@owlmeans/api-config 0.1.18-rc.11 → 0.1.18-rc.12

package/README.md

@@ -12,7 +12,7 @@ Shared entrypoint for advertising safe config values from server to client via a
 ## Installation
 
 ```bash
-bun add @owlmeans/api-config
+bun add @owlmeans/api-config@^0.1.18-rc.11
 ```
 
 ## Usage
@@ -51,7 +51,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.12
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/api-config",
-  "version": "0.1.18-rc.11",
-  "generatedAt": "2026-09-01T17:39:40.767Z",
+  "version": "0.1.18-rc.12",
+  "generatedAt": "2026-09-04T22:43:25.452Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/api-config/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-config
-description: How to use @owlmeans/api-config — module declarations for fetching API/service configuration at runtime. Auto-invoked when importing api-config types or modules.
+description: How to use @owlmeans/api-config — the shared entrypoint declaration and redaction lists behind the runtime config document a backend advertises and a frontend merges into its own config at boot. Auto-invoked when importing api-config, or when wiring runtime API config between a server and a client.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,25 +8,44 @@ user-invocable: false
 # @owlmeans/api-config
 
 **Layer:** Core
-**Install:** `"@owlmeans/api-config": "^0.1.18-rc.11"` in `dependencies`
+**Install:** `"@owlmeans/api-config": "^0.1.18-rc.12"` in `dependencies`
+
+The contract package of a three-package flow: this one declares the endpoint and what may cross it,
+`@owlmeans/api-config-server` answers it, `@owlmeans/api-config-client` fetches it and merges the
+answer into the client config. Nothing here runs — it is the shared declaration all three agree on.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `ApiConfig` types | Shape of remotely-served API config |
-| Modules | Module declarations for the config endpoint |
-| Constants | Module aliases, route paths |
+| `entrypoints` | The single declaration — alias `API_CONFIG`, route `/assets/config.json`, `sticky: true` so a router attaches it unconditionally |
+| `API_CONFIG` | The alias (`api-config:advertise`) both sides elevate |
+| `notAdvertizedConfigKeys` | Config keys the server strips before answering — `dbs`, `trusted`, `ready`, `service`, `type`, `records`, `webService`, `oidc`, `storageBuckets`, `secrets` |
+| `allowedConfigRecords` | The only `recordType` values a config record may carry to be advertised — `plan`, `product`, `l10n` |
+| `ApiConfig` | The advertised document — `CommonConfig` minus `dbs`, `trusted`, `ready`, `service` and `type` |
 
 ## Usage
 
-Pair with `@owlmeans/api-config-client` (browser) or `@owlmeans/api-config-server` (Fastify) for the runtime side. The `api-config` package itself defines the shared module/route shape.
+The declaration is elevated on both sides, so neither imports the other's package — they only share
+this one. Add it to the entrypoint list the way any other entrypoint set is added:
 
 ```typescript
-import { modules as apiConfigModules } from '@owlmeans/api-config'
-const appModules = [...apiConfigModules, ...myModules]
+import { entrypoints as apiConfigEntrypoints } from '@owlmeans/api-config'
+export const appEntrypoints = [...apiConfigEntrypoints, ...myEntrypoints]
 ```
 
+Most apps never do this directly: a backend built on `@owlmeans/server-app` already carries the
+server side in its built-in `entrypoints`, and a client panel package already carries the client
+side.
+
+## What may cross
+
+The advertised document is the server's own config with the secrets taken out, so anything added to
+a backend config is public by default. A new config key holding a credential, a connection string or
+an internal address belongs in `notAdvertizedConfigKeys`; a new config-record type is invisible to
+clients until it is listed in `allowedConfigRecords`. Both lists live here rather than in the server
+so the client's type (`ApiConfig`) and the server's redaction cannot drift apart.
+
 ## Depends On
 
 - `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/config`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/api-config",
-  "version": "0.1.18-rc.11",
+  "version": "0.1.18-rc.12",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,9 +21,9 @@
     }
   },
   "dependencies": {
-    "@owlmeans/config": "^0.1.18-rc.11",
-    "@owlmeans/entrypoint": "^0.1.18-rc.10",
-    "@owlmeans/route": "^0.1.18-rc.8"
+    "@owlmeans/config": "^0.1.18-rc.12",
+    "@owlmeans/entrypoint": "^0.1.18-rc.11",
+    "@owlmeans/route": "^0.1.18-rc.9"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",