@owlmeans/server-app 0.1.18-rc.2 → 0.1.18-rc.20

package/README.md

@@ -6,13 +6,14 @@ The main entry point for OwlMeans backend services — aggregates server package
 
 - `makeContext(cfg)` creates a fully initialized server context with Fastify, auth, WebSocket, and static resource support
 - `main(ctx, entrypoints)` registers entrypoints, initializes the context, and starts the HTTP server
+- `holdApiPort` + the boot-state module give a bind-first boot: the port answers for the app before it initializes
 - Re-exports the most commonly used symbols from lower-level packages so backend code has a single import target
 - Used by every service in the viable monorepo
 
 ## Installation
 
 ```bash
-bun add @owlmeans/server-app
+bun add @owlmeans/server-app@^0.1.18-rc.17
 ```
 
 ## Usage
@@ -20,29 +21,71 @@ bun add @owlmeans/server-app
 Bootstrap a backend service:
 
 ```typescript
-import { makeContext, main, modules, config, service, AppType, Layer } from '@owlmeans/server-app'
+import { makeContext, main, entrypoints, config, service, AppType } from '@owlmeans/server-app'
 
 const appConfig = config(
   AppType.Backend,
   'manager-api',
-  service({ service: 'mongo', host: process.env.MONGO_HOST!, port: 27017 }),
-  { layer: Layer.Service, port: 3000 }
+  service({ service: 'manager-api', host: process.env.API_HOST!, port: 3000 }),
+  { port: 3000, dbs: [{ service: 'mongo', alias: 'mongo', host: process.env.MONGO_HOST!, port: 27017 }] }
 )
 
 const context = makeContext(appConfig)
-await main(context, [...modules, ...appModules])
+await main(context, [...entrypoints, ...appEntrypoints])
 ```
 
 Elevate an entrypoint with a handler:
 
 ```typescript
-import { elevate, handleBody, guard, GUARD_ED25519, modules } from '@owlmeans/server-app'
+import { elevate, handleBody, guard, GUARD_ED25519 } from '@owlmeans/server-app'
+import { appEntrypoints } from './entrypoints'
 
-elevate(modules, 'project-create', handleBody<CreateProject>(async (payload, ctx) => {
+elevate(appEntrypoints, 'project-create', handleBody<CreateProject>(async (payload, ctx) => {
   return await (ctx as Context).project().create(payload)
 }), guard(GUARD_ED25519))
 ```
 
+### Bind-first boot
+
+`main()` is the short path. An app that must explain a **failed** boot binds the port first instead,
+so a startup failure has somewhere to be reported from — without a listener the edge answers a bare
+connect error that names neither the app nor the cause:
+
+```typescript
+import { holdApiPort, bootHold, setBootPhase, bootHealthPayload } from '@owlmeans/server-app'
+
+const hold = await holdApiPort(ctx.cfg, bootHold(HEALTH_PATH)).catch((error: Error) => {
+  // A failure to BIND is fatal: carried past, the boot ends with nothing listening and exits 0
+  // while a predecessor keeps serving stale code. Exit non-zero so a supervisor reclaims the port.
+  console.error(`[boot] STARTUP FAILED — ${error.message}`)
+  process.exit(1)
+})
+
+try {
+  await ctx.configure().init()
+} catch (error) {
+  // Stay alive: the hold is the only thing that can explain why nothing is serving.
+  setBootPhase('failed', (error as Error).message)
+  return
+}
+
+await hold.release()          // awaited — `listen()` throws while a predecessor holds the socket
+setBootPhase('ready')
+await ctx.getApiServer().listen()
+```
+
+The hold answers `HEALTH_PATH` with `bootHealthPayload()` and everything else with **503** (not 404
+— the real routes do not exist yet). Once the app's own server takes the socket, its health handler
+spreads the same `bootHealthPayload()` into its answer, so a consumer polling across the handover
+never sees the body change under it:
+
+```typescript
+export const handleHealtz = handleRequest(async (_req, ctx) => ({
+  ...bootHealthPayload(),
+  db: await pingDb(ctx)
+}))
+```
+
 ## API
 
 ### `makeContext<C, T>(cfg, customize?): T`
@@ -53,6 +96,23 @@ Creates a server context with Fastify HTTP, WebSocket, static resources, and aut
 
 Registers entrypoints, calls `configure().init()`, then starts the Fastify server.
 
+### Boot state
+
+Process-wide boot phase, shared by the port hold and the app's own health handler.
+
+| Symbol | Description |
+|---|---|
+| `setBootPhase(phase, detail?)` | Record the phase; `detail` is free text kept for every phase |
+| `getBootPhase(): BootPhase` / `getBootDetail()` | Current phase and its detail |
+| `bootHealthPayload(): BootHealth` | `{ status, phase, ok, reason?, bootId, pid }` — the health body |
+| `bootHold(okPath?): ApiPortHoldOptions` | `holdApiPort` options wired to this module |
+| `BootPhase` | `'initializing' \| 'ready' \| 'failed'` |
+| `BOOT_ID_ENV` | `'OWLMEANS_BOOT_ID'` — a supervisor stamps the child, `bootId` echoes it back |
+
+`bootId` is identity, not health: an answer carrying an id other than the one the supervisor spawned
+means a leftover process still owns the port and the health it reports describes code nobody asked
+for.
+
 ### Re-exported symbols (for convenience)
 
 | Symbol | Source |
@@ -62,19 +122,21 @@ Registers entrypoints, calls `configure().init()`, then starts the Fastify serve
 | `celevate` | `@owlmeans/client-entrypoint` |
 | `route` | `@owlmeans/route` |
 | `broute` | `@owlmeans/server-route` |
-| `filter`, `body`, `params`, `parent`, `EntrypointOutcome` | `@owlmeans/entrypoint` |
+| `filter`, `body`, `params`, `EntrypointOutcome` | `@owlmeans/entrypoint` |
 | `config`, `service`, `sservice`, `toConfigRecord` | various config packages |
-| `AppType`, `Layer`, `BASE`, `assertContext` | `@owlmeans/context` |
+| `AppType`, `BASE`, `assertContext` | `@owlmeans/context` |
 | `DAUTH_GUARD` | `@owlmeans/server-auth` |
 | `GUARD_ED25519`, `BED255_CASHE_RESOURCE` | `@owlmeans/auth-common` |
 | `klusterize` | `@owlmeans/kluster` |
-| `Request`, `Response`, `CommonEntrypoint`, `ClientEntrypoint` | type re-exports |
+| `createListSchema`, `filterObject` | `@owlmeans/resource` |
+| `Request`, `Response`, `ClientEntrypoint`, `RefedEntrypointHandler` | type re-exports |
+| `Criteria`, `ListOptions`, `ListQuery`, `ListResult`, `Sort` | type re-exports from `@owlmeans/resource` |
 
-### `modules`
+### `entrypoints`
 
 Default entrypoint array providing auth and API config routes. Spread into `main()`:
 ```typescript
-await main(context, [...modules, ...myModules])
+await main(context, [...entrypoints, ...myEntrypoints])
 ```
 
 ## Related Packages
@@ -91,7 +153,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.14
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-app",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.509Z",
+  "version": "0.1.18-rc.20",
+  "generatedAt": "2026-09-10T23:12:07.512Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-app/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-app
-description: How to use @owlmeans/server-app — main() entry point, handleRequest()/handleBody() handler wrappers, elevate()/celevate() to attach handlers to module declarations, sservice() to register backend services. Auto-invoked when working with the server entry point or request handlers.
+description: How to use @owlmeans/server-app — main() entry point, makeContext(), the bind-first boot (holdApiPort + boot state), handleRequest()/handleBody() handler wrappers, elevate()/celevate() to attach handlers to entrypoint declarations, and the config and entrypoint builders it re-exports. Auto-invoked when working with the server entry point, the server context factory, or request handlers.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,20 +8,68 @@ user-invocable: false
 # @owlmeans/server-app
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-app": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/server-app": "^0.1.18-rc.20"` in `dependencies`
+
+The one package a backend application depends on directly. It assembles the server context, owns the
+process entry point, and re-exports everything an app needs to declare its config, its entrypoints
+and its handlers — so an app on it rarely imports the server layer packages by name.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `main<E, C, T>(context, modules)` | Entry point — boots Express, registers all entrypoints as routes |
+| `main<R, C, T>(ctx, entrypoints)` | Entry point — registers all entrypoints, configures/inits the context, then boots the Fastify API server (`@owlmeans/server-api`) |
+| `makeContext(cfg, customize?)` | Build the server context with API server, API client, sockets, static resource and auth appended |
+| `AppConfig`, `AppContext<C>` | The config and context types an app extends |
+| `entrypoints` | Built-in system entrypoints — the auth endpoints plus the api-config advertise endpoint; spread into `appEntrypoints` |
+
+### Building the config
+
+| Export | Description |
+|--------|-------------|
+| `config(service, cfg?)` | Start a server config for this service |
+| `sservice(service, cfg?)` | Declare a backend service route into `cfg.services` |
+| `addWebService(service, alias?, cfg?)` | Declare a frontend service the app addresses |
+| `service(route, cfg?)`, `toConfigRecord(obj)`, `PLUGINS` | Generic service declaration and config records |
+| `AppType`, `BASE` | The app-type enum, and `base` — the alias of the intermediate area whose children require authentication |
+| `PluginConfig` | Plugin config record shape |
+
+### Declaring and elevating entrypoints
+
+| Export | Description |
+|--------|-------------|
+| `entrypoint(...)`, `route(...)`, `broute(...)` | Declaration builders — `entrypoint` from server-entrypoint (it builds a `ServerEntrypoint`), `route` from route, `broute` from server-route |
+| `elevate(entrypoints, alias, handler?, opts?)` | Attach a handler to an entrypoint declaration |
+| `celevate(entrypoints, alias, handler?, opts?)` | Make a declaration client-callable from the server side |
+| `guard(alias, opts?)` | Options requiring a guard |
+| `DAUTH_GUARD` | Alias of the default auth guard (`auth`) |
+| `GUARD_ED25519`, `BED255_CASHE_RESOURCE` | The service-to-service signature guard and its nonce cache |
+| `filter`, `body`, `params`, `EntrypointOutcome` | Validators and the outcome enum |
+
+### Writing handlers
+
+| Export | Description |
+|--------|-------------|
 | `handleRequest(fn)` | Wrap an async function as a server handler `(req, context) => result` |
 | `handleBody<T>(fn)` | Wrap an async function with validated body — `(payload, context, req) => result` |
-| `elevate(modules, alias, handler)` | Attach a handler to an entrypoint declaration |
-| `celevate(modules, alias, handler)` | Conditional elevate — only if entrypoint exists |
-| `sservice(options, cfg)` | Register a server-side service entry in the config |
-| `modules` | Built-in system entrypoints — spread into `appModules` |
-| `Context`, `Config`, `ClientEntrypoint` re-exports | Common types |
+| `handleParams<T>(fn)` | The same, over validated URL params |
+| `Request`, `Response`, `Module`, `RefedEntrypointHandler`, `ClientEntrypoint` | Handler and entrypoint types |
+| `createListSchema(schema)`, `filterObject(obj, keep?)` | List-result schema and object whitelisting |
+| `Criteria`, `ListOptions`, `ListQuery`, `ListResult`, `Sort` | Resource query types |
+| `assertContext(ctx, location?)` | Narrow a possibly-undefined context, throwing where it is missing |
+
+### Booting
+
+| Export | Description |
+|--------|-------------|
+| `holdApiPort(cfg, opts?)` | Own the app's port during boot |
+| `ApiPortHold`, `ApiPortHoldOptions` | The hold handle and its options |
+| `setBootPhase(phase, detail?)` | Record the process boot phase — `'initializing' \| 'ready' \| 'failed'` |
+| `getBootPhase()` / `getBootDetail()` | Read it back |
+| `bootHealthPayload()` | The health body: `{ status, phase, ok, reason?, bootId, pid }` |
+| `bootHold(okPath?)` | `holdApiPort` options wired to the boot state |
+| `BootPhase`, `BootHealth`, `BOOT_ID_ENV` | Boot-state types and the supervisor's boot-id env var |
+| `klusterize(ctx, alias?)` | Register the cluster client and its config-directive middleware |
 
 ## Usage
 
@@ -31,48 +79,135 @@ user-invocable: false
 import { main } from '@owlmeans/server-app'
 import config from './config.js'
 import { makeContext } from './context.js'
-import { appModules } from './modules.js'
+import { appEntrypoints } from './entrypoints.js'
 
 const context = makeContext(config)
-main<{}, Config, Context>(context, appModules)
+main<{}, Config, Context>(context, appEntrypoints)
 ```
 
+`makeContext(cfg, customize)` appends the API server, the API client, the socket service and its
+middleware, and the static resource. Passing `customize: true` — or having already registered the
+auth cache resource — leaves the auth service and its cache out, which is what an app that supplies
+its own authentication does.
+
+### Bind-first boot
+
+An app that must be able to explain a *failed* boot does not call `main()`; it binds the port
+first, so the failure has somewhere to be reported from. Never hand-roll the phase module —
+`boot-state` is it.
+
+```typescript
+import { holdApiPort, bootHold, setBootPhase, bootHealthPayload } from '@owlmeans/server-app'
+
+const hold = await holdApiPort(ctx.cfg, bootHold(HEALTH_PATH)).catch((error: Error) => {
+  console.error(`[boot] STARTUP FAILED — ${error.message}`)
+  process.exit(1)   // a bind failure is fatal — see below
+})
+
+try {
+  await ctx.configure().init()
+} catch (error) {
+  setBootPhase('failed', (error as Error).message)
+  return            // stay alive: the hold is the only thing that can explain the failure
+}
+
+await hold.release()
+setBootPhase('ready')
+await ctx.getApiServer().listen()
+```
+
+Rules this encodes:
+
+- **Bind before you initialize.** Everything after the bind can fail, and a failure before it is
+  invisible — the edge answers a bare connect error naming neither the app nor the reason.
+- **A bind failure exits non-zero.** Carried past, the boot ends with nothing listening and nothing
+  holding the event loop: a clean exit 0 while a predecessor keeps serving stale code.
+- **A failed init returns rather than exits.** The hold keeps answering `HEALTH_PATH` with
+  `phase: 'failed'` and the reason; everything else gets 503.
+- **`hold.release()` is awaited** — `listen()` throws while a predecessor still owns the socket.
+- **The app's own health handler spreads `bootHealthPayload()`**, so the body does not change shape
+  under a consumer polling across the handover:
+
+  ```typescript
+  export const handleHealtz = handleRequest(async (_req, ctx) => ({
+    ...bootHealthPayload(), db: await pingDb(ctx)
+  }))
+  ```
+
+`bootId` is identity, not health: a supervisor stamps the child it spawns via `BOOT_ID_ENV`
+(`OWLMEANS_BOOT_ID`) and compares it here — another id means a leftover process holds the port.
+
 ### Handlers
 ```typescript
 import { handleRequest, handleBody } from '@owlmeans/server-app'
-import { AuthUnknown } from '@owlmeans/auth'
+import { requireEntityKey } from '@owlmeans/auth-common'
 import type { ClientEntrypoint } from '@owlmeans/server-app'
 
 export const list = handleRequest(async (req, context) => {
-  if (req.auth?.entityId == null) throw new AuthUnknown('entity')
   const ctx = context as Context
-  const { items } = await ctx.project().list({ entityId: req.auth.entityId })
+  const { items } = await ctx.project().list({ entityId: requireEntityKey(req) })
   return items
 })
 
-export const create = handleBody<CreateProject>(async (payload, context, req) => {
+export const create = handleBody<CreateProject>(async (payload, context) => {
   const ctx = context as Context
-  const [result] = await ctx.entrypoint<ClientEntrypoint<Project>>(agent.project.create).call({
-    body: { prompt: payload.prompt, entity: req.auth?.entityId }
+  return await ctx.entrypoint<ClientEntrypoint<Project>>(agent.project.create).call({
+    body: { prompt: payload.prompt }
   })
-  return result
 })
 ```
 
-### Module elevation
+**Key organization-scoped records by `requireEntityKey(req)` / `entityKeyOf(req)` from
+`@owlmeans/auth-common`.** The token carries only `entitySlug`, which is renameable — there is no id
+on it. The guard resolves that slug once, at the boundary, and hands the result to the handler as
+`req.entity` (`{ id, slug, iamKey }`); those two helpers return `req.entity.id` and fall back to the
+slug for a deployment that registers no entity resolver, and `requireEntityKey` throws
+`AuthorizationError` when the request names no organization at all. `requireEntity(req)` gives the
+whole record when the slug or the frozen `iamKey` is wanted too.
+
+The id stays inside the process: it is what records, grants and permission checks key on, and it
+never goes onto the wire. A cross-service call carries the caller's token, so the peer resolves the
+organization for itself; anything that must name one in a payload names it by `entitySlug`.
+
+A cross-service call from a handler uses `call()` — it resolves to the value and throws whatever the
+peer replied. Reach for `invoke()` only where the outcome decides what happens next.
+
+### Entrypoint elevation
 ```typescript
-import { elevate, modules } from '@owlmeans/server-app'
-import { managerModules } from 'my-common'
+// entrypoints.ts
+import { elevate, entrypoints as systemEntrypoints } from '@owlmeans/server-app'
+import { managerEntrypoints } from 'my-common'
 import { create, list } from './app/project/index.js'
 
-elevate(managerModules, manager.back.project.create, create)
-elevate(managerModules, manager.back.project.list, list)
+elevate(managerEntrypoints, manager.back.project.create, create)
+elevate(managerEntrypoints, manager.back.project.list, list)
 
-export const appModules = [...modules, ...paymentModules, ...managerModules]
+export const appEntrypoints = [...systemEntrypoints, ...paymentEntrypoints, ...managerEntrypoints]
 ```
 
+Elevating is idempotent, so a later `elevate` of the same alias is legal and simply replaces the
+element again; the guards it brings are added to the declared ones rather than replacing them.
+
+A parent alias needs no elevation for its `guard()` to reach its children — `getGuards()` walks the
+registered declarations whether or not they were elevated. A **bare** `elevate(entrypoints, alias)`
+only turns the declaration into a server entrypoint; with no handler it is never bound as a route,
+and it runs in the intermediate chain only when the same call passes `true` (or
+`{ intermediate: true }`) along with a `handleIntermediate` handler from `@owlmeans/server-api`.
+`guard()` is re-exported here; `gate()` is not — take it from `@owlmeans/entrypoint`.
+
 ## Depends On
 
-- `@owlmeans/server-context`, `@owlmeans/server-entrypoint`, `@owlmeans/server-route`, `@owlmeans/server-api`
-- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/auth`, `@owlmeans/error`
-- `express` / `fastify` (server runtime)
+Declared:
+
+- `@owlmeans/server-context`, `@owlmeans/server-entrypoint`, `@owlmeans/server-route`, `@owlmeans/server-api`, `@owlmeans/server-auth`, `@owlmeans/server-socket`
+- `@owlmeans/api`, `@owlmeans/static-resource`, `@owlmeans/kluster`
+- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/config`, `@owlmeans/client-config`, `@owlmeans/client-entrypoint`, `@owlmeans/context`
+
+Imported but **not** declared in this package's manifest: `@owlmeans/api-config-server` (its
+advertise endpoint is in `entrypoints`), `@owlmeans/auth-common` (`GUARD_ED25519`),
+`@owlmeans/resource` (the list schema and the query types) and `@owlmeans/server-config`
+(`sservice`). A workspace resolves them anyway; a standalone install has to name them in its own
+dependencies.
+
+The HTTP server is Fastify, built by `@owlmeans/server-api` — this package neither depends on
+`fastify` nor exposes it. There is no Express anywhere in this layer.

package/build/boot-state.d.ts

@@ -0,0 +1,55 @@
+import type { ApiPortHoldOptions } from '@owlmeans/server-api';
+/**
+ * Boot phase of the process.
+ *
+ * An app binds its port before it initializes, so that a failure has somewhere to be reported
+ * from. Without a listener the only thing anyone sees is a connection refused at the edge — an
+ * opaque 503 that names neither the app nor the cause. This phase is what the health path answers
+ * with, and what the platform reads to tell "still starting" from "gave up, and here is why".
+ */
+export type BootPhase = 'initializing' | 'ready' | 'failed';
+export interface BootHealth extends Record<string, unknown> {
+    status: 'OK' | 'FAILED';
+    phase: BootPhase;
+    ok: boolean;
+    /** Whatever `setBootPhase` was given — the failure message, or the step being waited on. */
+    reason?: string;
+    /**
+     * Identity, not health: a supervisor passes the id to the child it spawns and compares it
+     * here, so an answer carrying another id means the port is held by a leftover process and the
+     * health it reports describes code nobody asked for. Empty when nothing supplied one.
+     */
+    bootId: string;
+    pid: number;
+}
+/** Env var a supervisor stamps the spawned process with; surfaced as `bootId`. */
+export declare const BOOT_ID_ENV = "OWLMEANS_BOOT_ID";
+export declare const getBootPhase: () => BootPhase;
+export declare const getBootDetail: () => string | undefined;
+/**
+ * `detail` is free text, and is kept for every phase — a boot that is merely slow is as worth
+ * explaining as one that failed.
+ */
+export declare const setBootPhase: (phase: BootPhase, detail?: string) => void;
+/**
+ * The body the health path answers with, from either server.
+ *
+ * The port hold and the app's own handler both build it here, so a consumer polling through the
+ * handover never sees the shape change under it — which is why the keys are unconditional and
+ * only `reason` comes and goes with the state it describes.
+ */
+export declare const bootHealthPayload: () => BootHealth;
+/**
+ * Hold options wired to this module — the bind-first boot in one line:
+ *
+ *     const hold = await holdApiPort(ctx.cfg, bootHold(HEALTH_PATH))
+ *     try { await init() } catch (e) { setBootPhase('failed', message); return }
+ *     await hold.release()
+ *     setBootPhase('ready')
+ *     await ctx.getApiServer().listen()
+ *
+ * The hold evaluates `payload` per request, so the phase set after a failure is reported live by
+ * the listener that is already bound rather than needing a server that will never start.
+ */
+export declare const bootHold: (okPath?: string) => ApiPortHoldOptions;
+//# sourceMappingURL=boot-state.d.ts.map

package/build/boot-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-state.d.ts","sourceRoot":"","sources":["../src/boot-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAE9D;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE3D,MAAM,WAAW,UAAW,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,MAAM,EAAE,IAAI,GAAG,QAAQ,CAAA;IACvB,KAAK,EAAE,SAAS,CAAA;IAChB,EAAE,EAAE,OAAO,CAAA;IACX,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,kFAAkF;AAClF,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAK7C,eAAO,MAAM,YAAY,QAAO,SAAmB,CAAA;AAEnD,eAAO,MAAM,aAAa,QAAO,MAAM,GAAG,SAAoB,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,SAAS,WAAW,MAAM,KAAG,IAGhE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAO,UAOnC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,YAAa,MAAM,KAAG,kBAGzC,CAAA"}

package/build/boot-state.js

@@ -0,0 +1,46 @@
+/** Env var a supervisor stamps the spawned process with; surfaced as `bootId`. */
+export const BOOT_ID_ENV = 'OWLMEANS_BOOT_ID';
+let _phase = 'initializing';
+let _detail;
+export const getBootPhase = () => _phase;
+export const getBootDetail = () => _detail;
+/**
+ * `detail` is free text, and is kept for every phase — a boot that is merely slow is as worth
+ * explaining as one that failed.
+ */
+export const setBootPhase = (phase, detail) => {
+    _phase = phase;
+    _detail = detail;
+};
+/**
+ * The body the health path answers with, from either server.
+ *
+ * The port hold and the app's own handler both build it here, so a consumer polling through the
+ * handover never sees the shape change under it — which is why the keys are unconditional and
+ * only `reason` comes and goes with the state it describes.
+ */
+export const bootHealthPayload = () => ({
+    status: _phase === 'failed' ? 'FAILED' : 'OK',
+    phase: _phase,
+    ok: _phase === 'ready',
+    ...(_detail != null ? { reason: _detail } : {}),
+    bootId: process.env[BOOT_ID_ENV] ?? '',
+    pid: process.pid
+});
+/**
+ * Hold options wired to this module — the bind-first boot in one line:
+ *
+ *     const hold = await holdApiPort(ctx.cfg, bootHold(HEALTH_PATH))
+ *     try { await init() } catch (e) { setBootPhase('failed', message); return }
+ *     await hold.release()
+ *     setBootPhase('ready')
+ *     await ctx.getApiServer().listen()
+ *
+ * The hold evaluates `payload` per request, so the phase set after a failure is reported live by
+ * the listener that is already bound rather than needing a server that will never start.
+ */
+export const bootHold = (okPath) => ({
+    ...(okPath != null ? { okPath } : {}),
+    payload: bootHealthPayload
+});
+//# sourceMappingURL=boot-state.js.map

package/build/boot-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-state.js","sourceRoot":"","sources":["../src/boot-state.ts"],"names":[],"mappings":"AA2BA,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C,IAAI,MAAM,GAAc,cAAc,CAAA;AACtC,IAAI,OAA2B,CAAA;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG,GAAc,EAAE,CAAC,MAAM,CAAA;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAuB,EAAE,CAAC,OAAO,CAAA;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAgB,EAAE,MAAe,EAAQ,EAAE;IACtE,MAAM,GAAG,KAAK,CAAA;IACd,OAAO,GAAG,MAAM,CAAA;AAClB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAe,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;IAC7C,KAAK,EAAE,MAAM;IACb,EAAE,EAAE,MAAM,KAAK,OAAO;IACtB,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;IACtC,GAAG,EAAE,OAAO,CAAC,GAAG;CACjB,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAsB,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrC,OAAO,EAAE,iBAAiB;CAC3B,CAAC,CAAA"}

package/build/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAMvD,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,cAAa,OAAO,MAkBnG,CAAA"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAMvD,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,cAAa,OAAO,MAgBnG,CAAA"}

package/build/context.js

@@ -15,7 +15,6 @@ export const makeContext = (cfg, customize = false) => {
         appendStaticResource(context, AUTH_CACHE);
         appendAuthService(context);
     }
-    context.makeContext = cfg => makeContext(cfg, customize);
     return context;
 };
 //# sourceMappingURL=context.js.map

package/build/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAErF,MAAM,CAAC,MAAM,WAAW,GAAG,CAA+C,GAAM,EAAE,SAAS,GAAY,KAAK,EAAE,EAAE;IAC9G,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAM,CAAA;IAE3C,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,mBAAmB,CAAO,OAAO,CAAC,CAAA;IAElC,OAAO,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,CAAA;IAEpD,oBAAoB,CAAO,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,oBAAoB,CAAO,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/C,iBAAiB,CAAO,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAQ,CAAA;IAE/D,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAErF,MAAM,CAAC,MAAM,WAAW,GAAG,CAA+C,GAAM,EAAE,SAAS,GAAY,KAAK,EAAE,EAAE;IAC9G,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAM,CAAA;IAE3C,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,mBAAmB,CAAO,OAAO,CAAC,CAAA;IAElC,OAAO,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,CAAA;IAEpD,oBAAoB,CAAO,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,oBAAoB,CAAO,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/C,iBAAiB,CAAO,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/entrypoints.d.ts

@@ -0,0 +1,2 @@
+export declare const entrypoints: import("@owlmeans/server-entrypoint").ServerEntrypoint<unknown>[];
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,mEAA0B,CAAA"}

package/build/entrypoints.js

@@ -0,0 +1,4 @@
+import { entrypoints as apiConfig } from '@owlmeans/api-config-server';
+import { entrypoints as list } from '@owlmeans/server-auth';
+export const entrypoints = [...list, ...apiConfig];
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,IAAI,SAAS,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAE3D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC,CAAA"}

package/build/exports.d.ts

@@ -2,17 +2,18 @@ export { config } from '@owlmeans/server-context';
 export { sservice } from '@owlmeans/server-config';
 export { addWebService } from '@owlmeans/client-config';
 export { service, toConfigRecord, PLUGINS } from '@owlmeans/config';
-export { parent, filter, body, params, EntrypointOutcome } from '@owlmeans/entrypoint';
+export { contract, filter, body, params, EntrypointOutcome, protocol, typed } from '@owlmeans/entrypoint';
 export type { AbstractRequest as Request, AbstractResponse as Response } from '@owlmeans/entrypoint';
 export { createListSchema, filterObject } from '@owlmeans/resource';
-export type { ListResult } from '@owlmeans/resource';
-export { AppType, BASE, Layer, assertContext } from '@owlmeans/context';
+export type { Criteria, ListOptions, ListQuery, ListResult, Sort } from '@owlmeans/resource';
+export { AppType, BASE, assertContext } from '@owlmeans/context';
 export { elevate, entrypoint, guard } from '@owlmeans/server-entrypoint';
 export { elevate as celevate } from '@owlmeans/client-entrypoint';
 export type { ServerEntrypoint as Module, RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
 export type { ClientEntrypoint } from '@owlmeans/client-entrypoint';
 export { route as broute } from '@owlmeans/server-route';
-export { handleRequest, handleBody, handleParams } from '@owlmeans/server-api';
+export { handlers, handleRequest, handleBody, handleParams, holdApiPort } from '@owlmeans/server-api';
+export type { ApiPortHold, ApiPortHoldOptions } from '@owlmeans/server-api';
 export { route } from '@owlmeans/route';
 export { DEFAULT_ALIAS as DAUTH_GUARD } from '@owlmeans/server-auth';
 export { klusterize } from '@owlmeans/kluster';

package/build/exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACtF,YAAY,EAAE,eAAe,IAAI,OAAO,EAAE,gBAAgB,IAAI,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACnE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AACjE,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACrG,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,aAAa,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACzG,YAAY,EAAE,eAAe,IAAI,OAAO,EAAE,gBAAgB,IAAI,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACnE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AACjE,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACrG,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACrG,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,aAAa,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}

package/build/exports.js

@@ -2,13 +2,13 @@ export { config } from '@owlmeans/server-context';
 export { sservice } from '@owlmeans/server-config';
 export { addWebService } from '@owlmeans/client-config';
 export { service, toConfigRecord, PLUGINS } from '@owlmeans/config';
-export { parent, filter, body, params, EntrypointOutcome } from '@owlmeans/entrypoint';
+export { contract, filter, body, params, EntrypointOutcome, protocol, typed } from '@owlmeans/entrypoint';
 export { createListSchema, filterObject } from '@owlmeans/resource';
-export { AppType, BASE, Layer, assertContext } from '@owlmeans/context';
+export { AppType, BASE, assertContext } from '@owlmeans/context';
 export { elevate, entrypoint, guard } from '@owlmeans/server-entrypoint';
 export { elevate as celevate } from '@owlmeans/client-entrypoint';
 export { route as broute } from '@owlmeans/server-route';
-export { handleRequest, handleBody, handleParams } from '@owlmeans/server-api';
+export { handlers, handleRequest, handleBody, handleParams, holdApiPort } from '@owlmeans/server-api';
 export { route } from '@owlmeans/route';
 export { DEFAULT_ALIAS as DAUTH_GUARD } from '@owlmeans/server-auth';
 export { klusterize } from '@owlmeans/kluster';

package/build/exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAEtF,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAGjE,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,aAAa,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAEzG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAGjE,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAErG,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,aAAa,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}

package/build/index.d.ts

@@ -1,6 +1,7 @@
 export * from './exports.js';
 export * from './main.js';
+export * from './boot-state.js';
 export type * from './types.js';
 export * from './context.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,mBAAmB,YAAY,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,iBAAiB,CAAA;AAC/B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA"}

package/build/index.js

@@ -1,5 +1,6 @@
 export * from './exports.js';
 export * from './main.js';
+export * from './boot-state.js';
 export * from './context.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AAEzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,iBAAiB,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA"}

package/build/main.d.ts

@@ -1,5 +1,5 @@
 import type { ServerEntrypoint } from '@owlmeans/server-entrypoint';
 import type { CommonEntrypoint } from '@owlmeans/entrypoint';
 import type { AppContext, AppConfig } from './types.js';
-export declare const main: <R, C extends AppConfig, T extends AppContext<C>>(ctx: T, modules: (CommonEntrypoint | ServerEntrypoint<R>)[]) => Promise<void>;
+export declare const main: <R, C extends AppConfig, T extends AppContext<C>>(ctx: T, entrypoints: (CommonEntrypoint | ServerEntrypoint<R>)[]) => Promise<void>;
 //# sourceMappingURL=main.d.ts.map

package/build/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAIvD,eAAO,MAAM,IAAI,GAAU,CAAC,EAAE,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,OACnE,CAAC,WAAW,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,kBAK5D,CAAA"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAIvD,eAAO,MAAM,IAAI,GAAU,CAAC,EAAE,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,OACnE,CAAC,eAAe,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,kBAKhE,CAAA"}

package/build/main.js

@@ -1,7 +1,7 @@
 // @TODO Remove or refactor request types. We actually don't use them and this make
 // a mess with <R
-export const main = async (ctx, modules) => {
-    ctx.registerEntrypoints(modules);
+export const main = async (ctx, entrypoints) => {
+    ctx.registerEntrypoints(entrypoints);
     await ctx.configure().init();
     await ctx.getApiServer().listen();
 };

package/build/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAMA,mFAAmF;AACnF,iBAAiB;AACjB,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EACvB,GAAM,EAAE,OAAmD,EAC3D,EAAE;IACF,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAMA,mFAAmF;AACnF,iBAAiB;AACjB,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EACvB,GAAM,EAAE,WAAuD,EAC/D,EAAE;IACF,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-app",
-  "version": "0.1.18-rc.2",
+  "version": "0.1.18-rc.20",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,21 +21,21 @@
     }
   },
   "dependencies": {
-    "@owlmeans/api": "^0.1.18-rc.2",
-    "@owlmeans/client-config": "^0.1.18-rc.2",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/config": "^0.1.18-rc.2",
-    "@owlmeans/context": "^0.1.18-rc.2",
-    "@owlmeans/kluster": "^0.1.18-rc.2",
-    "@owlmeans/entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/route": "^0.1.18-rc.2",
-    "@owlmeans/server-api": "^0.1.18-rc.2",
-    "@owlmeans/server-auth": "^0.1.18-rc.2",
-    "@owlmeans/server-context": "^0.1.18-rc.2",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/server-route": "^0.1.18-rc.2",
-    "@owlmeans/server-socket": "^0.1.18-rc.2",
-    "@owlmeans/static-resource": "^0.1.18-rc.2"
+    "@owlmeans/api": "^0.1.18-rc.15",
+    "@owlmeans/client-config": "^0.1.18-rc.14",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.15",
+    "@owlmeans/config": "^0.1.18-rc.14",
+    "@owlmeans/context": "^0.1.18-rc.10",
+    "@owlmeans/kluster": "^0.1.18-rc.14",
+    "@owlmeans/entrypoint": "^0.1.18-rc.13",
+    "@owlmeans/route": "^0.1.18-rc.11",
+    "@owlmeans/server-api": "^0.1.18-rc.19",
+    "@owlmeans/server-auth": "^0.1.18-rc.20",
+    "@owlmeans/server-context": "^0.1.18-rc.14",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.13",
+    "@owlmeans/server-route": "^0.1.18-rc.11",
+    "@owlmeans/server-socket": "^0.1.18-rc.20",
+    "@owlmeans/static-resource": "^0.1.18-rc.11"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",

package/src/boot-state.ts

@@ -0,0 +1,78 @@
+import type { ApiPortHoldOptions } from '@owlmeans/server-api'
+
+/**
+ * Boot phase of the process.
+ *
+ * An app binds its port before it initializes, so that a failure has somewhere to be reported
+ * from. Without a listener the only thing anyone sees is a connection refused at the edge — an
+ * opaque 503 that names neither the app nor the cause. This phase is what the health path answers
+ * with, and what the platform reads to tell "still starting" from "gave up, and here is why".
+ */
+export type BootPhase = 'initializing' | 'ready' | 'failed'
+
+export interface BootHealth extends Record<string, unknown> {
+  status: 'OK' | 'FAILED'
+  phase: BootPhase
+  ok: boolean
+  /** Whatever `setBootPhase` was given — the failure message, or the step being waited on. */
+  reason?: string
+  /**
+   * Identity, not health: a supervisor passes the id to the child it spawns and compares it
+   * here, so an answer carrying another id means the port is held by a leftover process and the
+   * health it reports describes code nobody asked for. Empty when nothing supplied one.
+   */
+  bootId: string
+  pid: number
+}
+
+/** Env var a supervisor stamps the spawned process with; surfaced as `bootId`. */
+export const BOOT_ID_ENV = 'OWLMEANS_BOOT_ID'
+
+let _phase: BootPhase = 'initializing'
+let _detail: string | undefined
+
+export const getBootPhase = (): BootPhase => _phase
+
+export const getBootDetail = (): string | undefined => _detail
+
+/**
+ * `detail` is free text, and is kept for every phase — a boot that is merely slow is as worth
+ * explaining as one that failed.
+ */
+export const setBootPhase = (phase: BootPhase, detail?: string): void => {
+  _phase = phase
+  _detail = detail
+}
+
+/**
+ * The body the health path answers with, from either server.
+ *
+ * The port hold and the app's own handler both build it here, so a consumer polling through the
+ * handover never sees the shape change under it — which is why the keys are unconditional and
+ * only `reason` comes and goes with the state it describes.
+ */
+export const bootHealthPayload = (): BootHealth => ({
+  status: _phase === 'failed' ? 'FAILED' : 'OK',
+  phase: _phase,
+  ok: _phase === 'ready',
+  ...(_detail != null ? { reason: _detail } : {}),
+  bootId: process.env[BOOT_ID_ENV] ?? '',
+  pid: process.pid
+})
+
+/**
+ * Hold options wired to this module — the bind-first boot in one line:
+ *
+ *     const hold = await holdApiPort(ctx.cfg, bootHold(HEALTH_PATH))
+ *     try { await init() } catch (e) { setBootPhase('failed', message); return }
+ *     await hold.release()
+ *     setBootPhase('ready')
+ *     await ctx.getApiServer().listen()
+ *
+ * The hold evaluates `payload` per request, so the phase set after a failure is reported live by
+ * the listener that is already bound rather than needing a server that will never start.
+ */
+export const bootHold = (okPath?: string): ApiPortHoldOptions => ({
+  ...(okPath != null ? { okPath } : {}),
+  payload: bootHealthPayload
+})

package/src/context.ts

@@ -21,7 +21,5 @@ export const makeContext = <C extends AppConfig, T extends AppContext<C>>(cfg: C
     appendAuthService<C, T>(context)
   }
 
-  context.makeContext = cfg => makeContext(cfg, customize) as any
-
   return context
 }

package/src/entrypoints.ts

@@ -0,0 +1,4 @@
+import { entrypoints as apiConfig } from '@owlmeans/api-config-server'
+import { entrypoints as list } from '@owlmeans/server-auth'
+
+export const entrypoints = [...list, ...apiConfig]

package/src/exports.ts

@@ -3,17 +3,18 @@ export { config } from '@owlmeans/server-context'
 export { sservice } from '@owlmeans/server-config'
 export { addWebService } from '@owlmeans/client-config'
 export { service, toConfigRecord, PLUGINS } from '@owlmeans/config'
-export { parent, filter, body, params, EntrypointOutcome } from '@owlmeans/entrypoint'
+export { contract, filter, body, params, EntrypointOutcome, protocol, typed } from '@owlmeans/entrypoint'
 export type { AbstractRequest as Request, AbstractResponse as Response } from '@owlmeans/entrypoint'
 export { createListSchema, filterObject } from '@owlmeans/resource'
-export type { ListResult } from '@owlmeans/resource'
-export { AppType, BASE, Layer, assertContext } from '@owlmeans/context'
+export type { Criteria, ListOptions, ListQuery, ListResult, Sort } from '@owlmeans/resource'
+export { AppType, BASE, assertContext } from '@owlmeans/context'
 export { elevate, entrypoint, guard } from '@owlmeans/server-entrypoint'
 export { elevate as celevate } from '@owlmeans/client-entrypoint'
 export type { ServerEntrypoint as Module, RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 export type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 export { route as broute } from '@owlmeans/server-route'
-export { handleRequest, handleBody, handleParams } from '@owlmeans/server-api'
+export { handlers, handleRequest, handleBody, handleParams, holdApiPort } from '@owlmeans/server-api'
+export type { ApiPortHold, ApiPortHoldOptions } from '@owlmeans/server-api'
 export { route } from '@owlmeans/route'
 export { DEFAULT_ALIAS as DAUTH_GUARD } from '@owlmeans/server-auth'
 export { klusterize } from '@owlmeans/kluster'

package/src/index.ts

@@ -1,6 +1,7 @@
 
 export * from './exports.js'
 export * from './main.js'
+export * from './boot-state.js'
 export type * from './types.js'
 export * from './context.js'
-export * from './modules.js'
+export * from './entrypoints.js'

package/src/main.ts

@@ -7,9 +7,9 @@ import type { AppContext, AppConfig } from './types.js'
 // @TODO Remove or refactor request types. We actually don't use them and this make
 // a mess with <R
 export const main = async <R, C extends AppConfig, T extends AppContext<C>>(
-  ctx: T, modules: (CommonEntrypoint | ServerEntrypoint<R>)[]
+  ctx: T, entrypoints: (CommonEntrypoint | ServerEntrypoint<R>)[]
 ) => {
-  ctx.registerEntrypoints(modules)
+  ctx.registerEntrypoints(entrypoints)
   await ctx.configure().init()
   await ctx.getApiServer().listen()
 }

package/build/modules.d.ts

@@ -1,2 +0,0 @@
-export declare const modules: import("@owlmeans/server-entrypoint").ServerEntrypoint<unknown>[];
-//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,mEAA0B,CAAA"}

package/build/modules.js

@@ -1,4 +0,0 @@
-import { modules as apiConfig } from '@owlmeans/api-config-server';
-import { modules as list } from '@owlmeans/server-auth';
-export const modules = [...list, ...apiConfig];
-//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAEvD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC,CAAA"}

package/src/modules.ts

@@ -1,4 +0,0 @@
-import { modules as apiConfig } from '@owlmeans/api-config-server'
-import { modules as list } from '@owlmeans/server-auth'
-
-export const modules = [...list, ...apiConfig]