@endora-commerce/platform 0.100.0

package/dist/demo/runner.js

@@ -0,0 +1,169 @@
+import { planDemoRun, } from './plan.js';
+import { createDemoPackageResolver, demoBodyFromPackage, } from './packages.js';
+/**
+ * A module's demo body failed, and the run failed with it (§3.8).
+ *
+ * *"A demo seed that half-succeeded silently is worse than one that failed: the
+ * operator cannot tell a partial demo from a complete one."* So the throw is
+ * unconditional and nothing is swallowed — the original error is the `cause`,
+ * unmodified, which is what keeps the entry point's `ModuleDisabledError`
+ * discrimination working through one `unwrapDemoFailure` call rather than
+ * through a `catch` that decides anything.
+ */
+export class DemoRunFailedError extends Error {
+    moduleId;
+    mode;
+    cause;
+    constructor(moduleId, mode, cause) {
+        super(`[demo] module '${moduleId}' failed while the demo ${mode} was running: ` +
+            `${cause instanceof Error ? cause.message : String(cause)}. Nothing after it ran; ` +
+            `the rows it wrote before failing are still there. Run the demo reset before ` +
+            `trying again.`);
+        this.moduleId = moduleId;
+        this.mode = mode;
+        this.cause = cause;
+        this.name = 'DemoRunFailedError';
+    }
+}
+/**
+ * The error a demo run really failed with.
+ *
+ * Not a `catch` and not a decision: it unwraps one known wrapper so that an
+ * entry point's existing discrimination — `err instanceof ModuleDisabledError`
+ * — sees what it saw before this layer existed. Everything else passes through.
+ */
+export function unwrapDemoFailure(error) {
+    return error instanceof DemoRunFailedError ? error.cause : error;
+}
+async function invoke(mode, demo, context) {
+    if (mode === 'seed') {
+        const result = await demo.seed(context);
+        return { entities: result.created, result };
+    }
+    const result = await demo.reset(context);
+    return { entities: result.removed, result };
+}
+/**
+ * The phases of one run, as a single result.
+ *
+ * Concatenation in execution order, and it has one property worth naming: an
+ * empty phase contributes nothing, so a composition that declares no foundation
+ * produces exactly the result it produced before the phase existed. That is
+ * what makes §5.5a additive rather than a change to what an operator reads.
+ */
+function mergePhases(phases) {
+    const credentials = phases.flatMap((phase) => phase.credentials ?? []);
+    return {
+        applied: phases.flatMap((phase) => phase.applied),
+        skipped: phases.flatMap((phase) => phase.skipped),
+        ...(credentials.length === 0 ? {} : { credentials }),
+    };
+}
+/**
+ * Run one demo pass and report it.
+ *
+ * The sequence is §3's and §5.5a's, in full: plan (which decides presence),
+ * then the foundation, then each module in order, then the wiring —
+ *
+ * ```
+ * seed   applyFoundation? -> module seed  (dependency order) -> apply
+ * reset  withdraw         -> module reset (reverse order)    -> withdrawFoundation?
+ * ```
+ *
+ * — so `reset` is the exact reverse of `seed` at every position, which is the
+ * property that lets a withdrawal be a filtered delete rather than a cascade.
+ */
+export async function runDemo(input) {
+    const plan = planDemoRun({
+        mode: input.mode,
+        entries: input.entries,
+        isPresent: input.isPresent,
+    });
+    // Every phase this run executes, in the order it executed them. The two
+    // phases are reported as **one** result rather than as a pair, and that is a
+    // decision rather than a shortcut: a step's name is the composition's own
+    // sentence, an operator reads the list as a sequence, and §6.5's *"the
+    // report's shape"* is a property this feature keeps. `phases` is what the
+    // merge is built from so that the merge itself is one statement.
+    const phases = [];
+    const runPhase = async (phase) => {
+        if (phase === undefined)
+            return;
+        phases.push(await phase.call(input.composition));
+    };
+    if (input.mode === 'reset') {
+        await runPhase(input.composition?.withdraw);
+    }
+    else {
+        await runPhase(input.composition?.applyFoundation);
+    }
+    const modules = [];
+    const credentials = [];
+    const skipped = [...plan.skipped];
+    const packages = input.demoPackages ?? createDemoPackageResolver();
+    for (const step of plan.steps) {
+        // §6.4's **probe**, and it sits here — outside the `try`, before a context
+        // exists — for §3.5's reason one field over: a module whose demo package
+        // is not installed contributes nothing, so nothing is built for it. The
+        // import is inside the `try` below, so a package that is installed and
+        // broken reaches §6.3's third answer and cannot be mistaken for this one.
+        const packageName = step.demo.package;
+        if (packageName !== undefined && !packages.isInstalled(packageName)) {
+            skipped.push({
+                moduleId: step.moduleId,
+                reason: 'demo-package-not-installed',
+                package: packageName,
+            });
+            continue;
+        }
+        try {
+            // §6.3's first answer, *"the module's demo data is the package's"*: when
+            // a package loads, its body replaces the declaration's. It has to — §6.2
+            // bars the module's own sources from naming the package at all, so the
+            // declared `seed` and `reset` could not reach the data if they wanted to.
+            const demo = packageName === undefined
+                ? step.demo
+                : demoBodyFromPackage(await packages.load(packageName), step.moduleId, packageName);
+            // The context is built here and nowhere earlier: §3.5's gate is upstream
+            // of it, in `planDemoRun`.
+            const context = { ctx: input.contextFor(step.moduleId) };
+            const { entities, result } = await invoke(input.mode, demo, context);
+            modules.push({
+                moduleId: step.moduleId,
+                summary: demo.summary,
+                entities,
+                notes: result.notes ?? [],
+            });
+            if ('credentials' in result && result.credentials)
+                credentials.push(...result.credentials);
+        }
+        catch (error) {
+            // Unconditional, and the only statement in the block: nothing is
+            // swallowed and no error is classified here. `DemoRunFailedError` adds
+            // the module's name, which is the whole of §3.8, and keeps the original
+            // as its `cause` — including the import's own throw, which is §6.3's
+            // third answer and must never be read as its second.
+            throw new DemoRunFailedError(step.moduleId, input.mode, error);
+        }
+    }
+    if (input.mode === 'seed') {
+        await runPhase(input.composition?.apply);
+    }
+    else {
+        await runPhase(input.composition?.withdrawFoundation);
+    }
+    const composition = phases.length === 0 ? undefined : mergePhases(phases);
+    return {
+        mode: plan.mode,
+        modules,
+        skipped,
+        counts: plan.counts,
+        // The modules' first and the composition's after, which is the order they
+        // were created in. A module's own account is its own rows; the
+        // composition's is the one no module could create.
+        credentials: [...credentials, ...(composition?.credentials ?? [])],
+        diagnostics: plan.diagnostics,
+        ...(composition === undefined ? {} : { composition }),
+    };
+}
+//# sourceMappingURL=runner.js.map

package/dist/demo/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/demo/runner.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,WAAW,GAKZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AAkIvB;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IACA;IACS;IAHpB,YACW,QAAgB,EAChB,IAAc,EACL,KAAc;QAEhC,KAAK,CACH,kBAAkB,QAAQ,2BAA2B,IAAI,gBAAgB;YACvE,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B;YACnF,8EAA8E;YAC9E,eAAe,CAClB,CAAC;QATO,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAU;QACL,UAAK,GAAL,KAAK,CAAS;QAQhC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAmBD,KAAK,UAAU,MAAM,CACnB,IAAc,EACd,IAA+B,EAC/B,OAAiC;IAKjC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,MAAwC;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;QACjD,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IAEH,wEAAwE;IACxE,6EAA6E;IAC7E,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,EACpB,KAAyD,EAC1C,EAAE;QACjB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAkB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,IAAI,yBAAyB,EAAE,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,4BAA4B;gBACpC,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,IAAI,GACR,WAAW,KAAK,SAAS;gBACvB,CAAC,CAAC,IAAI,CAAC,IAAI;gBACX,CAAC,CAAC,mBAAmB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACxF,yEAAyE;YACzE,2BAA2B;YAC3B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAA8B,CAAC;YACrF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;aAC1B,CAAC,CAAC;YACH,IAAI,aAAa,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iEAAiE;YACjE,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,qDAAqD;YACrD,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1E,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO;QACP,OAAO;QACP,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,0EAA0E;QAC1E,+DAA+D;QAC/D,mDAAmD;QACnD,WAAW,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;QAClE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/demo/scope.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The reasons a demo run's scope carries (feature 113 §3.4; issue #228, FR-020).
+ *
+ * ## Why a demo run needs a scope, and why the runner opens exactly one
+ *
+ * A demo run is a non-HTTP entry point: nothing above it establishes a
+ * `TenantContext`, so any filtered query it makes reads the ambient store, finds
+ * nothing and fails closed (`tenancy/filters.ts`). §3.4 puts that responsibility
+ * on the **runner** and takes it off every module's body: a module's demo data
+ * is not an entry point, so it neither opens a scope nor remembers to. That is
+ * stricter than what it replaced — the developer seed script this feature
+ * retired was a declared program in `check:entry-scope`'s population and had to
+ * remember `enterSystemScope` itself.
+ *
+ * ## Why `system`, and why that changes nothing the run produces
+ *
+ * `enterSystemScope` is the entry for an execution with no caller to derive
+ * tenancy from, and a demo run is the extreme case: it *creates* the demo
+ * organisation, so when it starts there is no organisation to pin to. In
+ * `system` mode both global filters contribute `{}` — every row a demo body
+ * reads and writes with the scope, it would read and write without it. The scope
+ * is not there to change the seeded database; it is there so that the day an
+ * entity a demo body touches is reclassified `@OrgScoped`, the run fails with a
+ * tenancy error instead of silently writing rows no request can ever read.
+ *
+ * Crossing every organisation is observable by construction: `enterSystemScope`
+ * emits one escape-hatch record carrying the reason.
+ *
+ * ## Why these are constants and not a wrapper function
+ *
+ * The scope is entered at the entry point itself, wrapping the invocation, in
+ * the idiom the other CLI entry points use. A tidier `runInSeedScope(main)`
+ * helper was written first and reverted: `check-entry-scope` reads the **entry
+ * file** for one of the two sanctioned entry functions, on the stated ground
+ * that a scope buried in something the entry calls is a scope nobody can see is
+ * there — and it cannot tell a one-caller helper from a shared service. Only the
+ * reasons live here, because they are the sentences the escape-hatch record
+ * carries and a test asserts what an operator would actually read.
+ */
+/** `endora demo seed` — every effectively present module's demo rows, plus the composition. */
+export declare const DEMO_SEED_SCOPE_REASON = "cli: demo seed \u2014 creates every present module's demo rows and the instance composition";
+/** `endora demo reset` — the withdrawal, in reverse. */
+export declare const DEMO_RESET_SCOPE_REASON = "cli: demo reset \u2014 withdraws the instance composition and every present module's demo rows";
+//# sourceMappingURL=scope.d.ts.map

package/dist/demo/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/demo/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,gGACwD,CAAC;AAE5F,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,mGAC0D,CAAC"}

package/dist/demo/scope.js

@@ -0,0 +1,44 @@
+/**
+ * The reasons a demo run's scope carries (feature 113 §3.4; issue #228, FR-020).
+ *
+ * ## Why a demo run needs a scope, and why the runner opens exactly one
+ *
+ * A demo run is a non-HTTP entry point: nothing above it establishes a
+ * `TenantContext`, so any filtered query it makes reads the ambient store, finds
+ * nothing and fails closed (`tenancy/filters.ts`). §3.4 puts that responsibility
+ * on the **runner** and takes it off every module's body: a module's demo data
+ * is not an entry point, so it neither opens a scope nor remembers to. That is
+ * stricter than what it replaced — the developer seed script this feature
+ * retired was a declared program in `check:entry-scope`'s population and had to
+ * remember `enterSystemScope` itself.
+ *
+ * ## Why `system`, and why that changes nothing the run produces
+ *
+ * `enterSystemScope` is the entry for an execution with no caller to derive
+ * tenancy from, and a demo run is the extreme case: it *creates* the demo
+ * organisation, so when it starts there is no organisation to pin to. In
+ * `system` mode both global filters contribute `{}` — every row a demo body
+ * reads and writes with the scope, it would read and write without it. The scope
+ * is not there to change the seeded database; it is there so that the day an
+ * entity a demo body touches is reclassified `@OrgScoped`, the run fails with a
+ * tenancy error instead of silently writing rows no request can ever read.
+ *
+ * Crossing every organisation is observable by construction: `enterSystemScope`
+ * emits one escape-hatch record carrying the reason.
+ *
+ * ## Why these are constants and not a wrapper function
+ *
+ * The scope is entered at the entry point itself, wrapping the invocation, in
+ * the idiom the other CLI entry points use. A tidier `runInSeedScope(main)`
+ * helper was written first and reverted: `check-entry-scope` reads the **entry
+ * file** for one of the two sanctioned entry functions, on the stated ground
+ * that a scope buried in something the entry calls is a scope nobody can see is
+ * there — and it cannot tell a one-caller helper from a shared service. Only the
+ * reasons live here, because they are the sentences the escape-hatch record
+ * carries and a test asserts what an operator would actually read.
+ */
+/** `endora demo seed` — every effectively present module's demo rows, plus the composition. */
+export const DEMO_SEED_SCOPE_REASON = 'cli: demo seed — creates every present module\'s demo rows and the instance composition';
+/** `endora demo reset` — the withdrawal, in reverse. */
+export const DEMO_RESET_SCOPE_REASON = 'cli: demo reset — withdraws the instance composition and every present module\'s demo rows';
+//# sourceMappingURL=scope.js.map

package/dist/demo/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/demo/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GACjC,yFAAyF,CAAC;AAE5F,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAClC,4FAA4F,CAAC"}

package/dist/env/index.d.ts

@@ -0,0 +1,68 @@
+/**
+ * What a running Endora host needs from its environment — the platform's half
+ * of the declaration (feature 117, FR-001; `environment-inputs.md` §R2.1).
+ *
+ * ## Why this exists at all
+ *
+ * `backend/src/index.ts` already tells an operator that a failed boot *"is
+ * almost always a configuration problem (a required secret/env var missing or
+ * malformed)"* and cannot name the variable, because until this file there was
+ * no list. Three `.env.example` files are prose, a module package ships no
+ * `.env.example` at all, and an instance's `.env` therefore could not be
+ * written correctly by anybody — us included.
+ *
+ * ## What is in here and what is not
+ *
+ * Exactly the inputs read under `backend/src` and `packages/platform/src`.
+ * Measured, not curated: `check:env-inputs` reconciles this array against
+ * every `process.env` read in those two trees, **both ways**, so an
+ * undeclared read and a declared input nothing reads are each a build failure.
+ * A module's inputs are the module's own (`manifest.ts`), and each
+ * application's are its own — three authors, one shape, no central list.
+ *
+ * ## No defaults live here (§R1.3)
+ *
+ * The `??` fallbacks in the tree are a separate repair and this file is not
+ * their second home. A declaration that carried a default would be the thing
+ * `defaulted=0` exists to make impossible.
+ *
+ * ## Two things this population taught, worth stating rather than rediscovering
+ *
+ * **`requirement` has no "one of these two" term**, and the tree has a real
+ * pair: `BACKEND_PUBLIC_URL` and `PUBLIC_API_BASE_URL` are read in that order
+ * by `absolutizePublicUrl`, and production refuses to boot when *neither* is
+ * set. It is written below as one `required` input and one `optional` synonym
+ * that says what it overrides, which is faithful about the obligation and
+ * slightly overstates which spelling carries it.
+ *
+ * **A shared secret is not `generable`.** `REVALIDATE_SECRET` is one string in
+ * two repositories; a command that generated it per tree would write two
+ * different values and each tree would be internally consistent and jointly
+ * wrong. `input-resolution.md` R4.1's test — *are two correct values
+ * interchangeable* — is answered per **environment**, and for a value two
+ * environments must share the answer is no.
+ *
+ * **The one exception is a command, not a change to this field.** A single
+ * run that writes **both** trees is one environment, so the premise *"two
+ * environments"* does not hold of it: `endora install` generates this secret
+ * once and writes the same value into both `.env` files
+ * (`input-resolution.md` R4.6, ruled 2026-09-25 as D-269). The field stays
+ * `false` because it describes the input to every other consumer, and every
+ * other command still may not generate it.
+ */
+import type { EnvironmentInput } from '@endora-commerce/contracts';
+/**
+ * The 23 inputs the host and the platform read.
+ *
+ * Order is the order a prompt asks in: the values without which nothing runs
+ * first, then the addresses the platform composes links from, then the knobs.
+ * An operator meeting this for the first time is asked for the database before
+ * they are asked about proxy hops.
+ *
+ * The last two arrived with the liveness probe (D-229), which used to be the
+ * `health_checks` module and is now `http/health.ts`. Their sentences are that
+ * manifest's, carried across rather than rewritten: they were written for this
+ * probe and a rewrite would be a translation round-trip for no gain.
+ */
+export declare const PLATFORM_ENVIRONMENT_INPUTS: readonly EnvironmentInput[];
+//# sourceMappingURL=index.d.ts.map

package/dist/env/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/env/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,gBAAgB,EA4ZlE,CAAC"}