Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

Back to skills

Api Config Client

ASecurity

How to use @owlmeans/api-config-client — the browser half of the runtime config flow, a loading-stage middleware that fetches the config a backend advertises and merges it into the client config. Auto-invoked when wiring runtime API config into a client app or debugging a client that boots with an incomplete config.

3 stars
0 votes
0 copies
0 views
Added 9/22/2026
developmenttypescriptdebuggingapibackend

Works with

cliapi

Security Analysis

A100/100

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add owlmeans/common --skill api-config-client --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Api Config Client?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Api Config Client
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/owlmeans-api-config-client/badge)](https://www.skillsdirectory.com/skills/owlmeans-api-config-client)

More formats (shields.io, HTML) on the badges page.

Download Zip
Files
SKILL.md
---
name: api-config-client
description: How to use @owlmeans/api-config-client — the browser half of the runtime config flow, a loading-stage middleware that fetches the config a backend advertises and merges it into the client config. Auto-invoked when wiring runtime API config into a client app or debugging a client that boots with an incomplete config.
user-invocable: false
---

# @owlmeans/api-config-client

**Layer:** Client
**Install:** `"@owlmeans/api-config-client": "^0.1.18-rc.28"` in `dependencies`

Consumes the declaration shared by `@owlmeans/api-config` and answered by
`@owlmeans/api-config-server`.

## Key Exports

| Export | Description |
|--------|-------------|
| `apiConfigMiddleware` | Context middleware, `Loading` stage — fetches the advertised config and merges it into `context.cfg` |
| `entrypoints` | The `API_CONFIG` protocol bound for client use, so the middleware can call it |

## Usage

Both halves are needed: the middleware does the work, the entrypoint is what it calls.

```typescript
import { apiConfigMiddleware, entrypoints as apiConfigBindings } from '@owlmeans/api-config-client'

export const makeContext = <C extends AppConfig, T extends AppContext<C>>(cfg: C): T => {
  const context = makeClientContext(cfg) as T
  context.registerMiddleware(apiConfigMiddleware)
  return context
}

export const clientBindings = [...apiConfigBindings, ...myClientBindings]
```

A panel app on `@owlmeans/web-panel` or `@owlmeans/mui-panel` already registers both — do it again
only in a context built from a lower layer.

## What the middleware does

It runs once during `init()`, as a `Context`/`Loading` middleware — after every service and
resource has initialized and just before the context is marked ready. So the merged values are
there for anything that reads `cfg` at request or render time, but **not** for a value a service
captured while initializing: that one still holds what the bundle shipped.

- **Both halves, or the boot dies.** The middleware resolves `API_CONFIG` against the context
  before it tests anything else, so a context that registers `apiConfigMiddleware` without also
  registering local `entrypoints` bindings fails `init()` with `SyntaxError: Entrypoint api-config:advertise not
  found`. That failure is outside the swallowing below — it is a hard boot error, not a missing
  value discovered later.
- **It is a no-op unless `cfg.primaryHost` is set.** A build without it keeps whatever the bundle
  was compiled with, silently. That is the first thing to check when a client boots with a config
  the backend does not agree with.
- `cfg.primaryHost` (and `cfg.primaryPort`, when given) are written onto the entrypoint's route
  before the call, so the config is fetched from the primary backend rather than from wherever the
  entrypoint would otherwise resolve.
- The answer is merged into `context.cfg` in place by `mergeConfig` from `@owlmeans/config`:
  objects are merged key by key, two arrays are **appended**, and the server's value replaces the
  built-in one only where that built-in is a scalar, `null` or absent. Where the built-in is an
  object or an array and the server sends a scalar, the merge recurses into that pair, matches
  neither branch and returns the built-in untouched — **the server's value is silently dropped**.
  An array the bundle already carries therefore grows on every merge, and can be neither replaced
  nor emptied from the server.
- A failed **fetch** is logged and swallowed — only the call and the merge are inside the
  try/catch. The app continues on its built-in config, so a misconfigured or unreachable primary
  host shows up as missing values later, never as a boot error.

## Depends On

Declared: `@owlmeans/api-config`, `@owlmeans/client-entrypoint`, `@owlmeans/client-context`,
`@owlmeans/context`.

Imported but **not** declared in this package's manifest: `@owlmeans/config` (`mergeConfig`, which
does the merging described above). A workspace resolves it anyway; a standalone install has to name
it in its own dependencies.

Attribution

owlmeansowlmeans
View sourceMore from owlmeans →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Browser Extension Developer

Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.

284072 votes

Seo Optimizer

SEO optimization with keyword analysis, readability assessment, technical validation, content quality. Use for search rankings, blog posts, content audits, or encountering keyword density, readability scores, meta tags, schema markup errors.

2192 votes

Google Official Seo Guide

Official Google SEO guide covering search optimization, best practices, Search Console, crawling, indexing, and improving website search visibility based on official Google documentation

1862 votes

Tanstack Start

Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 + Cloudflare Workers app with file-based routing and server functions — even if they don't name TanStack Start specifically. No template repo — Claude generates every file fresh per ...

9881 votes

Pentest

PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

5491 votes
View all in development →