@velajs/vela 1.19.0 → 1.19.1

package/dist/plugin-ByBlVOve.js

@@ -0,0 +1,1387 @@
+import { A as getOrCreateArray, C as InjectionToken, S as ForwardRef, T as MultipleProvidersFoundError, _ as APP_GUARD, a as Injectable, b as APP_PIPE, g as APP_FILTER, h as APP_EXCEPTION_HANDLER, i as Inject, k as MetadataRegistry, m as Scope, n as __decorateParam, o as Optional, r as __decorateMetadata, t as __decorate, v as APP_INTERCEPTOR, w as ModuleVisibilityError, x as ERROR_CATALOG, y as APP_MIDDLEWARE } from "./decorate-GcSMAbKn.js";
+import { A as UseGuards, E as applyDecorators, t as RouteManager } from "./route.manager-DRAZ5X04.js";
+import { n as resolveErrorReporter, s as ForbiddenException, t as DiscoveryService } from "./discovery.service-BYm95SSD.js";
+import { t as Container } from "./container-BqUHID4l.js";
+import { t as REQUEST_CONTEXT } from "./request-context-C3nCGJNd.js";
+import { n as verifySignedUrl, t as signUrl } from "./signed-url-CMmi0SIb.js";
+import { a as isModule, i as getModuleMetadata, n as Module } from "./decorators-C8YBFCIk.js";
+import { HTTPException } from "hono/http-exception";
+import { toErrorBody } from "@velajs/errors";
+//#region src/entrypoint/entrypoint.types.ts
+function contributesEntrypoints(x) {
+	return typeof x === "object" && x !== null && typeof x.collectEntrypoints === "function";
+}
+//#endregion
+//#region src/entrypoint/entrypoint.registry.ts
+const KIND_STORE_KEY = Symbol.for("vela:entrypoints:v1");
+function kindStore() {
+	const g = globalThis;
+	return g[KIND_STORE_KEY] ??= /* @__PURE__ */ new Map();
+}
+/**
+* Declare an entrypoint kind. Idempotent per `kind` (last declaration wins so
+* an HMR-re-evaluated module can re-declare); typically called at module
+* import time next to the decorator definition:
+*
+* ```ts
+* export const WS_GATEWAY_METADATA = 'vela:ws:gateway';
+* registerEntrypointKind({ kind: 'websocket', metaKey: WS_GATEWAY_METADATA, level: 'class' });
+* ```
+*/
+function registerEntrypointKind(k) {
+	kindStore().set(k.kind, k);
+}
+/** All declared kinds (registration order). */
+function getEntrypointKinds() {
+	return [...kindStore().values()];
+}
+/**
+* The per-application view of every entrypoint: built once after
+* `onApplicationBootstrap` hooks have run (so `ContributesEntrypoints`
+* providers have finished their own discovery), queried by runtime adapters:
+*
+* ```ts
+* for (const ep of app.entrypoints.ofKind('websocket')) { ... }
+* ```
+*
+* Per-app (never global): two applications in one process each build their
+* own registry from their own container.
+*/
+var EntrypointRegistry = class EntrypointRegistry {
+	byKind = /* @__PURE__ */ new Map();
+	static async build(discovery, eagerInstances, options = {}) {
+		const registry = new EntrypointRegistry();
+		const filter = options.deferLazy ? { deferLazy: true } : void 0;
+		for (const kind of getEntrypointKinds()) if (kind.level === "class") for (const found of discovery.providersWithMeta(kind.metaKey, filter)) registry.add({
+			kind: kind.kind,
+			token: found.token,
+			instance: found.instance,
+			meta: found.meta
+		});
+		else for (const found of discovery.methodsWithMeta(kind.metaKey, filter)) registry.add({
+			kind: kind.kind,
+			token: found.class.token,
+			instance: found.class.instance,
+			methodName: found.methodName,
+			meta: found.meta
+		});
+		const contributed = [];
+		for (const instance of new Set(eagerInstances)) {
+			if (!contributesEntrypoints(instance)) continue;
+			contributed.push(...await instance.collectEntrypoints(discovery));
+		}
+		for (const kind of new Set(contributed.map((ep) => ep.kind))) registry.byKind.delete(kind);
+		for (const ep of contributed) registry.add(ep);
+		return registry;
+	}
+	add(ep) {
+		const list = this.byKind.get(ep.kind);
+		if (list) list.push(ep);
+		else this.byKind.set(ep.kind, [ep]);
+	}
+	ofKind(kind) {
+		return this.byKind.get(kind) ?? [];
+	}
+	kinds() {
+		return [...this.byKind.keys()];
+	}
+	all() {
+		return [...this.byKind.values()].flat();
+	}
+};
+//#endregion
+//#region src/lifecycle/index.ts
+function hasOnModuleInit(instance) {
+	return instance !== null && typeof instance === "object" && typeof instance.onModuleInit === "function";
+}
+function hasOnApplicationBootstrap(instance) {
+	return instance !== null && typeof instance === "object" && typeof instance.onApplicationBootstrap === "function";
+}
+function hasOnModuleDestroy(instance) {
+	return instance !== null && typeof instance === "object" && typeof instance.onModuleDestroy === "function";
+}
+function hasBeforeApplicationShutdown(instance) {
+	return instance !== null && typeof instance === "object" && typeof instance.beforeApplicationShutdown === "function";
+}
+function hasOnApplicationShutdown(instance) {
+	return instance !== null && typeof instance === "object" && typeof instance.onApplicationShutdown === "function";
+}
+//#endregion
+//#region src/module/lazy-modules.ts
+function isThenable(x) {
+	return x !== null && (typeof x === "object" || typeof x === "function") && typeof x.then === "function";
+}
+/**
+* Owns deferred-module state for one application: which module instances are
+* still pending, which have been claimed by a container trigger, and how
+* claimed groups get completed (construction + lifecycle-hook replay).
+*
+* Phases:
+* - `'bootstrap'` (until the end of `callOnApplicationBootstrap`): completed
+*   groups are *absorbed* — their instances queue up for the application's
+*   normal hook phases, so a lazy module dragged in by an eager consumer gets
+*   today-identical semantics.
+* - `'live'`: hooks replay at drain time (memoized, exactly once), then the
+*   instances are handed to the application for shutdown-hook symmetry.
+*
+* Sync/async duality: sync drains throw a descriptive error when a member
+* factory or hook yields a thenable — lazy modules with async providers or
+* hooks must be reached through an async seam (`materializeLazyModules()`,
+* `resolveAsync`) or stay eager.
+*/
+var LazyModuleManager = class {
+	container;
+	pending = /* @__PURE__ */ new Map();
+	claimed = [];
+	absorbed = [];
+	phase = "bootstrap";
+	draining = false;
+	drainPromise;
+	onMaterialized;
+	constructor(container) {
+		this.container = container;
+	}
+	registerGroup(group) {
+		this.pending.set(group.moduleId, group);
+	}
+	/** Application sink for live-phase materializations (shutdown symmetry). */
+	setOnMaterialized(sink) {
+		this.onMaterialized = sink;
+	}
+	setPhaseLive() {
+		this.phase = "live";
+	}
+	isPending(moduleId) {
+		return this.pending.has(moduleId);
+	}
+	/** Tokens whose owning modules are ALL still pending are deferred. */
+	hasPendingModules() {
+		return this.pending.size > 0;
+	}
+	claim(moduleId) {
+		const group = this.pending.get(moduleId);
+		if (!group) return;
+		this.pending.delete(moduleId);
+		this.claimed.push(group);
+	}
+	hasClaimed() {
+		return this.claimed.length > 0;
+	}
+	/**
+	* A drain loop is running. The container consults this before its
+	* post-resolution drain: `constructGroupAsync` resolves members through
+	* `resolveAsync`, whose end-of-cascade check would otherwise re-enter and
+	* AWAIT the very drain promise it is executing inside — a self-referential
+	* await that never settles (with ≥2 claimed groups). Claims made while
+	* draining are picked up by the running loop instead.
+	*/
+	isDraining() {
+		return this.draining;
+	}
+	/** Instances constructed during the bootstrap phase, owed their hooks. */
+	takeAbsorbed() {
+		if (this.absorbed.length === 0) return [];
+		return this.absorbed.splice(0, this.absorbed.length);
+	}
+	drainSync() {
+		if (this.draining) return;
+		this.draining = true;
+		try {
+			while (this.claimed.length > 0) {
+				const batch = [];
+				while (this.claimed.length > 0) {
+					const group = this.claimed.shift();
+					batch.push({
+						group,
+						instances: this.constructGroupSync(group)
+					});
+				}
+				this.finishBatchSync(batch);
+			}
+		} finally {
+			this.draining = false;
+		}
+	}
+	drainAsync() {
+		if (this.draining) return this.drainPromise ?? Promise.resolve();
+		this.draining = true;
+		const run = (async () => {
+			try {
+				while (this.claimed.length > 0) {
+					const batch = [];
+					while (this.claimed.length > 0) {
+						const group = this.claimed.shift();
+						batch.push({
+							group,
+							instances: await this.constructGroupAsync(group)
+						});
+					}
+					await this.finishBatchAsync(batch);
+				}
+			} finally {
+				this.draining = false;
+				this.drainPromise = void 0;
+			}
+		})();
+		this.drainPromise = run;
+		return run;
+	}
+	/**
+	* Materialize every still-pending group whose providers compute entrypoints
+	* (`collectEntrypoints` on a class prototype). Called by the application
+	* right before the entrypoint-registry snapshot so computed contributions
+	* are never silently absent. The cost — those modules are effectively
+	* eager — is the documented price of contributing computed entrypoints.
+	*/
+	async materializeContributors() {
+		for (const group of [...this.pending.values()]) if (group.hasEntrypointContributor) this.claim(group.moduleId);
+		await this.drainAsync();
+	}
+	/** Materialize everything still pending (warmup / tests / node runtimes). */
+	async materializeAll() {
+		for (const moduleId of [...this.pending.keys()]) this.claim(moduleId);
+		await this.drainAsync();
+	}
+	groupTokensToConstruct(group) {
+		return group.tokens.filter((token) => this.container.getProviderScope(token) !== Scope.REQUEST);
+	}
+	constructGroupSync(group) {
+		const out = /* @__PURE__ */ new Set();
+		for (const token of this.groupTokensToConstruct(group)) try {
+			out.add(this.container.resolve(token, group.moduleId));
+		} catch (error) {
+			if (error instanceof Error && error.message.includes("returned a Promise")) throw this.describeSyncFailure(group.moduleId, error);
+			throw error;
+		}
+		return [...out];
+	}
+	async constructGroupAsync(group) {
+		const out = /* @__PURE__ */ new Set();
+		for (const token of this.groupTokensToConstruct(group)) out.add(await this.container.resolveAsync(token, group.moduleId));
+		return [...out];
+	}
+	/** Reversed batch = dependency-before-consumer (see drainSync comment). */
+	orderBatch(batch) {
+		return [...batch].reverse();
+	}
+	finishBatchSync(batch) {
+		const ordered = this.orderBatch(batch);
+		if (this.phase === "bootstrap") {
+			for (const { instances } of ordered) this.absorbed.push(...instances);
+			return;
+		}
+		for (const { group, instances } of ordered) for (const instance of instances) if (hasOnModuleInit(instance) && isThenable(instance.onModuleInit())) throw this.describeSyncFailure(group.moduleId);
+		for (const { group, instances } of ordered) for (const instance of instances) if (hasOnApplicationBootstrap(instance) && isThenable(instance.onApplicationBootstrap())) throw this.describeSyncFailure(group.moduleId);
+		this.onMaterialized?.(ordered.flatMap((b) => b.instances));
+	}
+	async finishBatchAsync(batch) {
+		const ordered = this.orderBatch(batch);
+		if (this.phase === "bootstrap") {
+			for (const { instances } of ordered) this.absorbed.push(...instances);
+			return;
+		}
+		for (const { instances } of ordered) for (const instance of instances) if (hasOnModuleInit(instance)) await instance.onModuleInit();
+		for (const { instances } of ordered) for (const instance of instances) if (hasOnApplicationBootstrap(instance)) await instance.onApplicationBootstrap();
+		this.onMaterialized?.(ordered.flatMap((b) => b.instances));
+	}
+	describeSyncFailure(moduleId, cause) {
+		return new Error(`[vela] lazy module '${moduleId}' has async providers or lifecycle hooks and was triggered through a synchronous resolution path. Reach it through an async seam first (app.materializeLazyModules(), an async provider) or remove lazy: true.`, cause !== void 0 ? { cause } : void 0);
+	}
+};
+//#endregion
+//#region src/openapi/scalar-ui.ts
+function renderScalarUi(jsonUrl, title) {
+	const safeUrl = jsonUrl.replace(/"/g, """);
+	return `<!doctype html>
+<html>
+  <head>
+    <title>${(title ?? "API Reference").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")}</title>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+  </head>
+  <body>
+    <script id="api-reference" data-url="${safeUrl}"><\/script>
+    <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"><\/script>
+  </body>
+</html>`;
+}
+//#endregion
+//#region src/openapi/swagger-ui.ts
+function renderSwaggerUi(specUrl, title) {
+	const safeUrl = specUrl.replace(/"/g, "&quot;");
+	return `<!doctype html>
+<html>
+  <head>
+    <title>${(title ?? "API Reference").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")}</title>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/swagger-ui-dist/swagger-ui.css" />
+  </head>
+  <body>
+    <div id="swagger-ui"></div>
+    <script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist/swagger-ui-bundle.js"><\/script>
+    <script>
+      window.ui = SwaggerUIBundle({ url: "${safeUrl}", dom_id: '#swagger-ui' });
+    <\/script>
+  </body>
+</html>`;
+}
+//#endregion
+//#region src/openapi/redoc-ui.ts
+function renderRedocUi(specUrl, title) {
+	const safeUrl = specUrl.replace(/"/g, "&quot;");
+	return `<!doctype html>
+<html>
+  <head>
+    <title>${(title ?? "API Reference").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")}</title>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+  </head>
+  <body>
+    <redoc spec-url="${safeUrl}"></redoc>
+    <script src="https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js"><\/script>
+  </body>
+</html>`;
+}
+//#endregion
+//#region src/application.ts
+var VelaApplication = class {
+	container;
+	routeManager;
+	instances = [];
+	honoApp = null;
+	entrypointRegistry = null;
+	disposed = false;
+	lazyManager;
+	knownInstances = /* @__PURE__ */ new Set();
+	constructor(container, routeManager) {
+		this.container = container;
+		this.routeManager = routeManager;
+		this.lazyManager = container.has(LazyModuleManager) ? container.resolve(LazyModuleManager) : void 0;
+		this.lazyManager?.setOnMaterialized((instances) => {
+			this.instances.push(...this.trackNew(instances));
+		});
+	}
+	trackNew(batch) {
+		const fresh = batch.filter((i) => !this.knownInstances.has(i));
+		for (const i of fresh) this.knownInstances.add(i);
+		return fresh;
+	}
+	/** Pre-build routes (handles async CRUD imports). Called by VelaFactory. */
+	async initRoutes() {
+		this.honoApp = await this.routeManager.build();
+		this.honoApp.onError((err, c) => {
+			const reporter = resolveErrorReporter(this.container);
+			if (err instanceof HTTPException) {
+				if (err.status >= 500) reporter.report(err, {
+					edge: "hono",
+					source: `${c.req.method} ${c.req.path}`
+				});
+				return err.getResponse();
+			}
+			reporter.report(err, {
+				edge: "hono",
+				source: `${c.req.method} ${c.req.path}`
+			});
+			const { body, status } = toErrorBody(err, { catalog: reporter.catalog });
+			return c.json(body, status);
+		});
+	}
+	getApp() {
+		if (!this.honoApp) throw new Error("Routes not built. This should not happen — VelaFactory.create() builds routes automatically.");
+		return this.honoApp;
+	}
+	get fetch() {
+		return this.getApp().fetch;
+	}
+	getInstances() {
+		return this.instances;
+	}
+	getContainer() {
+		return this.container;
+	}
+	setInstances(instances) {
+		this.instances = instances;
+		this.knownInstances.clear();
+		for (const i of instances) this.knownInstances.add(i);
+	}
+	get(token) {
+		return this.container.resolve(token);
+	}
+	getHonoApp() {
+		return this.getApp();
+	}
+	/**
+	* Every explicit controller route as the framework registered it (fully
+	* composed paths — the `vela route list` seam). Requires built routes;
+	* contributed routes (`@velajs/crud`) mount directly on Hono and are
+	* observable via `getHonoApp().routes` instead.
+	*/
+	describeRoutes() {
+		this.getApp();
+		return this.routeManager.getRouteDescriptions();
+	}
+	/** The global route prefix in effect ('' when none). */
+	getGlobalPrefix() {
+		return this.routeManager.getGlobalPrefix();
+	}
+	useGlobalPipes(...pipes) {
+		this.routeManager.useGlobalPipes(...pipes);
+		return this;
+	}
+	useGlobalGuards(...guards) {
+		this.routeManager.useGlobalGuards(...guards);
+		return this;
+	}
+	useGlobalInterceptors(...interceptors) {
+		this.routeManager.useGlobalInterceptors(...interceptors);
+		return this;
+	}
+	useGlobalFilters(...filters) {
+		this.routeManager.useGlobalFilters(...filters);
+		return this;
+	}
+	/**
+	* Register the application-wide {@link ExceptionHandler} imperatively — the
+	* sibling of `ErrorsModule.forRoot({ handler })`. A class is constructed
+	* through DI (`useClass`); a plain handler object is registered verbatim
+	* (`useValue`). Consumed by `resolveErrorReporter` at every transport edge,
+	* so it takes effect on the next request without a rebuild.
+	*
+	* ```ts
+	* app.useGlobalExceptionHandler({ report: (e) => sentry.capture(e) });
+	* ```
+	*/
+	useGlobalExceptionHandler(handler) {
+		this.container.register(typeof handler === "function" ? {
+			provide: APP_EXCEPTION_HANDLER,
+			useClass: handler
+		} : {
+			provide: APP_EXCEPTION_HANDLER,
+			useValue: handler
+		});
+		return this;
+	}
+	/**
+	* Serve a pre-built OpenAPI document and one or more interactive doc UIs
+	* (Swagger UI, Scalar, ReDoc) on the underlying Hono app, mirroring the
+	* hono-crud docs convention. Edge-safe: each UI is a tiny self-contained
+	* HTML shell that loads its renderer from a CDN at runtime so nothing is
+	* bundled server-side and no extra dependency is required.
+	*
+	* Defaults: spec at `/openapi.json`, Scalar at `/scalar`, Swagger UI at
+	* `/docs`, ReDoc at `/redoc`. The deprecated `path` / `uiPath` aliases are
+	* retained for migration from the previous single-UI shape.
+	*
+	* ```ts
+	* const doc = createOpenApiDocument(AppModule);
+	* app.mountOpenApi({ document: doc });            // Scalar @ /scalar
+	* app.mountOpenApi({ document: doc, ui: 'all' }); // swagger + scalar + redoc
+	* ```
+	*/
+	mountOpenApi(options) {
+		const app = this.getApp();
+		const doc = options.document;
+		const title = options.title;
+		const specPath = options.specPath ?? options.path ?? "/openapi.json";
+		app.get(specPath, (c) => c.json(doc));
+		const uiOption = options.ui;
+		let uis;
+		let singleStringUi = false;
+		if (uiOption === void 0) uis = ["scalar"];
+		else if (uiOption === "all") uis = [
+			"swagger",
+			"scalar",
+			"redoc"
+		];
+		else if (Array.isArray(uiOption)) uis = uiOption;
+		else {
+			uis = [uiOption];
+			singleStringUi = true;
+		}
+		for (const ui of uis) {
+			const legacyPath = singleStringUi && uis.length === 1 ? options.uiPath : void 0;
+			if (ui === "swagger") {
+				const path = legacyPath ?? options.swaggerPath ?? "/docs";
+				const html = renderSwaggerUi(specPath, title);
+				app.get(path, (c) => c.html(html));
+			} else if (ui === "redoc") {
+				const path = legacyPath ?? options.redocPath ?? "/redoc";
+				const html = renderRedocUi(specPath, title);
+				app.get(path, (c) => c.html(html));
+			} else {
+				const path = legacyPath ?? options.scalarPath ?? "/scalar";
+				const html = renderScalarUi(specPath, title);
+				app.get(path, (c) => c.html(html));
+			}
+		}
+		return this;
+	}
+	/**
+	* Pull instances materialized during the bootstrap phase (lazy modules
+	* dragged in by eager consumers) into the front of the instance list —
+	* dependency-before-consumer: a group absorbed because an eager provider
+	* injected it must be initialized before that consumer's hooks read it.
+	*/
+	absorbLazyInstances(prepend) {
+		const batch = this.trackNew(this.lazyManager?.takeAbsorbed() ?? []);
+		if (batch.length === 0) return batch;
+		if (prepend) this.instances = [...batch, ...this.instances];
+		else this.instances.push(...batch);
+		return batch;
+	}
+	async callOnModuleInit() {
+		this.absorbLazyInstances(true);
+		for (let i = 0; i < this.instances.length; i++) {
+			const instance = this.instances[i];
+			if (hasOnModuleInit(instance)) await instance.onModuleInit();
+			this.absorbLazyInstances(false);
+		}
+	}
+	async callOnApplicationBootstrap() {
+		for (let i = 0; i < this.instances.length; i++) {
+			const instance = this.instances[i];
+			if (hasOnApplicationBootstrap(instance)) await instance.onApplicationBootstrap();
+			for (const late of this.absorbLazyInstances(false)) if (hasOnModuleInit(late)) await late.onModuleInit();
+		}
+		if (this.lazyManager) {
+			await this.lazyManager.materializeContributors();
+			let batch;
+			while ((batch = this.absorbLazyInstances(false)).length > 0) {
+				for (const late of batch) if (hasOnModuleInit(late)) await late.onModuleInit();
+				for (const late of batch) if (hasOnApplicationBootstrap(late)) await late.onApplicationBootstrap();
+			}
+			this.lazyManager.setPhaseLive();
+		}
+		const discovery = this.container.has(DiscoveryService) ? this.container.resolve(DiscoveryService) : new DiscoveryService(this.container);
+		this.entrypointRegistry = await EntrypointRegistry.build(discovery, this.instances, { deferLazy: true });
+		this.container.register({
+			provide: EntrypointRegistry,
+			useValue: this.entrypointRegistry
+		});
+		this.container.markGlobalToken(EntrypointRegistry);
+	}
+	/**
+	* Materialize every still-pending lazy module (async-safe): construct the
+	* groups, replay their lifecycle hooks, and add their instances to the
+	* shutdown flow. Warmup escape hatch for tests and node runtimes that want
+	* eager-everything semantics back after bootstrap.
+	*/
+	async materializeLazyModules() {
+		await this.lazyManager?.materializeAll();
+	}
+	/**
+	* Every entrypoint contributed by the module graph, grouped by kind —
+	* what runtime adapters/transports query instead of re-scanning providers:
+	* `app.entrypoints.ofKind('websocket')`.
+	*/
+	get entrypoints() {
+		if (!this.entrypointRegistry) throw new Error("Entrypoints are not built yet — they are assembled at the end of callOnApplicationBootstrap(). Finish bootstrapping before querying them.");
+		return this.entrypointRegistry;
+	}
+	async close(signal) {
+		const reversed = [...this.instances].reverse();
+		for (const instance of reversed) if (hasBeforeApplicationShutdown(instance)) await instance.beforeApplicationShutdown(signal);
+		for (const instance of reversed) if (hasOnModuleDestroy(instance)) await instance.onModuleDestroy();
+		for (const instance of reversed) if (hasOnApplicationShutdown(instance)) await instance.onApplicationShutdown(signal);
+	}
+	/**
+	* Full teardown: run shutdown lifecycle hooks ({@link close}) then dispose
+	* container-held instances (LIFO) and clear cached singletons. Use for
+	* graceful shutdown and dev HMR so old and new DI graphs never coexist.
+	*
+	* On runtimes/TS supporting explicit resource management this is also exposed
+	* as `Symbol.asyncDispose`, enabling `await using app = await VelaFactory.create(...)`.
+	*/
+	async dispose(signal) {
+		if (this.disposed) return;
+		this.disposed = true;
+		await this.close(signal);
+		await this.container.dispose();
+	}
+};
+const ASYNC_DISPOSE = Symbol.asyncDispose;
+if (ASYNC_DISPOSE) VelaApplication.prototype[ASYNC_DISPOSE] = function() {
+	return this.dispose();
+};
+//#endregion
+//#region src/container/module-ref.ts
+let ModuleRef = class ModuleRef {
+	container;
+	constructor(container) {
+		this.container = container;
+	}
+	/**
+	* Retrieve a provider instance from the DI container.
+	* Returns the existing singleton (or cached value) for the token.
+	*/
+	get(token) {
+		return this.container.resolve(token);
+	}
+	/**
+	* Resolve a provider, creating a new instance for TRANSIENT-scoped providers.
+	* For SINGLETON-scoped providers this is equivalent to get().
+	*/
+	resolve(token) {
+		return this.container.resolve(token);
+	}
+	/**
+	* Instantiate a class outside of the DI container's singleton cache.
+	* Dependencies are resolved from the container. Each call returns a new instance.
+	*/
+	create(type) {
+		const sandbox = this.container.createDetached();
+		sandbox.register({
+			provide: type,
+			useClass: type,
+			scope: Scope.TRANSIENT
+		});
+		return sandbox.resolve(type);
+	}
+};
+ModuleRef = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [Object])], ModuleRef);
+//#endregion
+//#region src/config/config.tokens.ts
+const CONFIG_OPTIONS = new InjectionToken("CONFIG_OPTIONS");
+/**
+* Ambient environment record consumed by config-namespace factories
+* (`registerAs`). It is the multi-runtime substitute for stratal's
+* Cloudflare-specific `env` token: core never touches `process.env`.
+*
+* The token self-provides `{}` by default (so factories resolve even with no
+* platform binding), and stays OVERRIDABLE — a platform adapter
+* (`@velajs/cloudflare`) or a future `./config-node` subpath provides a global
+* `CONFIG_ENV` and that registration wins over the default.
+*/
+const CONFIG_ENV = new InjectionToken("CONFIG_ENV", { factory: () => ({}) });
+//#endregion
+//#region src/http/url/signing-secret.ts
+/**
+* Optional DI token holding the HMAC secret used to sign / verify URLs. Provide
+* it globally (e.g. from a platform adapter or a `@Global` module) so both
+* {@link UrlGeneratorService} and the signed-URL guard can read it:
+*
+* ```ts
+* { provide: URL_SIGNING_SECRET, useValue: env.URL_SIGNING_SECRET }
+* ```
+*/
+const URL_SIGNING_SECRET = new InjectionToken("URL_SIGNING_SECRET");
+/** Key read from `CONFIG_ENV` when no explicit secret / token is available. */
+const URL_SIGNING_SECRET_ENV_KEY = "URL_SIGNING_SECRET";
+/**
+* Resolve the signing secret from, in order: an explicit argument, the
+* {@link URL_SIGNING_SECRET} token, then `CONFIG_ENV[URL_SIGNING_SECRET]`.
+* Throws a descriptive error when none is available — signing must never fall
+* back to an empty/implicit key.
+*/
+function resolveSigningSecret(explicit, token, env) {
+	const fromEnv = env?.[URL_SIGNING_SECRET_ENV_KEY];
+	const secret = explicit ?? token ?? (typeof fromEnv === "string" ? fromEnv : void 0);
+	if (!secret) throw new Error("No URL signing secret is available. Pass one explicitly, register a `URL_SIGNING_SECRET` provider, or set `URL_SIGNING_SECRET` in `CONFIG_ENV`.");
+	return secret;
+}
+//#endregion
+//#region src/http/url/url-generator.service.ts
+let UrlGeneratorService = class UrlGeneratorService {
+	routeManager;
+	secretToken;
+	env;
+	routeMap = null;
+	constructor(routeManager, secretToken, env = {}) {
+		this.routeManager = routeManager;
+		this.secretToken = secretToken;
+		this.env = env;
+	}
+	/**
+	* Build the path for a named route, filling `:param` placeholders from
+	* `params`. Params that don't match a placeholder become query-string
+	* entries; `opts.query` is merged after them.
+	*
+	* @throws if no route carries `name`, or a required `:param` is missing.
+	*/
+	urlFor(name, params, opts) {
+		const description = this.routes().get(name);
+		if (!description) throw new Error(`No route named "${String(name)}" was found. Give the route a name via \`@Get(path, { name: '${String(name)}' })\`.`);
+		const provided = { ...params ?? {} };
+		const consumed = /* @__PURE__ */ new Set();
+		const path = description.path.replace(/:([A-Za-z0-9_]+)/g, (_match, key) => {
+			const value = provided[key];
+			if (value === void 0 || value === null) throw new Error(`Missing route param "${key}" for route "${String(name)}".`);
+			consumed.add(key);
+			return encodeURIComponent(String(value));
+		});
+		const query = new URLSearchParams();
+		for (const [key, value] of Object.entries(provided)) {
+			if (consumed.has(key) || value === void 0 || value === null) continue;
+			query.set(key, String(value));
+		}
+		for (const [key, value] of Object.entries(opts?.query ?? {})) {
+			if (value === void 0 || value === null) continue;
+			query.set(key, String(value));
+		}
+		const qs = query.toString();
+		return qs ? `${path}?${qs}` : path;
+	}
+	/**
+	* Build a named-route URL and HMAC-sign it (path + query). The secret comes
+	* from `options.secret`, else the {@link URL_SIGNING_SECRET} token, else
+	* `CONFIG_ENV`; a descriptive error is thrown when none is available.
+	*/
+	async signedUrl(name, params, options = {}) {
+		return signUrl(this.urlFor(name, params), resolveSigningSecret(options.secret, this.secretToken, this.env), options.expiresIn !== void 0 ? { expiresIn: options.expiresIn } : void 0);
+	}
+	/**
+	* Lazily index named route descriptions. Rebuilt while empty (routes may not
+	* be built yet), cached once populated.
+	*/
+	routes() {
+		if (this.routeMap && this.routeMap.size > 0) return this.routeMap;
+		const map = /* @__PURE__ */ new Map();
+		for (const description of this.routeManager.getRouteDescriptions()) if (description.name && !map.has(description.name)) map.set(description.name, description);
+		this.routeMap = map;
+		return map;
+	}
+};
+UrlGeneratorService = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(RouteManager)),
+	__decorateParam(1, Optional()),
+	__decorateParam(1, Inject(URL_SIGNING_SECRET)),
+	__decorateParam(2, Optional()),
+	__decorateParam(2, Inject(CONFIG_ENV)),
+	__decorateMetadata("design:paramtypes", [
+		typeof RouteManager === "undefined" ? Object : RouteManager,
+		String,
+		typeof Record === "undefined" ? Object : Record
+	])
+], UrlGeneratorService);
+//#endregion
+//#region src/http/url/signed-url.guard.ts
+let SignedUrlGuard = class SignedUrlGuard {
+	secretToken;
+	env;
+	constructor(secretToken, env = {}) {
+		this.secretToken = secretToken;
+		this.env = env;
+	}
+	async canActivate(context) {
+		const request = context.switchToHttp().getRequest();
+		const secret = resolveSigningSecret(void 0, this.secretToken, this.env);
+		if (!await verifySignedUrl(request.url, secret)) throw new ForbiddenException("Invalid or expired signed URL");
+		return true;
+	}
+};
+SignedUrlGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Optional()),
+	__decorateParam(0, Inject(URL_SIGNING_SECRET)),
+	__decorateParam(1, Optional()),
+	__decorateParam(1, Inject(CONFIG_ENV)),
+	__decorateMetadata("design:paramtypes", [String, typeof Record === "undefined" ? Object : Record])
+], SignedUrlGuard);
+/**
+* Guards a route with {@link SignedUrlGuard} — the request must carry a valid,
+* unexpired HMAC signature (produced by `UrlGeneratorService.signedUrl`).
+*
+* ```ts
+* @Get('download', { name: 'file.download' })
+* @SignedUrl()
+* download() { ... }
+* ```
+*/
+function SignedUrl() {
+	return applyDecorators(UseGuards(SignedUrlGuard));
+}
+//#endregion
+//#region src/module/middleware.ts
+var MiddlewareBuilder = class {
+	definitions = [];
+	apply(...middleware) {
+		const currentMiddleware = [...middleware];
+		let currentExcludes = [];
+		let currentPriority;
+		const proxy = {
+			exclude: (...routes) => {
+				currentExcludes = routes.map(normalizeRouteArg);
+				return proxy;
+			},
+			withPriority: (priority) => {
+				currentPriority = priority;
+				return proxy;
+			},
+			forRoutes: (...routes) => {
+				this.definitions.push({
+					middleware: currentMiddleware,
+					routes: routes.flatMap(resolveRouteArg),
+					excludes: [...currentExcludes],
+					...currentPriority !== void 0 ? { priority: currentPriority } : {}
+				});
+				currentExcludes = [];
+				currentPriority = void 0;
+				return this;
+			}
+		};
+		return proxy;
+	}
+	getDefinitions() {
+		return [...this.definitions];
+	}
+};
+function normalizeRouteArg(route) {
+	return typeof route === "string" ? { path: route } : route;
+}
+function resolveRouteArg(route) {
+	if (typeof route === "string") return [{ path: route }];
+	if (typeof route === "function") return [{ path: MetadataRegistry.getControllerPath(route) || "/" }];
+	return [route];
+}
+//#endregion
+//#region src/module/module-loader.ts
+const APP_TOKENS = /* @__PURE__ */ new Set([
+	APP_GUARD,
+	APP_PIPE,
+	APP_INTERCEPTOR,
+	APP_FILTER,
+	APP_MIDDLEWARE
+]);
+const DEFAULT_KEY = "default";
+/**
+* Structural check for `ContributesEntrypoints` on a provider's class —
+* deliberately string-coupled to the interface's method name so the loader
+* does not import from `entrypoint/` (layering).
+*/
+function declaresEntrypointContributor(provider) {
+	const cls = typeof provider === "function" ? provider : provider.useClass;
+	if (typeof cls !== "function") return false;
+	return typeof cls.prototype?.collectEntrypoints === "function";
+}
+function isDynamicModule(value) {
+	return typeof value === "object" && value !== null && "module" in value && typeof value.module === "function";
+}
+function implementsNestModule(cls) {
+	return typeof cls.prototype?.configure === "function";
+}
+function tokenOfProvider(provider) {
+	return typeof provider === "function" ? provider : provider.provide;
+}
+function keyOfImport(entry) {
+	return isDynamicModule(entry) ? entry.key ?? DEFAULT_KEY : DEFAULT_KEY;
+}
+/**
+* `ForwardRef.factory` is typed to return the broader `Token<T>` because the
+* primitive is shared with provider injection. In module-imports position the
+* runtime contract narrows: the factory must yield a module class or a
+* `DynamicModule`. This helper validates the contract AND narrows the type
+* without a structural cast.
+*/
+function unwrapModuleForwardRef(ref) {
+	const result = ref.factory();
+	if (typeof result === "function") return result;
+	if (isDynamicModule(result)) return result;
+	throw new Error(`forwardRef in module imports must resolve to a module class or DynamicModule; got ${typeof result === "object" ? "a non-module object" : typeof result}.`);
+}
+var ModuleLoader = class {
+	container;
+	router;
+	processedModules = /* @__PURE__ */ new Map();
+	processingStack = /* @__PURE__ */ new Set();
+	collectedControllers = /* @__PURE__ */ new Set();
+	registeredProviders = [];
+	moduleExportsCache = /* @__PURE__ */ new Map();
+	globalExports = /* @__PURE__ */ new Set();
+	consumerMiddlewareDefinitions = [];
+	appProviderCounter = 0;
+	appProviderTokens = /* @__PURE__ */ new Map([
+		[APP_GUARD, []],
+		[APP_PIPE, []],
+		[APP_INTERCEPTOR, []],
+		[APP_FILTER, []],
+		[APP_MIDDLEWARE, []]
+	]);
+	moduleIdByClassKey = /* @__PURE__ */ new Map();
+	seenModuleIds = /* @__PURE__ */ new Set();
+	lazyModuleIds = /* @__PURE__ */ new Set();
+	lazyGroups = /* @__PURE__ */ new Map();
+	constructor(container, router) {
+		this.container = container;
+		this.router = router;
+	}
+	load(rootModule) {
+		this.processModule(rootModule);
+		for (const controller of this.collectedControllers) this.router.registerController(controller);
+		const lazyManager = new LazyModuleManager(this.container);
+		for (const group of this.getLazyGroups()) lazyManager.registerGroup(group);
+		this.container.setLazyHook(lazyManager);
+		this.container.register({
+			provide: LazyModuleManager,
+			useValue: lazyManager
+		});
+	}
+	getModuleId(moduleClass, key) {
+		let perClass = this.moduleIdByClassKey.get(moduleClass);
+		if (perClass) {
+			const cached = perClass.get(key);
+			if (cached) return cached;
+		} else {
+			perClass = /* @__PURE__ */ new Map();
+			this.moduleIdByClassKey.set(moduleClass, perClass);
+		}
+		const baseName = moduleClass.name || "AnonModule";
+		let id = `${baseName}#${key}`;
+		let counter = 0;
+		while (this.seenModuleIds.has(id)) id = `${baseName}#${key}~${++counter}`;
+		this.seenModuleIds.add(id);
+		perClass.set(key, id);
+		return id;
+	}
+	isProcessed(moduleClass, key) {
+		return this.processedModules.get(moduleClass)?.has(key) ?? false;
+	}
+	markProcessed(moduleClass, key) {
+		let keys = this.processedModules.get(moduleClass);
+		if (!keys) {
+			keys = /* @__PURE__ */ new Set();
+			this.processedModules.set(moduleClass, keys);
+		}
+		keys.add(key);
+	}
+	getCachedExports(moduleClass, key) {
+		return this.moduleExportsCache.get(moduleClass)?.get(key);
+	}
+	cacheExports(moduleClass, key, exports) {
+		let perClass = this.moduleExportsCache.get(moduleClass);
+		if (!perClass) {
+			perClass = /* @__PURE__ */ new Map();
+			this.moduleExportsCache.set(moduleClass, perClass);
+		}
+		perClass.set(key, exports);
+	}
+	processModule(moduleClassOrDynamic) {
+		let moduleClass;
+		let extraImports = [];
+		let extraControllers = [];
+		let extraProviders = [];
+		let extraExports = [];
+		let key = DEFAULT_KEY;
+		if (isDynamicModule(moduleClassOrDynamic)) {
+			moduleClass = moduleClassOrDynamic.module;
+			extraImports = moduleClassOrDynamic.imports ?? [];
+			extraControllers = moduleClassOrDynamic.controllers ?? [];
+			extraProviders = moduleClassOrDynamic.providers ?? [];
+			extraExports = moduleClassOrDynamic.exports ?? [];
+			key = moduleClassOrDynamic.key ?? DEFAULT_KEY;
+		} else moduleClass = moduleClassOrDynamic;
+		if (this.isProcessed(moduleClass, key)) {
+			for (const controller of extraControllers) this.collectedControllers.add(controller);
+			return this.getCachedExports(moduleClass, key) ?? /* @__PURE__ */ new Set();
+		}
+		const stackKey = `${moduleClass.name}#${key}`;
+		if (this.processingStack.has(stackKey)) {
+			const chain = [...this.processingStack, stackKey].join(" -> ");
+			throw new Error(`Circular module dependency detected: ${chain}`);
+		}
+		if (!isModule(moduleClass)) if (isDynamicModule(moduleClassOrDynamic)) MetadataRegistry.setModuleOptions(moduleClass, {});
+		else throw new Error(`${moduleClass.name} is not a module. Add @Module() decorator to the class.`);
+		const metadata = getModuleMetadata(moduleClass);
+		if (!metadata) throw new Error(`Failed to get module metadata for ${moduleClass.name}`);
+		this.processingStack.add(stackKey);
+		const moduleId = this.getModuleId(moduleClass, key);
+		try {
+			const importedProviders = new Set(this.globalExports);
+			const importedModuleIds = /* @__PURE__ */ new Set();
+			const keysByClassInImports = /* @__PURE__ */ new Map();
+			const allImports = [...metadata.imports, ...extraImports];
+			for (const entry of allImports) {
+				const importedModule = entry instanceof ForwardRef ? unwrapModuleForwardRef(entry) : entry;
+				const importedModuleClass = isDynamicModule(importedModule) ? importedModule.module : importedModule;
+				const importedKey = keyOfImport(importedModule);
+				let keys = keysByClassInImports.get(importedModuleClass);
+				if (!keys) {
+					keys = /* @__PURE__ */ new Set();
+					keysByClassInImports.set(importedModuleClass, keys);
+				}
+				keys.add(importedKey);
+				const importedId = this.getModuleId(importedModuleClass, importedKey);
+				importedModuleIds.add(importedId);
+				const importedStackKey = `${importedModuleClass.name}#${importedKey}`;
+				if (entry instanceof ForwardRef && this.processingStack.has(importedStackKey)) continue;
+				const exportedTokens = this.processModule(importedModule);
+				for (const token of exportedTokens) importedProviders.add(token);
+			}
+			this.warnOnMixedDefaultAndKeyed(moduleClass.name, keysByClassInImports);
+			const allProviders = [...metadata.providers, ...extraProviders];
+			const allControllers = [...metadata.controllers, ...extraControllers];
+			const allExports = [...metadata.exports, ...extraExports];
+			const localProviders = /* @__PURE__ */ new Set();
+			for (const provider of allProviders) {
+				const tk = tokenOfProvider(provider);
+				if (tk !== void 0) localProviders.add(tk);
+			}
+			for (const controller of allControllers) localProviders.add(controller);
+			localProviders.add(moduleClass);
+			const isGlobal = metadata.isGlobal || isDynamicModule(moduleClassOrDynamic) && moduleClassOrDynamic.global === true;
+			const isLazy = metadata.lazy || isDynamicModule(moduleClassOrDynamic) && moduleClassOrDynamic.lazy === true;
+			this.container.registerScope({
+				moduleId,
+				localProviders,
+				importedModules: importedModuleIds,
+				exportedTokens: new Set(allExports),
+				isGlobal,
+				lazy: isLazy
+			});
+			const lazyTokens = [];
+			let hasEntrypointContributor = false;
+			for (const provider of allProviders) {
+				const registered = this.registerProvider(provider, moduleId);
+				if (isLazy && registered !== void 0) {
+					lazyTokens.push(registered);
+					hasEntrypointContributor ||= declaresEntrypointContributor(provider);
+				}
+			}
+			for (const controller of allControllers) {
+				this.container.register(controller, moduleId);
+				this.collectedControllers.add(controller);
+				if (isLazy) lazyTokens.push(controller);
+			}
+			if (isLazy) {
+				this.lazyModuleIds.add(moduleId);
+				this.lazyGroups.set(moduleId, {
+					moduleId,
+					tokens: lazyTokens,
+					hasEntrypointContributor
+				});
+			}
+			for (const controller of allControllers) MetadataRegistry.propagateControllerComponents(moduleClass, controller);
+			this.markProcessed(moduleClass, key);
+			const exports = this.buildExportSet(allExports, allProviders, importedProviders);
+			this.cacheExports(moduleClass, key, exports);
+			if (isGlobal) for (const token of exports) this.globalExports.add(token);
+			if (implementsNestModule(moduleClass)) {
+				if (!this.container.hasInScope(moduleClass, moduleId)) this.container.register(moduleClass, moduleId);
+				const instance = this.container.resolve(moduleClass, moduleId);
+				const builder = new MiddlewareBuilder();
+				instance.configure(builder);
+				this.consumerMiddlewareDefinitions.push(...builder.getDefinitions());
+			}
+			return exports;
+		} finally {
+			this.processingStack.delete(stackKey);
+		}
+	}
+	warnOnMixedDefaultAndKeyed(parentName, keysByClass) {
+		const mode = this.container.getDiagnostics();
+		if (mode === "silent") return;
+		for (const [cls, keys] of keysByClass) {
+			if (keys.size < 2) continue;
+			if (!keys.has(DEFAULT_KEY)) continue;
+			const message = `[vela] ${cls.name} imported in both bare and keyed form in '${parentName}'. These resolve to distinct module instances; consumers asking for an exported token will hit MultipleProvidersFoundError. Use one form consistently.`;
+			if (mode === "throw") throw new Error(message);
+			console.warn(message);
+		}
+	}
+	/** Registers the provider and returns the token it was registered under. */
+	registerProvider(provider, moduleId) {
+		if (typeof provider === "function") {
+			this.container.register(provider, moduleId);
+			this.registeredProviders.push(provider);
+			return provider;
+		}
+		const token = provider.provide;
+		if (!token) {
+			this.container.register(provider, moduleId);
+			return;
+		}
+		if (this.isAppToken(token)) {
+			const syntheticToken = new InjectionToken(`${token.toString()}:${this.appProviderCounter++}`);
+			this.container.register({
+				...provider,
+				provide: syntheticToken
+			}, moduleId);
+			this.registeredProviders.push(syntheticToken);
+			getOrCreateArray(this.appProviderTokens, token).push(syntheticToken);
+			return syntheticToken;
+		}
+		this.container.register(provider, moduleId);
+		this.registeredProviders.push(token);
+		return token;
+	}
+	isAppToken(token) {
+		return APP_TOKENS.has(token);
+	}
+	buildExportSet(exports, providers, importedProviders) {
+		const exportSet = /* @__PURE__ */ new Set();
+		const providerTokens = /* @__PURE__ */ new Set();
+		for (const p of providers) {
+			const token = tokenOfProvider(p);
+			if (token !== void 0) providerTokens.add(token);
+		}
+		for (const exported of exports) {
+			const isLocalProvider = providerTokens.has(exported);
+			const isImportedProvider = importedProviders.has(exported);
+			if (!isLocalProvider && !isImportedProvider) {
+				const name = typeof exported === "function" ? exported.name : String(exported);
+				console.warn(`Warning: Exporting '${name}' which is neither a local provider nor imported from another module.`);
+			}
+			exportSet.add(exported);
+		}
+		return exportSet;
+	}
+	getControllers() {
+		return [...this.collectedControllers];
+	}
+	getRegisteredProviders() {
+		return [...this.registeredProviders];
+	}
+	getAppProviderTokens(token) {
+		return [...this.appProviderTokens.get(token) ?? []];
+	}
+	getConsumerMiddlewareDefinitions() {
+		return [...this.consumerMiddlewareDefinitions];
+	}
+	/**
+	* Every lazy module instance recorded during load. Handed to the
+	* LazyModuleManager at bootstrap; empty when no module opted in.
+	*/
+	getLazyGroups() {
+		return [...this.lazyGroups.values()];
+	}
+	/**
+	* A token is deferred iff EVERY module bucket holding it belongs to a lazy
+	* module instance — a token also registered by a non-lazy module stays on
+	* the eager pass (and resolving it there claims the lazy sibling, which is
+	* the "any use = init" semantic, not a bug).
+	*/
+	isLazyOnlyToken(token) {
+		if (this.lazyModuleIds.size === 0) return false;
+		const owners = this.container.getOwnerModuleIds(token);
+		if (owners.length === 0) return false;
+		return owners.every((id) => this.lazyModuleIds.has(id));
+	}
+	async resolveAllInstances() {
+		const instanceSet = /* @__PURE__ */ new Set();
+		for (const token of this.registeredProviders) try {
+			if (this.container.getProviderScope(token) === Scope.REQUEST) continue;
+			if (this.isLazyOnlyToken(token)) continue;
+			const instance = await this.container.resolveAsync(token);
+			instanceSet.add(instance);
+		} catch (err) {
+			if (err instanceof ModuleVisibilityError || err instanceof MultipleProvidersFoundError) throw err;
+			this.routeError(err, `resolve provider`);
+		}
+		for (const controller of this.collectedControllers) try {
+			if (this.container.getProviderScope(controller) === Scope.REQUEST) continue;
+			if (this.isLazyOnlyToken(controller)) continue;
+			const instance = await this.container.resolveAsync(controller);
+			instanceSet.add(instance);
+		} catch (err) {
+			if (err instanceof ModuleVisibilityError || err instanceof MultipleProvidersFoundError) throw err;
+			this.routeError(err, `resolve controller ${controller.name}`);
+		}
+		return [...instanceSet];
+	}
+	routeError(err, context) {
+		const mode = this.container.getDiagnostics();
+		if (mode === "silent") return;
+		if (mode === "throw") throw err instanceof Error ? err : new Error(String(err));
+		console.warn(`[vela] ${context} failed:`, err);
+	}
+};
+//#endregion
+//#region src/pipeline/app-providers.ts
+const SLOTS = [
+	{
+		token: APP_GUARD,
+		bind: (rm) => rm.useGlobalGuardTokens.bind(rm)
+	},
+	{
+		token: APP_PIPE,
+		bind: (rm) => rm.useGlobalPipeTokens.bind(rm)
+	},
+	{
+		token: APP_INTERCEPTOR,
+		bind: (rm) => rm.useGlobalInterceptorTokens.bind(rm)
+	},
+	{
+		token: APP_FILTER,
+		bind: (rm) => rm.useGlobalFilterTokens.bind(rm)
+	},
+	{
+		token: APP_MIDDLEWARE,
+		bind: (rm) => rm.useGlobalMiddlewareTokens.bind(rm)
+	}
+];
+/**
+* Bind every APP_* provider registered in the container as a global
+* component on the RouteManager. The single source of truth for app-level
+* pipeline configuration — used by both VelaFactory.create and
+* @velajs/testing's TestingModuleBuilder.compile.
+*/
+function bindAppProviders(routeManager, container, loader) {
+	for (const { token, bind } of SLOTS) {
+		const collected = loader.getAppProviderTokens(token);
+		if (collected.length > 0) bind(routeManager)(...collected);
+		else if (container.has(token)) bind(routeManager)(token);
+	}
+}
+//#endregion
+//#region src/factory/bootstrap.ts
+/**
+* Wire the DI graph for `rootModule` and prepare the route manager — without
+* running lifecycle hooks or building the Hono app. The single primitive
+* shared by `VelaFactory.create` (HTTP), `@velajs/testing` (test), and any
+* non-HTTP consumer (CLI tools, custom runtimes).
+*
+* Framework-internal tokens (`Container`, `ModuleRef`, `APP_*`) are marked
+* global so they are resolvable from any module.
+*/
+async function bootstrap(rootModule, options = {}) {
+	const container = new Container({ diagnostics: options.diagnostics });
+	container.register({
+		provide: Container,
+		useValue: container
+	});
+	container.markGlobalToken(Container);
+	container.register({
+		provide: ModuleRef,
+		useFactory: (c) => new ModuleRef(c),
+		inject: [Container]
+	});
+	container.markGlobalToken(ModuleRef);
+	container.register({
+		provide: DiscoveryService,
+		useFactory: (c) => new DiscoveryService(c),
+		inject: [Container]
+	});
+	container.markGlobalToken(DiscoveryService);
+	for (const t of [
+		APP_GUARD,
+		APP_PIPE,
+		APP_INTERCEPTOR,
+		APP_FILTER,
+		APP_MIDDLEWARE,
+		APP_EXCEPTION_HANDLER,
+		ERROR_CATALOG
+	]) container.markGlobalToken(t);
+	container.register({
+		provide: REQUEST_CONTEXT,
+		scope: Scope.REQUEST,
+		useFactory: () => {
+			throw new Error("REQUEST_CONTEXT can only be resolved inside a request — it is seeded by RouteManager when the request enters the pipeline.");
+		}
+	});
+	container.markGlobalToken(REQUEST_CONTEXT);
+	const routeManager = new RouteManager(container, options);
+	container.register({
+		provide: RouteManager,
+		useValue: routeManager
+	});
+	container.markGlobalToken(RouteManager);
+	container.register(UrlGeneratorService);
+	container.markGlobalToken(UrlGeneratorService);
+	container.register(SignedUrlGuard);
+	container.markGlobalToken(SignedUrlGuard);
+	const loader = new ModuleLoader(container, routeManager);
+	loader.load(rootModule);
+	bindAppProviders(routeManager, container, loader);
+	routeManager.registerConsumerMiddleware(loader.getConsumerMiddlewareDefinitions());
+	if (options.globalPrefix) routeManager.setGlobalPrefix(options.globalPrefix);
+	for (const handler of options.middleware ?? []) {
+		const mw = { use: handler };
+		routeManager.useGlobalMiddleware(mw);
+	}
+	container.computeEffectiveScopes();
+	return {
+		container,
+		routeManager,
+		loader
+	};
+}
+//#endregion
+//#region src/plugin/plugin.ts
+/**
+* Freeze and validate a plugin manifest. Returns the same object so it can
+* be used in `composePlugins([definePlugin(...), ...])`.
+*/
+function definePlugin(plugin) {
+	if (!plugin.id) throw new Error("Plugin requires an id");
+	if (!plugin.version) throw new Error("Plugin requires a version");
+	if (!plugin.module) throw new Error("Plugin requires a module");
+	return Object.freeze({ ...plugin });
+}
+var PluginRegistry = class {
+	byId;
+	constructor(plugins) {
+		this.byId = /* @__PURE__ */ new Map();
+		for (const p of plugins) {
+			if (this.byId.has(p.id)) throw new Error(`Duplicate plugin id: '${p.id}'`);
+			this.byId.set(p.id, p);
+		}
+	}
+	list() {
+		return [...this.byId.values()];
+	}
+	get(id) {
+		return this.byId.get(id);
+	}
+	dependents(id) {
+		return this.list().filter((p) => p.dependsOn?.includes(id) ?? false);
+	}
+};
+const PLUGIN_REGISTRY_TOKEN = new InjectionToken("PLUGIN_REGISTRY");
+let PluginRootModule = class PluginRootModule {};
+PluginRootModule = __decorate([Module({})], PluginRootModule);
+/**
+* Topologically sort plugins so each plugin's dependencies appear first.
+* Throws on missing dependencies and cycles.
+*/
+function topologicalSort(plugins) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const p of plugins) {
+		if (byId.has(p.id)) throw new Error(`Duplicate plugin id: '${p.id}'`);
+		byId.set(p.id, p);
+	}
+	const result = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	const visit = (p, path) => {
+		if (visited.has(p.id)) return;
+		if (visiting.has(p.id)) {
+			const cycle = [...path, p.id].join(" -> ");
+			throw new Error(`Plugin cycle detected: ${cycle}`);
+		}
+		visiting.add(p.id);
+		for (const depId of p.dependsOn ?? []) {
+			const dep = byId.get(depId);
+			if (!dep) throw new Error(`Plugin '${p.id}' depends on missing plugin '${depId}'`);
+			visit(dep, [...path, p.id]);
+		}
+		visiting.delete(p.id);
+		visited.add(p.id);
+		result.push(p);
+	};
+	for (const p of plugins) visit(p, []);
+	return result;
+}
+/**
+* Compose a list of plugins into a single dynamic module that imports each
+* plugin's module in dependency order, registers a `PluginRegistry`, and
+* exposes it globally so any plugin can introspect peers.
+*/
+function composePlugins(plugins) {
+	const sorted = topologicalSort(plugins);
+	const registry = new PluginRegistry(sorted);
+	return {
+		module: PluginRootModule,
+		imports: sorted.map((p) => p.module),
+		providers: [{
+			provide: PLUGIN_REGISTRY_TOKEN,
+			useValue: registry
+		}],
+		exports: [PLUGIN_REGISTRY_TOKEN],
+		global: true
+	};
+}
+//#endregion
+export { EntrypointRegistry as _, definePlugin as a, contributesEntrypoints as b, ModuleLoader as c, UrlGeneratorService as d, URL_SIGNING_SECRET as f, VelaApplication as g, ModuleRef as h, composePlugins as i, SignedUrl as l, CONFIG_OPTIONS as m, PluginRegistry as n, bootstrap as o, CONFIG_ENV as p, PluginRootModule as r, bindAppProviders as s, PLUGIN_REGISTRY_TOKEN as t, SignedUrlGuard as u, getEntrypointKinds as v, registerEntrypointKind as y };
+
+//# sourceMappingURL=plugin-ByBlVOve.js.map