393,7 +1305,7 @@ Resources supplied by "${m.name}": ${provided}.`);
 			if (fastify.hasDecorator("getScheduleStats")) throw new Error("[arc] modules declare scheduledJobs but schedulesPlugin was already registered manually. Configure their runner through arcPlugins.schedules so Arc can compose one schedule table.");
 			const frozenJobs = Object.freeze(scheduledJobs.map((job) => Object.freeze({ ...job })));
 			const scheduleOptions = typeof config.arcPlugins?.schedules === "object" ? config.arcPlugins.schedules : {};
-			const { default: schedulesPlugin } = await import("./schedules-j6uXXAeJ.mjs").then((n) => n.r);
+			const { default: schedulesPlugin } = await import("./schedules-CKTs5ys8.mjs").then((n) => n.n);
 			await fastify.register(schedulesPlugin, {
 				...scheduleOptions,
 				schedules: frozenJobs
@@ -1408,7 +1320,64 @@ Resources supplied by "${m.name}": ${provided}.`);
 			}
 		}
 		const subscriptionCounts = /* @__PURE__ */ new Map();
-		eventUnsubscribes = await subscribeModuleEventHandlers(fastify, modules, subscriptionCounts);
+		const consumedByModule = /* @__PURE__ */ new Map();
+		const handlersByModule = /* @__PURE__ */ new Map();
+		eventUnsubscribes = await subscribeModuleEventHandlers(fastify, modules, subscriptionCounts, consumedByModule, handlersByModule);
+		const registry = fastify.arc?.registry;
+		const emitsCrud = config.arcPlugins?.emitEvents !== false && registry !== void 0;
+		const derived = /* @__PURE__ */ new Map();
+		const moduleOwned = /* @__PURE__ */ new Set();
+		if (emitsCrud) for (const [moduleName, names] of moduleResourceNames) {
+			const publishes = [];
+			for (const name of names) {
+				moduleOwned.add(name);
+				const entry = registry.get(name);
+				if (entry) publishes.push(...crudEventsOf(entry));
+			}
+			derived.set(moduleName, {
+				publishes,
+				namespaces: [...names]
+			});
+		}
+		const appCrudEvents = emitsCrud ? registry.getAll().filter((e) => !moduleOwned.has(e.name)).flatMap((e) => crudEventsOf(e)) : [];
+		const eventRegistry = fastify.events?.registry;
+		if (emitsCrud && eventRegistry) for (const entry of registry.getAll()) for (const name of crudEventsOf(entry)) {
+			if (eventRegistry.get(name)) continue;
+			eventRegistry.register(defineEvent({
+				name,
+				description: `arc CRUD event — a ${entry.name} was ${name.slice(entry.name.length + 1)}.`,
+				schema: CRUD_EVENT_SCHEMA
+			}));
+		}
+		const moduleGraph = buildModuleGraph(modules, consumedByModule, skippedBridges, [
+			...config.moduleGraph?.externalEvents ?? [],
+			...ARC_OWNED_EVENTS,
+			...appCrudEvents
+		], derived);
+		for (const bridge of moduleGraph.skippedBridges) fastify.log.info({
+			bridge: bridge.name,
+			missing: bridge.missing
+		}, "[arc] bridge module inactive — a module it joins is not composed");
+		const graphMode = config.moduleGraph?.events ?? (config.preset === "production" ? "warn" : "off");
+		if (graphMode !== "off") {
+			const analysis = analyzeModuleGraph(moduleGraph);
+			const issues = verifyModuleGraph(moduleGraph, analysis);
+			if (issues.length > 0 && graphMode === "strict") throw new Error(`[arc] module graph has ${issues.length} issue(s):\n${issues.map((i) => `  - ${i.message}`).join("\n")}`);
+			for (const issue of issues) fastify.log.warn({ issue }, `[arc] module graph: ${issue.message}`);
+			const outboxModules = new Set(modules.filter((m) => isTransactionalOutbox(getOptionalModuleExports(fastify, m.name))).map((m) => m.name));
+			const durabilityIssues = verifyEventDurability(modules, {
+				outboxModules,
+				handlers: handlersByModule
+			});
+			if (durabilityIssues.length && graphMode === "strict") throw new Error(`[arc] module graph durability has ${durabilityIssues.length} issue(s):\n${durabilityIssues.map((i) => `  - ${i.message}`).join("\n")}`);
+			for (const issue of durabilityIssues) fastify.log.warn({ issue }, `[arc] module graph (${issue.code}): ${issue.message}`);
+		}
+		if (fastify.arc) fastify.arc.moduleGraph = moduleGraph;
+		const events = fastify.events;
+		if (graphMode !== "off" && typeof events?.observe === "function" && fastify.arc) {
+			const undeclared = watchUndeclaredEvents(fastify, moduleGraph, graphMode);
+			fastify.arc.undeclaredEvents = undeclared;
+		}
 		if (fastify.arc) fastify.arc.moduleDescriptors = Object.freeze(modules.map((m) => describeResolvedModule({
 			name: m.name,
 			dependsOn: m.dependsOn,
@@ -1427,6 +1396,8 @@ Resources supplied by "${m.name}": ${provided}.`);
 			fastify.log.debug("afterResources hook executed");
 		}
 	} catch (err) {
+		const shutdownErrors = await runShutdown(fastify);
+		for (const shutdownError of shutdownErrors) fastify.log.error({ err: shutdownError }, "[arc] runtime rollback failed");
 		const unsubscribeErrors = await unsubscribeModuleEventHandlers(eventUnsubscribes);
 		for (const unsubscribeError of unsubscribeErrors) fastify.log.error({ err: unsubscribeError }, "[arc] module event-handler rollback after boot failure failed");
 		const closeErrors = await teardown.rollback();
@@ -1441,30 +1412,53 @@ Resources supplied by "${m.name}": ${provided}.`);
 	}
 	const appOnClose = config.onClose;
 	if (teardown.hasComposedModules() || appOnClose || eventUnsubscribes.length) fastify.addHook("onClose", async () => {
+		const shutdownErrors = await runShutdown(fastify);
 		const unsubscribeErrors = await unsubscribeModuleEventHandlers(eventUnsubscribes);
 		for (const err of unsubscribeErrors) fastify.log.error({ err }, "[arc] module event-handler shutdown unsubscribe failed");
 		const closeErrors = await teardown.closeAll();
 		for (const err of closeErrors) fastify.log.error({ err }, "[arc] module onClose failed during shutdown");
 		if (appOnClose) await appOnClose(fastify);
 		if (closeErrors.length > 0) throw closeErrors[0];
+		if (shutdownErrors.length > 0) throw shutdownErrors[0];
 	});
 }
 /**
-* `plugins()` is CALLED by arc, never handed to `fastify.register()` — so a
-* module author who returns a Fastify plugin expecting arc to register it
-* gets silence: nothing is registered, and the "disposer" shorthand then
-* invokes their plugin at shutdown with no arguments.
-*
-* The `fastify-plugin` case is unambiguous (its marker symbols are only ever
-* set by `fp()`), so it throws. A bare `(fastify, opts)` function is a strong
-* but not certain signal — arc's disposer contract calls it with ZERO
-* arguments, so a 2-parameter disposer is meaningless either way — and warns.
+* `plugins()` is CALLED by arc, never `register()`ed — a returned Fastify
+* plugin would be silently treated as a disposer. `fp()` markers are
+* unambiguous, so that throws; a bare 2+-arg function only warns.
 */
 function assertNotAReturnedPlugin(returned, moduleName, fastify) {
 	const fn = returned;
 	if (fn[Symbol.for("skip-override")] !== void 0 || fn[Symbol.for("plugin-meta")] !== void 0 || fn[Symbol.for("fastify.display-name")] !== void 0) throw new Error(`[arc] module "${moduleName}" returned a fastify-plugin from plugins(). That slot is a SETUP function arc calls directly — it is never passed to fastify.register(), so the returned value is read as a disposer and your plugin would be invoked at shutdown instead of registered at boot. Register it yourself: \`plugins: async (fastify) => { await fastify.register(myPlugin) }\`.`);
 	if (returned.length >= 2) fastify.log?.warn?.(`[arc] module "${moduleName}" returned a ${returned.length}-argument function from plugins(). Arc calls disposers with NO arguments, so this looks like a Fastify plugin that was meant to be registered (\`await fastify.register(fn)\`) rather than a teardown callback. If it really is a disposer, declare it with no parameters.`);
 }
+/** Namespaces arc itself publishes — lifecycle (`arc.*`) and its streamline integration (`workflow.*`). */
+const ARC_OWNED_EVENTS = ["arc.*", "workflow.*"];
+/**
+* Record every published event type the graph has no owner for. Logs each name once; never
+* touches delivery.
+*/
+function watchUndeclaredEvents(fastify, graph, mode) {
+	const owned = new Set(graph.modules.flatMap((m) => m.publishes));
+	const external = createEventRouter();
+	for (const pattern of graph.externalEvents) external.add(pattern, true);
+	const undeclared = /* @__PURE__ */ new Set();
+	const stop = fastify.events.observe((event) => {
+		const type = event.type;
+		if (owned.has(type) || undeclared.has(type) || type.startsWith("$")) return;
+		if (external.route(type).length > 0) return;
+		undeclared.add(type);
+		fastify.log[mode === "strict" ? "error" : "warn"]({ event: type }, `[arc] module graph: "${type}" was published but no module declares it — add it to its owner's \`publishes\` (or \`moduleGraph.externalEvents\`).`);
+	});
+	fastify.addHook("onClose", async () => stop());
+	return undeclared;
+}
+/** A module export that is an outbox whose `save` enlists the caller's session. */
+function isTransactionalOutbox(exports) {
+	if (typeof exports !== "object" || exports === null || !("store" in exports)) return false;
+	const store = exports.store;
+	return typeof store === "object" && store !== null && "transactionalSave" in store && store.transactionalSave === true;
+}
 //#endregion
 //#region src/factory/security/cors.ts
 /**
@@ -1650,12 +1644,17 @@ async function registerSecurityPlugins(fastify, config) {
 		});
 		await fastify.register(rateLimit, rateLimitOpts);
 		const rateLimitRecord = typeof rateLimitOpts === "object" && rateLimitOpts !== null ? rateLimitOpts : void 0;
-		if (!(rateLimitRecord !== void 0 && (rateLimitRecord.store != null || rateLimitRecord.redis != null))) {
+		const hasStore = rateLimitRecord !== void 0 && (rateLimitRecord.store != null || rateLimitRecord.redis != null);
+		resolveResourceRateLimiter(fastify, hasStore ? "shared" : "memory");
+		if (!hasStore) {
 			if (config.runtime === "distributed") throw new Error("[Arc] runtime: 'distributed' with rate limiting requires a shared store.\nProvide rateLimit: { redis: ioredisClient } (or { store: CustomStore }) or disable rate limiting: rateLimit: false");
 			else if (config.preset === "production") fastify.log.warn("Rate limiting is using in-memory store. In multi-instance deployments, each instance tracks limits independently. Configure a Redis store for distributed rate limiting.");
 		}
 		fastify.log.debug("Rate limiting enabled");
-	} else fastify.log.warn("Rate limiting disabled");
+	} else {
+		fastify.log.warn("Rate limiting disabled");
+		markRateLimitingDisabled(fastify);
+	}
 }
 /**
 * Register performance and utility plugins (Under Pressure, Sensible, Multipart, Raw Body).
@@ -1721,40 +1720,18 @@ async function registerUtilityPlugins(fastify, config) {
 //#endregion
 //#region src/factory/createApp.ts
 /**
-* ArcFactory - Production-ready Fastify application factory
-*
-* Enforces security best practices by making plugins opt-out instead of opt-in.
-* A developer must explicitly disable security features rather than forget to enable them.
+* ArcFactory - Production-ready Fastify application factory.
 *
-* Note: Arc is database-agnostic. Connect your database separately and provide
-* adapters when defining resources. This allows multiple databases, custom
-* connection pooling, and full control over your data layer.
+* Security plugins are opt-out, not opt-in. Arc is database-agnostic: connect
+* your database separately and pass adapters to `defineResource`.
 *
 * @example
-* // 1. Connect your database(s) separately
-* import mongoose from 'mongoose';
-* await mongoose.connect(process.env.MONGO_URI);
-*
-* // 2. Create Arc app with resources
 * const app = await createApp({
 *   preset: 'production',
+*   runtime: 'memory',
 *   auth: { type: 'jwt', jwt: { secret: process.env.JWT_SECRET } },
-*   cors: { origin: ['https://example.com'] },
 *   resources: [productResource, orderResource],
 * });
-*
-* @example
-* // Multiple databases example
-* const primaryDb = await mongoose.connect(process.env.PRIMARY_DB);
-* const analyticsDb = mongoose.createConnection(process.env.ANALYTICS_DB);
-*
-* const orderResource = defineResource({
-*   adapter: createMongooseAdapter({ model: OrderModel, repository: orderRepo }),
-* });
-*
-* const analyticsResource = defineResource({
-*   adapter: createMongooseAdapter({ model: AnalyticsModel, repository: analyticsRepo }),
-* });
 */
 var createApp_exports = /* @__PURE__ */ __exportAll({
 	ArcFactory: () => ArcFactory,
@@ -1763,10 +1740,8 @@ var createApp_exports = /* @__PURE__ */ __exportAll({
 	resolveLoggerConfig: () => resolveLoggerConfig
 });
 /**
-* The fail-loud switches, and what each one costs while OFF.
-*
-* Every one is a SPECIFIC instruction defeated by a GENERAL default, which is
-* why they are reported together rather than one at a time.
+* The fail-loud switches — ON by default — and what each one costs when a deployment turns it OFF.
+* Reported together at production boot, so an opt-out is never silent.
 */
 const STRICT_ENV_FLAGS = [
 	["ARC_STRICT_PERMISSIONS", "An ungated write route warns instead of failing boot."],
@@ -1775,18 +1750,10 @@ const STRICT_ENV_FLAGS = [
 ];
 const MEMORY_STORE_NAMES = /* @__PURE__ */ new Set(["memory", "memory-cache"]);
 /**
-* Default redact paths layered into Fastify's pino logger when the host
-* doesn't supply a `logger.redact` of their own. Covers the common token /
-* cookie / password leak surfaces — `Authorization` and `Cookie` headers
-* (and their case-variants because Node lower-cases incoming headers but
-* outgoing logs may carry either), API-key headers, and any nested
-* `password` / `token` / `secret` / `apiKey` fields anywhere in the log
-* tree.
-*
-* Hosts that need NO redaction (test fixtures, security audits) opt out
-* with `logger: { redact: [] }`. Hosts that need MORE redaction supply
-* their own `redact` and arc steps aside — this default never overrides
-* an explicit setting.
+* Default pino redact paths (auth/cookie/API-key headers, nested
+* password/token/secret fields), applied only when the host supplies no
+* `logger.redact`. Opt out with `logger: { redact: [] }`; an explicit
+* `redact` always wins.
 */
 const DEFAULT_LOGGER_REDACT_PATHS = [
 	"req.headers.authorization",
@@ -1805,16 +1772,8 @@ const DEFAULT_LOGGER_REDACT_PATHS = [
 	"*.apiKey"
 ];
 /**
-* Resolve the host's `logger` option, layering safe redact defaults
-* when the host hasn't supplied any. Returns the value Fastify expects
-* for its `logger` server option.
-*
-* Three branches:
-*   - `logger === false` → pass through (no logger).
-*   - `logger === undefined` → enable with default redact paths.
-*   - `logger === true` → enable with default redact paths.
-*   - `logger` is an object → respect explicit `redact` (host wins);
-*     otherwise inject defaults.
+* Resolve the host's `logger` option for Fastify, layering the default redact
+* paths unless it is `false` or an object with its own `redact`.
 */
 function resolveLoggerConfig(logger) {
 	if (logger === false) return false;
@@ -1900,28 +1859,31 @@ Missing:\n${lines}\n\nFix: pass durable adapters under \`stores\`, or use runtim
 */
 async function createApp(options) {
 	/**
-	* ROLE contradiction check — before anything constructs. A relay/scheduler
-	* process declaring HTTP resources is a wiring error, not a preference:
-	* those roles exist to NOT serve traffic, and mounting routes anyway would
-	* hide the misdeployment behind a working endpoint.
+	* TOPOLOGY is declared, never guessed: a second replica on the in-memory runtime silently
+	* loses cross-instance events and caches.
+	*/
+	if (options.preset === "production" && options.runtime === void 0) throw new Error("createApp: preset 'production' requires an explicit `runtime` — 'memory' for a single instance, 'distributed' before running a second replica (it requires shared stores and is audited at boot).");
+	/**
+	* A relay/scheduler process declaring HTTP resources is a wiring error —
+	* mounting routes anyway would hide the misdeployment behind a working endpoint.
 	*/
 	const declaredRole = options.role ?? "all";
 	if ((declaredRole === "relay" || declaredRole === "scheduler") && (options.resources !== void 0 || options.resourceDir !== void 0)) throw new Error(`createApp: role '${declaredRole}' declares HTTP resources — a ${declaredRole} process must not serve routes. Remove \`resources\`/\`resourceDir\`, or change the role.`);
 	/**
-	* This app's own `arcLog` config, entered for the WHOLE boot.
-	*
-	* Held by reference and mutated in `buildApp` once `fastify.log` exists:
-	* boot starts before Fastify does, so a copied snapshot would send every
-	* post-construction boot warning to the console instead of this app's
-	* logger. Scoping it per app is what stops two apps in one process from
-	* overwriting each other's writer — see `src/logger/index.ts`.
+	* This app's own `arcLog` config, entered for the WHOLE boot. Held by
+	* reference and mutated in `buildApp` once `fastify.log` exists — a copy
+	* would send post-construction boot warnings to the console. Per-app so two
+	* apps in one process keep separate writers.
 	*/
 	const loggerScope = {};
 	if (options.debug !== void 0 && options.debug !== false) loggerScope.debug = options.debug;
 	let partial;
+	let disposeBoot;
 	try {
 		return await runWithArcLogger(loggerScope, () => buildApp(options, loggerScope, (instance) => {
 			partial = instance;
+		}, (dispose) => {
+			disposeBoot = dispose;
 		}));
 	} catch (err) {
 		if (partial) try {
@@ -1929,38 +1891,42 @@ async function createApp(options) {
 		} catch (closeErr) {
 			partial.log?.error?.({ err: closeErr }, "[arc] cleanup of a partially-booted app failed; original boot error follows");
 		}
+		if (disposeBoot) try {
+			await disposeBoot();
+		} catch (disposeErr) {
+			arcLog("createApp").error("beforeBoot disposer failed during failed-boot cleanup; original boot error follows", disposeErr);
+		}
 		throw err;
 	}
 }
-async function buildApp(options, loggerScope, onInstance) {
+async function buildApp(options, loggerScope, onInstance, onBootDisposer) {
 	validateAuthOptions(options);
 	const deferredWarnings = validateDistributedRuntime(options);
-	if (options.beforeBoot) await options.beforeBoot();
+	let disposeBoot;
+	if (options.beforeBoot) {
+		const dispose = await options.beforeBoot();
+		if (typeof dispose === "function") {
+			let once;
+			disposeBoot = () => {
+				once ??= Promise.resolve().then(dispose);
+				return once;
+			};
+			onBootDisposer(disposeBoot);
+		}
+	}
 	const config = {
 		...options.preset ? getPreset(options.preset) : {},
-		...options
+		...options,
+		...options.role === "relay" || options.role === "scheduler" ? { mountRoutes: false } : {}
 	};
 	const inheritedTrustProxyDefault = options.preset === "production" && options.trustProxy === void 0;
 	/**
-	* A NUMERIC `trustProxy` is a no-op on Fastify >= 5.12.1.
-	*
-	* Fastify made hop-count trust fail-closed on purpose — the comment in
-	* `lib/request.js` is explicit: "Hop-count-only trust cannot validate the
-	* immediate peer. Fail closed so direct clients cannot spoof X-Forwarded-*
-	* values by supplying enough hops." So `trustProxy: 1` now trusts NOTHING.
-	*
-	* That is the right call upstream and the wrong thing to inherit silently:
-	* `request.ip` becomes the proxy's address, which is the exact failure the
-	* production-preset warning below describes — rate-limit keys collapse onto
-	* one bucket and audit rows record the wrong client. The host asked for
-	* proxy trust and got none, with no error.
-	*
-	* Warn rather than refuse: the app still serves, and a hard boot failure on
-	* a transitive `fastify` bump would be a harsher surprise than the one being
-	* reported. The replacement is named so the fix is a copy-paste.
+	* A NUMERIC `trustProxy` trusts NOTHING on Fastify >= 5.12.1 (hop-count
+	* trust fails closed upstream), so the host silently gets the proxy's IP.
+	* Warn rather than refuse — a boot failure on a transitive bump is harsher.
 	*/
 	const numericTrustProxy = typeof config.trustProxy === "number";
-	const resolvedModules = orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
+	const { modules: resolvedModules, skipped: skippedBridges } = await composeModules(config.modules ?? [], config.ports);
 	const moduleErrorMappers = resolvedModules.flatMap((m) => m.errorMappers ?? []);
 	const moduleHealthChecks = collectModuleHealthChecks(resolvedModules);
 	const resolvedLogger = resolveLoggerConfig(config.logger);
@@ -1983,16 +1949,13 @@ async function buildApp(options, loggerScope, onInstance) {
 			}),
 			maxParamLength: config.maxParamLength ?? 400
 		},
-		ajv: { customOptions: {
-			coerceTypes: true,
-			useDefaults: true,
-			removeAdditional: false,
-			strictTypes: false,
-			keywords: ["example", ...config.ajv?.keywords ?? []]
-		} }
+		ajv: { customOptions: arcAjvCustomOptions(config.ajv?.keywords) }
 	});
+	markArcRootValidator(fastify);
 	onInstance(fastify);
+	if (disposeBoot) fastify.addHook("onClose", disposeBoot);
 	initRuntimeCapabilityRegistry(fastify);
+	initShutdownRegistry(fastify);
 	if (resolvedLogger !== false) {
 		const writer = createPinoWriter(fastify.log);
 		loggerScope.writer = writer;
@@ -2006,22 +1969,15 @@ async function buildApp(options, loggerScope, onInstance) {
 	});
 	for (const warning of deferredWarnings) fastify.log.warn(warning);
 	if (numericTrustProxy) fastify.log.warn(`[arc] trustProxy: ${String(config.trustProxy)} (a hop COUNT) trusts nothing on Fastify >= 5.12.1 — hop-count trust cannot validate the immediate peer, so it fails closed upstream to stop clients spoofing X-Forwarded-* with padded hops. \`request.ip\` is therefore the PROXY's address: rate-limit keys collapse onto one bucket and audit rows record the wrong client. Name the proxies instead — trustProxy: 'loopback', '10.0.0.0/8', a comma-separated list, or \`true\` if every upstream hop is genuinely trusted.`);
-	if (inheritedTrustProxyDefault) fastify.log.warn("[arc] preset: 'production' now defaults to trustProxy: false (fail-closed; was true before 2.24). If this app runs behind a load balancer or reverse proxy, request.ip is currently the PROXY's address — rate-limit keys collapse onto one bucket and audit logs record the wrong client. Set trustProxy explicitly: a hop count (trustProxy: 1), a CIDR allow-list ('10.0.0.0/8'), a resolver function, or false if clients truly connect directly.");
+	if (inheritedTrustProxyDefault) fastify.log.warn("[arc] preset: 'production' defaults to trustProxy: false (fail-closed). If this app runs behind a load balancer or reverse proxy, request.ip is currently the PROXY's address — rate-limit keys collapse onto one bucket and audit logs record the wrong client. Set trustProxy explicitly: the proxies' addresses ('loopback', '10.0.0.0/8', a comma-separated list), a resolver function, or false if clients truly connect directly. A hop count trusts nothing on Fastify >= 5.12.1.");
 	/**
-	* `preset: 'production'` REPORTS the fail-loud switches it cannot set.
-	*
-	* All three are read where the object is CONSTRUCTED — `defineResource` at
-	* define time, `QueryParser` and `BodySanitizer` in their constructors — and a
-	* host imports its resources before it calls `createApp`. So setting
-	* `process.env` here would be too late for everything already built: wired to
-	* read, doing nothing. Reporting cannot fail that way.
-	*
-	* Set them in the process entrypoint, BEFORE the first resource import, with
-	* `??=` so an operator's explicit `false` still wins.
+	* Production names every fail-loud switch turned OFF. They are read before `createApp`, so this
+	* reports rather than sets.
 	*/
 	if (config.preset === "production") {
-		const off = STRICT_ENV_FLAGS.filter(([name]) => process.env[name] !== "true");
-		if (off.length > 0) fastify.log.warn(`[arc] preset: 'production' with fail-loud OFF: ${off.map(([n]) => n).join(", ")}. ${off.map(([, what]) => what).join(" ")} Set them in the entrypoint BEFORE any resource import — they are read when resources, parsers and sanitizers are CONSTRUCTED, so setting them later is silently too late. Per-resource options still override.`);
+		const env = readEnv(process.env);
+		const off = STRICT_ENV_FLAGS.filter(([name]) => !env.bool(name, true));
+		if (off.length > 0) fastify.log.warn(`[arc] preset: 'production' with fail-loud turned OFF: ${off.map(([n]) => n).join(", ")}. ${off.map(([, what]) => what).join(" ")} They default ON; unset them to restore enforcement. Per-resource options still override.`);
 	}
 	fastify.removeContentTypeParser("application/json");
 	fastify.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
@@ -2053,15 +2009,14 @@ async function buildApp(options, loggerScope, onInstance) {
 	await registerAuth(fastify, config, trackPlugin);
 	await registerElevation(fastify, config, trackPlugin);
 	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
-	await registerResources(fastify, config, resolvedModules);
+	await registerResources(fastify, config, resolvedModules, skippedBridges);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-CNdvMfM4.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-Bnc6lJyy.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {
-		const mode = config.serializeBigInt === "string" ? "string" : "number";
-		if (config.serializeBigInt === true) arcLog("createApp").warn("serializeBigInt: true is a back-compat alias for 'number' (lossy above Number.MAX_SAFE_INTEGER = 9007199254740991). For IDs / money / counters / ledger values use serializeBigInt: 'string' (lossless). The boolean form will be removed in a future major.");
-		else if (mode === "number") arcLog("createApp").warn("serializeBigInt: 'number' loses precision above Number.MAX_SAFE_INTEGER (9007199254740991). Use 'string' instead unless you've audited that no bigint payload field can exceed the safe range.");
+		const mode = config.serializeBigInt;
+		if (mode === "number") arcLog("createApp").warn("serializeBigInt: 'number' loses precision above Number.MAX_SAFE_INTEGER (9007199254740991). Use 'string' instead unless you've audited that no bigint payload field can exceed the safe range.");
 		fastify.addHook("preSerialization", async (_request, _reply, payload) => {
 			if (payload === null || payload === void 0) return payload;
 			try {
@@ -2107,48 +2062,4 @@ const ArcFactory = {
 	}
 };
 //#endregion
-//#region src/factory/preloadResources.ts
-/**
-* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
-*
-* Accepts either:
-* - `{ import: 'default' }` form: values are the resource directly
-* - default form: values are the full module — picks first export with `toPlugin()`
-*
-* Throws if any module doesn't yield a valid `ResourceLike`.
-*/
-function preloadResources(globResult) {
-	const resources = [];
-	for (const [path, value] of Object.entries(globResult)) {
-		const resource = pickResource(value);
-		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		resources.push(resource);
-	}
-	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-/**
-* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
-*
-* Use this when resources depend on prior bootstrap (e.g., engine init) and
-* cannot be evaluated at import time of the preload file.
-*/
-async function preloadResourcesAsync(globResult) {
-	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
-		const resource = pickResource(await loader());
-		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		return resource;
-	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-function pickResource(value) {
-	if (!value || typeof value !== "object") return void 0;
-	if (typeof value.toPlugin === "function") return value;
-	const mod = value;
-	const candidates = [
-		mod.default,
-		mod.resource,
-		...Object.values(mod)
-	];
-	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
-}
-//#endregion
-export { resolveModule as S, describeResolvedModule as _, createApp as a, collectModuleWorkflows as b, edgePreset as c, testingPreset as d, workerPreset as f, subscribeModuleEventHandlers as g, orderModules as h, DEFAULT_LOGGER_REDACT_PATHS as i, getPreset as l, hasModule as m, preloadResourcesAsync as n, createApp_exports as o, getModuleState as p, ArcFactory as r, developmentPreset as s, preloadResources as t, productionPreset as u, collectModuleHealthChecks as v, resolveContribution as x, collectModuleScheduledJobs as y };
+export { developmentPreset as a, productionPreset as c, getModuleResources as d, getModuleState as f, collectModuleWorkflows as g, asModulePorts as h, createApp_exports as i, testingPreset as l, subscribeModuleEventHandlers as m, DEFAULT_LOGGER_REDACT_PATHS as n, edgePreset as o, hasModule as p, createApp as r, getPreset as s, ArcFactory as t, workerPreset as u };