@openora/core 0.4.1-canary.21 → 0.4.1-canary.25

package/dist/server/kernel/redis-streams-broker.js

@@ -0,0 +1,208 @@
+import { randomUUID } from 'node:crypto';
+import { createLogger } from './logger.js';
+const STREAM_PREFIX = 'oss:evt:';
+const STREAM_MAXLEN = 10_000;
+const READ_COUNT = 10;
+const BLOCK_MS = 5_000;
+const CLAIM_INTERVAL_MS = 30_000;
+const CLAIM_MIN_IDLE_MS = 60_000;
+const RETRY_DELAY_MS = 2_000;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function streamKey(topic) {
+    return STREAM_PREFIX + topic;
+}
+function isBusyGroupError(err) {
+    return err instanceof Error && err.message.includes('BUSYGROUP');
+}
+/**
+ * Durable `MESSAGE_BROKER` reference driver on Redis Streams, auto-bound by
+ * `createApp` when `REDIS_URL` is set (ADR-0030 - production is distributed-only,
+ * core ships no in-process default).
+ *
+ * Every `subscribe(topic, handler)` call for the same (topic, group) - default
+ * group is the deployment's `serviceName` - coalesces into ONE Redis consumer-group
+ * loop that fans out to every registered local handler, then XACKs once: an event
+ * is delivered to exactly one replica of the service (competing consumers across
+ * replicas via the shared group), and that replica runs every local handler for
+ * the topic (matches in-process fan-out semantics, but once per cluster, not once
+ * per replica). A distinct `SERVICE_NAME` per split service gives each service its
+ * own copy of every event; `createApp` requires one as soon as `SERVICE_MANIFEST`
+ * is set, since the group name is a durable identity and can't be derived from a
+ * module list that reorders and grows.
+ *
+ * Blocking `XREADGROUP` runs on a `client.duplicate()`d connection per loop, never
+ * on the shared client - `publish` (`XADD`, non-blocking) uses the shared client,
+ * so a blocked read never stalls the cache/rate-limiter commands sharing it.
+ * `publish` awaits the XADD and lets errors propagate (the `OutboxRelay` marks a
+ * row published only after this resolves - it must be reliable, not a silent
+ * no-op). Handler errors are guarded + logged, then the entry is XACKed regardless
+ * (matches `EventBus.on` - no per-handler retry; must-not-lose events use the
+ * outbox). A crash before XACK leaves the entry pending; `XAUTOCLAIM` periodically
+ * reclaims idle-pending entries so at-least-once delivery survives a replica crash.
+ *
+ * At-least-once holds from group creation onward, NOT before it. A group is created
+ * at `startId` (default `$`) on first subscribe and persists in Redis from then on,
+ * so restarts and outages are covered: the group keeps its cursor, undelivered
+ * entries wait in the stream, and pending ones are reclaimed. The one uncovered
+ * window is a group's FIRST-EVER creation - a service extracted after events were
+ * already flowing starts from `$` and never sees the backlog. `startId: '0'` closes
+ * that window by replaying everything still retained (up to STREAM_MAXLEN), at the
+ * cost of re-running every handler for those events: safe on a fresh deploy (empty
+ * streams), a duplicate-side-effect hazard for a late-added service, since core has
+ * no dedup layer - `EventBus.on` invokes handlers directly, and `eventId` is a key
+ * consumers must dedup on themselves.
+ *
+ * `orderingKey` is NOT honoured - Redis Streams have no partitioning, so per-key
+ * ordering across concurrent consumers isn't guaranteed (same footnote as
+ * `BullMqJobQueue`'s `orderingKey`).
+ */
+export class RedisStreamsBroker {
+    client;
+    logger = createLogger('message-broker');
+    serviceName;
+    startId;
+    consumerId = randomUUID();
+    loops = new Map();
+    constructor(client, opts) {
+        this.client = client;
+        this.serviceName = opts.serviceName;
+        this.startId = opts.startId ?? '$';
+    }
+    async publish(envelope) {
+        await this.client.xAdd(streamKey(envelope.topic), '*', { data: JSON.stringify(envelope) }, { TRIM: { strategy: 'MAXLEN', strategyModifier: '~', threshold: STREAM_MAXLEN } });
+    }
+    subscribe(topic, handler, options) {
+        const group = options?.consumerGroup ?? this.serviceName;
+        const key = streamKey(topic);
+        const loopKey = `${key}::${group}`;
+        let loop = this.loops.get(loopKey);
+        if (!loop) {
+            loop = this.startLoop(key, group);
+            this.loops.set(loopKey, loop);
+        }
+        loop.handlers.add(handler);
+        return () => {
+            const current = this.loops.get(loopKey);
+            if (!current || !current.handlers.delete(handler)) {
+                return;
+            }
+            if (current.handlers.size === 0) {
+                this.loops.delete(loopKey);
+                current.stop();
+            }
+        };
+    }
+    async close() {
+        const loops = [...this.loops.values()];
+        this.loops.clear();
+        for (const loop of loops) {
+            loop.stop();
+        }
+        await Promise.allSettled(loops.map((loop) => loop.done));
+    }
+    startLoop(key, group) {
+        const handlers = new Set();
+        const reader = this.client.duplicate();
+        reader.on('error', (err) => this.logger.error({ err, key, group }, 'stream reader connection error'));
+        let stopped = false;
+        let lastClaimAt = 0;
+        const stop = () => {
+            stopped = true;
+            // Rejects the in-flight blocking XREADGROUP (if any) immediately, instead of
+            // waiting up to BLOCK_MS for it to time out on its own.
+            reader.destroy();
+        };
+        // `ready` gates connecting + group creation, and stays false until BOTH have
+        // succeeded - so a Redis outage at loop start retries the whole handshake with
+        // backoff rather than permanently abandoning this (topic, group)'s consumption.
+        // It is NOT reset on a later error: node-redis owns reconnection from there on
+        // (socket.reconnectStrategy re-establishes the connection and re-queues the
+        // blocked XREADGROUP), and the group already exists, so there is nothing to redo.
+        // Both steps are idempotent regardless - `connect()` throws 'Socket already
+        // opened' once the socket is open, hence the isOpen guard, and a re-created group
+        // comes back BUSYGROUP, which is tolerated below.
+        const done = (async () => {
+            let ready = false;
+            while (!stopped) {
+                try {
+                    if (!ready) {
+                        if (!reader.isOpen) {
+                            await reader.connect();
+                        }
+                        try {
+                            await reader.xGroupCreate(key, group, this.startId, { MKSTREAM: true });
+                        }
+                        catch (err) {
+                            if (!isBusyGroupError(err)) {
+                                throw err;
+                            }
+                        }
+                        ready = true;
+                    }
+                    if (Date.now() - lastClaimAt > CLAIM_INTERVAL_MS) {
+                        lastClaimAt = Date.now();
+                        await this.reclaimPending(reader, key, group, handlers);
+                    }
+                    const reply = (await reader.xReadGroup(group, this.consumerId, { key, id: '>' }, { COUNT: READ_COUNT, BLOCK: BLOCK_MS }));
+                    if (!reply) {
+                        continue;
+                    }
+                    for (const stream of reply) {
+                        for (const message of stream.messages) {
+                            await this.dispatch(reader, key, group, message, handlers);
+                        }
+                    }
+                }
+                catch (err) {
+                    if (stopped) {
+                        break;
+                    }
+                    this.logger.error({ err, key, group }, 'stream loop error, retrying');
+                    await delay(RETRY_DELAY_MS);
+                }
+            }
+        })();
+        return { handlers, stop, done };
+    }
+    async reclaimPending(reader, key, group, handlers) {
+        try {
+            const claimed = (await reader.xAutoClaim(key, group, this.consumerId, CLAIM_MIN_IDLE_MS, '0-0', { COUNT: READ_COUNT }));
+            for (const message of claimed.messages) {
+                if (message) {
+                    await this.dispatch(reader, key, group, message, handlers);
+                }
+            }
+        }
+        catch (err) {
+            this.logger.error({ err, key, group }, 'stream reclaim failed');
+        }
+    }
+    async dispatch(reader, key, group, message, handlers) {
+        const raw = message.message['data'];
+        if (raw === undefined) {
+            await reader.xAck(key, group, message.id);
+            return;
+        }
+        let envelope;
+        try {
+            envelope = JSON.parse(raw);
+        }
+        catch (err) {
+            this.logger.error({ err, key, group, id: message.id }, 'stream envelope parse failed');
+            await reader.xAck(key, group, message.id);
+            return;
+        }
+        for (const fn of handlers) {
+            try {
+                await fn(envelope);
+            }
+            catch (err) {
+                this.logger.error({ err, topic: envelope.topic }, 'message broker handler threw');
+            }
+        }
+        await reader.xAck(key, group, message.id);
+    }
+}
+//# sourceMappingURL=redis-streams-broker.js.map

package/dist/server/kernel/redis-streams-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-streams-broker.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-streams-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAgCD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,aAAa,GAAG,KAAK,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,OAAO,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,OAAO,kBAAkB;IAQV;IAPF,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;IACxC,WAAW,CAAS;IACpB,OAAO,CAAY;IACnB,UAAU,GAAG,UAAU,EAAE,CAAC;IAC1B,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEzD,YACmB,MAAmB,EACpC,IAA+B;QADd,WAAM,GAAN,MAAM,CAAa;QAGpC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAuB;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EACzB,GAAG,EACH,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAClC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,OAAsB,EAAE,OAA0B;QACzE,MAAM,KAAK,GAAG,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC;QACzD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;QAEnC,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3B,OAAO,GAAG,EAAE;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;QACD,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,KAAa;QAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,gCAAgC,CAAC,CACzE,CAAC;QAEF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,OAAO,GAAG,IAAI,CAAC;YACf,6EAA6E;YAC7E,wDAAwD;YACxD,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC;QAEF,6EAA6E;QAC7E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,4EAA4E;QAC5E,kFAAkF;QAClF,4EAA4E;QAC5E,kFAAkF;QAClF,kDAAkD;QAClD,MAAM,IAAI,GAAG,CAAC,KAAK,IAAmB,EAAE;YACtC,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;4BACnB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;wBACzB,CAAC;wBACD,IAAI,CAAC;4BACH,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC1E,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC3B,MAAM,GAAG,CAAC;4BACZ,CAAC;wBACH,CAAC;wBACD,KAAK,GAAG,IAAI,CAAC;oBACf,CAAC;oBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,iBAAiB,EAAE,CAAC;wBACjD,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBACzB,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;oBAC1D,CAAC;oBACD,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CACpC,KAAK,EACL,IAAI,CAAC,UAAU,EACf,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAChB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CACvC,CAAoB,CAAC;oBACtB,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,SAAS;oBACX,CAAC;oBACD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;wBAC3B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;4BACtC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC7D,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM;oBACR,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,6BAA6B,CAAC,CAAC;oBACtE,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAAmB,EACnB,GAAW,EACX,KAAa,EACb,QAA4B;QAE5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CACtC,GAAG,EACH,KAAK,EACL,IAAI,CAAC,UAAU,EACf,iBAAiB,EACjB,KAAK,EACL,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAqB,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACvC,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,MAAmB,EACnB,GAAW,EACX,KAAa,EACb,OAAsB,EACtB,QAA4B;QAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACvF,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/server/runtime/__tests__/create-app.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=create-app.test.d.ts.map

package/dist/server/runtime/__tests__/create-app.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app.test.d.ts","sourceRoot":"","sources":["../../../../src/server/runtime/__tests__/create-app.test.ts"],"names":[],"mappings":""}

package/dist/server/runtime/__tests__/create-app.test.js

@@ -0,0 +1,60 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { MESSAGE_BROKER, JOB_QUEUE, CACHE, RATE_LIMITER } from '@openora/core/contracts';
+import { InMemoryBroker, InProcessJobQueue, InProcessCache, InProcessRateLimiter, } from '@openora/core/testing';
+import { createLogger } from '../../kernel/index.js';
+import { createApp } from '../create-app.js';
+// A syntactically valid but unreachable DB url - fine here because nothing in this
+// suite ever runs a query: DrizzleService's pg.Pool connects lazily, and neither
+// health.ping nor better-auth's getSession() touch the DB when the request carries
+// no session cookie (getSessionFromCtx short-circuits on a missing cookie).
+const DUMMY_DATABASE_URL = 'postgres://test:test@127.0.0.1:1/create_app_test';
+describe('createApp - distributed-only durable seams (ADR-0030)', () => {
+    it('throws a clear, actionable error when no durable seam is bound', async () => {
+        await expect(createApp({ plugins: [], databaseUrl: DUMMY_DATABASE_URL, openapi: { enabled: false } })).rejects.toThrow(/MESSAGE_BROKER.*JOB_QUEUE.*CACHE.*RATE_LIMITER/s);
+    });
+    it('boots and serves once the fakes are bound via configure', async () => {
+        const created = await createApp({
+            plugins: [],
+            databaseUrl: DUMMY_DATABASE_URL,
+            openapi: { enabled: false },
+            configure(container) {
+                container.register(MESSAGE_BROKER, () => new InMemoryBroker());
+                container.register(JOB_QUEUE, () => new InProcessJobQueue(createLogger('job-queue')));
+                container.register(CACHE, () => new InProcessCache());
+                container.register(RATE_LIMITER, () => new InProcessRateLimiter());
+            },
+        });
+        const res = await created.app.request('/health');
+        expect(res.status).toBe(200);
+        expect(await res.json()).toMatchObject({ status: 'ok' });
+        await created.close();
+    });
+});
+describe('createApp - service name for the Redis Streams consumer group', () => {
+    const saved = { redis: process.env['REDIS_URL'], manifest: process.env['SERVICE_MANIFEST'] };
+    afterEach(() => {
+        // Restore rather than delete: a bare delete would strip a REDIS_URL the rest of
+        // the suite (or a CI service container) legitimately set.
+        for (const [key, value] of [
+            ['REDIS_URL', saved.redis],
+            ['SERVICE_MANIFEST', saved.manifest],
+        ]) {
+            if (value === undefined) {
+                delete process.env[key];
+            }
+            else {
+                process.env[key] = value;
+            }
+        }
+    });
+    it('refuses to boot a split service that has no SERVICE_NAME of its own', async () => {
+        // The consumer group is a durable identity, so it can never be derived from
+        // SERVICE_MANIFEST - that is a list of module ids ('wallet,iam') which reorders
+        // and grows. Throws before any Redis client is opened.
+        process.env['REDIS_URL'] = 'redis://127.0.0.1:1';
+        process.env['SERVICE_MANIFEST'] = 'wallet,iam';
+        delete process.env['SERVICE_NAME'];
+        await expect(createApp({ plugins: [], databaseUrl: DUMMY_DATABASE_URL, openapi: { enabled: false } })).rejects.toThrow(/SERVICE_MANIFEST is set but SERVICE_NAME is not/);
+    });
+});
+//# sourceMappingURL=create-app.test.js.map

package/dist/server/runtime/__tests__/create-app.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app.test.js","sourceRoot":"","sources":["../../../../src/server/runtime/__tests__/create-app.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,mFAAmF;AACnF,iFAAiF;AACjF,mFAAmF;AACnF,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,kDAAkD,CAAC;AAE9E,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CACzF,CAAC,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC3B,SAAS,CAAC,SAAS;gBACjB,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;gBAC/D,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACtF,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;gBACtD,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+DAA+D,EAAE,GAAG,EAAE;IAC7E,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAE7F,SAAS,CAAC,GAAG,EAAE;QACb,gFAAgF;QAChF,0DAA0D;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;YACzB,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC;YAC1B,CAAC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC;SAC5B,EAAE,CAAC;YACX,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,4EAA4E;QAC5E,gFAAgF;QAChF,uDAAuD;QACvD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,qBAAqB,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;QAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEnC,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CACzF,CAAC,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/runtime/assert-durable-seams.d.ts

@@ -0,0 +1,18 @@
+import { type AnyToken } from '@openora/core/contracts';
+/**
+ * Production is distributed-only (ADR-0030, superseding ADR-0010/0014/0016/0028):
+ * the in-process seam impls no longer ship on the production path, so every
+ * always-needed seam must resolve to a durable binding before `createApp` finishes
+ * booting. Call this AFTER `loadPlugins` + `configure` so a `REDIS_URL` auto-bind or
+ * an overlay's own registration has already won (Container is last-registration-wins).
+ * Modeled on `assertSealedServicesBound` (`compliance/assert.ts`) - same `has(token)`
+ * shape, same "list every gap, don't stop at the first" style.
+ *
+ * `REALTIME_TRANSPORT` is deliberately excluded: it stays lazy and throws on first
+ * use, since not every deployment serves realtime traffic.
+ */
+export type DurableSeamContainerView = {
+    has(token: AnyToken<unknown>): boolean;
+};
+export declare function assertDurableSeamsBound(container: DurableSeamContainerView): void;
+//# sourceMappingURL=assert-durable-seams.d.ts.map

package/dist/server/runtime/assert-durable-seams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-durable-seams.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/assert-durable-seams.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACxC,CAAC;AA2BF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,wBAAwB,GAAG,IAAI,CASjF"}

package/dist/server/runtime/assert-durable-seams.js

@@ -0,0 +1,32 @@
+import { MESSAGE_BROKER, JOB_QUEUE, CACHE, RATE_LIMITER, } from '@openora/core/contracts';
+const REQUIRED_DURABLE_SEAMS = [
+    {
+        token: MESSAGE_BROKER,
+        name: 'MESSAGE_BROKER',
+        fix: 'set REDIS_URL to auto-bind RedisStreamsBroker, or bind a MessageBrokerAdapter overlay (eg RabbitMQ/Kafka) via ctx.provide(MESSAGE_BROKER, ...)',
+    },
+    {
+        token: JOB_QUEUE,
+        name: 'JOB_QUEUE',
+        fix: 'set REDIS_URL to auto-bind BullMqJobQueue, or bind a JOB_QUEUE overlay directly',
+    },
+    {
+        token: CACHE,
+        name: 'CACHE',
+        fix: 'set REDIS_URL to auto-bind RedisCache, or bind a CACHE overlay directly',
+    },
+    {
+        token: RATE_LIMITER,
+        name: 'RATE_LIMITER',
+        fix: 'set REDIS_URL to auto-bind RedisRateLimiter, or bind a RATE_LIMITER overlay directly',
+    },
+];
+export function assertDurableSeamsBound(container) {
+    const missing = REQUIRED_DURABLE_SEAMS.filter((seam) => !container.has(seam.token));
+    if (missing.length === 0) {
+        return;
+    }
+    throw new Error(`[create-app] production is distributed-only - the following seams have no durable binding:\n` +
+        missing.map((seam) => `  - ${seam.name}: ${seam.fix}`).join('\n'));
+}
+//# sourceMappingURL=assert-durable-seams.js.map

package/dist/server/runtime/assert-durable-seams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-durable-seams.js","sourceRoot":"","sources":["../../../src/server/runtime/assert-durable-seams.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,KAAK,EACL,YAAY,GAEb,MAAM,yBAAyB,CAAC;AAoBjC,MAAM,sBAAsB,GAA+B;IACzD;QACE,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,gJAAgJ;KACtJ;IACD;QACE,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,iFAAiF;KACvF;IACD;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,yEAAyE;KAC/E;IACD;QACE,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,sFAAsF;KAC5F;CACF,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,SAAmC;IACzE,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8FAA8F;QAC5F,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACpE,CAAC;AACJ,CAAC"}

package/dist/server/runtime/create-app.d.ts

@@ -38,15 +38,21 @@ export type CreatedApp = {
 };
 /**
  * The single composition root: wires the DI container, boots every plugin in
- * `config.plugins`, and mounts the resulting oRPC router on a Hono app. Seam
- * defaults auto-upgrade when env vars are set - `REDIS_URL` binds `JOB_QUEUE`/
- * `RATE_LIMITER`/`CACHE` to their Redis-backed drivers, `OUTBOX_ENABLED` (or
- * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay - otherwise
- * every seam stays in-process (zero deps for dev/test). `container.dispose()`
- * (via `close()`) runs disposers in REVERSE registration order, so DRIZZLE is
- * registered before JOB_QUEUE to guarantee workers drain before the DB closes.
- * A router namespace registered by more than one plugin throws at boot, not at
- * request time.
+ * `config.plugins`, and mounts the resulting oRPC router on a Hono app.
+ * Production is distributed-only (ADR-0030, superseding ADR-0010/0014/0016/0028):
+ * `REDIS_URL` auto-binds `JOB_QUEUE`/`RATE_LIMITER`/`CACHE`/`MESSAGE_BROKER` to their
+ * Redis-backed drivers - the broker being the `RedisStreamsBroker` reference driver,
+ * which an overlay (RabbitMQ/Kafka) or a test's `configure` callback can replace.
+ * `assertDurableSeamsBound` runs right after
+ * plugins + `configure` and throws a clear, actionable error listing every
+ * always-needed seam that still has no binding - it never falls back to an
+ * in-process impl. `REALTIME_TRANSPORT` stays lazy (throws on first use) since not
+ * every deployment serves realtime traffic. `OUTBOX_ENABLED` (or
+ * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay.
+ * `container.dispose()` (via `close()`) runs disposers in REVERSE registration
+ * order, so DRIZZLE is registered before JOB_QUEUE to guarantee workers drain
+ * before the DB closes. A router namespace registered by more than one plugin
+ * throws at boot, not at request time.
  */
 export declare function createApp(config: CreateAppConfig): Promise<CreatedApp>;
 //# sourceMappingURL=create-app.d.ts.map

package/dist/server/runtime/create-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/create-app.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,EACL,SAAS,EAiBV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAaL,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBxE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IAOvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,IAAI,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAEjD,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,QAAQ,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,OAAO,CAAC,EAAE,aAAa,CAAC;IAIxB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAEjE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAqDF;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CA6R5E"}
+{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/create-app.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,EACL,SAAS,EAYV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAWL,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA8CxE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IAOvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,IAAI,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAEjD,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,QAAQ,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,OAAO,CAAC,EAAE,aAAa,CAAC;IAIxB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAEjE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAqDF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAgR5E"}

package/dist/server/runtime/create-app.js

@@ -8,12 +8,13 @@ import { HTTPException } from 'hono/http-exception';
 import { serve } from '@hono/node-server';
 import { resolve } from 'node:path';
 import { generateOpenApiSpec } from './openapi.js';
-import { Container, BullMqJobQueue, InMemoryBroker, InProcessCache, InProcessJobQueue, InProcessRateLimiter, InProcessRealtimeTransport, RedisCache, RedisRateLimiter, SseClientAuthorizer, createEventBus, createLogger, createRedisClient, withRequestContext, setErrorReporter, EVENT_BUS, } from '../kernel/index.js';
+import { Container, BullMqJobQueue, RedisCache, RedisRateLimiter, RedisStreamsBroker, createEventBus, createLogger, createRedisClient, withRequestContext, setErrorReporter, EVENT_BUS, } from '../kernel/index.js';
 import { randomUUID } from 'node:crypto';
-import { MESSAGE_BROKER, JOB_QUEUE, REALTIME_TRANSPORT, REALTIME_CLIENT_AUTHORIZER, OUTBOX, ADMIN_PERMISSION_RESOLVER, RATE_LIMITER, CACHE, ERROR_TRACKING, composeContract, healthContract, IGAMING_CONFIG, PLATFORM_CONFIG, } from '@openora/core/contracts';
+import { MESSAGE_BROKER, JOB_QUEUE, OUTBOX, ADMIN_PERMISSION_RESOLVER, RATE_LIMITER, CACHE, ERROR_TRACKING, composeContract, healthContract, IGAMING_CONFIG, PLATFORM_CONFIG, } from '@openora/core/contracts';
 import { DrizzleService, DRIZZLE, DrizzleOutboxWriter, OutboxRelay } from '../db/index.js';
 import { AdminGuard, ADMIN_GUARD, SessionResolver, AUTH_SESSION } from '../auth/index.js';
 import { loadPlugins } from '../plugin-host/index.js';
+import { assertDurableSeamsBound } from './assert-durable-seams.js';
 import { loadPlatformConfig, resolvePlatformConfigPath } from '../kernel/platform-config-loader.js';
 // Path prefixes safe to cache at the HTTP layer: public, non-personalized reads
 // only (lobby feeds, public CMS content, the game catalogue). NOTHING
@@ -32,6 +33,26 @@ const PUBLIC_HTTP_CACHE_PATHS = [
 ];
 const DEFAULT_HTTP_CACHE_MAX_AGE_SECONDS = 30;
 const DEFAULT_HTTP_CACHE_STALE_WHILE_REVALIDATE_SECONDS = 60;
+// Redis Streams consumer group name for MESSAGE_BROKER. Distinct deployments/services
+// sharing one Redis MUST use distinct names so their subscribers don't compete for
+// each other's events. The name is a durable identity: renaming it strands the old
+// group's pending (delivered-but-unacked) entries and starts the new one at `$`, so
+// it can never be derived from SERVICE_MANIFEST - that is a LIST of module ids
+// (see service-manifest.ts) whose value reorders and grows as modules move.
+// A split deployment must therefore name itself explicitly.
+function resolveServiceName() {
+    const serviceName = process.env['SERVICE_NAME'];
+    if (serviceName) {
+        return serviceName;
+    }
+    if (process.env['SERVICE_MANIFEST']) {
+        throw new Error('[create-app] SERVICE_MANIFEST is set but SERVICE_NAME is not. A split service needs a stable ' +
+            'name of its own: it becomes the MESSAGE_BROKER consumer group, and every service sharing a ' +
+            'group competes for the same events instead of each receiving a copy. Set SERVICE_NAME to a ' +
+            'stable identifier for this deployment (eg SERVICE_NAME=wallet).');
+    }
+    return 'monolith';
+}
 function headersToRecord(headers) {
     const out = {};
     headers.forEach((value, key) => {
@@ -83,15 +104,21 @@ async function captureRawBody(req) {
 }
 /**
  * The single composition root: wires the DI container, boots every plugin in
- * `config.plugins`, and mounts the resulting oRPC router on a Hono app. Seam
- * defaults auto-upgrade when env vars are set - `REDIS_URL` binds `JOB_QUEUE`/
- * `RATE_LIMITER`/`CACHE` to their Redis-backed drivers, `OUTBOX_ENABLED` (or
- * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay - otherwise
- * every seam stays in-process (zero deps for dev/test). `container.dispose()`
- * (via `close()`) runs disposers in REVERSE registration order, so DRIZZLE is
- * registered before JOB_QUEUE to guarantee workers drain before the DB closes.
- * A router namespace registered by more than one plugin throws at boot, not at
- * request time.
+ * `config.plugins`, and mounts the resulting oRPC router on a Hono app.
+ * Production is distributed-only (ADR-0030, superseding ADR-0010/0014/0016/0028):
+ * `REDIS_URL` auto-binds `JOB_QUEUE`/`RATE_LIMITER`/`CACHE`/`MESSAGE_BROKER` to their
+ * Redis-backed drivers - the broker being the `RedisStreamsBroker` reference driver,
+ * which an overlay (RabbitMQ/Kafka) or a test's `configure` callback can replace.
+ * `assertDurableSeamsBound` runs right after
+ * plugins + `configure` and throws a clear, actionable error listing every
+ * always-needed seam that still has no binding - it never falls back to an
+ * in-process impl. `REALTIME_TRANSPORT` stays lazy (throws on first use) since not
+ * every deployment serves realtime traffic. `OUTBOX_ENABLED` (or
+ * `AMQP_URL`/`RABBITMQ_URL`) enables the transactional outbox relay.
+ * `container.dispose()` (via `close()`) runs disposers in REVERSE registration
+ * order, so DRIZZLE is registered before JOB_QUEUE to guarantee workers drain
+ * before the DB closes. A router namespace registered by more than one plugin
+ * throws at boot, not at request time.
  */
 export async function createApp(config) {
     if (config.databaseUrl) {
@@ -103,35 +130,31 @@ export async function createApp(config) {
         container.onDispose(() => svc.dispose());
         return svc;
     });
-    container.register(MESSAGE_BROKER, () => {
-        const broker = new InMemoryBroker();
-        container.onDispose(() => broker.close());
-        return broker;
-    });
-    // Enabled when OUTBOX_ENABLED is set or a durable broker is configured (AMQP_URL) -
-    // a distributed deployment wants events that survive a crash between commit and
-    // publish. In the default in-process monolith it stays off, so emit() keeps its
-    // synchronous fan-out and emitInTransaction() guides callers to enable it.
+    // A distributed deployment wants events that survive a crash between commit and
+    // publish. Off by default: emit() keeps its best-effort fan-out and
+    // emitInTransaction() throws a guiding error until this is enabled.
+    // AMQP_URL/RABBITMQ_URL only signal the INTENT to run a RabbitMQ broker overlay -
+    // core binds no AMQP driver, so they enable the outbox and nothing else. The relay
+    // publishes to whatever MESSAGE_BROKER resolves to (the Redis Streams driver below,
+    // unless an overlay replaced it); set OUTBOX_ENABLED directly when that is the aim.
     const outboxEnabled = !!process.env['OUTBOX_ENABLED'] || !!process.env['AMQP_URL'] || !!process.env['RABBITMQ_URL'];
     if (outboxEnabled) {
         container.register(OUTBOX, () => new DrizzleOutboxWriter());
     }
     container.register(EVENT_BUS, (c) => createEventBus(c.get(MESSAGE_BROKER), createLogger('event-bus'), outboxEnabled ? c.get(OUTBOX) : undefined));
-    // Default in-process fan-out served as SSE; an overlay rebinds to a managed
-    // vendor (Ably/GetStream) without touching modules. See ADR-0007.
-    container.register(REALTIME_TRANSPORT, () => new InProcessRealtimeTransport());
-    // Default is first-party SSE (no token; the session cookie authorizes the stream).
-    // A managed-vendor overlay rebinds this to mint a per-player scoped token. See ADR-0007.
-    container.register(REALTIME_CLIENT_AUTHORIZER, () => new SseClientAuthorizer());
-    // When REDIS_URL is set, JOB_QUEUE, the rate limiter and cache bind to the shipped
-    // Redis reference adapters: BullMQ-backed durable jobs (survive restarts, real cron),
-    // distributed throttling and cross-replica cache invalidation - mirrors the AMQP_URL
-    // outbox precedent above. Otherwise the process-local in-process defaults stay (zero
-    // deps for dev/test). Either way a consumer overlay can rebind any of these tokens
-    // (plugins load after). The JOB_QUEUE disposer drains in-flight jobs before the DB
-    // closes (DRIZZLE is resolved before JOB_QUEUE below, and disposers run in reverse).
+    // When REDIS_URL is set, JOB_QUEUE, the rate limiter, the cache and the message
+    // broker bind to the shipped Redis reference adapters: BullMQ-backed durable jobs
+    // (survive restarts, real cron), distributed throttling, cross-replica cache
+    // invalidation and cross-replica events over Redis Streams. There is no in-process
+    // fallback (ADR-0030) - a deployment without REDIS_URL must bind these itself (an
+    // overlay, or a test's `configure` callback), or `assertDurableSeamsBound` below
+    // throws. The JOB_QUEUE disposer drains in-flight jobs before the DB closes (DRIZZLE
+    // is resolved before JOB_QUEUE below, and disposers run in reverse).
     const redisUrl = process.env['REDIS_URL'];
     if (redisUrl) {
+        // Resolved eagerly, before any client is opened: a misconfigured service name is
+        // a boot error, not a surprise on whichever code path resolves the broker first.
+        const serviceName = resolveServiceName();
         container.register(JOB_QUEUE, () => {
             const q = new BullMqJobQueue(redisUrl);
             container.onDispose(() => q.close());
@@ -141,22 +164,10 @@ export async function createApp(config) {
         container.onDispose(() => redis.close());
         container.register(RATE_LIMITER, () => new RedisRateLimiter(redis));
         container.register(CACHE, () => new RedisCache(redis));
-    }
-    else {
-        container.register(JOB_QUEUE, () => {
-            const q = new InProcessJobQueue(createLogger('job-queue'));
-            container.onDispose(() => q.close());
-            return q;
-        });
-        container.register(RATE_LIMITER, () => {
-            const limiter = new InProcessRateLimiter();
-            container.onDispose(() => limiter.close());
-            return limiter;
-        });
-        container.register(CACHE, () => {
-            const cache = new InProcessCache();
-            container.onDispose(() => cache.close());
-            return cache;
+        container.register(MESSAGE_BROKER, () => {
+            const broker = new RedisStreamsBroker(redis, { serviceName });
+            container.onDispose(() => broker.close());
+            return broker;
         });
     }
     // One shared better-auth instance for both the per-request middleware and AdminGuard -
@@ -176,6 +187,7 @@ export async function createApp(config) {
     container.register(PLATFORM_CONFIG, () => loadPlatformConfig(resolvePlatformConfigPath()));
     const registry = await loadPlugins(config.plugins, container);
     await config.configure?.(container);
+    assertDurableSeamsBound(container);
     if (container.has(ERROR_TRACKING)) {
         const tracker = container.get(ERROR_TRACKING);
         setErrorReporter((error, context) => tracker.captureException(error, context));