Host the API

using Elarion.AspNetCore;

[assembly: GenerateModuleBootstrapper]

cd src/Billing.Api
dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer
dotnet add package OpenTelemetry.Extensions.Hosting
dotnet add package OpenTelemetry.Instrumentation.AspNetCore
dotnet add package OpenTelemetry.Exporter.OpenTelemetryProtocol
cd ../..

using System.Text.Json;
using System.Text.Json.Serialization;
using System.Text.Json.Serialization.Metadata;
using Billing.Api;               // the generated ElarionBootstrapper lives in the host's root namespace
using Billing.Application;
using Billing.Application.Modules.Invoicing.Services;
using Billing.Application.Persistence;
using Billing.Infrastructure.Email;
using Elarion.Abstractions.Diagnostics;
using Elarion.Abstractions.Messaging;
using Elarion.Diagnostics;
using Elarion.Abstractions.Scheduling;
using Elarion.AspNetCore;
using Elarion.AspNetCore.Identity;
using Elarion.AspNetCore.Mcp;
using Elarion.Auditing.EntityFrameworkCore;
using Elarion.Caching;
using Elarion.Messaging.Outbox;
using Elarion.JsonRpc;
using Elarion.Resilience;
using Elarion.Scheduling;
using Microsoft.EntityFrameworkCore;
using OpenTelemetry.Metrics;
using OpenTelemetry.Trace;

var builder = WebApplication.CreateSlimBuilder(args);

// Clock — used by handlers, jobs, and the current-user snapshot.
builder.Services.AddSingleton(TimeProvider.System);

// Database: the context lives in the application's persistence layer (the database is application logic);
// handlers inject the concrete BillingDbContext. Provider registration (UseNpgsql + connection) is the host's job.
builder.Services.AddDbContext<BillingDbContext>(o =>
    o.UseNpgsql(builder.Configuration.GetConnectionString("billing")));
builder.Services.AddScoped<DbContext>(sp => sp.GetRequiredService<BillingDbContext>());

// Integration events: durable, after-commit delivery via the EF Core outbox on the billing context.
builder.Services.AddElarionOutbox<BillingDbContext>();

// Framework audit trail (ADR-0045): the durable EF sink over the billing context, so [Auditable] handlers
// record one compliance AuditRecord per invocation (committed with the transaction; denials included).
builder.Services.AddElarionAuditingEntityFrameworkCore<BillingDbContext>();

// Infrastructure capability: the concrete email sender behind the module's port. (The account-standing
// policy is a Core [ModuleContract] with a Core-internal [Service] impl — so it self-registers.)
builder.Services.AddScoped<IInvoiceEmailSender, SmtpInvoiceEmailSender>();

// Scheduler runtime. Job descriptors and event consumers are composed per module by the
// services.AddElarion(...) call below — there is no explicit Add…ScheduledJobs call.
builder.Services.AddElarionScheduler(builder.Configuration);

// Resilience: generated policy metadata + the Microsoft/Polly-backed runtime. The generated method
// name is Add{AssemblyName}ResiliencePolicies with dots replaced by underscores.
builder.Services.AddBilling_ApplicationResiliencePolicies();
builder.Services.AddElarionResilience();

// Per-user handler caching, backed by HybridCache.
builder.Services.AddElarionHandlerCaching();

// Request validation: enforces the DataAnnotations on request DTOs through the generated
// per-module resolvers (the same constraints the schemas and the Zod client export).
builder.Services.AddElarionValidation();

// Transport-neutral current user, filled from the authenticated principal.
builder.Services.AddElarionCurrentUser(options => options.UserIdClaimType = "sub");

// Authentication: a JWT bearer issuer of your choice (Entra, Auth0, Keycloak, …).
builder.Services.AddAuthentication("Bearer")
    .AddJwtBearer(options => {
        options.Authority = builder.Configuration["Auth:Authority"];
        options.Audience = builder.Configuration["Auth:Audience"];
    });
builder.Services.AddAuthorization();

// Compose every module's services — handlers, services, validation metadata, scheduled jobs, and event
// consumers — each gated by Modules:{Name}:Enabled. This also contributes every enabled module's
// source-generated JSON context to the canonical serializer every subsystem reads.
builder.Services.AddElarion(builder.Configuration);

// JSON-RPC: methods gated per module. Serialization comes from the canonical IElarionJsonSerialization
// (customize it via ConfigureElarionJson) — no hand-built JsonSerializerOptions is threaded in.
builder.Services.AddElarionJsonRpc(ElarionBootstrapper.RegisterHandlers);

// MCP: a thin adapter over the same handler bus, equally gated; both surfaces share one registry.
builder.Services.AddElarionMcp(
    builder.Configuration.GetMcpMetadata(),
    ElarionBootstrapper.RegisterHandlers,
    o => o.ServerName = "Billing");

// Telemetry: register the Elarion sources/meters; the host owns the exporters.
builder.Services.AddOpenTelemetry()
    .WithTracing(t => t
        .AddSource(
            JsonRpcTelemetry.ActivitySourceName,
            SchedulerTelemetry.ActivitySourceName,
            HandlerCacheTelemetry.ActivitySourceName,
            ResilienceTelemetry.ActivitySourceName,
            HandlerTelemetry.ActivitySourceName,
            EventTelemetry.ActivitySourceName)
        .AddAspNetCoreInstrumentation()
        .AddOtlpExporter())
    .WithMetrics(m => m
        .AddMeter(
            JsonRpcTelemetry.MeterName,
            SchedulerTelemetry.MeterName,
            HandlerCacheTelemetry.MeterName,
            ResilienceTelemetry.MeterName,
            HandlerTelemetry.MeterName,
            EventTelemetry.MeterName)
        .AddAspNetCoreInstrumentation()
        .AddOtlpExporter());

var app = builder.Build();

// Apply pending migrations on startup, against the Aspire-provisioned database.
using (var scope = app.Services.CreateScope()) {
    var db = scope.ServiceProvider.GetRequiredService<BillingDbContext>();
    await db.Database.MigrateAsync();
}

app.UseAuthentication();
app.UseElarionCurrentUser();   // snapshot claims into the scoped ICurrentUser
app.UseAuthorization();

app.MapElarionEndpoints(app.Configuration);
app.MapElarionJsonRpc().RequireAuthorization();        // POST /rpc
app.MapElarionMcp().RequireAuthorization();     // /mcp — independent of /rpc

app.Run();

[HttpEndpoint("clients/{id}")]   // verb inferred from the IQuery marker → GET /clients/{id}
[Handler("clients.get")]         // …and still exposed over JSON-RPC/MCP — one handler, two transports
public sealed class GetClient(BillingDbContext db)
    : IHandler<GetClient.Query, Result<GetClient.Response>> { /* … */ }

{
  "Scheduler": {
    "Enabled": true,
    "MaxConcurrentExecutions": 8
  }
}

<ItemGroup>
  <PackageReference Include="Elarion.AspNetCore.SchemaGeneration" PrivateAssets="all" />
</ItemGroup>

<PropertyGroup>
  <ElarionJsonRpcGenerateSchema>true</ElarionJsonRpcGenerateSchema>
  <ElarionJsonRpcSchemaOutputPath>$(MSBuildProjectDirectory)/../../rpc-schema.json</ElarionJsonRpcSchemaOutputPath>
</PropertyGroup>

dotnet run --project src/Billing.AppHost

curl -s http://localhost:5000/rpc \
  -H 'authorization: Bearer <token>' \
  -H 'content-type: application/json' \
  -d '{
        "jsonrpc": "2.0",
        "id": 1,
        "method": "clients.create",
        "params": { "name": "Acme Inc.", "email": "billing@acme.test" }
      }'