English 한국어
\n\nThe assembly layer that compiles a module graph and wires DI and HTTP into a runnable application shell.\n\nPreparing for the coordinated Node 24 release? Follow the [consumer migration guide](../../docs/getting-started/migrate-node24.md) before upgrading packages.\n\n## Table of Contents\n\n- [Installation](#installation)\n- [When to Use](#when-to-use)\n- [Quick Start](#quick-start)\n- [Common Patterns](#common-patterns)\n- [Node Static Asset Source](#node-static-asset-source)\n- [Behavioral Contracts](#behavioral-contracts)\n- [Public API Overview](#public-api-overview)\n- [Related Packages](#related-packages)\n- [Example Sources](#example-sources)\n\n## Installation\n\n```bash\nnpm install @fluojs/runtime\n```\n\nThe published package intentionally declares no package-wide `engines.node`: its root, `./web`, and runtime-neutral internal seams contain no eager Node builtin imports and are shared by Node, Bun, Deno, Cloudflare Workers, and other Web-standard hosts. Node listener, filesystem, logger, compression, and process-signal responsibilities live in `@fluojs/platform-nodejs`, which declares the verified Node engine range.\n\n## Node Static Asset Source\n\n`@fluojs/http` owns portable static middleware and representation-selection contracts. `@fluojs/platform-nodejs` exports `createNodeFileSystemAssetSource(...)`, its Node filesystem `StaticAssetSource` implementation: it validates the root directory during configuration, keeps lexical and realpath resolution inside that root (including symlink checks), and can select `.br` or `.gz` siblings. For each selected regular-file representation, it opens the verified file, eagerly copies the entire file into an immutable byte snapshot, and closes its `FileHandle` before response writing. Its returned `source()` replays only that snapshot and never reopens or lazily streams the pathname; application owners therefore bound memory by the selected whole-file size, and `size` plus the strong `ETag` describe those exact bytes. Raw Node, Express, and Fastify adapters share this portable middleware/source seam and preserve the selected representation boundary rather than applying adapter-specific re-encoding. This Node-only helper is intentionally absent from `@fluojs/runtime/web`; Web and edge deployments must provide an application-owned source.\n\n## When to Use\n\nUse this package when you need to:\n- **Bootstrap a fluo application**: Convert your modules into a running HTTP server or microservice.\n- **Orchestrate DI and Lifecycle**: Manage module-graph compilation, provider wiring, and application hooks (`onModuleInit`, `onApplicationBootstrap`).\n- **Create Standalone Contexts**: Run CLI tasks, scripts, or workers that need DI but not an HTTP server.\n- **Diagnostic Inspection**: Produce machine-readable platform snapshots, compiled route catalogs, and diagnostic issues for CLI export while leaving graph viewing and Mermaid presentation to Studio.\n\n## Quick Start\n\n### Minimal HTTP Application\n\nThe `FluoFactory` is the primary entrypoint for creating applications.\n\n```typescript\nimport { Module } from '@fluojs/core';\nimport { Controller, Get } from '@fluojs/http';\nimport { FluoFactory } from '@fluojs/runtime';\nimport { NodeHttpApplicationAdapter } from '@fluojs/platform-nodejs';\n\n@Controller('/')\nclass AppController {\n @Get()\n index() {\n return { hello: 'world' };\n }\n}\n\n@Module({\n controllers: [AppController],\n})\nclass AppModule { }\n\n// Create and start the application\nconst app = await FluoFactory.create(AppModule, {\n adapter: NodeHttpApplicationAdapter.create({ port: 3000 }),\n});\n\nawait app.listen();\n```\n\nThe `@Get()` above uses the empty relative path, so the controller serves GET `/`.\nWith `@Controller('cats')` it would serve `/cats`, not bypass the prefix. An empty\n`@Module()` can also bootstrap and close without inventing providers.\n\n## Common Patterns\n\n### Canonical HTTP Factory\n\nUse `FluoFactory.create(AppModule, { adapter })` → `app.listen()` → `app.close()` as the only HTTP creation path. `logger` registers the exact supplied object as `APPLICATION_LOGGER`; omission selects the portable console logger. Factory composes configured CORS → global prefix/exclusions → default security headers → caller middleware; module middleware follows route matching. CORS/prefix default off, security headers default on, and `securityHeaders: false` opts out.\n\nReadiness/listen/startup-log/host-registration failures clean acquired resources through `close('bootstrap-failed')` and preserve the initiating error. Create a new app to start again. Optional `shutdownRegistration` is supplied by the host and runs only after listen. Omission or close before listen installs no signals. Node callers can supply `createNodeShutdownSignalRegistration()` from `@fluojs/platform-nodejs`.\n\nSignal unregistration is attempted once and never skips runtime teardown on failure. Concurrent and later closes share its failure, aggregating with other teardown failures. Once runtime resources close, `state` is `closed` even if signal unregistration failed. `app.get(PublicToken