@owlmeans/api-config-server 0.1.18-rc.16 → 0.1.18-rc.18

package/README.md

@@ -4,14 +4,14 @@ Server-side entrypoint that serves safe configuration values at `GET /assets/con
 
 ## Overview
 
-- Registers the `API_CONFIG` handler that returns non-sensitive config fields to clients
+- Registers the `API_CONFIG` handler that returns package-allowlisted config fields to clients
 - Used alongside `@owlmeans/api-config-client` to push runtime config from server to browser
 - Include `entrypoints` in your server entrypoint registration
 
 ## Installation
 
 ```bash
-bun add @owlmeans/api-config-server
+bun add @owlmeans/api-config-server@^0.1.18-rc.16
 ```
 
 ## Usage
@@ -28,6 +28,8 @@ context.registerEntrypoints([...appEntrypoints, ...apiConfigEntrypoints])
 ### `entrypoints`
 
 Array of server-side route handlers for the config advertisement endpoint (`GET /assets/config.json`).
+The handler returns only values registered through `apiConfigPlugin()` by packages loaded in the
+server process; it never copies server config generically.
 
 ## Related Packages
 
@@ -42,7 +44,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.13
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/api-config-server",
-  "version": "0.1.18-rc.16",
-  "generatedAt": "2026-09-01T17:39:40.760Z",
+  "version": "0.1.18-rc.18",
+  "generatedAt": "2026-09-10T18:54:42.492Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/api-config-server/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-config-server
-description: How to use @owlmeans/api-config-server — server-side modules that expose the API config endpoint consumed by api-config-client. Auto-invoked when serving API config from a server app.
+description: How to use @owlmeans/api-config-server — the backend half of the runtime config flow, which answers the api-config endpoint from package-owned allowlist plugins. Auto-invoked when serving API config from a server app or deciding what a backend advertises to its clients.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,21 +8,49 @@ user-invocable: false
 # @owlmeans/api-config-server
 
 **Layer:** Server
-**Install:** `"@owlmeans/api-config-server": "^0.1.18-rc.16"` in `dependencies`
+**Install:** `"@owlmeans/api-config-server": "^0.1.18-rc.18"` in `dependencies`
+
+Answers the declaration shared by `@owlmeans/api-config`; the browser side that consumes it is
+`@owlmeans/api-config-client`.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `modules` | Server-side api-config module declarations |
+| `entrypoints` | The `API_CONFIG` declaration elevated with the advertise handler, ready to spread into the app's entrypoint list |
 
 ## Usage
 
 ```typescript
-import { modules as apiConfigServerModules } from '@owlmeans/api-config-server'
-export const appModules = [...modules, ...apiConfigServerModules, ...managerModules]
+import { entrypoints as apiConfigEntrypoints } from '@owlmeans/api-config-server'
+export const appEntrypoints = [...apiConfigEntrypoints, ...myEntrypoints]
 ```
 
+An app built on `@owlmeans/server-app` already has it: the `entrypoints` that package exports
+include this one, so spreading those is enough and adding this list again is redundant.
+
+## What is advertised
+
+The handler calls `advertisedConfig(ctx.cfg)`. It copies nothing generically: only import-time
+`apiConfigPlugin()` registrations from `@owlmeans/api-config` and packages the application loaded
+can contribute fields.
+
+- Base registration keeps public service routes, branding, login settings, selected debug flags and frontend plugins. An `sservice()` route with only `internalHost`/`internalPort` is omitted rather than re-exposed through its derived `host`/`port`.
+- `@owlmeans/oidc` admits only browser OIDC fields and drops internal providers and credentials.
+- `@owlmeans/flow`, `@owlmeans/i18n` and `@owlmeans/payment` register their own client settings and record types.
+- SMTP, queues, databases, storage, trusted keys, secrets and all unregistered config fields are absent.
+
+The endpoint carries no guard — it is fetched before the client has any credential — so nothing
+that requires authorization to read belongs in a plugin's `allow` selection.
+
+The endpoint carries no guard — it is fetched before the client has any credential — so nothing
+that requires authorization to read belongs in the answer.
+
 ## Depends On
 
-- `@owlmeans/api-config`, `@owlmeans/server-entrypoint`, `@owlmeans/server-context`
+Declared: `@owlmeans/api-config`, `@owlmeans/server-api`, `@owlmeans/server-entrypoint`,
+`@owlmeans/server-context`.
+
+Imported but **not** declared in this package's manifest: `@owlmeans/config` (`PLUGINS`, the plugin
+config type) and `@owlmeans/context` (`AppType`, the config-record key). A workspace resolves them
+anyway; a standalone install has to name them in its own dependencies.

package/build/actions/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AASrD,eAAO,MAAM,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAuCtD,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIrD,eAAO,MAAM,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAEtD,CAAA"}

package/build/actions/config.js

@@ -1,34 +1,6 @@
-import { notAdvertizedConfigKeys, allowedConfigRecords } from '@owlmeans/api-config';
+import { advertisedConfig } from '@owlmeans/api-config';
 import { handleRequest } from '@owlmeans/server-api';
-import { PLUGINS } from '@owlmeans/config';
-import { AppType, CONFIG_RECORD } from '@owlmeans/context';
 export const advertise = handleRequest(async (_, ctx) => {
-    const apiConfig = {
-        debug: ctx.cfg.debug ?? {},
-        brand: {},
-        services: Object.fromEntries(Object.entries(ctx.cfg.services ?? {}).map(([service, config]) => [
-            service, {
-                service: config.service,
-                type: config.type,
-                host: config.host,
-                port: config.port,
-                base: config.base
-            }
-        ])),
-        plugins: (ctx.cfg[PLUGINS] ?? [])
-            .filter((plugin) => plugin.type === AppType.Frontend),
-        [CONFIG_RECORD]: (ctx.cfg[CONFIG_RECORD] ?? []).filter((record) => record.recordType != null && allowedConfigRecords.includes(record.recordType)),
-        ...(Object.fromEntries(Object.entries(ctx.cfg).filter(([key]) => ![
-            'debug', 'services', PLUGINS, ...notAdvertizedConfigKeys
-        ].includes(key)))),
-        ...("oidc" in ctx.cfg ? {
-            oidc: {
-                clientCookie: ctx.cfg.oidc.clientCookie,
-                providers: ctx.cfg.oidc.providers?.map(provider => Object.fromEntries(Object.entries(provider)
-                    .filter(([key]) => !['secret', 'apiClientId'].includes(key)))).filter(provider => provider.internal !== true),
-            }
-        } : {})
-    };
-    return apiConfig;
+    return advertisedConfig(ctx.cfg);
 });
 //# sourceMappingURL=config.js.map

package/build/actions/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAG1D,MAAM,CAAC,MAAM,SAAS,GAAsC,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;IACzF,MAAM,SAAS,GAAc;QAC3B,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAChF,OAAO,EAAE;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF,CAAC,CACH;QACD,OAAO,EAAE,CAAE,GAAG,CAAC,GAAiD,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;aAC7E,MAAM,CAAC,CAAC,MAAoB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC;QACrE,CAAC,aAAa,CAAC,EAAE,CAAE,GAAG,CAAC,GAAiD,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACnG,CAAC,MAAoB,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CACxG;QACD,GAAG,CACD,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,uBAAuB;SACzD,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CACjB,CACF;QACD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE;gBACJ,YAAY,EAAG,GAAG,CAAC,GAAG,CAAC,IAAkC,CAAC,YAAY;gBACtE,SAAS,EAAG,GAAG,CAAC,GAAG,CAAC,IAAgC,CAAC,SAAS,EAAE,GAAG,CACjE,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;qBACpD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAChE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;aACjD;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,OAAO,SAAS,CAAA;AAClB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/actions/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,MAAM,CAAC,MAAM,SAAS,GAAsC,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;IACzF,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAc,CAAA;AAC/C,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/api-config-server",
-  "version": "0.1.18-rc.16",
+  "version": "0.1.18-rc.18",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,10 +21,10 @@
     }
   },
   "dependencies": {
-    "@owlmeans/api-config": "^0.1.18-rc.11",
-    "@owlmeans/server-api": "^0.1.18-rc.16",
-    "@owlmeans/server-context": "^0.1.18-rc.11",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.10"
+    "@owlmeans/api-config": "^0.1.18-rc.13",
+    "@owlmeans/server-api": "^0.1.18-rc.18",
+    "@owlmeans/server-context": "^0.1.18-rc.13",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.12"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",

package/src/actions/config.ts

@@ -1,50 +1,8 @@
 import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 import type { ApiConfig } from '@owlmeans/api-config'
-import type { ServerConfig } from '@owlmeans/server-context'
-import type { PluginConfig } from '@owlmeans/config'
-import { notAdvertizedConfigKeys, allowedConfigRecords } from '@owlmeans/api-config'
+import { advertisedConfig } from '@owlmeans/api-config'
 import { handleRequest } from '@owlmeans/server-api'
-import { PLUGINS } from '@owlmeans/config'
-import { AppType, CONFIG_RECORD } from '@owlmeans/context'
-import type { ConfigRecord } from '@owlmeans/context'
 
 export const advertise: RefedEntrypointHandler<ApiConfig> = handleRequest(async (_, ctx) => {
-  const apiConfig: ApiConfig = {
-    debug: ctx.cfg.debug ?? {},
-    brand: {},
-    services: Object.fromEntries(
-      Object.entries(ctx.cfg.services ?? {} as ServerConfig).map(([service, config]) => [
-        service, {
-          service: config.service,
-          type: config.type,
-          host: config.host,
-          port: config.port,
-          base: config.base
-        }
-      ])
-    ),
-    plugins: ((ctx.cfg as unknown as Record<string, PluginConfig[]>)[PLUGINS] ?? [])
-      .filter((plugin: PluginConfig) => plugin.type === AppType.Frontend),
-    [CONFIG_RECORD]: ((ctx.cfg as unknown as Record<string, ConfigRecord[]>)[CONFIG_RECORD] ?? []).filter(
-      (record: ConfigRecord) => record.recordType != null && allowedConfigRecords.includes(record.recordType)
-    ),
-    ...(
-      Object.fromEntries(
-        Object.entries(ctx.cfg).filter(([key]) => ![
-          'debug', 'services', PLUGINS, ...notAdvertizedConfigKeys
-        ].includes(key))
-      )
-    ),
-    ...("oidc" in ctx.cfg ? {
-      oidc: {
-        clientCookie: (ctx.cfg.oidc as { clientCookie: unknown }).clientCookie,
-        providers: (ctx.cfg.oidc as { providers: Object[] }).providers?.map(
-          provider => Object.fromEntries(Object.entries(provider)
-            .filter(([key]) => !['secret', 'apiClientId'].includes(key)))
-        ).filter(provider => provider.internal !== true),
-      }
-    } : {})
-  }
-
-  return apiConfig
+  return advertisedConfig(ctx.cfg) as ApiConfig
 })