@spfn/core 0.3.0-beta.1 → 0.3.0-beta.10

package/README.md

@@ -43,7 +43,7 @@ Next.js owns the frontend, Drizzle owns the SQL, and your services own the rules
 
 ```bash
 pnpm add @spfn/core@beta drizzle-orm@1.0.0-rc.4 postgres pg
-# optional peer: next ^16.2.11   (only for the Next.js bridge)
+# optional peer: next ^16.3.3   (only for the Next.js bridge)
 ```
 
 Node `>=20.0.0`. ESM only.
@@ -185,18 +185,144 @@ import type { AppRouter } from '@/server/router';
 
 export const api = createApi<AppRouter>();
 
-// anywhere — server component, client component, or server action:
+// the same client in a Server Component, a Client Component or a Server Action:
 const user = await api.getUser.call({ params: { id: '123' } });    // typed { id, name }
 const made = await api.createUser.call({ body: { name: 'A' } });
 ```
 
+That the client is isomorphic does not make the three callers interchangeable. **A page's
+initial data is awaited in the Server Component**, where
+`api.getUser.fetchOptions({ next: { revalidate, tags } }).call(…)` participates in
+Next.js caching and reaches the backend without a browser round trip. Fetching that same
+first paint from a `'use client'` component inside a `useEffect` is the anti-pattern: it
+ships a loading state and a second network hop for data the server already had. Client
+Components and Server Actions are for what happens after the first paint — interaction
+and mutation. Cache tags, revalidation and SSR cookie forwarding are in
+[the Next.js bridge docs](https://superfunction.xyz/docs/packages/core/nextjs).
+
+---
+
+## How does a repository talk to the database?
+
+Through `BaseRepository`. Extending it gives a repository two transaction-aware
+connections — `this.db` (write/primary) and `this.readDb` (the replica, when one is
+configured) — plus the CRUD set as protected methods.
+
+```typescript
+// server/repositories/order.ts
+import { BaseRepository } from '@spfn/core/db';
+import { desc } from 'drizzle-orm';
+import { orders } from '../entities/order';
+
+export class OrderRepository extends BaseRepository
+{
+    findRecentFor(userId: string)
+    {
+        return this._findMany(orders, { where: { userId }, orderBy: desc(orders.createdAt) });
+    }
+
+    place(data: { userId: string; total: number })
+    {
+        return this._create(orders, data);
+    }
+}
+
+export const orderRepo = new OrderRepository();
+```
+
+Handlers never import drizzle query builders; repositories do. `_findMany` reads through
+`this.readDb`, `_create` writes through `this.db`, and both getters resolve to the active
+transaction's connection when there is one — so the same method is correct inside a
+transaction and outside it. When a helper cannot express a query, drop to
+`this.readDb.select()…` inside the repository rather than in the handler. The full
+protected CRUD set is in [src/db](./src/db/README.md).
+
+---
+
+## Where do transactions and their side effects go?
+
+`Transactional()` covers the route case — commit on return, rollback on throw. Two rules
+decide the rest.
+
+**Nothing takes a `tx` parameter.** The transaction travels in AsyncLocalStorage, so
+`this.db` inside a repository already resolves to it. A service that accepts `tx` and
+threads it downward re-implements propagation that already happened, and the first caller
+that forgets to pass it writes outside the transaction. For a service, script or job with
+no route around it, open one with `runInTransaction(fn, options?)`;
+`runWithTransaction(tx, txId, fn)` is the lower-level primitive that binds an existing
+Drizzle transaction into the context.
+
+**Side effects go on the commit hooks, not inline.** An event emitted or a mail sent from
+inside the transaction still went out when the transaction later rolls back.
+
+| Hook | When it runs | What it is for |
+|---|---|---|
+| `onBeforeCommit(fn)` | Inside the still-open transaction, just before commit — a throw aborts and rolls back | Last-moment invariant checks, and statements that must land in the same commit |
+| `onAfterCommit(fn)` | After the root transaction commits, outside the transaction context; errors are logged, never thrown | Events, mail, cache invalidation — anything the outside world observes |
+| `onAfterRollback(fn)` | After the root transaction rolls back, before the causing error propagates; errors are logged, never thrown | Undoing external work that cannot roll itself back, such as an object already uploaded |
+
+All three import from `@spfn/core/db`, can be registered anywhere inside the transaction,
+and bubble to the **root** transaction — a nested block's callbacks fire on the outermost
+outcome, not on a savepoint's.
+
+```typescript
+import { runInTransaction, onAfterCommit } from '@spfn/core/db';
+
+export async function placeOrder(input: { userId: string; total: number })
+{
+    return runInTransaction(async () =>
+    {
+        const order = await orderRepo.place(input);   // no tx argument, at any depth
+        onAfterCommit(() => orderPlacedEvent.emit({ orderId: order.id }));
+
+        return order;
+    });
+}
+```
+
+---
+
+## What else can defineServerConfig configure?
+
+`.port()` and `.routes()` are the two every app calls. The rest of the builder is how an
+app wires its infrastructure without touching the server's boot sequence. Every method
+returns the builder; `.build()` ends the chain.
+
+| Method | What it configures |
+|---|---|
+| `.port(n)` / `.host(s)` | Where the server listens |
+| `.routes(router)` | The `defineRouter` router to mount, with its own `.use()` and `.packages()` |
+| `.jobs(router, config?)` | Background jobs — a `defineJobRouter`, plus pg-boss options |
+| `.events(router, config?)` | SSE streaming — a `defineEventRouter`, served at `GET /events/stream` |
+| `.websockets(router, config?)` | Bidirectional WebSockets — a `defineWSRouter`, served at `WS /ws` |
+| `.workflows(router, config?)` | `@spfn/workflow` orchestration; the engine starts once the database is ready |
+| `.lifecycle(hooks)` | Boot and shutdown hooks. Callable more than once; hooks run in registration order |
+| `.migrations(opts)` | The migration boot gate — `{ allowPending: true }` lets a server start behind its migrations |
+| `.database(opts)` | Connection and pool settings |
+| `.infrastructure(opts)` | Which infrastructure is initialized at boot |
+| `.healthCheck(opts)` | The health endpoint |
+| `.serverTime(clock)` | The clock behind `GET /_core/time`; normally left at the default |
+| `.middleware(opts)` | The built-in middleware — `ErrorHandler`, `RequestLogger` |
+| `.use(handlers)` | Additional global Hono middleware |
+| `.middlewares(named)` | Global middleware under names, so a route can `.skip([...])` it |
+| `.cors(opts)` | CORS |
+| `.rateLimit(opts)` | A global default limiter plus the named policies routes resolve against |
+| `.proxyGuard(opts)` | Trusted-proxy signature and origin verification, resolved to a `clientType` |
+| `.outboundFetch(opts)` | The SSRF policy `safeFetch` applies to outbound calls |
+| `.timeout(opts)` / `.shutdown(opts)` | Request timeouts and graceful shutdown |
+| `.debug(bool)` | Debug logging |
+
+The options each one takes are in [src/server](./src/server/README.md).
+
 ---
 
 ## Which import path do I use for what?
 
 There is **no root barrel**: `import … from '@spfn/core'` does not resolve. Every symbol
 comes from a subpath, and the table below is the complete public surface — one row per
-entry in `package.json` `exports`. Each module has its own README with the API detail.
+entry in `package.json` `exports`, with a single exclusion: `./client` is still listed in
+`exports` but the build no longer emits it, so it has no row (see [Pitfalls](#pitfalls)).
+Each module has its own README with the API detail.
 
 | Import path | Purpose | Doc |
 |-------------|---------|-----|
@@ -207,16 +333,17 @@ entry in `package.json` `exports`. Each module has its own README with the API d
 | `@spfn/core/nextjs/server` | Server-only: `createRpcProxy({ routeMap })`, `registerInterceptors`. Uses `next/headers`. | [src/nextjs](./src/nextjs/README.md) |
 | `@spfn/core/db` | PostgreSQL through Drizzle: CRUD helpers, `BaseRepository`, schema helpers, transactions, Postgres error mapping. One entry point for all of it. | [src/db](./src/db/README.md) |
 | `@spfn/core/db` → manager | Connection lifecycle, pool, primary/replica, health check, reconnect (`initDatabase`, `getDatabase`). Re-exported from `@spfn/core/db`. | [src/db/manager](./src/db/manager/README.md) |
-| `@spfn/core/db` → migrations | Which migrations each installed function package ships, and which the database has applied (`collectMigrationStatus`, `discoverFunctionMigrations`). What `spfn db status`, the boot gate and health all read. Re-exported from `@spfn/core/db`. | [src/db/migrations](./src/db/migrations/index.ts) |
+| `@spfn/core/db` → migrations | Which migrations each installed function package ships, and which the database has applied (`collectMigrationStatus`, `discoverFunctionMigrations`). What `spfn db status`, the boot gate and health all read. Re-exported from `@spfn/core/db`. | [src/db/migrations](https://github.com/fxylabs/spfn/blob/main/packages/core/src/db/migrations/index.ts) |
 | `@spfn/core/db` → schema | Drizzle column helpers (`id`, `uuid`, `timestamps`, `foreignKey`, `enumText`, `typedJsonb`, `softDelete`, …). Re-exported from `@spfn/core/db`. | [src/db/schema](./src/db/schema/README.md) |
 | `@spfn/core/db` → transaction | `Transactional()` middleware and `runInTransaction`; the transaction reaches every repository through AsyncLocalStorage. Re-exported from `@spfn/core/db`. | [src/db/transaction](./src/db/transaction/README.md) |
 | `@spfn/core/middleware` | Built-in Hono middleware: `ErrorHandler`, `RequestLogger` and its masking helper. | [src/middleware](./src/middleware/README.md) |
 | `@spfn/core/errors` | Serializable HTTP and database error classes, plus `ErrorRegistry` so an error survives the trip to the client as its own class. | [src/errors](./src/errors/README.md) |
 | `@spfn/core/security` | `safeFetch` — a drop-in `fetch` hardened against SSRF, including DNS rebinding, by pinning the connection to a validated IP. | [src/security](./src/security/README.md) |
-| `@spfn/core/authz` | Ownership guards. `requireOwner(resource, userId)` makes "load it, then check it belongs to the requester" one call, so a handler cannot forget it. | [src/authz/index.ts](./src/authz/index.ts) |
+| `@spfn/core/authz` | Ownership guards. `requireOwner(resource, userId)` makes "load it, then check it belongs to the requester" one call, so a handler cannot forget it. | [src/authz/index.ts](https://github.com/fxylabs/spfn/blob/main/packages/core/src/authz/index.ts) |
 | `@spfn/core/env` | Schema-based environment validation, isomorphic. | [src/env](./src/env/README.md) |
 | `@spfn/core/env/loader` | The **server-only** `.env` file loader (uses `node:fs`). | [src/env](./src/env/README.md) |
 | `@spfn/core/config` | `@spfn/core`'s own validated env config (`env`, `envSchema`, `registry`), built on `@spfn/core/env`. | [src/config](./src/config/README.md) |
+| `@spfn/core/app-config` | Reads `spfn.config.js` — the one committed place that says which ports and host the app is served on (`loadAppConfig`, `resolvePorts`, `resolveHost`, `PORT_DEFAULTS`). Deliberately side-effect free, so the CLI can import it before an app's environment exists. | [src/app-config/index.ts](https://github.com/fxylabs/spfn/blob/main/packages/core/src/app-config/index.ts) |
 | `@spfn/core/logger` | Structured singleton `logger` with child loggers and level masking. No dependencies. | [src/logger](./src/logger/README.md) |
 | `@spfn/core/cache` | Valkey/Redis singleton over ioredis (`getCache`, `getCacheRead`). Degrades to disabled rather than throwing. | [src/cache](./src/cache/README.md) |
 | `@spfn/core/job` | Background jobs on pg-boss: a fluent `job()` builder, cron, run-once, event-driven, `defineJobRouter`. | [src/job](./src/job/README.md) |
@@ -227,6 +354,7 @@ entry in `package.json` `exports`. Each module has its own README with the API d
 | `@spfn/core/event/ws/client` | Browser WebSocket client. | [src/event](./src/event/README.md) |
 | `@spfn/core/codegen` | The codegen orchestrator and the built-in generators: `@spfn/core:route-map` for the proxy's route map, `@spfn/core:contract` for the client contract. | [src/codegen](./src/codegen/README.md) |
 | `@spfn/core/contract` | Route contracts for clients that ship separately: collect, snapshot, and the build gate that refuses a breaking change. | [src/contract](./src/contract/README.md) |
+| `@spfn/core/ops` | The operations surface `spfn ops` drives: `opsRoute`, `createOpsRouter`, `defineOpsModule`, and the manifest the CLI discovers commands from. Structure only — the router is always authenticated, and token verification lives in `@spfn/auth`. | [How do I operate the app from the terminal?](#how-do-i-operate-the-app-from-the-terminal) |
 
 `db/manager`, `db/schema` and `db/transaction` are **not** package subpaths of their own.
 They are internal modules re-exported by `@spfn/core/db` — import their symbols from
@@ -292,8 +420,8 @@ export default defineServerConfig()
 
 All three log the pending list as a warning rather than silently continuing.
 
-**A readiness probe sees the same thing.** When detailed health is on, `GET /health`
-carries a `migrations` object beside `services`:
+**A readiness probe sees the same thing.** When detailed health is on,
+`GET /_core/health` carries a `migrations` object beside `services`:
 
 ```json
 {
@@ -320,6 +448,78 @@ The serverless path (`createServerlessApp`) has no boot to gate — run
 
 ---
 
+## Which path does the health endpoint answer on?
+
+`/_core/health`. That is the whole answer — `@spfn/core` registers nothing on `/health`.
+
+`/_core/` belongs to `@spfn/core` the way `/_auth/` belongs to `@spfn/auth`: the endpoints
+in it are registered before your routes, so no route you declare can take one. That is
+what makes `/_core/health` the right target for a readiness probe, a Dockerfile
+`HEALTHCHECK` or an uptime monitor — the answer does not depend on what your app defines.
+
+```typescript
+// the endpoint answers at /_core/health, and nowhere else
+export default defineServerConfig().build();
+
+// an additional address, for a probe path you cannot change
+export default defineServerConfig().healthCheck({ path: '/health' }).build();
+
+// off → nothing answers anywhere
+export default defineServerConfig().healthCheck({ enabled: false }).build();
+```
+
+`healthCheck.path` adds a second address. It never moves `/_core/health`, and it is
+registered before your routes like the canonical one — so an app route on the same path
+will not run, and the server says so at boot.
+
+**`/health` is yours now.** Declare `GET /health` and it behaves like any other route of
+yours. Declare nothing there and, for one release, a `GET` answers **410** naming
+`/_core/health`, and the server warns once the first time it is hit — a readiness probe
+failure shows an operator neither a response body nor a status text, so a bare 404 would
+leave them nothing to search for. Upgrading an existing deployment?
+[docs/guides/migration/health-endpoint.md](../../docs/guides/migration/health-endpoint.md).
+
+Every built-in health address is registered before the `lifecycle.beforeRoutes` hook, and
+a Hono middleware only wraps handlers registered after it. So a global guard your app adds
+in that hook — which is what the hook is documented for — cannot close the endpoint a
+probe depends on, and a probe reaches it unauthenticated. An app with `src/server/app.ts`
+(level 3) wires its own server and gets no health endpoint at all.
+
+---
+
+## How does a client synchronize with the server clock?
+
+Call `GET /_core/time` before minting a timestamped proof. It is a built-in,
+unauthenticated and session-free operation registered before application middleware and
+routes:
+
+```json
+{ "serverTimeMillis": 1750000000123 }
+```
+
+The response is a closed contract: `serverTimeMillis` is an integer Unix epoch in
+milliseconds and no additional fields are declared. It always carries
+`Cache-Control: no-store`; a cached clock reading is not a synchronization point.
+
+The value is trustworthy only when the transport is trustworthy. Production clients must
+call the endpoint over HTTPS and validate the server certificate. The endpoint does not
+sign its response, compensate for network latency, choose an authentication skew margin,
+or define client retry and persistence policy — those belong to the consuming protocol.
+
+Tests can inject an exact clock without replacing global time:
+
+```typescript
+const app = await createServer(defineServerConfig()
+    .serverTime({ clock: { now: () => 1750000000123 } })
+    .build());
+```
+
+`CORE_TIME_ROUTE`, `CORE_TIME_PATH`, `ServerTimeResponseSchema` and the
+`ServerTimeResponse` type are exported from `@spfn/core/server` for separately deployed
+client-contract exporters to consume from the same wire definition.
+
+---
+
 ## Can I deploy this to Vercel?
 
 Yes, and it is a first-class target rather than a workaround. From your app:
@@ -369,11 +569,10 @@ path: `spfn build && spfn start`, or the generated Docker files.
 Put the contract in a file and let the agent read it, instead of describing the
 architecture again in every prompt.
 
-An SPFN repository ships an `AGENTS.md` stating what the repo is, the commands, the
+The SPFN repository states it in `CONTRIBUTING.md`: what the repo is, the commands, the
 vertical-slice pattern, and the rules that are not negotiable — never hand-edit generated
-files, migrations come from the schema. Tool-specific files (`CLAUDE.md`,
-`.cursorrules`) point at it in one line rather than duplicating it, so they cannot drift
-apart. Projects created by `spfn create` get the same arrangement.
+files, migrations come from the schema. One file answers to people and agents alike, so
+there is no second copy to drift apart from the first.
 
 Each module README under `src/` is written for the same reader. When an agent is working
 on database code, `src/db/README.md` is the page to give it.
@@ -389,12 +588,11 @@ vertical slice whose path lives under `/_ops/`.
 ```typescript
 // src/server/ops.ts
 import { Type } from '@sinclair/typebox';
-import { route } from '@spfn/core/route';
-import { createOpsRouter } from '@spfn/core/ops';
+import { createOpsRouter, opsRoute } from '@spfn/core/ops';
 import { opsTokenAuth, requireOpsScope } from '@spfn/auth/server';
 
 export const opsRouter = createOpsRouter({
-    listSignups: route.get('/_ops/signups')
+    listSignups: opsRoute.get('/signups')                    // GET /_ops/signups
         .use([requireOpsScope('waitlist:read')])
         .input({ query: Type.Object({ limit: Type.Optional(Type.Number()) }) })
         .handler(async (c) => signupsRepository.list((await c.data()).query.limit)),
@@ -404,16 +602,41 @@ export const opsRouter = createOpsRouter({
 export const appRouter = defineRouter({ ... }).packages([opsRouter]);
 ```
 
-`createOpsRouter` refuses a route outside `/_ops/`, injects the auth middleware into every
-route (there is no unauthenticated variant), and serves `GET /_ops/_manifest` — the
-self-description the CLI reads, with each command's TypeBox schemas as JSON Schema:
+`opsRoute` is `route` with the `/_ops` namespace applied, so a definition carries only the
+path this app owns — what that path looks like, how it nests, which segments are
+parameters are the app's decisions. It exists from `@spfn/core` **0.3.0-beta.2**.
+`createOpsRouter` injects the auth middleware into every route (there is no
+unauthenticated variant) and serves `GET /_ops/_manifest` — the self-description the CLI
+reads, with each command's TypeBox schemas as JSON Schema.
+
+The manifest is registered ahead of the ops routes, so none of them can take its URL even
+when one is a pattern like `/_ops/:name`. That ordering does not reach outside the ops
+router: routes an app declares in its own router are registered before any package router,
+so a pattern there that covers `/_ops/_manifest` — a `/*` catch-all, say — shadows the
+manifest, exactly as it shadows every other package route.
 
 Routes may be grouped in nested `defineRouter`s, and a group's own `.use()` middlewares
-apply to its routes as usual. Three things are refused when the surface is defined, rather
-than discovered in production: two routes sharing a command name (the manifest flattens
-nested groups into one list, so the CLI could not tell them apart), the reserved name
-`getOpsManifest`, and a group mounting `.packages()` (those routes register without the
-prefix check or the auth injection).
+apply to its routes — always after the injected auth, so a group-wide guard reads a
+request that has already been authenticated. A group-level middleware must be a named one;
+wrap a factory to give it a name:
+
+```typescript
+const requireAdmin = defineMiddleware('opsAdminScope', requireOpsScope('admin:read'));
+
+export const opsRouter = createOpsRouter({
+    admin: defineRouter({ getStats, reindex }).use([requireAdmin]),
+}, { auth: opsTokenAuth });
+```
+
+Note that a group's `.use()` middleware carries its `skips` into every route in the group,
+suppressing that server-level middleware there.
+
+Three things are refused when the surface is defined, rather than discovered in
+production: a route built with `route` instead of `opsRoute` (it would carry no
+namespace), two routes sharing a command name (the manifest flattens nested groups into
+one list, so the CLI could not tell them apart), and a group mounting `.packages()` (those
+routes register with neither the namespace nor the auth injection). The command name
+`getOpsManifest` and the path `/_ops/_manifest` are reserved.
 
 ```bash
 spfn ops list --app https://api.example.com          # discover commands
@@ -421,11 +644,63 @@ spfn ops call listSignups --query limit=50            # invoke one
 spfn ops call listSignups --describe                  # print its usage (--json for raw schemas)
 ```
 
+### Can a package ship ops commands?
+
+It can describe them. Whether they are reachable is your application's decision, made in
+the `createOpsRouter` call — installing a package never adds anything to your ops surface.
+Available from **0.3.0-beta.5**.
+
+```typescript
+// in the package
+export const ledgerOpsModule = defineOpsModule({
+    id: 'ledger',
+    source: '@acme/ledger',
+    contractVersion: '1.0.0',
+    summary: 'Ledger diagnostics',
+    commands: {
+        verify: {
+            summary: 'Verify ledger invariants',
+            effect: 'read',                                  // read | write | destructive
+            scopes: ['ledger:read'],
+            route: opsRoute.get('/ledger/verify').handler(verifyLedger),
+        },
+    },
+});
+
+// in the application — nothing is mounted until this line names it
+export const opsRouter = createOpsRouter({ listSignups }, {
+    auth: opsTokenAuth,
+    authorize: requireOpsScope,
+    modules: [ledgerOpsModule],
+});
+```
+
+A module command is named `<module>.<command>` (`ledger.verify`) and its route must live
+under `/_ops/<module>/`. The scopes it declares become a server-side guard, run after
+authentication — `authorize` is required as soon as any module is mounted, and it is passed
+in rather than imported so core stays independent of `@spfn/auth`.
+
+What is refused at definition time: a path that could decode its way out of the module's
+namespace, two commands in one module that could answer the same URL, and an app route that
+overlaps a mounted module's command. That last one matters because the alternative is a
+surface where which command answers depends on route registration order.
+
+The manifest gains a `modules` array and per-command `module`, `summary`, `effect` and
+`scopes`. All of it is additive — an app that mounts no modules serves exactly the v1
+manifest it served before.
+
+```bash
+spfn ops modules                                      # what is mounted, and from where
+spfn ops list --module ledger                         # just that module's commands
+spfn ops call ledger.compact --yes                    # effect=destructive needs this
+```
+
 Authentication is an ops token from [`@spfn/auth`](../auth/README.md#ops-tokens-spfn-ops):
-scoped, revocable, hash-stored, issued with `spfn ops token issue` where database access
-already exists — a deployed app has no token-creation endpoint. On macOS the CLI keeps the
-token in the keychain (`spfn ops token store`), and resolution order is `--token` →
-`SPFN_OPS_TOKEN` → keychain.
+scoped, revocable, hash-stored, issued with `spfn ops token issue` against the running app
+— the CLI signs in as an administrator, so issuance needs no database access. On macOS the
+CLI keeps the token in the keychain (`spfn ops token store`), and resolution order is
+`--token` → `SPFN_OPS_TOKEN` → keychain. The `--app` URL must be https, since every command
+carries a secret; `http` is accepted only against a loopback host.
 
 ---
 

package/dist/app-config/index.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `spfn.config.js` — the app's serving shape, read by both the CLI and the server.
+ *
+ * The file has existed since `spfn init` started writing it, and until now
+ * nothing read it back. It is the one committed place that describes how an app
+ * is served, which makes it the right home for the ports: an app that wants a
+ * different port says so once here instead of repeating the number across its
+ * `server.config.ts`, Dockerfile, compose file, `next.config.ts` and env
+ * example, where nothing checks that the copies still agree.
+ *
+ * This module is deliberately free of side effects. `@spfn/core/config`
+ * validates the whole environment schema the moment it is imported, which is
+ * fine inside a server and wrong inside a CLI that has not been handed an
+ * app's environment yet.
+ *
+ * @module app-config
+ */
+/**
+ * Ports the app is served on.
+ *
+ * Two names because two processes are started. Next.js reads `PORT` as its own,
+ * so the SPFN server cannot claim that name without the two colliding whenever
+ * they run together.
+ */
+interface SpfnPorts {
+    /** Next.js frontend. Passed to `next` as `-p`. */
+    next?: number;
+    /** SPFN API server. */
+    server?: number;
+}
+interface SpfnAppConfig {
+    ports?: SpfnPorts;
+    /** Host the SPFN API server binds. */
+    host?: string;
+    /** Deployment settings — untouched by this module, kept so the type is whole. */
+    [key: string]: unknown;
+}
+/**
+ * The single place each default exists.
+ *
+ * Defaults live at the bottom of the chain and nowhere else. A default declared
+ * at an input layer — a commander option, a generated entry file, an env schema
+ * — cannot be told apart from a value someone supplied, so it silently outranks
+ * whatever is below it. Three separate defects in this repository came from
+ * exactly that, including an env schema default that forced the environment to
+ * be consulted last and made an injected port unreachable.
+ */
+declare const PORT_DEFAULTS: {
+    readonly next: 3790;
+    readonly server: 8790;
+};
+declare const HOST_DEFAULT = "localhost";
+/**
+ * Read `spfn.config.js` from an app directory.
+ *
+ * Returns an empty object when there is no file, and also when the file cannot
+ * be imported — a malformed deployment config must not stop a server from
+ * booting. The caller decides whether the absence is worth reporting.
+ */
+declare function loadAppConfig(cwd?: string): Promise<SpfnAppConfig>;
+/**
+ * The port each process binds, given a loaded config and the environment.
+ *
+ * Three layers, in this order, and no more: environment variable, then
+ * `spfn.config.js`, then the default.
+ */
+declare function resolvePorts(config: SpfnAppConfig, env?: NodeJS.ProcessEnv): {
+    next: number;
+    server: number;
+};
+/**
+ * The host the SPFN server binds, on the same three layers.
+ *
+ * `localhost` by default: a container states `SPFN_HOST=0.0.0.0` in its own
+ * files, where that decision belongs, rather than every developer machine
+ * publishing a dev server to its network.
+ */
+declare function resolveHost(config: SpfnAppConfig, env?: NodeJS.ProcessEnv): string;
+/**
+ * Where the SPFN server binds, including the address a server config may still
+ * carry through `.port()` / `.host()`.
+ *
+ * Those two are deprecated and sit between `spfn.config.js` and the default for
+ * one release, so an app that has not moved yet keeps the address it had. Once
+ * they are removed this collapses back to {@link resolvePorts} and
+ * {@link resolveHost}.
+ */
+declare function resolveServerAddress(config: SpfnAppConfig, deprecated?: {
+    port?: number;
+    host?: string;
+}, env?: NodeJS.ProcessEnv): {
+    port: number;
+    host: string;
+};
+
+export { HOST_DEFAULT, PORT_DEFAULTS, type SpfnAppConfig, type SpfnPorts, loadAppConfig, resolveHost, resolvePorts, resolveServerAddress };

package/dist/app-config/index.js

@@ -0,0 +1,58 @@
+import { existsSync } from 'fs';
+import { pathToFileURL } from 'url';
+import { join } from 'path';
+
+// src/app-config/index.ts
+var PORT_DEFAULTS = {
+  next: 3790,
+  server: 8790
+};
+var HOST_DEFAULT = "localhost";
+var CONFIG_FILE_NAMES = [
+  "spfn.config.js",
+  "spfn.config.mjs"
+];
+async function loadAppConfig(cwd = process.cwd()) {
+  for (const fileName of CONFIG_FILE_NAMES) {
+    const fullPath = join(cwd, fileName);
+    if (!existsSync(fullPath)) {
+      continue;
+    }
+    try {
+      const module = await import(pathToFileURL(fullPath).href);
+      return module.default ?? {};
+    } catch (error) {
+      console.warn(
+        `\u26A0\uFE0F  ${fileName} could not be imported \u2014 falling back to defaults for ports and host. ${error instanceof Error ? error.message : String(error)}`
+      );
+      return {};
+    }
+  }
+  return {};
+}
+function resolvePorts(config, env = process.env) {
+  return {
+    next: readPort(env.NEXT_PORT) ?? config.ports?.next ?? PORT_DEFAULTS.next,
+    server: readPort(env.SPFN_PORT) ?? config.ports?.server ?? PORT_DEFAULTS.server
+  };
+}
+function resolveHost(config, env = process.env) {
+  return env.SPFN_HOST || config.host || HOST_DEFAULT;
+}
+function resolveServerAddress(config, deprecated = {}, env = process.env) {
+  return {
+    port: readPort(env.SPFN_PORT) ?? config.ports?.server ?? deprecated.port ?? PORT_DEFAULTS.server,
+    host: env.SPFN_HOST || config.host || deprecated.host || HOST_DEFAULT
+  };
+}
+function readPort(value) {
+  if (!value) {
+    return void 0;
+  }
+  const port = Number(value);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : void 0;
+}
+
+export { HOST_DEFAULT, PORT_DEFAULTS, loadAppConfig, resolveHost, resolvePorts, resolveServerAddress };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/app-config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/app-config/index.ts"],"names":[],"mappings":";;;;;AA2DO,IAAM,aAAA,GAAgB;AAAA,EACzB,IAAA,EAAM,IAAA;AAAA,EACN,MAAA,EAAQ;AACZ;AAEO,IAAM,YAAA,GAAe;AAE5B,IAAM,iBAAA,GAAoB;AAAA,EACtB,gBAAA;AAAA,EACA;AACJ,CAAA;AASA,eAAsB,aAAA,CAAc,GAAA,GAAc,OAAA,CAAQ,GAAA,EAAI,EAC9D;AACI,EAAA,KAAA,MAAW,YAAY,iBAAA,EACvB;AACI,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA;AAEnC,IAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EACxB;AACI,MAAA;AAAA,IACJ;AAEA,IAAA,IACA;AAGI,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,aAAA,CAAc,QAAQ,CAAA,CAAE,IAAA,CAAA;AAEpD,MAAA,OAAQ,MAAA,CAAO,WAAW,EAAC;AAAA,IAC/B,SACO,KAAA,EACP;AAQI,MAAA,OAAA,CAAQ,IAAA;AAAA,QACJ,CAAA,cAAA,EAAO,QAAQ,CAAA,2EAAA,EACU,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,OACnF;AAEA,MAAA,OAAO,EAAC;AAAA,IACZ;AAAA,EACJ;AAEA,EAAA,OAAO,EAAC;AACZ;AAQO,SAAS,YAAA,CACZ,MAAA,EACA,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAErC;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,SAAS,GAAA,CAAI,SAAS,KAAK,MAAA,CAAO,KAAA,EAAO,QAAQ,aAAA,CAAc,IAAA;AAAA,IACrE,MAAA,EAAQ,SAAS,GAAA,CAAI,SAAS,KAAK,MAAA,CAAO,KAAA,EAAO,UAAU,aAAA,CAAc;AAAA,GAC7E;AACJ;AASO,SAAS,WAAA,CACZ,MAAA,EACA,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAErC;AACI,EAAA,OAAO,GAAA,CAAI,SAAA,IAAa,MAAA,CAAO,IAAA,IAAQ,YAAA;AAC3C;AAWO,SAAS,qBACZ,MAAA,EACA,UAAA,GAA+C,EAAC,EAChD,GAAA,GAAyB,QAAQ,GAAA,EAErC;AACI,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,QAAA,CAAS,GAAA,CAAI,SAAS,CAAA,IACrB,OAAO,KAAA,EAAO,MAAA,IACd,UAAA,CAAW,IAAA,IACX,aAAA,CAAc,MAAA;AAAA,IACrB,MAAM,GAAA,CAAI,SAAA,IACH,MAAA,CAAO,IAAA,IACP,WAAW,IAAA,IACX;AAAA,GACX;AACJ;AAEA,SAAS,SAAS,KAAA,EAClB;AACI,EAAA,IAAI,CAAC,KAAA,EACL;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AAEzB,EAAA,OAAO,MAAA,CAAO,UAAU,IAAI,CAAA,IAAK,OAAO,CAAA,IAAK,IAAA,GAAO,QAAQ,IAAA,GAAO,MAAA;AACvE","file":"index.js","sourcesContent":["/**\n * `spfn.config.js` — the app's serving shape, read by both the CLI and the server.\n *\n * The file has existed since `spfn init` started writing it, and until now\n * nothing read it back. It is the one committed place that describes how an app\n * is served, which makes it the right home for the ports: an app that wants a\n * different port says so once here instead of repeating the number across its\n * `server.config.ts`, Dockerfile, compose file, `next.config.ts` and env\n * example, where nothing checks that the copies still agree.\n *\n * This module is deliberately free of side effects. `@spfn/core/config`\n * validates the whole environment schema the moment it is imported, which is\n * fine inside a server and wrong inside a CLI that has not been handed an\n * app's environment yet.\n *\n * @module app-config\n */\n\nimport { existsSync } from 'fs';\nimport { pathToFileURL } from 'url';\nimport { join } from 'path';\n\n/**\n * Ports the app is served on.\n *\n * Two names because two processes are started. Next.js reads `PORT` as its own,\n * so the SPFN server cannot claim that name without the two colliding whenever\n * they run together.\n */\nexport interface SpfnPorts\n{\n    /** Next.js frontend. Passed to `next` as `-p`. */\n    next?: number;\n\n    /** SPFN API server. */\n    server?: number;\n}\n\nexport interface SpfnAppConfig\n{\n    ports?: SpfnPorts;\n\n    /** Host the SPFN API server binds. */\n    host?: string;\n\n    /** Deployment settings — untouched by this module, kept so the type is whole. */\n    [key: string]: unknown;\n}\n\n/**\n * The single place each default exists.\n *\n * Defaults live at the bottom of the chain and nowhere else. A default declared\n * at an input layer — a commander option, a generated entry file, an env schema\n * — cannot be told apart from a value someone supplied, so it silently outranks\n * whatever is below it. Three separate defects in this repository came from\n * exactly that, including an env schema default that forced the environment to\n * be consulted last and made an injected port unreachable.\n */\nexport const PORT_DEFAULTS = {\n    next: 3790,\n    server: 8790,\n} as const;\n\nexport const HOST_DEFAULT = 'localhost';\n\nconst CONFIG_FILE_NAMES = [\n    'spfn.config.js',\n    'spfn.config.mjs',\n] as const;\n\n/**\n * Read `spfn.config.js` from an app directory.\n *\n * Returns an empty object when there is no file, and also when the file cannot\n * be imported — a malformed deployment config must not stop a server from\n * booting. The caller decides whether the absence is worth reporting.\n */\nexport async function loadAppConfig(cwd: string = process.cwd()): Promise<SpfnAppConfig>\n{\n    for (const fileName of CONFIG_FILE_NAMES)\n    {\n        const fullPath = join(cwd, fileName);\n\n        if (!existsSync(fullPath))\n        {\n            continue;\n        }\n\n        try\n        {\n            // A file URL, not a path: on Windows an absolute path is not a\n            // valid ESM specifier, and this file is imported at runtime.\n            const module = await import(pathToFileURL(fullPath).href);\n\n            return (module.default ?? {}) as SpfnAppConfig;\n        }\n        catch (error)\n        {\n            // Falling back to defaults, and saying so. A file that exists and\n            // cannot be imported is a typo, not an absence — silence would send\n            // the server to port 8790 while its own config named another, and\n            // the only symptom would be a port nobody chose.\n            //\n            // console, not the server logger: this runs inside the CLI too,\n            // before any logger is configured.\n            console.warn(\n                `⚠️  ${fileName} could not be imported — falling back to defaults `\n                + `for ports and host. ${error instanceof Error ? error.message : String(error)}`,\n            );\n\n            return {};\n        }\n    }\n\n    return {};\n}\n\n/**\n * The port each process binds, given a loaded config and the environment.\n *\n * Three layers, in this order, and no more: environment variable, then\n * `spfn.config.js`, then the default.\n */\nexport function resolvePorts(\n    config: SpfnAppConfig,\n    env: NodeJS.ProcessEnv = process.env,\n): { next: number; server: number }\n{\n    return {\n        next: readPort(env.NEXT_PORT) ?? config.ports?.next ?? PORT_DEFAULTS.next,\n        server: readPort(env.SPFN_PORT) ?? config.ports?.server ?? PORT_DEFAULTS.server,\n    };\n}\n\n/**\n * The host the SPFN server binds, on the same three layers.\n *\n * `localhost` by default: a container states `SPFN_HOST=0.0.0.0` in its own\n * files, where that decision belongs, rather than every developer machine\n * publishing a dev server to its network.\n */\nexport function resolveHost(\n    config: SpfnAppConfig,\n    env: NodeJS.ProcessEnv = process.env,\n): string\n{\n    return env.SPFN_HOST || config.host || HOST_DEFAULT;\n}\n\n/**\n * Where the SPFN server binds, including the address a server config may still\n * carry through `.port()` / `.host()`.\n *\n * Those two are deprecated and sit between `spfn.config.js` and the default for\n * one release, so an app that has not moved yet keeps the address it had. Once\n * they are removed this collapses back to {@link resolvePorts} and\n * {@link resolveHost}.\n */\nexport function resolveServerAddress(\n    config: SpfnAppConfig,\n    deprecated: { port?: number; host?: string } = {},\n    env: NodeJS.ProcessEnv = process.env,\n): { port: number; host: string }\n{\n    return {\n        port: readPort(env.SPFN_PORT)\n            ?? config.ports?.server\n            ?? deprecated.port\n            ?? PORT_DEFAULTS.server,\n        host: env.SPFN_HOST\n            || config.host\n            || deprecated.host\n            || HOST_DEFAULT,\n    };\n}\n\nfunction readPort(value: string | undefined): number | undefined\n{\n    if (!value)\n    {\n        return undefined;\n    }\n\n    const port = Number(value);\n\n    return Number.isInteger(port) && port > 0 && port < 65536 ? port : undefined;\n}\n"]}