@owlmeans/api-config 0.1.18-rc.3 → 0.1.18-rc.30

package/README.md

@@ -1,46 +1,69 @@
 # @owlmeans/api-config
 
-Shared module for advertising safe config values from server to client via a REST endpoint.
+Shared protocol for advertising safe config values from server to client via a REST endpoint.
 
 ## Overview
 
-- Exposes a `GET /assets/config.json` module that returns non-sensitive config fields
+- Exposes the `advertise` protocol for `GET /assets/config.json`, returning package-allowlisted config fields
 - `ApiConfig` — the advertised config type (subset of `CommonConfig`)
-- `API_CONFIG` — module alias for the config endpoint
-- `notAdvertizedConfigKeys` / `allowedConfigRecords` — lists controlling what is/isn't exposed
+- `API_CONFIG` — entrypoint alias for the config endpoint
+- `apiConfigPlugin` / `every` — import-time allowlist helpers for package-owned client config
 
 ## Installation
 
 ```bash
-bun add @owlmeans/api-config
+bun add @owlmeans/api-config@^0.1.18-rc.30
 ```
 
 ## Usage
 
-Use with server and client counterparts — this package provides the shared types and module alias:
+Use with server and client counterparts — this package provides the shared protocol, types, and
+private adapter alias:
 
 ```typescript
-import { API_CONFIG } from '@owlmeans/api-config'
+import { advertise } from '@owlmeans/api-config'
 import type { ApiConfig } from '@owlmeans/api-config'
+
+// Bind this exact declaration in the server and browser packages.
+context.entrypoint(advertise)
 ```
 
 ## API
 
 ### `ApiConfig`
 
-Subset of `CommonConfig` safe to expose to clients (no db credentials, secrets, etc.).
+Partial public config assembled only from imported packages' allowlist plugins. Unregistered
+server values — including databases, queues and secrets — are never returned.
 
 ### `API_CONFIG`
 
-Module alias `'api-config:advertise'` used to register/call the config endpoint.
+Internal adapter alias `'api-config:advertise'`. Application code imports `advertise` instead of
+looking the protocol up by this string.
+
+### `advertise`
+
+The immutable, sticky protocol for `GET /assets/config.json`. It is the only shared declaration;
+`@owlmeans/api-config-server` and `@owlmeans/api-config-client` each export local bindings for it.
+
+### `apiConfigPlugin`
 
-### `modules`
+Call this once at module scope in the package that owns a client-facing configuration field:
+
+```typescript
+import { apiConfigPlugin, every } from '@owlmeans/api-config'
+
+apiConfigPlugin({
+  allow: { integrations: every(true) },
+  deny: { integrations: every({ token: true }) },
+})
+```
 
-Array of route definitions for the config advertisement endpoint.
+The `deny` selector removes nested values after the allowlist selection. Prefer a precise nested
+allowlist to `true`; `true` is appropriate only for data that is public at every depth.
 
 ## Related Packages
 
-- [`@owlmeans/api-config-server`](../api-config-server) — server-side module that serves the config
+- [`@owlmeans/api-config-server`](../api-config-server) — server-side entrypoint that serves the config
 - [`@owlmeans/api-config-client`](../api-config-client) — client middleware that fetches and merges config
 
 <!-- owlmeans:agent-guidance:start -->
@@ -51,7 +74,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.31
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/api-config",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.515Z",
+  "version": "0.1.18-rc.30",
+  "generatedAt": "2026-09-21T21:54:22.978Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/api-config/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api-config
-description: How to use @owlmeans/api-config — module declarations for fetching API/service configuration at runtime. Auto-invoked when importing api-config types or modules.
+description: How to use @owlmeans/api-config — the shared entrypoint declaration and import-time allowlist plugins behind the runtime config document a backend advertises and a frontend merges into its own config at boot. Auto-invoked when importing api-config, or when wiring runtime API config between a server and a client.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,25 +8,61 @@ user-invocable: false
 # @owlmeans/api-config
 
 **Layer:** Core
-**Install:** `"@owlmeans/api-config": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/api-config": "^0.1.18-rc.30"` in `dependencies`
+
+The contract package of a three-package flow: this one declares the endpoint and what may cross it,
+`@owlmeans/api-config-server` answers it, `@owlmeans/api-config-client` fetches it and merges the
+answer into the client config. Nothing here runs — it is the shared declaration all three agree on.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `ApiConfig` types | Shape of remotely-served API config |
-| Modules | Module declarations for the config endpoint |
-| Constants | Module aliases, route paths |
+| `advertise` | The single immutable declaration — route `/assets/config.json`, `sticky: true` so a router attaches it unconditionally |
+| `API_CONFIG` | Internal adapter alias for `advertise`; do not use it for ordinary application lookup |
+| `apiConfigPlugin(plugin)` | Registers one package's public config selection as its module loads |
+| `every(selection, where?)` | Applies a selection to every list item or object-map value, optionally filtering items |
+| `ApiConfigPlugin` | `{ allow, deny? }` — nested allowlist with an optional nested redaction selector |
+| `advertisedConfig(cfg)` | Applies every imported package contract to build the endpoint document |
+| `ApiConfig` | The partial public document a client merges into its local config |
 
 ## Usage
 
-Pair with `@owlmeans/api-config-client` (browser) or `@owlmeans/api-config-server` (Fastify) for the runtime side. The `api-config` package itself defines the shared module/route shape.
+The declaration is bound on both sides, so neither imports the other's package — they only share
+this one. A server or browser package binds `advertise`; it does not import a flattened shared list:
+
+```typescript
+import { advertise } from '@owlmeans/api-config'
+import { bind } from '@owlmeans/server-entrypoint'
+
+export const serverBindings = [bind(advertise, handler)]
+```
+
+Most apps never do this directly: a backend built on `@owlmeans/server-app` already carries the
+server side in its built-in `entrypoints`, and a client panel package already carries the client
+side.
+
+## What may cross
+
+The document is default-deny: a server config value is absent until the package that owns its
+browser consumer registers a precise `allow` selector during import. Do not allow an ancestor with
+`true` unless every descendant is public; name fields instead, and use `deny` when an otherwise
+public collection carries nested credentials.
 
 ```typescript
-import { modules as apiConfigModules } from '@owlmeans/api-config'
-const appModules = [...apiConfigModules, ...myModules]
+import { apiConfigPlugin, every } from '@owlmeans/api-config'
+
+apiConfigPlugin({
+  allow: { oidc: { providers: every(true) } },
+  deny: { oidc: { providers: every({ secret: true, apiClientId: true }) } },
+})
 ```
 
+The base contract supplies public routes, branding, login settings, selected debug flags and
+frontend plugins. `@owlmeans/oidc`, `@owlmeans/flow`, `@owlmeans/i18n` and `@owlmeans/payment`
+register their own client settings during import. Databases, queues, SMTP, secrets and every
+unregistered config extension never cross the unauthenticated endpoint.
+
 ## Depends On
 
 - `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/config`

package/build/consts.d.ts

@@ -1,4 +1,2 @@
 export declare const API_CONFIG = "api-config:advertise";
-export declare const notAdvertizedConfigKeys: string[];
-export declare const allowedConfigRecords: string[];
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,UAAU,yBAAyB,CAAA;AAEhD,eAAO,MAAM,uBAAuB,UAInC,CAAA;AAED,eAAO,MAAM,oBAAoB,UAEhC,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,UAAU,yBAAyB,CAAA"}

package/build/consts.js

@@ -1,10 +1,2 @@
 export const API_CONFIG = 'api-config:advertise';
-export const notAdvertizedConfigKeys = [
-    'dbs', 'trusted', 'ready', 'service', 'layer', 'type',
-    'layerId', 'records', 'webService', 'oidc', 'storageBuckets',
-    'secrets',
-];
-export const allowedConfigRecords = [
-    'plan', 'product', 'l10n'
-];
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAA;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;IACrD,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB;IAC5D,SAAS;CACV,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,SAAS,EAAE,MAAM;CAC1B,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAA"}

package/build/defaults.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=defaults.d.ts.map

package/build/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":""}

package/build/defaults.js

@@ -0,0 +1,33 @@
+import { AppType } from '@owlmeans/context';
+import { PLUGINS } from '@owlmeans/config';
+import { apiConfigPlugin, every } from './plugins.js';
+const isPublicService = (value) => {
+    if (value == null || typeof value !== 'object') {
+        return false;
+    }
+    const service = value;
+    // sservice() copies an internal address into host/port. Keep a service only when it has an
+    // independently declared public address; otherwise an internal-only peer leaks through host.
+    return service.internalHost == null || service.host !== service.internalHost;
+};
+apiConfigPlugin({
+    allow: {
+        debug: { all: true, i18n: true, supervisor: true },
+        brand: true,
+        security: {
+            unsecure: true,
+            auth: { flow: true, enter: true, login: true },
+        },
+        services: every({
+            service: true,
+            type: true,
+            host: true,
+            port: true,
+            base: true,
+            home: true,
+            default: true,
+        }, isPublicService),
+        [PLUGINS]: every(true, value => value != null && typeof value === 'object' && value.type === AppType.Frontend),
+    },
+});
+//# sourceMappingURL=defaults.js.map

package/build/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAErD,MAAM,eAAe,GAAG,CAAC,KAAc,EAAW,EAAE;IAClD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAmD,CAAA;IAEnE,2FAA2F;IAC3F,6FAA6F;IAC7F,OAAO,OAAO,CAAC,YAAY,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,YAAY,CAAA;AAC9E,CAAC,CAAA;AAED,eAAe,CAAC;IACd,KAAK,EAAE;QACL,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QAClD,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE;YACR,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;SAC/C;QACD,QAAQ,EAAE,KAAK,CAAC;YACd,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;SACd,EAAE,eAAe,CAAC;QACnB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAC7B,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA4B,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CACtG;KACF;CACF,CAAC,CAAA"}

package/build/entrypoints.d.ts

@@ -0,0 +1,3 @@
+/** The public runtime-config endpoint protocol. */
+export declare const advertise: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,eAAO,MAAM,SAAS,yIAA2E,CAAA"}

package/build/entrypoints.js

@@ -0,0 +1,6 @@
+import { openProtocol } from '@owlmeans/entrypoint';
+import { route } from '@owlmeans/route';
+import { API_CONFIG } from './consts.js';
+/** The public runtime-config endpoint protocol. */
+export const advertise = openProtocol(route(API_CONFIG, '/assets/config.json'), { sticky: true });
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,mDAAmD;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,4 +1,6 @@
 export type * from './types.js';
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
+export * from './plugins.js';
+export * from './defaults.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA"}

package/build/index.js

@@ -1,3 +1,5 @@
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
+export * from './plugins.js';
+export * from './defaults.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA"}

package/build/plugins.d.ts

@@ -0,0 +1,31 @@
+/** A declarative selection of config values that may cross into a browser. */
+export type ConfigSelection = true | ConfigSelectionMap | EveryConfigValue;
+export interface ConfigSelectionMap {
+    readonly [key: string]: ConfigSelection | undefined;
+}
+/** Apply a selection to every item in an array or every value in an object map. */
+export interface EveryConfigValue {
+    readonly every: ConfigSelection;
+    readonly where?: (value: unknown) => boolean;
+}
+/** A package-owned contribution to the public runtime-config document. */
+export interface ApiConfigPlugin {
+    /** Fields this package intentionally makes public. */
+    readonly allow: ConfigSelection;
+    /** Nested fields to remove after selection, even when an ancestor is allowed. */
+    readonly deny?: ConfigSelection;
+}
+/** Build a selector for lists and string-keyed maps. */
+export declare const every: (selection: ConfigSelection, where?: (value: unknown) => boolean) => EveryConfigValue;
+/**
+ * Register a package's public config contract during module import.
+ *
+ * The registry is intentionally additive: importing a package can only expose the fields it
+ * names, while a package's `deny` selector can still remove sensitive nested values.
+ */
+export declare const apiConfigPlugin: (plugin: ApiConfigPlugin) => void;
+/** Apply one package contract without registering it; useful for focused contract tests. */
+export declare const selectApiConfig: (config: Record<string, unknown>, plugin: ApiConfigPlugin) => Record<string, unknown>;
+/** Build the document the unauthenticated config endpoint may return. */
+export declare const advertisedConfig: <C extends object>(config: C) => Record<string, unknown>;
+//# sourceMappingURL=plugins.d.ts.map

package/build/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../src/plugins.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,kBAAkB,GAAG,gBAAgB,CAAA;AAE1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;CACpD;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAA;CAC7C;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAChC;AAaD,wDAAwD;AACxD,eAAO,MAAM,KAAK,cAAe,eAAe,UAAU,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,KAAG,gBAC3B,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,eAAe,KAAG,IAEzD,CAAA;AAoGD,4FAA4F;AAC5F,eAAO,MAAM,eAAe,WAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,eAAe,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAQhH,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,UAAU,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAIlF,CAAA"}

package/build/plugins.js

@@ -0,0 +1,121 @@
+const plugins = [];
+const OMIT = Symbol('api-config:omit');
+const isRecord = (value) => value != null && typeof value === 'object' && !Array.isArray(value);
+const isEvery = (selection) => selection !== true && 'every' in selection;
+/** Build a selector for lists and string-keyed maps. */
+export const every = (selection, where) => ({ every: selection, ...(where != null ? { where } : {}) });
+/**
+ * Register a package's public config contract during module import.
+ *
+ * The registry is intentionally additive: importing a package can only expose the fields it
+ * names, while a package's `deny` selector can still remove sensitive nested values.
+ */
+export const apiConfigPlugin = (plugin) => {
+    plugins.push(plugin);
+};
+const select = (value, selection) => {
+    if (value === undefined) {
+        return OMIT;
+    }
+    if (selection === true) {
+        return value;
+    }
+    if (isEvery(selection)) {
+        if (Array.isArray(value)) {
+            return value.flatMap(item => {
+                if (selection.where?.(item) === false) {
+                    return [];
+                }
+                const selected = select(item, selection.every);
+                return selected === OMIT ? [] : [selected];
+            });
+        }
+        if (isRecord(value)) {
+            return Object.fromEntries(Object.entries(value).flatMap(([key, item]) => {
+                if (selection.where?.(item) === false) {
+                    return [];
+                }
+                const selected = select(item, selection.every);
+                return selected === OMIT ? [] : [[key, selected]];
+            }));
+        }
+        return OMIT;
+    }
+    if (!isRecord(value)) {
+        return OMIT;
+    }
+    return Object.fromEntries(Object.entries(selection).flatMap(([key, nested]) => {
+        if (nested == null) {
+            return [];
+        }
+        const selected = select(value[key], nested);
+        return selected === OMIT ? [] : [[key, selected]];
+    }));
+};
+const redact = (value, selection) => {
+    if (selection === true) {
+        return OMIT;
+    }
+    if (isEvery(selection)) {
+        if (Array.isArray(value)) {
+            return value.flatMap(item => {
+                if (selection.where?.(item) === false) {
+                    return [item];
+                }
+                const redacted = redact(item, selection.every);
+                return redacted === OMIT ? [] : [redacted];
+            });
+        }
+        if (isRecord(value)) {
+            return Object.fromEntries(Object.entries(value).flatMap(([key, item]) => {
+                if (selection.where?.(item) === false) {
+                    return [[key, item]];
+                }
+                const redacted = redact(item, selection.every);
+                return redacted === OMIT ? [] : [[key, redacted]];
+            }));
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(item => redact(item, selection)).filter(item => item !== OMIT);
+    }
+    if (!isRecord(value)) {
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).flatMap(([key, item]) => {
+        const nested = selection[key];
+        if (nested == null) {
+            return [[key, item]];
+        }
+        const redacted = redact(item, nested);
+        return redacted === OMIT ? [] : [[key, redacted]];
+    }));
+};
+const merge = (target, source) => {
+    Object.entries(source).forEach(([key, value]) => {
+        const current = target[key];
+        if (Array.isArray(current) && Array.isArray(value)) {
+            target[key] = [...current, ...value];
+        }
+        else if (isRecord(current) && isRecord(value)) {
+            target[key] = merge({ ...current }, value);
+        }
+        else {
+            target[key] = value;
+        }
+    });
+    return target;
+};
+/** Apply one package contract without registering it; useful for focused contract tests. */
+export const selectApiConfig = (config, plugin) => {
+    const selected = select(config, plugin.allow);
+    if (!isRecord(selected)) {
+        return {};
+    }
+    const redacted = plugin.deny == null ? selected : redact(selected, plugin.deny);
+    return isRecord(redacted) ? redacted : {};
+};
+/** Build the document the unauthenticated config endpoint may return. */
+export const advertisedConfig = (config) => plugins.reduce((result, plugin) => merge(result, selectApiConfig(config, plugin)), {});
+//# sourceMappingURL=plugins.js.map

package/build/plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../src/plugins.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,GAAsB,EAAE,CAAA;AACrC,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAA;AAItC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAErE,MAAM,OAAO,GAAG,CAAC,SAA0B,EAAiC,EAAE,CAC5E,SAAS,KAAK,IAAI,IAAI,OAAO,IAAI,SAAS,CAAA;AAE5C,wDAAwD;AACxD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,SAA0B,EAAE,KAAmC,EAAoB,EAAE,CACzG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAuB,EAAQ,EAAE;IAC/D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,SAA0B,EAAmB,EAAE;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;oBACtC,OAAO,EAAE,CAAA;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC9C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;gBACtE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;oBACtC,OAAO,EAAE,CAAA;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC9C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;YACnD,CAAC,CAAC,CAAC,CAAA;QACL,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;QAC5E,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAC,CAAA;AACL,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,SAA0B,EAAmB,EAAE;IAC7E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;oBACtC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC9C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;gBACtE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;oBACtC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;gBACtB,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC9C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;YACnD,CAAC,CAAC,CAAC,CAAA;QACL,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAC,CAAA;AACL,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CAAC,MAA+B,EAAE,MAA+B,EAA2B,EAAE;IAC1G,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAA;QACtC,CAAC;aAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAA+B,EAAE,MAAuB,EAA2B,EAAE;IACnH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAE/E,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAmB,MAAS,EAA2B,EAAE,CACvF,OAAO,CAAC,MAAM,CACZ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,MAAiC,EAAE,MAAM,CAAC,CAAC,EAC7F,EAA6B,CAC9B,CAAA"}

package/build/types.d.ts

@@ -1,4 +1,5 @@
 import type { CommonConfig } from '@owlmeans/config';
-export interface ApiConfig extends Omit<CommonConfig, 'dbs' | 'trusted' | 'ready' | 'service' | 'layer' | 'type' | 'layerId'> {
+/** The public subset registered by packages through apiConfigPlugin(). */
+export interface ApiConfig extends Partial<CommonConfig> {
 }
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,WAAW,SAAU,SAAQ,IAAI,CACrC,YAAY,EACZ,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CACvE;CACA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAEpD,0EAA0E;AAC1E,MAAM,WAAW,SAAU,SAAQ,OAAO,CAAC,YAAY,CAAC;CACvD"}

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@owlmeans/api-config",
-  "version": "0.1.18-rc.3",
+  "version": "0.1.18-rc.30",
   "license": "MIT",
   "type": "module",
   "scripts": {
     "build": "tsc -b",
+    "test": "bun test ./tests",
     "dev": "sleep 6 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
     "watch": "tsc -b -w --preserveWatchOutput --pretty"
   },
@@ -21,9 +22,10 @@
     }
   },
   "dependencies": {
-    "@owlmeans/config": "^0.1.18-rc.3",
-    "@owlmeans/entrypoint": "^0.1.18-rc.3",
-    "@owlmeans/route": "^0.1.18-rc.3"
+    "@owlmeans/config": "^0.1.18-rc.31",
+    "@owlmeans/context": "^0.1.18-rc.27",
+    "@owlmeans/entrypoint": "^0.1.18-rc.30",
+    "@owlmeans/route": "^0.1.18-rc.28"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",

package/src/consts.ts

@@ -1,12 +1,2 @@
 
 export const API_CONFIG = 'api-config:advertise'
-
-export const notAdvertizedConfigKeys = [
-  'dbs', 'trusted', 'ready', 'service', 'layer', 'type', 
-  'layerId', 'records', 'webService', 'oidc', 'storageBuckets',
-  'secrets',
-]
-
-export const allowedConfigRecords = [
-  'plan', 'product', 'l10n'
-]

package/src/defaults.ts

@@ -0,0 +1,37 @@
+import { AppType } from '@owlmeans/context'
+import { PLUGINS } from '@owlmeans/config'
+import { apiConfigPlugin, every } from './plugins.js'
+
+const isPublicService = (value: unknown): boolean => {
+  if (value == null || typeof value !== 'object') {
+    return false
+  }
+  const service = value as { host?: unknown, internalHost?: unknown }
+
+  // sservice() copies an internal address into host/port. Keep a service only when it has an
+  // independently declared public address; otherwise an internal-only peer leaks through host.
+  return service.internalHost == null || service.host !== service.internalHost
+}
+
+apiConfigPlugin({
+  allow: {
+    debug: { all: true, i18n: true, supervisor: true },
+    brand: true,
+    security: {
+      unsecure: true,
+      auth: { flow: true, enter: true, login: true },
+    },
+    services: every({
+      service: true,
+      type: true,
+      host: true,
+      port: true,
+      base: true,
+      home: true,
+      default: true,
+    }, isPublicService),
+    [PLUGINS]: every(true, value =>
+      value != null && typeof value === 'object' && (value as { type?: AppType }).type === AppType.Frontend
+    ),
+  },
+})

package/src/entrypoints.ts

@@ -0,0 +1,6 @@
+import { openProtocol } from '@owlmeans/entrypoint'
+import { route } from '@owlmeans/route'
+import { API_CONFIG } from './consts.js'
+
+/** The public runtime-config endpoint protocol. */
+export const advertise = openProtocol(route(API_CONFIG, '/assets/config.json'), { sticky: true })

package/src/index.ts

@@ -2,4 +2,6 @@
 export type * from './types.js'
 
 export * from './consts.js'
-export * from './modules.js'
+export * from './entrypoints.js'
+export * from './plugins.js'
+export * from './defaults.js'

package/src/plugins.ts

@@ -0,0 +1,161 @@
+/** A declarative selection of config values that may cross into a browser. */
+export type ConfigSelection = true | ConfigSelectionMap | EveryConfigValue
+
+export interface ConfigSelectionMap {
+  readonly [key: string]: ConfigSelection | undefined
+}
+
+/** Apply a selection to every item in an array or every value in an object map. */
+export interface EveryConfigValue {
+  readonly every: ConfigSelection
+  readonly where?: (value: unknown) => boolean
+}
+
+/** A package-owned contribution to the public runtime-config document. */
+export interface ApiConfigPlugin {
+  /** Fields this package intentionally makes public. */
+  readonly allow: ConfigSelection
+  /** Nested fields to remove after selection, even when an ancestor is allowed. */
+  readonly deny?: ConfigSelection
+}
+
+const plugins: ApiConfigPlugin[] = []
+const OMIT = Symbol('api-config:omit')
+
+type SelectionResult = unknown | typeof OMIT
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value != null && typeof value === 'object' && !Array.isArray(value)
+
+const isEvery = (selection: ConfigSelection): selection is EveryConfigValue =>
+  selection !== true && 'every' in selection
+
+/** Build a selector for lists and string-keyed maps. */
+export const every = (selection: ConfigSelection, where?: (value: unknown) => boolean): EveryConfigValue =>
+  ({ every: selection, ...(where != null ? { where } : {}) })
+
+/**
+ * Register a package's public config contract during module import.
+ *
+ * The registry is intentionally additive: importing a package can only expose the fields it
+ * names, while a package's `deny` selector can still remove sensitive nested values.
+ */
+export const apiConfigPlugin = (plugin: ApiConfigPlugin): void => {
+  plugins.push(plugin)
+}
+
+const select = (value: unknown, selection: ConfigSelection): SelectionResult => {
+  if (value === undefined) {
+    return OMIT
+  }
+  if (selection === true) {
+    return value
+  }
+  if (isEvery(selection)) {
+    if (Array.isArray(value)) {
+      return value.flatMap(item => {
+        if (selection.where?.(item) === false) {
+          return []
+        }
+        const selected = select(item, selection.every)
+        return selected === OMIT ? [] : [selected]
+      })
+    }
+    if (isRecord(value)) {
+      return Object.fromEntries(Object.entries(value).flatMap(([key, item]) => {
+        if (selection.where?.(item) === false) {
+          return []
+        }
+        const selected = select(item, selection.every)
+        return selected === OMIT ? [] : [[key, selected]]
+      }))
+    }
+    return OMIT
+  }
+  if (!isRecord(value)) {
+    return OMIT
+  }
+
+  return Object.fromEntries(Object.entries(selection).flatMap(([key, nested]) => {
+    if (nested == null) {
+      return []
+    }
+    const selected = select(value[key], nested)
+    return selected === OMIT ? [] : [[key, selected]]
+  }))
+}
+
+const redact = (value: unknown, selection: ConfigSelection): SelectionResult => {
+  if (selection === true) {
+    return OMIT
+  }
+  if (isEvery(selection)) {
+    if (Array.isArray(value)) {
+      return value.flatMap(item => {
+        if (selection.where?.(item) === false) {
+          return [item]
+        }
+        const redacted = redact(item, selection.every)
+        return redacted === OMIT ? [] : [redacted]
+      })
+    }
+    if (isRecord(value)) {
+      return Object.fromEntries(Object.entries(value).flatMap(([key, item]) => {
+        if (selection.where?.(item) === false) {
+          return [[key, item]]
+        }
+        const redacted = redact(item, selection.every)
+        return redacted === OMIT ? [] : [[key, redacted]]
+      }))
+    }
+    return value
+  }
+  if (Array.isArray(value)) {
+    return value.map(item => redact(item, selection)).filter(item => item !== OMIT)
+  }
+  if (!isRecord(value)) {
+    return value
+  }
+
+  return Object.fromEntries(Object.entries(value).flatMap(([key, item]) => {
+    const nested = selection[key]
+    if (nested == null) {
+      return [[key, item]]
+    }
+    const redacted = redact(item, nested)
+    return redacted === OMIT ? [] : [[key, redacted]]
+  }))
+}
+
+const merge = (target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown> => {
+  Object.entries(source).forEach(([key, value]) => {
+    const current = target[key]
+    if (Array.isArray(current) && Array.isArray(value)) {
+      target[key] = [...current, ...value]
+    } else if (isRecord(current) && isRecord(value)) {
+      target[key] = merge({ ...current }, value)
+    } else {
+      target[key] = value
+    }
+  })
+
+  return target
+}
+
+/** Apply one package contract without registering it; useful for focused contract tests. */
+export const selectApiConfig = (config: Record<string, unknown>, plugin: ApiConfigPlugin): Record<string, unknown> => {
+  const selected = select(config, plugin.allow)
+  if (!isRecord(selected)) {
+    return {}
+  }
+  const redacted = plugin.deny == null ? selected : redact(selected, plugin.deny)
+
+  return isRecord(redacted) ? redacted : {}
+}
+
+/** Build the document the unauthenticated config endpoint may return. */
+export const advertisedConfig = <C extends object>(config: C): Record<string, unknown> =>
+  plugins.reduce(
+    (result, plugin) => merge(result, selectApiConfig(config as Record<string, unknown>, plugin)),
+    {} as Record<string, unknown>
+  )

package/src/types.ts

@@ -1,7 +1,5 @@
 import type { CommonConfig } from '@owlmeans/config'
 
-export interface ApiConfig extends Omit<
-  CommonConfig,
-  'dbs' | 'trusted' | 'ready' | 'service' | 'layer' | 'type' | 'layerId'
-> {
+/** The public subset registered by packages through apiConfigPlugin(). */
+export interface ApiConfig extends Partial<CommonConfig> {
 }

package/tests/plugins.spec.ts

@@ -0,0 +1,79 @@
+import { describe, expect, test } from 'bun:test'
+import { AppType, CONFIG_RECORD } from '@owlmeans/context'
+import '@owlmeans/flow'
+import '@owlmeans/i18n'
+import '@owlmeans/oidc'
+import '@owlmeans/payment'
+import { advertisedConfig, every, selectApiConfig } from '@owlmeans/api-config'
+import type { CommonConfig } from '@owlmeans/config'
+
+describe('@owlmeans/api-config plugins', () => {
+  test('keeps only registered config and public nested fields', () => {
+    const result = advertisedConfig({
+      debug: { all: true, supervisor: true, serverTrace: 'private' },
+      brand: { name: 'Example' },
+      security: {
+        unsecure: false,
+        auth: { login: { title: 'Sign in' }, serverOnly: 'private' },
+      },
+      services: {
+        api: {
+          service: 'api', type: AppType.Backend, host: 'api.example.test', port: 443,
+          base: 'api', internalHost: 'api.cluster.local', serverOnly: 'private',
+        },
+        worker: {
+          service: 'worker', type: AppType.Backend, host: 'worker.cluster.local',
+          internalHost: 'worker.cluster.local', port: 3000,
+        },
+      },
+      plugins: [
+        { id: 'web', type: AppType.Frontend, value: 'safe' },
+        { id: 'server', type: AppType.Backend, value: 'private' },
+      ],
+      oidc: {
+        clientCookie: { interaction: { name: 'oidc', ttl: 60 } },
+        accountLinkingService: 'private',
+        providers: [
+          { clientId: 'public', service: 'iam', secret: 'secret', apiClientId: 'admin' },
+          { clientId: 'internal', service: 'iam', internal: true, secret: 'secret' },
+        ],
+      },
+      flowConfig: { defaultFlow: 'signin', services: { auth: 'web' }, serverOnly: 'private' },
+      i18n: { defaultLng: 'en', supportedLngs: ['en', 'pl'], serverOnly: 'private' },
+      [CONFIG_RECORD]: [
+        { id: 'plan:starter', recordType: 'plan', price: 10 },
+        { id: 'flow:signin', recordType: 'flow' },
+      ],
+      smtp: { host: 'smtp.example.test', pass: 'secret' },
+      queue: { queues: [{ name: 'private' }] },
+      dbs: [{ host: 'db.example.test', secret: 'secret' }],
+      secrets: { key: 'secret' },
+    } as unknown as CommonConfig)
+
+    expect(result).toEqual({
+      debug: { all: true, supervisor: true },
+      brand: { name: 'Example' },
+      security: { unsecure: false, auth: { login: { title: 'Sign in' } } },
+      services: {
+        api: { service: 'api', type: AppType.Backend, host: 'api.example.test', port: 443, base: 'api' },
+      },
+      plugins: [{ id: 'web', type: AppType.Frontend, value: 'safe' }],
+      [CONFIG_RECORD]: [{ id: 'plan:starter', recordType: 'plan', price: 10 }],
+    })
+  })
+
+  test('can remove nested secrets after allowing a collection', () => {
+    const result = selectApiConfig({
+      integrations: [
+        { name: 'public', token: 'secret', options: { endpoint: 'https://example.test', key: 'private' } },
+      ],
+    }, {
+      allow: { integrations: every(true) },
+      deny: { integrations: every({ token: true, options: { key: true } }) },
+    })
+
+    expect(result).toEqual({
+      integrations: [{ name: 'public', options: { endpoint: 'https://example.test' } }],
+    })
+  })
+})

package/tsconfig.json

@@ -6,5 +6,5 @@
     "rootDir": "./src/",
     "outDir": "./build/"
   },
-  "exclude": ["./dist/**/*", "./build/**/*", "./*.ts"]
+  "exclude": ["./dist/**/*", "./build/**/*", "./tests/**/*", "./*.ts"]
 }

package/build/modules.d.ts

@@ -1,2 +0,0 @@
-export declare const modules: import("@owlmeans/entrypoint").CommonEntrypoint[];
-//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,OAAO,mDAEnB,CAAA"}

package/build/modules.js

@@ -1,7 +0,0 @@
-import { entrypoint } from '@owlmeans/entrypoint';
-import { route } from '@owlmeans/route';
-import { API_CONFIG } from './consts.js';
-export const modules = [
-    entrypoint(route(API_CONFIG, '/assets/config.json'), { sticky: true }),
-];
-//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CACvE,CAAA"}

package/src/modules.ts

@@ -1,7 +0,0 @@
-import { entrypoint } from '@owlmeans/entrypoint'
-import { route } from '@owlmeans/route'
-import { API_CONFIG } from './consts.js'
-
-export const modules = [
-  entrypoint(route(API_CONFIG, '/assets/config.json'), { sticky: true }),
-]