bazis 0.106.0 → 0.108.0

package/cli/build.ts

@@ -14,9 +14,13 @@ export interface BuildOptions {
   readonly outfile?: string;
   /** Let the executable read `.env` files from its working directory (off by default). */
   readonly dotenv?: boolean;
+  /** Another platform, `linux-x64`: `bun build --target=bun-linux-x64`. */
+  readonly platform?: string;
 }
 
 export interface CompileOptions {
+  /** Cross-compile for `bun-<platform>`; Bun downloads that runtime once. */
+  readonly platform?: string;
   /** Let the executable read `.env`, `.env.local`, `.env.<NODE_ENV>` from its working directory. */
   readonly dotenv?: boolean;
 }
@@ -149,10 +153,11 @@ export async function runBuild(cwd: string, options: BuildOptions, codegen: Code
   const s = ui.out;
   const t = s.t;
   const startedAt = performance.now();
-  const outfile = options.bin ? path.resolve(cwd, options.outfile ?? path.join("bin", await binaryName(cwd))) : undefined;
+  const outfile = options.bin ? path.resolve(cwd, options.outfile ?? path.join("bin", await defaultBinaryName(cwd, options.platform))) : undefined;
   commandHeader(s, "build", cwd, [
     s.kv(t.meta.target, s.text(options.bin ? "executable" : "typecheck")),
     ...(outfile === undefined ? [] : [s.kv(t.meta.out, s.text(path.relative(cwd, outfile)))]),
+    ...(options.platform === undefined ? [] : [s.kv(t.meta.platform, s.text(options.platform))]),
   ]);
   s.section(t.section.build);
   const generated = await codegen(cwd, "all", { ui });
@@ -182,7 +187,7 @@ export async function runBuild(cwd: string, options: BuildOptions, codegen: Code
   s.section(t.section.binary);
   const stopCompile = s.progress(t.step.compile);
   const compileStarted = performance.now();
-  const compiled = await compileBinaryAsync(bun, await projectEntry(cwd), outfile, { dotenv: options.dotenv });
+  const compiled = await compileBinaryAsync(bun, await projectEntry(cwd), outfile, { dotenv: options.dotenv, platform: options.platform });
   stopCompile();
   const compileMs = formatDuration(performance.now() - compileStarted);
   const relative = path.relative(cwd, outfile);
@@ -263,9 +268,10 @@ export async function compileBinaryAsync(bun: string, entry: string, outfile: st
   }
 }
 
-function compileArgs(bun: string, entry: string, outfile: string, options: CompileOptions): string[] {
+export function compileArgs(bun: string, entry: string, outfile: string, options: CompileOptions): string[] {
   const autoload = ["--no-compile-autoload-bunfig", options.dotenv === true ? "--compile-autoload-dotenv" : "--no-compile-autoload-dotenv"];
-  return [bun, "build", "--compile", ...autoload, path.resolve(entry), "--outfile", path.resolve(outfile)];
+  const target = options.platform === undefined ? [] : [`--target=bun-${options.platform}`];
+  return [bun, "build", "--compile", ...target, ...autoload, path.resolve(entry), "--outfile", path.resolve(outfile)];
 }
 
 function removeWorkDir(workDir: string): void {
@@ -287,6 +293,12 @@ async function projectEntry(cwd: string): Promise<string> {
   return path.resolve(cwd, entry);
 }
 
+/** `bin/<name>`, or `bin/<name>-<platform>` for another platform, so the local build is kept. */
+async function defaultBinaryName(cwd: string, platform: string | undefined): Promise<string> {
+  const name = await binaryName(cwd);
+  return platform === undefined ? name : `${name}-${platform}`;
+}
+
 async function binaryName(cwd: string): Promise<string> {
   const manifest = Bun.file(path.join(cwd, "package.json"));
   const name = await manifest.exists() ? (await manifest.json() as { name?: unknown }).name : undefined;

package/cli/main.ts

@@ -20,6 +20,8 @@ export const USAGE = `Usage:
   bazis build                                 Codegen and typecheck
   bazis build --bin [--outfile <path>]        Also compile a standalone executable (default bin/<name>)
   bazis build --bin --dotenv                  The executable also reads .env files from its working directory
+  bazis build --bin --platform <os-arch>      For another platform, e.g. linux-x64, linux-arm64-musl
+                                             (default output bin/<name>-<os-arch>)
   bazis --help
   bazis --version                             Print the bazis version (also -v)
   g can also be written as generate.
@@ -130,7 +132,7 @@ export async function runCli(argv: readonly string[], runtime: CliRuntime = defa
     if (parsed.kind === "codegen") return await runCodegenCommand(cwd, parsed.target, codegen, ui);
     if (parsed.kind === "dev") return await runDev(cwd, codegen, ui, { watch: parsed.watch });
     if (parsed.kind === "test") return await runTest(cwd, parsed.args, codegen, ui);
-    if (parsed.kind === "build") return await runBuild(cwd, { bin: parsed.bin, outfile: parsed.outfile, dotenv: parsed.dotenv }, codegen, ui);
+    if (parsed.kind === "build") return await runBuild(cwd, { bin: parsed.bin, outfile: parsed.outfile, dotenv: parsed.dotenv, platform: parsed.platform }, codegen, ui);
     if (parsed.kind === "new") return await runNew(parsed, ui);
     // Module registration parses the host module with the TypeScript API: load it
     // only after switching TypeScript 7 to @typescript/typescript6.

package/cli/parseCli.ts

@@ -26,14 +26,16 @@ export type ParseCliResult =
   | { readonly kind: "codegen"; readonly target?: string }
   | { readonly kind: "dev"; readonly watch: boolean }
   | { readonly kind: "test"; readonly args: readonly string[] }
-  | { readonly kind: "build"; readonly bin: boolean; readonly outfile?: string; readonly dotenv: boolean }
+  | { readonly kind: "build"; readonly bin: boolean; readonly outfile?: string; readonly dotenv: boolean; readonly platform?: string }
   | { readonly kind: "error"; readonly message: string };
 
 const GENERATOR_ALIASES = new Map<string, "module" | "pack">([
   ["module", "module"], ["m", "module"],
   ["pack", "pack"], ["p", "pack"], ["module-pack", "pack"],
 ]);
-const VALUE_OPTIONS = new Set(["--modules-root", "--app-module", "--pack", "--parts", "--target", "--path", "--framework", "--outfile"]);
+const VALUE_OPTIONS = new Set(["--modules-root", "--app-module", "--pack", "--parts", "--target", "--path", "--framework", "--outfile", "--platform"]);
+/** Platforms of `bun build --compile --target=bun-<platform>`. */
+export const BINARY_PLATFORM = /^(linux|darwin|windows)-(x64|arm64)(-musl)?(-baseline|-modern)?$/;
 const FLAG_OPTIONS = new Set(["--no-register", "--force", "--full", "--enterprise", "--minimal", "--empty", "--dry-run", "--no-codegen", "--link-framework", "--vendor", "--bin", "--watch", "--dotenv"]);
 
 /** Parsing is pure: help and invalid input can never start generation. */
@@ -91,15 +93,20 @@ export function parseCliArgs(argv: readonly string[]): ParseCliResult {
   }
   if (options.has("--watch")) return error("--watch is only supported by dev.");
   if (command === "build") {
-    if (positional.length !== 1) return error("Use: bazis build [--bin [--outfile <path>] [--dotenv]]");
+    if (positional.length !== 1) return error("Use: bazis build [--bin [--outfile <path>] [--platform <os-arch>] [--dotenv]]");
     for (const option of options.keys()) {
-      if (option !== "--bin" && option !== "--outfile" && option !== "--dotenv") return error(`Option ${option} is not supported by build.`);
+      if (option !== "--bin" && option !== "--outfile" && option !== "--dotenv" && option !== "--platform") return error(`Option ${option} is not supported by build.`);
     }
     if (options.has("--outfile") && !options.has("--bin")) return error("--outfile requires --bin.");
     if (options.has("--dotenv") && !options.has("--bin")) return error("--dotenv requires --bin.");
-    return { kind: "build", bin: options.has("--bin"), outfile: options.get("--outfile"), dotenv: options.has("--dotenv") };
+    if (options.has("--platform") && !options.has("--bin")) return error("--platform requires --bin.");
+    const platform = options.get("--platform");
+    if (platform !== undefined && !BINARY_PLATFORM.test(platform)) {
+      return error(`Unknown platform: ${platform}. Use <os>-<arch>[-musl]: linux-x64, linux-arm64, linux-x64-musl, linux-arm64-musl, darwin-arm64, darwin-x64, windows-x64.`);
+    }
+    return { kind: "build", bin: options.has("--bin"), outfile: options.get("--outfile"), dotenv: options.has("--dotenv"), ...(platform === undefined ? {} : { platform }) };
   }
-  if (options.has("--bin") || options.has("--outfile") || options.has("--dotenv")) return error("--bin, --outfile and --dotenv are only supported by build.");
+  if (options.has("--bin") || options.has("--outfile") || options.has("--dotenv") || options.has("--platform")) return error("--bin, --outfile, --platform and --dotenv are only supported by build.");
   if (command === "codegen") {
     if (positional.length !== 1) return error("Use: bazis codegen [--target <name|all>]");
     for (const option of options.keys()) {

package/core/app/messages.ts

@@ -1,10 +1,19 @@
-import { EN_HTTP_MESSAGES, RU_HTTP_MESSAGES, formatMessage, type HttpMessageKey, type Localize } from "../http/Errors/messages";
+import { EN_HTTP_MESSAGES, RU_HTTP_MESSAGES, formatMessage, type HttpMessageKey, type LanguageSelection, type Localize, type SelectedLanguage } from "../http/Errors/messages";
 import { KernelError } from "../kernel";
 import { EN_VALIDATION_MESSAGES, MessageRegistry, RU_VALIDATION_MESSAGES, type ValidationCode } from "../../library/validation";
 
 /** Language of the texts the framework writes into responses. */
 export type AppLanguage = "en" | "ru";
 
+/**
+ * Several response languages: each request gets the best match of its
+ * `Accept-Language` among `supported`, or `default`.
+ */
+export interface AppLanguageOptions {
+  readonly default: AppLanguage;
+  readonly supported: readonly AppLanguage[];
+}
+
 /**
  * Own texts for framework messages, by key: HTTP texts (`notFound`,
  * `malformedJson`, …), validation codes (`required`, `minLength`, …),
@@ -42,3 +51,49 @@ export function createLocalize(language: AppLanguage = "en", messages: AppMessag
     return text === undefined ? undefined : formatMessage(text, params, template);
   };
 }
+
+/**
+ * The response language of every request: one language, or the best match of
+ * `Accept-Language` (`ru-RU,ru;q=0.9,en;q=0.8`) among `supported`.
+ */
+export function createLanguages(option: AppLanguage | AppLanguageOptions = "en", messages: AppMessages = {}): LanguageSelection {
+  if (typeof option === "string") {
+    const single: SelectedLanguage = { language: option, localize: createLocalize(option, messages) };
+    return { negotiated: false, select: () => single };
+  }
+  const supported = [...new Set(option.supported)];
+  if (supported.length === 0) throw new KernelError("runApp: language.supported needs at least one language.");
+  if (!supported.includes(option.default)) {
+    throw new KernelError(`runApp: language.default "${String(option.default)}" must be one of language.supported (${supported.join(", ")}).`);
+  }
+  const selected = new Map<string, SelectedLanguage>(supported.map((language) => [language, { language, localize: createLocalize(language, messages) }]));
+  const fallback = selected.get(option.default)!;
+  return {
+    negotiated: supported.length > 1,
+    select(acceptLanguage) {
+      const language = negotiateLanguage(acceptLanguage, supported);
+      return language === undefined ? fallback : selected.get(language)!;
+    },
+  };
+}
+
+/** The supported language with the highest `q` in `Accept-Language`; ties keep the header order. */
+export function negotiateLanguage(header: string | null | undefined, supported: readonly string[]): string | undefined {
+  if (header === null || header === undefined || header.length > 1024) return undefined;
+  let best: { language: string; q: number } | undefined;
+  for (const part of header.split(",").slice(0, 32)) {
+    const [range = "", ...parameters] = part.trim().split(";");
+    const tag = range.trim().toLowerCase();
+    if (tag.length === 0) continue;
+    let q = 1;
+    for (const parameter of parameters) {
+      const [name, value] = parameter.trim().split("=");
+      if (name?.trim() === "q") q = Number(value);
+    }
+    if (!Number.isFinite(q) || q <= 0 || q > 1) continue;
+    const primary = tag === "*" ? undefined : tag.split("-")[0];
+    const language = primary === undefined ? undefined : supported.find((candidate) => candidate === primary);
+    if (language !== undefined && (best === undefined || q > best.q)) best = { language, q };
+  }
+  return best?.language;
+}

package/core/app/runApp.ts

@@ -13,6 +13,7 @@ import { missingCacheModuleCheck } from "../cache/http/missingCacheModuleCheck";
 import { httpModule, useModelValidator, type HttpModuleOptions, type ModelValidator } from "../http";
 import { grpcModule, type GrpcModuleOptions } from "../grpc";
 import { buildHttpOpenApiDocument } from "../http/OpenApi/openApiDocument";
+import { defaultAuthorizeChecks } from "../http/Authorization/metadata";
 import { KernelBuilder, Bazis, KernelError, type KernelOptions, type ValidatableConfig } from "../kernel";
 import { websocketModule, type WebSocketOptions } from "../websocket";
 import {
@@ -20,7 +21,7 @@ import {
   type UiProfileV1,
 } from "../../library/ui";
 import { modelValidatorAdapter } from "../../library/validation";
-import { createLocalize, type AppLanguage, type AppMessages } from "./messages";
+import { createLanguages, type AppLanguage, type AppLanguageOptions, type AppMessages } from "./messages";
 import { useCodexLanguage } from "../infra/connectors/codex/contracts";
 import {
   type RunAppUiOptions,
@@ -65,8 +66,16 @@ export interface RunAppOptions {
    * ```ts
    * await runApp(AppModule, { language: "ru", http: { port: 3000 } });
    * ```
+   *
+   * Several languages — each request gets the best match of its
+   * `Accept-Language`, or `default`; such responses carry `Content-Language`
+   * and `Vary: Accept-Language`, and `ctx.language` names the choice:
+   *
+   * ```ts
+   * await runApp(AppModule, { language: { default: "ru", supported: ["ru", "en"] } });
+   * ```
    */
-  readonly language?: AppLanguage;
+  readonly language?: AppLanguage | AppLanguageOptions;
   /**
    * Own texts for single framework messages, on top of `language`:
    * `{ notFound: "Нет такой страницы", required: "Заполните {property}" }`.
@@ -204,6 +213,7 @@ function buildUiOpenApiDocument(
     controllers: collectModuleControllers([root]),
     globalPrefix: http.prefix,
     versioning: http.versioning,
+    authorize: defaultAuthorizeChecks(http.authorize),
     title: docs?.title ?? "Bazis UI profiles",
     version: docs?.version ?? "1.0.0",
   });
@@ -290,8 +300,8 @@ export async function runApp(root: BazisModuleRef, options: RunAppOptions = {}):
  */
 export function composeApp(root: BazisModuleRef, options: RunAppOptions = {}): BazisModuleRef {
   // Checked even without HTTP: an unknown language is a startup error.
-  const localize = createLocalize(options.language, options.messages);
-  useCodexLanguage(options.language ?? "en");
+  const languages = createLanguages(options.language, options.messages);
+  useCodexLanguage(typeof options.language === "object" ? options.language.default : options.language ?? "en");
   // Infrastructure and cache are global modules; add them to the graph next to the feature root.
   const globals: BazisModuleRef[] = [];
   if (options.infra !== undefined) {
@@ -329,7 +339,7 @@ export function composeApp(root: BazisModuleRef, options: RunAppOptions = {}): B
       options.http,
     );
     const httpRoot = httpModule({
-      localize,
+      languages,
       ...options.http,
       validator,
       imports: [httpAppRoot],

package/core/http/Authorization/authorizeComposer.ts

@@ -2,7 +2,7 @@ import { JwtError } from "../../../library/jwt/errors";
 import { ForbiddenError, UnauthorizedError } from "../Errors/HttpError";
 import type { HttpMiddleware } from "../Middleware/types";
 import type { RouteMiddlewareComposer } from "../options";
-import { resolveAuthorizeMeta } from "./metadata";
+import { routeAuthorizeChecks, type AuthorizeCheck } from "./metadata";
 
 /**
  * Built-in composer for `@Authorize`. The HTTP server puts it first among
@@ -12,14 +12,13 @@ import { resolveAuthorizeMeta } from "./metadata";
  * `UnauthorizedError` → `401`). A `JwtError` (missing, malformed, expired or
  * forged token) escaping a check is a 401 as well, not a server error.
  */
-export function createAuthorizeComposer(): RouteMiddlewareComposer {
+export function createAuthorizeComposer(defaults: readonly AuthorizeCheck[] = []): RouteMiddlewareComposer {
   return (controllerClass, methodName) => {
-    const meta = resolveAuthorizeMeta(controllerClass, methodName);
-    if (meta.allowAnonymous || meta.authorize === undefined) {
+    const checks = routeAuthorizeChecks(controllerClass, methodName, defaults);
+    if (checks === undefined) {
       return [];
     }
 
-    const { checks } = meta.authorize;
     const middleware: HttpMiddleware = async (ctx, next) => {
       for (const check of checks) {
         let allowed: boolean;

package/core/http/Authorization/metadata.ts

@@ -177,3 +177,20 @@ export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol):
     ? { allowAnonymous: false }
     : { allowAnonymous: false, authorize: { checks } };
 }
+
+/**
+ * The checks a route runs: the server's default checks (`runApp({ http:
+ * { authorize } })`) first, then the route's own `@Authorize`; each function
+ * once. `undefined` — the route is open: `@AllowAnonymous`, or no checks at all.
+ */
+export function routeAuthorizeChecks(ctor: object, methodName: string | symbol, defaults: readonly AuthorizeCheck[] = []): readonly AuthorizeCheck[] | undefined {
+  const meta = resolveAuthorizeMeta(ctor, methodName);
+  if (meta.allowAnonymous) return undefined;
+  const checks = [...new Set([...defaults, ...(meta.authorize?.checks ?? [])])];
+  return checks.length === 0 ? undefined : checks;
+}
+
+/** `authorize` of the HTTP options as a list. */
+export function defaultAuthorizeChecks(option: AuthorizeCheck | readonly AuthorizeCheck[] | undefined): readonly AuthorizeCheck[] {
+  return option === undefined ? [] : typeof option === "function" ? [option] : option;
+}

package/core/http/Errors/messages.ts

@@ -8,6 +8,27 @@ export type MessageParams = Readonly<Record<string, unknown>>;
  */
 export type Localize = (key: string, params: MessageParams) => string | undefined;
 
+/** The response language of one request and its texts. */
+export interface SelectedLanguage {
+  readonly language: string;
+  readonly localize: Localize;
+}
+
+/**
+ * Picks the response language of a request. `negotiated`: several languages,
+ * chosen by `Accept-Language`; responses whose text the framework wrote then
+ * carry `Content-Language` and `Vary: Accept-Language`.
+ */
+export interface LanguageSelection {
+  readonly negotiated: boolean;
+  select(acceptLanguage: string | null | undefined): SelectedLanguage;
+}
+
+/** Headers of a framework-written response in a negotiated language. */
+export function languageHeaders(selection: LanguageSelection | undefined, selected: SelectedLanguage | undefined): [string, string][] {
+  return selection?.negotiated === true && selected !== undefined ? [["content-language", selected.language], ["vary", "Accept-Language"]] : [];
+}
+
 /** A message key and parameters carried by an error, rendered at the response. */
 export interface LocalizedMessage {
   readonly key: string;

package/core/http/HttpContext/HttpContext.ts

@@ -46,6 +46,12 @@ export class HttpContext {
     readonly clientIp?: string,
     /** Validator captured by the owning HTTP server. */
     readonly modelValidator?: ModelValidator,
+    /**
+     * Response language of this request: `runApp({ language })`, or the best
+     * match of `Accept-Language` when several languages are supported.
+     * `undefined` without `language`.
+     */
+    readonly language?: string,
   ) {}
 
   get method(): string {

package/core/http/HttpServer.ts

@@ -15,6 +15,7 @@ import type { HttpMiddleware } from "./Middleware/types";
 import { prepareOpenApiDocs, serveOpenApiDocs } from "./OpenApi/openApiDocs";
 import type { PreparedOpenApiDocs } from "../../library/openapi";
 import { RouterBuilder } from "./Routing/RouterBuilder";
+import { defaultAuthorizeChecks } from "./Authorization/metadata";
 import type { Router } from "./Routing/Router";
 import { parseRequestPath } from "./Routing/template";
 import { assertVersioningOptions, createVersionReader, type VersionReader } from "./Versioning/VersionReader";
@@ -22,7 +23,7 @@ import { HTTP_ERROR_HOOK, ROUTE_MIDDLEWARE_COMPOSER, SERVER_MIDDLEWARE, sortByOr
 import type { HealthEndpointOptions, RouteMiddlewareComposer, HttpModuleOptions, HttpServerOptions } from "./options";
 import { WEBSOCKET_UPGRADE, type WebSocketUpgrade } from "./WebSocketUpgrade";
 import { HttpSetupError } from "./Errors/HttpError";
-import { EN_HTTP_MESSAGES, formatMessage, type HttpMessageKey, type MessageParams } from "./Errors/messages";
+import { EN_HTTP_MESSAGES, formatMessage, languageHeaders, type HttpMessageKey, type MessageParams, type SelectedLanguage } from "./Errors/messages";
 import { getModelValidator, type ModelValidator } from "./Binding/modelValidator";
 
 const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
@@ -167,7 +168,7 @@ export class HttpServer implements HostedService {
       errorHandler({
         exposeDetails,
         ...(errorLogger ? { logger: errorLogger } : {}),
-        ...(this.options.localize ? { localize: this.options.localize } : {}),
+        ...(this.options.languages ? { languages: this.options.languages } : {}),
         ...this.options.errorHandler,
         onUnexpectedError: this.collectErrorHook(),
       }),
@@ -177,11 +178,13 @@ export class HttpServer implements HostedService {
     this.globalCors = this.options.cors || serverMiddleware.map(corsOptionsOf).find((options) => options !== undefined);
     serverChain.push(...serverMiddleware.filter((middleware) => !isCorrelationIdMiddleware(middleware)));
 
+    const defaultChecks = defaultAuthorizeChecks(this.options.authorize);
     const builder = new RouterBuilder(
       serverChain,
       this.options.prefix,
       this.options.versioning,
       this.collectRouteComposer(),
+      defaultChecks,
     );
     this.router = builder.build(this.options.controllers);
     const routes = builder.routes;
@@ -192,6 +195,7 @@ export class HttpServer implements HostedService {
       globalPrefix: this.options.prefix,
       versioning: this.options.versioning,
       environment: this.resolver.tryResolve(Environment),
+      authorize: defaultChecks,
     });
 
     this.webSocket = this.resolver.tryResolve(WEBSOCKET_UPGRADE);
@@ -204,7 +208,7 @@ export class HttpServer implements HostedService {
         await ws.initialize();
         this.server = await this.startBunServer((listen) => Bun.serve({
           ...listen,
-          error: (error) => this.transportError(error),
+          error: (error) => this.transportError(error, undefined),
           websocket: ws.createBunHandler(),
           fetch: async (request, server) => {
             // null -> not for the WS runtime, fall through to HTTP.
@@ -230,7 +234,7 @@ export class HttpServer implements HostedService {
         Bun.serve({
           ...listen,
           fetch: (request, server) => this.dispatch(request, server.requestIP(request)?.address),
-          error: (error) => this.transportError(error),
+          error: (error) => this.transportError(error, undefined),
         }),
       );
     }
@@ -380,29 +384,44 @@ export class HttpServer implements HostedService {
     } catch (error) {
       // Covers failures before a request context can be created. Normal route
       // and short-circuit failures are handled by the configured error boundary.
-      response = this.prepareClientResponse(this.transportError(error), request);
+      response = this.prepareClientResponse(this.transportError(error, request), request);
     }
     // HEAD must echo the GET response's status/headers without a body.
     return request.method === "HEAD" ? stripBody(response) : response;
   }
 
-  /** A response text the server writes itself, in the application language. */
-  private text(key: HttpMessageKey, params: MessageParams = {}): string {
+  /** The response language of a request; `undefined` without `runApp({ language })`. */
+  private selected(request: Request | undefined): SelectedLanguage | undefined {
+    try {
+      return this.options.languages?.select(request?.headers.get("accept-language"));
+    } catch {
+      return undefined;
+    }
+  }
+
+  /** A response text the server writes itself, in the language of the request. */
+  private text(key: HttpMessageKey, request: Request | undefined, params: MessageParams = {}): string {
     const english = formatMessage(EN_HTTP_MESSAGES[key], params);
     try {
-      return this.options.localize?.(key, params) ?? english;
+      return this.selected(request)?.localize(key, params) ?? english;
     } catch {
       return english;
     }
   }
 
-  private transportError(error: unknown): Response {
+  /** `{ error, …extra }` the server writes itself, with the language headers when negotiated. */
+  private errorJson(request: Request | undefined, status: number, key: HttpMessageKey, extra: Record<string, unknown> = {}, headers: Record<string, string> = {}): Response {
+    const language = Object.fromEntries(languageHeaders(this.options.languages, this.selected(request)));
+    return json(status, { error: this.text(key, request), ...extra }, { ...headers, ...language });
+  }
+
+  private transportError(error: unknown, request: Request | undefined): Response {
     try {
       console.error("[http] transport failed:", redactSensitive(error));
     } catch {
       // Best-effort diagnostics only.
     }
-    const response = json(500, { error: this.text("internalServerError") });
+    const response = this.errorJson(request, 500, "internalServerError");
     if (this.options.securityHeaders !== false) {
       applySecurityHeaders(response, this.options.securityHeaders ?? {});
     }
@@ -446,9 +465,9 @@ export class HttpServer implements HostedService {
     if (!segments) {
       if (this.maxBodyBytes !== undefined && exceedsBodyLimit(request, this.maxBodyBytes)) {
         return this.runShortCircuit(request, url, clientIp, () =>
-          json(413, { error: this.text("payloadTooLarge"), details: { maxBytes: this.maxBodyBytes } }));
+          this.errorJson(request, 413, "payloadTooLarge", { details: { maxBytes: this.maxBodyBytes } }));
       }
-      return this.runShortCircuit(request, url, clientIp, () => json(400, { error: this.text("malformedPath") }));
+      return this.runShortCircuit(request, url, clientIp, () => this.errorJson(request, 400, "malformedPath"));
     }
 
     const match = this.router!.match(request.method, segments, this.readVersion(request, url));
@@ -457,18 +476,18 @@ export class HttpServer implements HostedService {
       : this.maxBodyBytes;
     if (effectiveMaxBodyBytes !== undefined && exceedsBodyLimit(request, effectiveMaxBodyBytes)) {
       return this.runShortCircuit(request, url, clientIp, () =>
-        json(413, { error: this.text("payloadTooLarge"), details: { maxBytes: effectiveMaxBodyBytes } }));
+        this.errorJson(request, 413, "payloadTooLarge", { details: { maxBytes: effectiveMaxBodyBytes } }));
     }
     if (match.kind === "not-found") {
-      return this.runShortCircuit(request, url, clientIp, () => json(404, { error: this.text("notFound") }));
+      return this.runShortCircuit(request, url, clientIp, () => this.errorJson(request, 404, "notFound"));
     }
     if (match.kind === "method-not-allowed") {
       return this.runShortCircuit(request, url, clientIp, () =>
-        json(405, { error: this.text("methodNotAllowed") }, { allow: match.allow.join(", ") }));
+        this.errorJson(request, 405, "methodNotAllowed", {}, { allow: match.allow.join(", ") }));
     }
     if (match.kind === "unsupported-version") {
       return this.runShortCircuit(request, url, clientIp, () =>
-        json(400, { error: this.text("unsupportedApiVersion"), details: { supported: match.supported } }));
+        this.errorJson(request, 400, "unsupportedApiVersion", { details: { supported: match.supported } }));
     }
 
     const scope = this.provider.createScope();
@@ -481,13 +500,14 @@ export class HttpServer implements HostedService {
       effectiveMaxBodyBytes,
       clientIp,
       this.modelValidator,
+      this.selected(request)?.language,
     );
     let scopeTransferred = false;
     try {
       await runPipeline(match.action.chain, ctx);
       // The error boundary always sets a response on failure; an empty
       // response here means no middleware produced one.
-      const response = this.prepareClientResponse(ctx.response ?? json(404, { error: this.text("notFound") }), request);
+      const response = this.prepareClientResponse(ctx.response ?? this.errorJson(request, 404, "notFound"), request);
       if (request.method === "HEAD") return stripBody(response);
       if (!response.body) return response;
       this.trackResponse(holdResponseScope(response, request.signal, () =>
@@ -525,6 +545,7 @@ export class HttpServer implements HostedService {
       this.maxBodyBytes,
       clientIp,
       this.modelValidator,
+      this.selected(request)?.language,
     );
     const terminal: HttpMiddleware = async (context) => {
       context.response = await produce();
@@ -532,7 +553,7 @@ export class HttpServer implements HostedService {
     let scopeTransferred = false;
     try {
       await runPipeline([...this.shortCircuitChain, terminal], ctx);
-      const response = this.prepareClientResponse(ctx.response ?? json(500, { error: this.text("internalServerError") }), request);
+      const response = this.prepareClientResponse(ctx.response ?? this.errorJson(request, 500, "internalServerError"), request);
       if (request.method === "HEAD") return stripBody(response);
       if (!response.body) return response;
       this.trackResponse(holdResponseScope(response, request.signal, () =>

package/core/http/Middleware/errorHandler.ts

@@ -3,7 +3,7 @@ import { redactSensitive, redactSensitiveText } from "../../../library/redaction
 import { HttpClientError, HttpErrorCode } from "../../../library/http-client/errors";
 import type { HttpContext } from "../HttpContext/HttpContext";
 import { HttpError, ModelValidationError } from "../Errors/HttpError";
-import { EN_HTTP_MESSAGES, STATUS_MESSAGE_KEYS, type HttpMessageKey, type Localize } from "../Errors/messages";
+import { EN_HTTP_MESSAGES, STATUS_MESSAGE_KEYS, type HttpMessageKey, languageHeaders, type LanguageSelection, type Localize } from "../Errors/messages";
 import { upstreamFailure } from "../Errors/upstreamFailure";
 import type { HttpMiddleware } from "./types";
 
@@ -36,11 +36,11 @@ export interface ErrorHandlerOptions {
   logger?: Logger;
   /**
    * Renders framework texts (`Not Found`, validation messages, …) in the
-   * application language; `runApp` builds it from `language` and `messages`.
-   * Without it the texts stay English. Messages an application passes to an
-   * error itself are never changed.
+   * response language of each request; `runApp` builds it from `language` and
+   * `messages`. Without it the texts stay English. Messages an application
+   * passes to an error itself are never changed.
    */
-  localize?: Localize;
+  languages?: LanguageSelection;
 }
 
 function jsonResponse(status: number, body: unknown, extraHeaders?: readonly [string, string][]): Response {
@@ -111,13 +111,15 @@ function safelyReportUnexpected(
  */
 export function errorHandler(options: ErrorHandlerOptions = {}): HttpMiddleware {
   const log = resolveErrorLog(options);
-  const text = textRenderer(options.localize);
   return async (ctx, next) => {
     try {
       await next();
     } catch (error) {
+      const selected = options.languages?.select(ctx.header("accept-language"));
+      const text = textRenderer(selected?.localize);
+      const language = languageHeaders(options.languages, selected);
       if (error instanceof HttpError) {
-        const extra: [string, string][] = [];
+        const extra: [string, string][] = [...language];
         const allow = (error as { allow?: readonly string[] }).allow;
         if (allow) {
           extra.push(["allow", allow.join(", ")]);
@@ -159,8 +161,8 @@ export function errorHandler(options: ErrorHandlerOptions = {}): HttpMiddleware
             // message must not reach a browser or a shared screenshot.
             message: redactSensitiveText(error instanceof Error ? error.message : String(error)),
             stack: error instanceof Error && error.stack !== undefined ? redactSensitiveText(error.stack) : undefined,
-          })
-        : safeJsonResponse(status, { error: title });
+          }, language)
+        : safeJsonResponse(status, { error: title }, language);
     }
   };
 }

package/core/http/OpenApi/openApiDocs.ts

@@ -1,3 +1,4 @@
+import type { AuthorizeCheck } from "../Authorization/metadata";
 import type { Class } from "../../di";
 import { Environment } from "../../kernel";
 import {
@@ -15,6 +16,7 @@ interface PrepareOpenApiDocsInput {
   readonly globalPrefix?: string;
   readonly versioning?: ApiVersioningOptions;
   readonly environment?: Environment;
+  readonly authorize?: readonly AuthorizeCheck[];
 }
 
 const DEFAULT_UI_PATH = "/docs";
@@ -38,6 +40,7 @@ export function prepareOpenApiDocs(input: PrepareOpenApiDocsInput): PreparedOpen
     versioning: input.versioning,
     title,
     version,
+    ...(input.authorize === undefined ? {} : { authorize: input.authorize }),
   });
   const json = JSON.stringify(document, null, 2);
   return {

package/core/http/OpenApi/openApiDocument.ts

@@ -8,7 +8,7 @@ import {
   type OpenApiSchema,
 } from "../../../library/openapi";
 import { optionsFromSchema } from "../../../library/jsonapi";
-import { resolveAuthorizeMeta } from "../Authorization/metadata";
+import { resolveAuthorizeMeta, routeAuthorizeChecks, type AuthorizeCheck } from "../Authorization/metadata";
 import type { ParameterBinding } from "../Binding/bindings";
 import { resolveGeneratedBindings } from "../Binding/autoBindings";
 import { controllerMetaOf, type ActionMeta, type ControllerMeta } from "../Decorators/metadata";
@@ -23,6 +23,8 @@ export interface HttpOpenApiDocumentBuildInput {
   readonly versioning?: ApiVersioningOptions;
   readonly title: string;
   readonly version: string;
+  /** Default checks of `runApp({ http: { authorize } })`: such routes are secured too. */
+  readonly authorize?: readonly AuthorizeCheck[];
 }
 
 /** Body of every error response: `{ "error": "...", "details": ... }` (see Middleware/errorHandler). */
@@ -80,6 +82,7 @@ function collectOpenApiOperations(
           routeTemplate: joinPaths(meta.prefix, route.template),
           versioning: input.versioning,
           generated,
+          defaultChecks: input.authorize ?? [],
         }));
       }
     }
@@ -98,6 +101,7 @@ interface CreateOperationInput {
   readonly routeTemplate: string;
   readonly versioning?: ApiVersioningOptions;
   readonly generated: GeneratedOpenApiMetadata;
+  readonly defaultChecks: readonly AuthorizeCheck[];
 }
 
 function createOperation(input: CreateOperationInput): OpenApiCatalogOperation {
@@ -108,7 +112,7 @@ function createOperation(input: CreateOperationInput): OpenApiCatalogOperation {
   const status = String(successStatus(input.httpMethod, input.action, generatedOperation?.status));
   const responseSchema = generatedOperation?.response;
   const contentType = input.action.produces ?? "application/json";
-  const authorized = !auth.allowAnonymous && auth.authorize !== undefined;
+  const authorized = routeAuthorizeChecks(input.controllerClass, input.methodName, input.defaultChecks) !== undefined;
 
   return {
     path: input.path,

package/core/http/Routing/RouterBuilder.ts

@@ -10,7 +10,7 @@ import { corsOptionsOf } from "../Middleware/cors";
 import { normalizeResult } from "../Results/normalize";
 import type { ApiVersioningOptions, RouteMiddlewareComposer } from "../options";
 import { createAuthorizeComposer } from "../Authorization/authorizeComposer";
-import { resolveAuthorizeMeta } from "../Authorization/metadata";
+import { resolveAuthorizeMeta, routeAuthorizeChecks, type AuthorizeCheck } from "../Authorization/metadata";
 
 /** A registered route as the startup screen lists it. */
 export interface RegisteredRoute {
@@ -39,7 +39,7 @@ interface ActionPipeline {
  * precompiled per route — request dispatch performs no metadata work at all.
  */
 export class RouterBuilder {
-  private readonly authorizeComposer = createAuthorizeComposer();
+  private readonly authorizeComposer: RouteMiddlewareComposer;
   /** Every route of the last {@link build}, in registration order. */
   readonly routes: RegisteredRoute[] = [];
 
@@ -49,7 +49,11 @@ export class RouterBuilder {
     private readonly globalPrefix: string | undefined,
     private readonly versioning: ApiVersioningOptions | undefined,
     private readonly routeMiddlewareComposer?: RouteMiddlewareComposer,
-  ) {}
+    /** Checks for every route that is not `@AllowAnonymous`. */
+    private readonly defaultChecks: readonly AuthorizeCheck[] = [],
+  ) {
+    this.authorizeComposer = createAuthorizeComposer(defaultChecks);
+  }
 
   build(controllers: readonly Class<object>[]): Router {
     const router = new Router();
@@ -110,7 +114,7 @@ export class RouterBuilder {
           method: declaration.httpMethod,
           path: fullPath,
           handler: routeAction.name,
-          open: access.allowAnonymous === true || access.authorize === undefined,
+          open: routeAuthorizeChecks(controllerClass, methodName, this.defaultChecks) === undefined,
           anonymous: access.allowAnonymous === true,
         }));
       }

package/core/http/options.ts

@@ -2,12 +2,13 @@ import type { Class } from "../di";
 import type { AccessLogOptions } from "./Middleware/accessLog";
 import type { CorsOptions } from "./Middleware/cors";
 import type { ErrorHandlerOptions } from "./Middleware/errorHandler";
-import type { Localize } from "./Errors/messages";
+import type { LanguageSelection } from "./Errors/messages";
 import type { SecurityHeadersOptions } from "./Middleware/securityHeaders";
 import type { HttpMiddleware } from "./Middleware/types";
 import type { ActionMeta, ControllerMeta } from "./Decorators/metadata";
 import type { OpenApiDocsOptions } from "../../library/openapi";
 import type { ModelValidator } from "./Binding/modelValidator";
+import type { AuthorizeCheck } from "./Authorization/metadata";
 
 /** Built-in health endpoint (liveness/readiness probe). */
 export interface HealthEndpointOptions {
@@ -60,11 +61,11 @@ export interface HttpModuleOptions {
   /** Request-model validator captured by this HTTP server instance. */
   readonly validator?: ModelValidator;
   /**
-   * Renders framework response texts in the application language. `runApp`
+   * Response language of each request and its framework texts. `runApp`
    * sets it from its `language` and `messages` options; without it the
    * texts are English.
    */
-  readonly localize?: Localize;
+  readonly languages?: LanguageSelection;
   /**
    * Modules providing the controllers' dependencies. Controllers live inside
    * the returned HttpModule, so their dependencies must be visible to it:
@@ -129,6 +130,16 @@ export interface HttpModuleOptions {
    * title/version.
    */
   readonly docs?: OpenApiDocsOptions | boolean;
+  /**
+   * Closed by default: these checks run on every route that is not
+   * `@AllowAnonymous`, before the route's own `@Authorize` checks
+   * (like ASP.NET Core's fallback policy). `/health` and the docs stay open.
+   *
+   * ```ts
+   * runApp(AppModule, { http: { authorize: signedIn } });
+   * ```
+   */
+  readonly authorize?: AuthorizeCheck | readonly AuthorizeCheck[];
   /**
    * Access log for every request (method, path, status, duration, correlation
    * id). `true` enables the default single-line sink; pass an object to plug a

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.106.0" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.108.0" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/kernel/Kernel.ts

@@ -261,18 +261,32 @@ export class Kernel {
       if (this.startupCleanupFailure !== undefined) return Promise.reject(this.startupCleanupFailure);
       return Promise.resolve();
     }
+    // Only an application that started announces its stop.
+    const wasStarted = this.state === "started";
     this.state = "stopping";
-    this.shutdownPromise = this.stopCore(request);
+    this.shutdownPromise = this.stopCore(request, wasStarted);
     return this.shutdownPromise;
   }
 
-  private async stopCore(request: StopRequest): Promise<void> {
+  private async stopCore(request: StopRequest, wasStarted: boolean): Promise<void> {
     // The whole graceful-stop sequence — lifetime notifications, the STOPPING
     // event, hosted services/hooks and disposal — is bounded by one budget. A
     // single hanging callback or handler must not wedge shutdown forever.
+    const announce = wasStarted && this.options.startupReport && this.options.schemaOnly !== true;
+    const logger = announce ? this.container.tryResolve(LOGGER) : undefined;
+    const startedAt = performance.now();
     const work = this.runShutdownSequence(request);
     try {
       await awaitShutdown(work, this.options.shutdownTimeoutMs);
+      if (announce) {
+        const fields = {
+          ...(request.signal === undefined ? {} : { signal: request.signal }),
+          exitCode: request.exitCode,
+          shutdownMs: Number((performance.now() - startedAt).toFixed(1)),
+        };
+        if (logger) logger.info("bazis stopped", fields);
+        else console.log(`[bazis] stopped ${JSON.stringify(fields)}`);
+      }
     } finally {
       this.state = "stopped";
     }
@@ -441,6 +455,12 @@ export class Kernel {
     console.error("[bazis] Unhandled error, shutting down:", redacted);
   }
 
+  /** Where the servers listen: `{ listening: ["http://localhost:3000"] }`. */
+  private listening(): { listening?: readonly string[] } {
+    const urls = (this.container.tryResolve(StartupReport)?.listeners ?? []).map((listener) => listener.url);
+    return urls.length > 0 ? { listening: urls } : {};
+  }
+
   private printStartupReport(): void {
     if (this.options.onStarted !== undefined) {
       try {
@@ -460,6 +480,7 @@ export class Kernel {
       hostedServices: this.coordinator.startedHostedCount,
       hooks: this.coordinator.hookCount,
       startupMs: Number(this.startupMs.toFixed(1)),
+      ...this.listening(),
     };
     if (logger) {
       logger.info("bazis started", fields);

package/core/kernel/KernelBuilder.ts

@@ -166,9 +166,11 @@ export class KernelBuilder {
     const userRoot = resolveUserRoot(this.rootModule, environment);
     const configs = collectModuleConfigs([userRoot]);
     const configRegistry = new ConfigRegistry(configs, environment.name, configuration);
-    const startupReport = this.startupReport ?? !environment.isProduction;
-    // The screen replaces the report line, so it follows the same switch.
-    const screen = this.startupScreen !== undefined && startupReport;
+    // The `bazis started` / `bazis stopped` lines are printed in every
+    // environment: in production they are the only sign that the process is up.
+    const startupReport = this.startupReport ?? true;
+    // The screen replaces the started line outside production.
+    const screen = this.startupScreen !== undefined && (this.startupReport ?? !environment.isProduction);
     const report = new StartupReport(screen);
     report.configuration(configRegistry.inspect());
     this.builtReport = report;

package/library/terminal/messages.ts

@@ -98,7 +98,7 @@ const en = {
     codegen: "codegen", typecheck: "typecheck", config: "config", connections: "connections", schema: "schema",
     modules: "modules", services: "services", tests: "bun test", compile: "compile", files: "files", register: "register",
   },
-  meta: { env: "env", watch: "watch", on: "on", off: "off", src: "src", pid: "pid", target: "target", out: "output", path: "path" },
+  meta: { env: "env", watch: "watch", on: "on", off: "off", src: "src", pid: "pid", target: "target", out: "output", path: "path", platform: "platform" },
   common: {
     of: "of", in: "in", and: "and", none: "none", ok: "ok", empty: "empty", plus: "plus", memory: "memory",
     declaredIn: "declared in", code: "code", where: "where", try: "try", logs: "logs", inProcess: "in process",
@@ -260,7 +260,7 @@ const ru: Messages = {
     codegen: "кодогенерация", typecheck: "типы", config: "конфигурация", connections: "подключения", schema: "схема",
     modules: "модули", services: "сервисы", tests: "bun test", compile: "компиляция", files: "файлы", register: "подключение",
   },
-  meta: { env: "среда", watch: "слежение", on: "вкл", off: "выкл", src: "вход", pid: "pid", target: "цель", out: "файл", path: "путь" },
+  meta: { env: "среда", watch: "слежение", on: "вкл", off: "выкл", src: "вход", pid: "pid", target: "цель", out: "файл", path: "путь", platform: "платформа" },
   common: {
     of: "из", in: "в", and: "и", none: "нет", ok: "в порядке", empty: "пусто", plus: "ещё", memory: "память",
     declaredIn: "объявлено в", code: "код", where: "где", try: "попробуйте", logs: "журнал", inProcess: "в процессе",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.106.0",
+  "version": "0.108.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",