@owlmeans/server-api 0.1.18-rc.5 → 0.1.18-rc.50

package/build/utils/error.d.ts

@@ -1,3 +1,49 @@
 import type { FastifyReply } from 'fastify';
-export declare const handleError: (error: Error, reply: FastifyReply) => void;
+import type { Config, HttpErrorExposure } from '../types.js';
+import type { SerializedHttpError } from './types.js';
+/**
+ * The HTTP status an error's class declares, or `null` when it declares none that may be honoured.
+ *
+ * Read through the constructor chain — a static property is inherited, so a subclass answers what
+ * its nearest declaring ancestor says, and redeclares to change it. An integer 4xx is honoured
+ * directly. A 5xx is honoured only with `allowServerErrorStatus = true`, so a domain class must
+ * explicitly opt in to exposing a precise availability response. The read is structural, so a
+ * class from a duplicate module copy declares exactly what the imported one does.
+ */
+export declare const declaredErrorStatus: (error: unknown) => number | null;
+/**
+ * The HTTP status an error is answered with, read off the error exactly as given.
+ *
+ * Two families reach here and both must be recognised. `AuthFailedError` / `AccessError` are this
+ * package's own, raised by the request pipeline itself. `AuthorizationError` / `AuthForbidden`
+ * come from `@owlmeans/auth` and are what the guards and gates actually throw — an unrecognised
+ * one answers 500, which reports a refused request as a crashed server: the client cannot tell
+ * "sign in again" from "the service is broken", and a consumer watching statuses concludes the
+ * application fell over. A family member is recognised by class OR by registered type name
+ * ({@link typeNamesOf}), so a class from a duplicate module copy answers the same status.
+ *
+ * **Order matters.** `AuthForbidden extends AuthorizationError`, so the 403 branch has to be
+ * tested first or every refusal of a permission is reported as a failure to authenticate. Both
+ * auth branches come before a class's own declaration, so an auth refusal can never be restated
+ * as something else. Everything that is neither an auth error nor a class declaring an allowed
+ * {@link declaredErrorStatus} answers 500.
+ */
+export declare const errorStatus: (error: unknown) => number;
+/** Invalid or absent configuration always resolves to the production-safe policy. */
+export declare const errorExposure: (config?: Pick<Config, 'http'>) => HttpErrorExposure;
+/** One central wire shape for every server error. */
+export declare const serializeError: (error: Error, exposure?: HttpErrorExposure) => SerializedHttpError;
+/** Apply safe response metadata carried by an error without coupling its package to Fastify. */
+export declare const applyErrorHeaders: (error: unknown, reply: FastifyReply) => void;
+/**
+ * Answer a thrown error: a status, and the marshalled `ResilientError` as the body.
+ *
+ * The status is resolved in two steps. The error AS THROWN comes first: it is the one object whose
+ * class is certainly the class that was raised, while `ResilientError.ensure` rebuilds through the
+ * registry of whichever `@owlmeans/error` copy this module loaded — under duplicate module copies
+ * that turns a perfectly recognisable auth refusal into a plain `ResilientError` answering 500.
+ * Only when the thrown error answers 500 is the ENSURED error asked, because the rebuild is what
+ * gives a status to a marshalled error that crossed a hop as a plain `Error`.
+ */
+export declare const handleError: (error: Error, reply: FastifyReply, exposure?: HttpErrorExposure) => void;
 //# sourceMappingURL=error.d.ts.map

package/build/utils/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAI3C,eAAO,MAAM,WAAW,UAAW,KAAK,SAAS,YAAY,SAY5D,CAAA"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAM3C,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAG5D,OAAO,KAAK,EAAyB,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAG5E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,UAAW,OAAO,KAAG,MAAM,GAAG,IAc7D,CAAA;AAkCD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,WAAW,UAAW,OAAO,KAAG,MAkB5C,CAAA;AAED,qFAAqF;AACrF,eAAO,MAAM,aAAa,YAAa,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,iBACmB,CAAA;AAsBjF,qDAAqD;AACrD,eAAO,MAAM,cAAc,UAClB,KAAK,aAAY,iBAAiB,KACxC,mBAcF,CAAA;AAED,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,UAAW,OAAO,SAAS,YAAY,KAAG,IAcvE,CAAA;AA+BD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,UACf,KAAK,SAAS,YAAY,aAAY,iBAAiB,SAU/D,CAAA"}

package/build/utils/error.js

@@ -1,16 +1,199 @@
-import { FORBIDDEN_ERROR, SERVER_ERROR, UNAUTHORIZED_ERROR } from '@owlmeans/api';
+import { FORBIDDEN_ERROR, SERVER_ERROR, UNAUTHORIZED_ERROR, DENIAL_KIND_HEADER, ACCESS_DENIED_KIND, } from '@owlmeans/api';
 import { AccessError, AuthFailedError } from '../errors.js';
-import { ResilientError } from '@owlmeans/error';
-export const handleError = (error, reply) => {
-    let code = SERVER_ERROR;
-    if (error instanceof AuthFailedError) {
-        code = UNAUTHORIZED_ERROR;
+import { AuthForbidden, AuthorizationError } from '@owlmeans/auth';
+import { isResilientError, ResilientError, SEPARATOR } from '@owlmeans/error';
+import { randomUUID } from 'node:crypto';
+import { logger } from '@owlmeans/log';
+import { CLIENT_ERROR_FIRST, CLIENT_ERROR_LAST, SERVER_ERROR_FIRST, SERVER_ERROR_LAST } from './consts.local.js';
+import { INCIDENT_ID_HEADER } from './consts.js';
+/**
+ * The HTTP status an error's class declares, or `null` when it declares none that may be honoured.
+ *
+ * Read through the constructor chain — a static property is inherited, so a subclass answers what
+ * its nearest declaring ancestor says, and redeclares to change it. An integer 4xx is honoured
+ * directly. A 5xx is honoured only with `allowServerErrorStatus = true`, so a domain class must
+ * explicitly opt in to exposing a precise availability response. The read is structural, so a
+ * class from a duplicate module copy declares exactly what the imported one does.
+ */
+export const declaredErrorStatus = (error) => {
+    if (error == null || typeof error !== 'object') {
+        return null;
     }
-    else if (error instanceof AccessError) {
-        code = FORBIDDEN_ERROR;
+    const declaration = error.constructor;
+    const status = declaration?.httpStatus;
+    if (typeof status !== 'number' || !Number.isInteger(status)) {
+        return null;
     }
+    if (status >= CLIENT_ERROR_FIRST && status <= CLIENT_ERROR_LAST)
+        return status;
+    if (status >= SERVER_ERROR_FIRST && status <= SERVER_ERROR_LAST
+        && declaration?.allowServerErrorStatus === true)
+        return status;
+    return null;
+};
+/**
+ * The registered type names an error carries: its own `type`, and the static `typeName` of every
+ * class on its constructor chain.
+ *
+ * This is how a class is recognised when `instanceof` cannot see it. A process that loads a package
+ * twice — `bun --preserve-symlinks` over a linked workspace resolves one package through several
+ * `node_modules` paths — holds several copies of every error class, and an error built by one copy
+ * is not an instance of another. The registered names are the same in every copy. A subclass's
+ * `typeName` does not reliably embed its parent's (`EntitlementRefusal` extends `AuthForbidden`), so
+ * a family is recognised by walking the chain and matching names exactly, never by a substring.
+ */
+const typeNamesOf = (error) => {
+    const names = new Set();
+    const type = error.type;
+    if (typeof type === 'string') {
+        names.add(type);
+    }
+    let ctor = error.constructor;
+    while (typeof ctor === 'function') {
+        const name = ctor.typeName;
+        if (typeof name === 'string') {
+            names.add(name);
+        }
+        ctor = Object.getPrototypeOf(ctor);
+    }
+    return names;
+};
+const isOfFamily = (names, family) => family.some(typeName => names.has(typeName));
+/**
+ * The HTTP status an error is answered with, read off the error exactly as given.
+ *
+ * Two families reach here and both must be recognised. `AuthFailedError` / `AccessError` are this
+ * package's own, raised by the request pipeline itself. `AuthorizationError` / `AuthForbidden`
+ * come from `@owlmeans/auth` and are what the guards and gates actually throw — an unrecognised
+ * one answers 500, which reports a refused request as a crashed server: the client cannot tell
+ * "sign in again" from "the service is broken", and a consumer watching statuses concludes the
+ * application fell over. A family member is recognised by class OR by registered type name
+ * ({@link typeNamesOf}), so a class from a duplicate module copy answers the same status.
+ *
+ * **Order matters.** `AuthForbidden extends AuthorizationError`, so the 403 branch has to be
+ * tested first or every refusal of a permission is reported as a failure to authenticate. Both
+ * auth branches come before a class's own declaration, so an auth refusal can never be restated
+ * as something else. Everything that is neither an auth error nor a class declaring an allowed
+ * {@link declaredErrorStatus} answers 500.
+ */
+export const errorStatus = (error) => {
+    if (error == null || typeof error !== 'object') {
+        return SERVER_ERROR;
+    }
+    const names = typeNamesOf(error);
+    if (error instanceof AuthForbidden || error instanceof AccessError
+        || isOfFamily(names, [AuthForbidden.typeName, AccessError.typeName])) {
+        // An established identity that lacks the permission. Re-authenticating changes nothing.
+        return FORBIDDEN_ERROR;
+    }
+    if (error instanceof AuthorizationError || error instanceof AuthFailedError
+        || isOfFamily(names, [AuthorizationError.typeName, AuthFailedError.typeName])) {
+        // No usable credential — absent, expired, revoked, or naming a session this server no longer
+        // holds. The caller is told to sign in, not that signing in would not help.
+        return UNAUTHORIZED_ERROR;
+    }
+    return declaredErrorStatus(error) ?? SERVER_ERROR;
+};
+/** Invalid or absent configuration always resolves to the production-safe policy. */
+export const errorExposure = (config) => config?.http?.errors?.exposure === 'development' ? 'development' : 'production';
+/**
+ * Preserve a typed/marshalled error when possible without asking `ensure` to convert a plain
+ * error. In particular, `ensure` deliberately rethrows SyntaxError; an HTTP boundary still has
+ * to serialize it safely and let the incident log retain the original object.
+ */
+const normalizeForWire = (error) => {
+    if (error instanceof SyntaxError || isResilientError(error)) {
+        return error;
+    }
+    if (error.message.includes(SEPARATOR)) {
+        const ensured = ResilientError.ensure(error);
+        // The catch-all converter's legacy constructor shape shifts an ordinary error's fields.
+        // Only keep `ensure`'s result when a registered wire prefix actually rebuilt something.
+        if (ensured.type !== error.message || ensured.message !== error.stack) {
+            return ensured;
+        }
+    }
+    return error;
+};
+/** One central wire shape for every server error. */
+export const serializeError = (error, exposure = 'production') => {
+    const normalized = normalizeForWire(error);
+    const thrown = errorStatus(error);
+    const status = thrown !== SERVER_ERROR ? thrown : errorStatus(normalized);
+    const incidentId = randomUUID();
+    // The server log owns every diagnostic. Production callers receive only its correlation key;
+    // development keeps the typed wire form so local clients can retain their usual error details.
+    Object.assign(error, { incidentId });
+    if (isResilientError(normalized))
+        normalized.incidentId = incidentId;
+    const body = exposure === 'production'
+        ? incidentId
+        : ResilientError.marshal(normalized, { includeStack: true, incidentId }).message;
+    return { status, body, incidentId };
+};
+/** Apply safe response metadata carried by an error without coupling its package to Fastify. */
+export const applyErrorHeaders = (error, reply) => {
+    if (error == null || typeof error !== 'object') {
+        return;
+    }
+    const retryAfter = error.retryAfter;
+    if (typeof retryAfter === 'number' && Number.isFinite(retryAfter) && retryAfter > 0) {
+        reply.header('Retry-After', String(Math.ceil(retryAfter)));
+    }
+    // Match exact registered types. EntitlementRefusal also extends AuthForbidden but is a plan
+    // decision, not a person's IAM permission denial.
+    const type = error.type;
+    if (type === AuthForbidden.typeName || type === AccessError.typeName) {
+        reply.header(DENIAL_KIND_HEADER, ACCESS_DENIED_KIND);
+    }
+};
+const http = logger('http');
+/**
+ * The one log entry of a failed request, by what the failure means:
+ *
+ * | Status | Level | Why |
+ * |---|---|---|
+ * | 5xx | error | a fault — the one entry that owns type, message and stack, keyed by the incident id |
+ * | 403 | warn, `access.forbidden` | an established identity was refused; worth an operator's eye |
+ * | 401 | debug, `auth.refused` | an absent or expired credential is the ordinary shape of a sign-in |
+ * | other 4xx | debug | the caller's mistake, not the server's |
+ *
+ * The method and path are logged; the query string is not — it can carry a token.
+ */
+const logFailure = (error, reply, status, incidentId) => {
+    const request = reply.request;
+    const where = { method: request?.method, path: request?.url?.split('?')[0], status, incidentId };
+    if (status >= SERVER_ERROR) {
+        http.error('Request failed', { err: error, ...where });
+    }
+    else if (status === FORBIDDEN_ERROR) {
+        http.warn('Access forbidden', { type: error.type, message: error.message, ...where }, { event: 'access.forbidden' });
+    }
+    else if (status === UNAUTHORIZED_ERROR) {
+        http.debug('Authentication refused', { message: error.message, ...where }, { event: 'auth.refused' });
+    }
+    else {
+        http.debug('Request refused', { message: error.message, ...where });
+    }
+};
+/**
+ * Answer a thrown error: a status, and the marshalled `ResilientError` as the body.
+ *
+ * The status is resolved in two steps. The error AS THROWN comes first: it is the one object whose
+ * class is certainly the class that was raised, while `ResilientError.ensure` rebuilds through the
+ * registry of whichever `@owlmeans/error` copy this module loaded — under duplicate module copies
+ * that turns a perfectly recognisable auth refusal into a plain `ResilientError` answering 500.
+ * Only when the thrown error answers 500 is the ENSURED error asked, because the rebuild is what
+ * gives a status to a marshalled error that crossed a hop as a plain `Error`.
+ */
+export const handleError = (error, reply, exposure = 'production') => {
     if (!reply.sent) {
-        reply.code(code).send(ResilientError.marshal(ResilientError.ensure(error)).message);
+        const serialized = serializeError(error, exposure);
+        applyErrorHeaders(error, reply);
+        logFailure(error, reply, serialized.status, serialized.incidentId);
+        reply.header(INCIDENT_ID_HEADER, serialized.incidentId)
+            .code(serialized.status)
+            .send(serialized.body);
     }
 };
 //# sourceMappingURL=error.js.map

package/build/utils/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEjF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAY,EAAE,KAAmB,EAAE,EAAE;IAC/D,IAAI,IAAI,GAAW,YAAY,CAAA;IAC/B,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,GAAG,kBAAkB,CAAA;IAC3B,CAAC;SAAM,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACxC,IAAI,GAAG,eAAe,CAAA;IACxB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACnB,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,KAAc,CAAC,CAAC,CAAC,OAAO,CACtE,CAAA;IACH,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,GAC1F,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAChH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAIhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAiB,EAAE;IACnE,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAgD,CAAA;IAC1E,MAAM,MAAM,GAAG,WAAW,EAAE,UAAU,CAAA;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,IAAI,kBAAkB,IAAI,MAAM,IAAI,iBAAiB;QAAE,OAAO,MAAM,CAAA;IAC9E,IAAI,MAAM,IAAI,kBAAkB,IAAI,MAAM,IAAI,iBAAiB;WAC1D,WAAW,EAAE,sBAAsB,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IAEhE,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAAC,KAAa,EAAe,EAAE;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAA;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,GAAY,KAAK,CAAC,WAAW,CAAA;IACrC,OAAO,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,GAAI,IAA+B,CAAC,QAAQ,CAAA;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QACD,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAE,MAAgB,EAAW,EAAE,CACnE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;AAE9C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE;IACpD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,YAAY,WAAW;WAC7D,UAAU,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvE,wFAAwF;QACxF,OAAO,eAAe,CAAA;IACxB,CAAC;IACD,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,YAAY,eAAe;WACtE,UAAU,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChF,6FAA6F;QAC7F,4EAA4E;QAC5E,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAED,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAA;AACnD,CAAC,CAAA;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAA6B,EAAqB,EAAE,CAChF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAA;AAEjF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,KAAY,EAAS,EAAE;IAC/C,IAAI,KAAK,YAAY,WAAW,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5C,wFAAwF;QACxF,wFAAwF;QACxF,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACtE,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAY,EAAE,QAAQ,GAAsB,YAAY,EACnC,EAAE;IACvB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACzE,MAAM,UAAU,GAAG,UAAU,EAAE,CAAA;IAC/B,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IACpC,IAAI,gBAAgB,CAAC,UAAU,CAAC;QAAE,UAAU,CAAC,UAAU,GAAG,UAAU,CAAA;IACpE,MAAM,IAAI,GAAG,QAAQ,KAAK,YAAY;QACpC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAA;IAElF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AACrC,CAAC,CAAA;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,KAAmB,EAAQ,EAAE;IAC7E,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAM;IACR,CAAC;IACD,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;IACjE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC5D,CAAC;IACD,4FAA4F;IAC5F,kDAAkD;IAClD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAA;IAC/C,IAAI,IAAI,KAAK,aAAa,CAAC,QAAQ,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QACrE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAA;IACtD,CAAC;AACH,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,CAAC,KAAY,EAAE,KAAmB,EAAE,MAAc,EAAE,UAAkB,EAAQ,EAAE;IACjG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;IAC7B,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAChG,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IACxD,CAAC;SAAM,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAG,KAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,EAC1G,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAClC,CAAC;SAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;IACvG,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IACrE,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,KAAY,EAAE,KAAmB,EAAE,QAAQ,GAAsB,YAAY,EAC7E,EAAE;IACF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAClD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC/B,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;QAClE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC,UAAU,CAAC;aACpD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;AACH,CAAC,CAAA"}

package/build/utils/guards.d.ts

@@ -1,9 +1,5 @@
 import type { FastifyReply, FastifyRequest } from 'fastify';
 import type { ServerEntrypoint } from '@owlmeans/server-entrypoint';
-import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
-type Config = ServerConfig;
-interface Context<C extends Config = Config> extends ServerContext<C> {
-}
+import type { Config, Context } from './types.local.js';
 export declare const authorize: <C extends Config, T extends Context<C>>(context: T, module: ServerEntrypoint<FastifyRequest>, req: FastifyRequest, reply: FastifyReply) => Promise<[T, ServerEntrypoint<FastifyRequest>]>;
-export {};
 //# sourceMappingURL=guards.d.ts.map

package/build/utils/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAK3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAC1B,UAAU,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;CAAI;AAEzE,eAAO,MAAM,SAAS,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,UAAU,gBAAgB,CAAC,cAAc,CAAC,OAC/C,cAAc,SAAS,YAAY,KACvC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CA0D/C,CAAA"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAMnE,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGvD,eAAO,MAAM,SAAS,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,UAAU,gBAAgB,CAAC,cAAc,CAAC,OAC/C,cAAc,SAAS,YAAY,KACvC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAmD/C,CAAA"}

package/build/utils/guards.js

@@ -1,7 +1,7 @@
-import { isContextWithoutIds, Layer } from '@owlmeans/context';
 import { provideResponse } from '@owlmeans/entrypoint';
 import { executeResponse, provideRequest } from './payload.js';
 import { AuthFailedError } from '../errors.js';
+import { attachEntity } from '@owlmeans/auth-common';
 export const authorize = async (context, module, req, reply) => {
     const guards = module.getGuards();
     if (guards.length > 0) {
@@ -34,20 +34,16 @@ export const authorize = async (context, module, req, reply) => {
         if (request.auth != null) {
             req._auth = request.auth;
         }
-        if (request.auth?.entityId != null) {
-            // @TODO Probably we need to downgrade context in this case
-            if (!isContextWithoutIds(context)) {
-                throw SyntaxError(`Context should be without ids during authorization ${context.cfg.layer}:${context.cfg.layerId}`);
-            }
-            if (isContextWithoutIds(context) && context.cfg.layer !== Layer.Service) {
-                context = await context.updateContext(undefined, Layer.Service);
-                await context.waitForInitialized();
-            }
-            context = await context.updateContext(request.auth.entityId, Layer.Entity);
-            await context.waitForInitialized();
-            // We elevate module to the context level if it was changed
-            module = context.entrypoint(module.alias);
-            await module.resolve();
+        // The token names the organization by slug; everything downstream — grants, records, minted
+        // infrastructure names — keys on the entity's stable id. Resolving here, once, is what keeps a
+        // rename from being a sweep of every handler: the id arrives on the request, and a slug that
+        // has since been retired still resolves to the entity that retired it.
+        const entity = await attachEntity(context, request);
+        if (entity != null) {
+            // Carried on the raw request the same way `_auth` is, so the request the handler is given
+            // later — a different object, built after this runs — sees the same resolution.
+            ;
+            req._entity = entity;
         }
     }
     // Update context in request object

package/build/utils/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAI9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAM9C,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAU,EAAE,MAAwC,EACpD,GAAmB,EAAE,KAAmB,EACQ,EAAE;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAEjD,IAAI,KAAK,GAA6B,SAAS,CAAA;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAiB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACnD,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC1C,KAAK,GAAG,MAAM,CAAA;YAChB,CAAC;YACD,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACtC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,EAAE,CAAA;QAC7B,CAAC;QAED,MAAM,YAAY,GAAG,eAAe,CAAO,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAU,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACxC,CAAC;QACD,eAAe,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAC1C,6EAA6E;QAC7E,oCAAoC;QACpC,6GAA6G;QAC7G,IAAI;QACJ,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,GAAW,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAA;QACnC,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;YACnC,2DAA2D;YAC3D,IAAI,CAAC,mBAAmB,CAAC,OAAc,CAAC,EAAE,CAAC;gBACzC,MAAM,WAAW,CAAC,sDAAsD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACrH,CAAC;YAED,IAAI,mBAAmB,CAAC,OAAc,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC/E,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC/D,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAA;YACpC,CAAC;YACD,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC1E,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAA;YAElC,2DAA2D;YAC3D,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACH,CAAC;IACD,mCAAmC;IAClC,GAAW,CAAC,IAAI,GAAG,OAAO,CAAA;IAE3B,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AAC1B,CAAC,CAAA"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAIpD,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAU,EAAE,MAAwC,EACpD,GAAmB,EAAE,KAAmB,EACQ,EAAE;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAEjD,IAAI,KAAK,GAA6B,SAAS,CAAA;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAiB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACnD,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC1C,KAAK,GAAG,MAAM,CAAA;YAChB,CAAC;YACD,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACtC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,EAAE,CAAA;QAC7B,CAAC;QAED,MAAM,YAAY,GAAG,eAAe,CAAO,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAU,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACxC,CAAC;QACD,eAAe,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAC1C,6EAA6E;QAC7E,oCAAoC;QACpC,6GAA6G;QAC7G,IAAI;QACJ,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,GAAW,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAA;QACnC,CAAC;QAED,4FAA4F;QAC5F,+FAA+F;QAC/F,6FAA6F;QAC7F,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,0FAA0F;YAC1F,gFAAgF;YAChF,CAAC;YAAC,GAAW,CAAC,OAAO,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,mCAAmC;IAClC,GAAW,CAAC,IAAI,GAAG,OAAO,CAAA;IAE3B,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AAC1B,CAAC,CAAA"}

package/build/utils/index.d.ts

@@ -1,4 +1,6 @@
 export * from './error.js';
+export * from './consts.js';
+export type * from './types.js';
 export * from './server.js';
 export * from './payload.js';
 export * from './server.js';

package/build/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/utils/index.js

@@ -1,4 +1,5 @@
 export * from './error.js';
+export * from './consts.js';
 export * from './server.js';
 export * from './payload.js';
 export * from './server.js';

package/build/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAE3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/utils/log.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyBaseLogger } from 'fastify';
+import { type Logger } from '@owlmeans/log';
+/**
+ * A pino-shaped logger over `@owlmeans/log`, handed to Fastify as its `loggerInstance`.
+ *
+ * Fastify then logs through the process's own level, format and plugins instead of a second pino
+ * instance that ignores them. `(object, message)` and `(message)` are the two shapes Fastify and
+ * its plugins call with; an `err` in the object travels as the record's error.
+ */
+export declare const fastifyLogger: (log?: Logger, bindings?: Record<string, unknown>) => FastifyBaseLogger;
+//# sourceMappingURL=log.d.ts.map

package/build/utils/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/utils/log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAyB,KAAK,MAAM,EAAE,MAAM,eAAe,CAAA;AA0BlE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,SAAS,MAAM,aAA8B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,iBAsBhG,CAAA"}

package/build/utils/log.js

@@ -0,0 +1,57 @@
+import { logger } from '@owlmeans/log';
+/**
+ * What Fastify says about itself, mapped to what an operator needs at each level.
+ *
+ * Fastify writes a pair of `info` lines for EVERY request and one for each unknown route, and
+ * announces its own listening address. The server writes one `debug` record per request itself
+ * (`onResponse`), a failed request is classified once in `handleError`, and the listening line is
+ * `server.listening` — so these are dropped or lowered here, by their fixed wording, rather than by
+ * a Fastify option (`disableRequestLogging` is deprecated from 5.12, `logController` does not exist
+ * before it).
+ */
+const levelOf = (level, message) => {
+    if (typeof message !== 'string' || level !== 'info') {
+        return level;
+    }
+    if (message === 'incoming request' || message === 'request completed') {
+        return undefined;
+    }
+    if (message.startsWith('Server listening at') || /^Route .* not found$/.test(message)) {
+        return 'debug';
+    }
+    return level;
+};
+/**
+ * A pino-shaped logger over `@owlmeans/log`, handed to Fastify as its `loggerInstance`.
+ *
+ * Fastify then logs through the process's own level, format and plugins instead of a second pino
+ * instance that ignores them. `(object, message)` and `(message)` are the two shapes Fastify and
+ * its plugins call with; an `err` in the object travels as the record's error.
+ */
+export const fastifyLogger = (log = logger('http'), bindings) => {
+    const call = (requested) => (first, second) => {
+        const [object, message] = typeof first === 'string' || first instanceof Error
+            ? [undefined, first] : [first, second];
+        const level = levelOf(requested, message);
+        if (level == null) {
+            return;
+        }
+        const data = bindings != null && Object.keys(bindings).length > 0
+            ? { ...bindings, ...(object != null && typeof object === 'object' ? object : {}) } : object;
+        log[level](message == null ? '' : message instanceof Error ? message : String(message), data);
+    };
+    const adapter = {
+        get level() { return levelName(log); },
+        set level(_value) { },
+        fatal: call('error'), error: call('error'), warn: call('warn'),
+        info: call('info'), debug: call('debug'), trace: call('debug'),
+        silent: () => undefined,
+        child: (extra) => fastifyLogger(log, { ...bindings, ...extra }),
+    };
+    return adapter;
+};
+const levelName = (log) => {
+    const order = ['debug', 'info', 'warn', 'error'];
+    return order.find(level => log.enabled(level)) ?? 'silent';
+};
+//# sourceMappingURL=log.js.map

package/build/utils/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/utils/log.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAA8B,MAAM,eAAe,CAAA;AAGlE;;;;;;;;;GASG;AACH,MAAM,OAAO,GAAG,CAAC,KAAe,EAAE,OAAgB,EAAwB,EAAE;IAC1E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACpD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACtE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,GAAW,MAAM,CAAC,MAAM,CAAC,EAAE,QAAkC,EAAqB,EAAE;IACnH,MAAM,IAAI,GAAG,CAAC,SAAmB,EAAE,EAAE,CAAC,CAAC,KAAc,EAAE,MAAgB,EAAQ,EAAE;QAC/E,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,KAAK;YAC3E,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACzC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;YAC/D,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7F,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/F,CAAC,CAAA;IAED,MAAM,OAAO,GAAG;QACd,IAAI,KAAK,KAAa,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAc,IAA+D,CAAC;QACxF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC9D,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;QAC9D,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;QACvB,KAAK,EAAE,CAAC,KAA8B,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;KACzF,CAAA;IACD,OAAO,OAAuC,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE;IACxC,MAAM,KAAK,GAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAA;AAC5D,CAAC,CAAA"}

package/build/utils/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/utils/payload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,KAAK,CAAA;AAE1C,eAAO,MAAM,cAAc,UAAW,MAAM,OAAO,OAAO,cAAc,OAAO,KAAG,eAYjF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,YAAY,gBAAgB,CAAC,CAAC,CAAC,SAAS,QAAQ,iBAAiB,OAAO,KAAG,OAuB3G,CAAA;AAGD,eAAO,MAAM,cAAc,WAAY,eAAe,oBAgBrD,CAAA"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/utils/payload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,KAAK,CAAA;AAG1C,eAAO,MAAM,cAAc,UAAW,MAAM,OAAO,OAAO,cAAc,OAAO,KAAG,eAejF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,YAAY,gBAAgB,CAAC,CAAC,CAAC,SAAS,QAAQ,iBAAiB,OAAO,KAAG,OAuB3G,CAAA;AAGD,eAAO,MAAM,cAAc,WAAY,eAAe,oBAgBrD,CAAA"}

package/build/utils/payload.js

@@ -1,10 +1,14 @@
 import { EntrypointOutcome } from '@owlmeans/entrypoint';
-import { ACCEPTED, CREATED, OK, SERVER_ERROR } from '@owlmeans/api';
+import { ACCEPTED, CREATED, OK } from '@owlmeans/api';
+import { handleError } from './error.js';
 export const provideRequest = (alias, req, provision) => {
     provision = provision ?? false;
     return {
         alias,
         auth: req._auth ?? undefined,
+        // Resolved once by `authorize` and carried by reference, exactly like `_auth`, so a handler
+        // reached through any path sees the same entity the guard admitted.
+        entity: req._entity ?? undefined,
         params: req.params,
         body: req.body,
         headers: req.headers,
@@ -27,7 +31,7 @@ export const executeResponse = (response, reply, throwOnError) => {
         if (throwOnError ?? false) {
             throw response.error;
         }
-        reply.code(SERVER_ERROR).send(response.error.message);
+        handleError(response.error, reply);
         return true;
     }
     else if (response.outcome != null) {

package/build/utils/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/utils/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAGxD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAGnE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,GAAY,EAAE,SAAmB,EAAmB,EAAE;IAClG,SAAS,GAAG,SAAS,IAAI,KAAK,CAAA;IAC9B,OAAO;QACL,KAAK;QACL,IAAI,EAAG,GAAW,CAAC,KAAK,IAAI,SAAS;QACrC,MAAM,EAAE,GAAG,CAAC,MAA4D;QACxE,IAAI,EAAE,GAAG,CAAC,IAA2B;QACrC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAA2D;QACtE,IAAI,EAAE,GAAG,CAAC,GAAG;QACb,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACtC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,QAA6B,EAAE,KAAe,EAAE,YAAsB,EAAW,EAAE;IACpH,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,QAAQ,CAAC,KAAK,CAAA;QACtB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACpC,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,KAAK,iBAAiB,CAAC,QAAQ;gBAC7B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAK;YACP,KAAK,iBAAiB,CAAC,OAAO;gBAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBACxC,MAAK;YACP,KAAK,iBAAiB,CAAC,EAAE,CAAC;YAC1B;gBACE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAGD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAuB,EAAE,EAAE;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAA;YACtB,MAAM,CAAC,MAAM,GAAG,WAAW,CAAA;YAC3B,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,QAAQ,CAAA;YACxB,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YACrC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CACpC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAwB,CAAC,CAAC,CAAC,CACzG,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/utils/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAGxD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,GAAY,EAAE,SAAmB,EAAmB,EAAE;IAClG,SAAS,GAAG,SAAS,IAAI,KAAK,CAAA;IAC9B,OAAO;QACL,KAAK;QACL,IAAI,EAAG,GAAW,CAAC,KAAK,IAAI,SAAS;QACrC,4FAA4F;QAC5F,oEAAoE;QACpE,MAAM,EAAG,GAAW,CAAC,OAAO,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG,CAAC,MAA4D;QACxE,IAAI,EAAE,GAAG,CAAC,IAA2B;QACrC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAA2D;QACtE,IAAI,EAAE,GAAG,CAAC,GAAG;QACb,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACtC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,QAA6B,EAAE,KAAe,EAAE,YAAsB,EAAW,EAAE;IACpH,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,QAAQ,CAAC,KAAK,CAAA;QACtB,CAAC;QACD,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACpC,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,KAAK,iBAAiB,CAAC,QAAQ;gBAC7B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAK;YACP,KAAK,iBAAiB,CAAC,OAAO;gBAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBACxC,MAAK;YACP,KAAK,iBAAiB,CAAC,EAAE,CAAC;YAC1B;gBACE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAGD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAuB,EAAE,EAAE;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAA;YACtB,MAAM,CAAC,MAAM,GAAG,WAAW,CAAA;YAC3B,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,QAAQ,CAAA;YACxB,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YACrC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CACpC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAwB,CAAC,CAAC,CAAC,CACzG,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/utils/server.d.ts

@@ -1,10 +1,7 @@
 import type { FastifyReply, FastifyRequest } from 'fastify';
 import type { ServerEntrypoint } from '@owlmeans/server-entrypoint';
-import type { CommonEntrypoint } from '@owlmeans/entrypoint';
-import type { ServerContext, ServerConfig } from '@owlmeans/server-context';
-type Config = ServerConfig;
-type Context = ServerContext<Config>;
-export declare const canServeModule: (context: Context, module: CommonEntrypoint) => module is ServerEntrypoint<unknown>;
+import { type CommonEntrypoint } from '@owlmeans/entrypoint';
+import type { ServerContext2 } from './types.local.js';
+export declare const canServeModule: (context: ServerContext2, module: CommonEntrypoint) => module is ServerEntrypoint<unknown>;
 export declare const createServerHandler: (module: ServerEntrypoint<FastifyRequest>, location: string) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
-export {};
 //# sourceMappingURL=server.d.ts.map

package/build/utils/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/utils/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE3D,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAG5D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQ3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAC1B,KAAK,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;AAEpC,eAAO,MAAM,cAAc,YAAa,OAAO,UAAU,gBAAgB,KAAG,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAY7G,CAAA;AAED,eAAO,MAAM,mBAAmB,WAAY,gBAAgB,CAAC,cAAc,CAAC,YAAY,MAAM,WAChF,cAAc,SAAS,YAAY,kBA0C9C,CAAA"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/utils/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,EAAE,KAAK,gBAAgB,EAAqC,MAAM,sBAAsB,CAAA;AAQ/F,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGrE,eAAO,MAAM,cAAc,YAAa,cAAc,UAAU,gBAAgB,KAAG,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAcpH,CAAA;AAED,eAAO,MAAM,mBAAmB,WAAY,gBAAgB,CAAC,cAAc,CAAC,YAAY,MAAM,WAChF,cAAc,SAAS,YAAY,kBAuC9C,CAAA"}

package/build/utils/server.js

@@ -1,9 +1,9 @@
-import { AppType } from '@owlmeans/context';
-import { assertContext } from '@owlmeans/context';
+import { AppType, assertContext } from '@owlmeans/context';
 import { provideResponse } from '@owlmeans/entrypoint';
 import { ResilientError } from '@owlmeans/error';
 import { OK } from '@owlmeans/api';
-import { handleError } from './error.js';
+import { logger } from '@owlmeans/log';
+import { errorExposure, handleError } from './error.js';
 import { executeResponse, provideRequest } from './payload.js';
 import { authorize } from './guards.js';
 import { RouteProtocols } from '@owlmeans/route';
@@ -14,7 +14,9 @@ export const canServeModule = (context, module) => {
     if (module.route.route.service != null && module.route.route.service !== context.cfg.service) {
         return false;
     }
-    if (module.route.route.protocol === RouteProtocols.SOCKET) {
+    // HTTP serves only its own protocol. Custom transports are handled by their owning packages.
+    if (module.route.route.protocol != null
+        && module.route.route.protocol !== RouteProtocols.WEB) {
         return false;
     }
     return 'isIntermediate' in module.route;
@@ -43,20 +45,17 @@ export const createServerHandler = (module, location) => async (req, reply) => {
         // neither `executeResponse` nor the handler itself (hijack) replied.
         const responded = executeResponse(response, reply, true);
         if (!responded && !reply.sent) {
-            console.warn(`SENDS DEFAULT RESPONSE: ${module.alias}`);
+            logger('http').warn(`SENDS DEFAULT RESPONSE: ${module.alias}`);
             reply.code(OK).send(response.value);
         }
     }
     catch (error) {
-        console.error(`Error in ${module.alias} (${location})`);
-        console.error(JSON.stringify(error, null, 2));
-        console.error(error);
         if (module.fixer != null) {
             const fixer = context.service(module.fixer);
             fixer.handle(reply, ResilientError.ensure(error));
             return;
         }
-        handleError(error, reply);
+        handleError(error, reply, errorExposure(context.cfg));
     }
 };
 //# sourceMappingURL=server.js.map

package/build/utils/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/utils/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAIjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAKhD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAwB,EAAuC,EAAE;IAChH,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC7F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,gBAAgB,IAAI,MAAM,CAAC,KAAK,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAwC,EAAE,QAAgB,EAAE,EAAE,CAChG,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;IACjD,iDAAiD;IACjD,IAAI,OAAO,GAAG,aAAa,CAAmB,GAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACzE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC/D,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAEtB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,GAAgB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5C,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAEtC,iEAAiE;QACjE,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,KAAK,KAAK,QAAQ,GAAG,CAAC,CAAA;QACvD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACpB,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,KAAK,GAAiB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAc,CAAC,CAAC,CAAA;YAC1D,OAAM;QACR,CAAC;QACD,WAAW,CAAC,KAAc,EAAE,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/utils/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAG1D,OAAO,EAA2C,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAIhD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAuB,EAAE,MAAwB,EAAuC,EAAE;IACvH,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC7F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,6FAA6F;IAC7F,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI;WAClC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC,GAAG,EAAE,CAAC;QACxD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,gBAAgB,IAAI,MAAM,CAAC,KAAK,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAwC,EAAE,QAAgB,EAAE,EAAE,CAChG,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;IACjD,iDAAiD;IACjD,IAAI,OAAO,GAAG,aAAa,CAAiC,GAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC/D,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAEtB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,GAAgB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC5C,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAEtC,iEAAiE;QACjE,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;YAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,KAAK,GAAiB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAc,CAAC,CAAC,CAAA;YAC1D,OAAM;QACR,CAAC;QACD,WAAW,CAAC,KAAc,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAChE,CAAC;AACH,CAAC,CAAA"}

package/build/utils/types.d.ts

@@ -0,0 +1,18 @@
+/**
+ * What an error class may declare about the HTTP status it is answered with.
+ *
+ * Structural on purpose: the classes that declare it live in packages that must not depend on an
+ * HTTP server (`@owlmeans/payment`, a product's contract package), so they write a plain
+ * `public static httpStatus = 409` and nothing imports this type.
+ */
+export interface HttpStatusDeclaration {
+    httpStatus?: unknown;
+    /** Explicit opt-in for a declared 5xx response. Client-error declarations need no opt-in. */
+    allowServerErrorStatus?: unknown;
+}
+export interface SerializedHttpError {
+    status: number;
+    body: string;
+    incidentId: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/utils/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,6FAA6F;IAC7F,sBAAsB,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB"}