@sparkerp/plugin-sdk 0.1.0 → 1.0.0

package/bundle/catalog.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-09-14T13:48:11.094Z",
+  "generatedAt": "2026-09-23T05:56:28.078Z",
   "generatedBy": "erp platform catalog --refresh (tools/erp-cli/erp.mjs buildEngineCatalog)",
   "note": "Mechanically-derived from backend/platform-runtime/engine-*/src/main/java (regex class/interface/enum/record + @*Mapping scan) and every V*__*.sql Flyway migration under backend/platform-runtime — NOT a hand-maintained inventory, NOT a full Java AST parse. Regenerate with `erp platform catalog --refresh` whenever engine-* source changes.",
   "engineCount": 43,
@@ -1032,6 +1032,22 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V65__gateway_public_read_path.sql",
+          "version": 65,
+          "tables": [
+            "gateway_public_read_path"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V101__erp_orchestration_phases_2_to_6.sql",
           "version": 101,
@@ -1575,6 +1591,23 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -1757,7 +1790,7 @@
     },
     "engine-api": {
       "module": "engine-api",
-      "classCount": 288,
+      "classCount": 310,
       "classes": [
         {
           "name": "AccessRow",
@@ -1929,6 +1962,11 @@
           "kind": "interface",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\asset\\AssetStorage.java"
         },
+        {
+          "name": "AssignApplicationRequest",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
+        },
         {
           "name": "AssignApplicationsRequest",
           "kind": "record",
@@ -1959,6 +1997,16 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\rule\\RuleAuthoringController.java"
         },
+        {
+          "name": "AvailableApplication",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\AvailableApplicationsController.java"
+        },
+        {
+          "name": "AvailableApplicationsController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\AvailableApplicationsController.java"
+        },
         {
           "name": "BackfillSummary",
           "kind": "record",
@@ -1969,6 +2017,11 @@
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantLifecycleService.java"
         },
+        {
+          "name": "BootstrapAdminUserRequest",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
+        },
         {
           "name": "BrandingController",
           "kind": "class",
@@ -1994,6 +2047,16 @@
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\rule\\BusinessRuleEvaluator.java"
         },
+        {
+          "name": "CatalogEntry",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformCatalogController.java"
+        },
+        {
+          "name": "CatalogResponse",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformCatalogController.java"
+        },
         {
           "name": "CloneModuleRequest",
           "kind": "record",
@@ -2034,6 +2097,11 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\region\\TenantRegionController.java"
         },
+        {
+          "name": "DashboardResponse",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformDashboardController.java"
+        },
         {
           "name": "DataServiceExecutionSweepJob",
           "kind": "class",
@@ -2394,6 +2462,21 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\application\\ApplicationScaffoldController.java"
         },
+        {
+          "name": "GatewayPublicReadPathController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathController.java"
+        },
+        {
+          "name": "GatewayPublicReadPathRepository",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathRepository.java"
+        },
+        {
+          "name": "GatewayPublicReadPathRow",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathRow.java"
+        },
         {
           "name": "GrantAccessRequest",
           "kind": "record",
@@ -2569,11 +2652,46 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\bundle\\ApplicationPackageService.java"
         },
+        {
+          "name": "PathRequest",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathController.java"
+        },
+        {
+          "name": "PlatformAdminGate",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformAdminGate.java"
+        },
+        {
+          "name": "PlatformAdminRoleRepository",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformAdminRoleRepository.java"
+        },
         {
           "name": "PlatformBootstrapPluginInstaller",
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformBootstrapPluginInstaller.java"
         },
+        {
+          "name": "PlatformCatalogController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformCatalogController.java"
+        },
+        {
+          "name": "PlatformDashboardController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformDashboardController.java"
+        },
+        {
+          "name": "PlatformPluginRow",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformPluginsController.java"
+        },
+        {
+          "name": "PlatformPluginsController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformPluginsController.java"
+        },
         {
           "name": "PlatformTenantBootstrapRunner",
           "kind": "class",
@@ -2589,11 +2707,21 @@
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformTenantResolutionController.java"
         },
+        {
+          "name": "PlatformTenantsController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformTenantsController.java"
+        },
         {
           "name": "PlatformUserDirectoryRepository",
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformUserDirectoryRepository.java"
         },
+        {
+          "name": "PluginEntitlementResult",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
+        },
         {
           "name": "PromoteRequest",
           "kind": "record",
@@ -2804,6 +2932,11 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\application\\ApplicationScaffoldController.java"
         },
+        {
+          "name": "ServiceCounts",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformDashboardController.java"
+        },
         {
           "name": "ServiceDeploymentTargetRequest",
           "kind": "record",
@@ -2954,6 +3087,11 @@
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
         },
+        {
+          "name": "TenantCounts",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformDashboardController.java"
+        },
         {
           "name": "TenantDatabase",
           "kind": "class",
@@ -3139,6 +3277,11 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantApplicationRestController.java"
         },
+        {
+          "name": "UpdateTenantRequest",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\UpdateTenantRequest.java"
+        },
         {
           "name": "UpsertBody",
           "kind": "record",
@@ -3202,6 +3345,7 @@
       ],
       "controllerBasePaths": [
         "/access",
+        "/active",
         "/ai-generate",
         "/api/platform/deployment-targets",
         "/api/v1/assets",
@@ -3229,10 +3373,15 @@
         "/api/v1/localization-master-data",
         "/api/v1/organizations",
         "/api/v1/platform-tenant",
+        "/api/v1/platform/catalog",
+        "/api/v1/platform/dashboard",
         "/api/v1/platform/extension-registry",
+        "/api/v1/platform/gateway-public-read-paths",
+        "/api/v1/platform/plugins",
         "/api/v1/platform/service-registry",
         "/api/v1/platform/tenant-applications",
         "/api/v1/platform/tenant-extensions",
+        "/api/v1/platform/tenants",
         "/api/v1/provisioning",
         "/api/v1/reference",
         "/api/v1/reference/providers",
@@ -3243,6 +3392,7 @@
         "/application-catalog/{key}",
         "/approval-permissions",
         "/authoring/workflows",
+        "/available-applications",
         "/by-name",
         "/by-subdomain/{subdomain}",
         "/catalog",
@@ -3276,12 +3426,15 @@
         "/tenant-settings",
         "/tenant-users",
         "/tenants",
+        "/tenants/{tenantId}/upload",
         "/{code}",
         "/{entityType}",
         "/{extensionCode}",
         "/{extensionCode}/status",
         "/{id}",
+        "/{id}/applications/{applicationKey}/assign",
         "/{id}/archive",
+        "/{id}/bootstrap-admin-user",
         "/{id}/bootstrap-defaults",
         "/{id}/decommission",
         "/{id}/deprecate",
@@ -3791,6 +3944,34 @@
           "path": "/{scope}/{scopeKey}",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\state\\StateController.java"
         },
+        {
+          "path": "/api/v1/organizations",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\AvailableApplicationsController.java"
+        },
+        {
+          "path": "/available-applications",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\AvailableApplicationsController.java"
+        },
+        {
+          "path": "/api/v1/platform/gateway-public-read-paths",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathController.java"
+        },
+        {
+          "path": "/active",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathController.java"
+        },
+        {
+          "path": "/{id}",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathController.java"
+        },
+        {
+          "path": "/{id}",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathController.java"
+        },
+        {
+          "path": "/{id}",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\GatewayPublicReadPathController.java"
+        },
         {
           "path": "/api/v1/organizations",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\OrganizationRegistrationController.java"
@@ -3799,10 +3980,38 @@
           "path": "/register",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\OrganizationRegistrationController.java"
         },
+        {
+          "path": "/api/v1/platform/catalog",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformCatalogController.java"
+        },
+        {
+          "path": "/api/v1/platform/dashboard",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformDashboardController.java"
+        },
+        {
+          "path": "/api/v1/platform/plugins",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformPluginsController.java"
+        },
+        {
+          "path": "/tenants/{tenantId}/upload",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformPluginsController.java"
+        },
         {
           "path": "/api/v1/platform-tenant",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformTenantResolutionController.java"
         },
+        {
+          "path": "/api/v1/platform/tenants",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformTenantsController.java"
+        },
+        {
+          "path": "/{id}/suspend",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformTenantsController.java"
+        },
+        {
+          "path": "/{id}/decommission",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\PlatformTenantsController.java"
+        },
         {
           "path": "/api/v1/provisioning",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\ProvisioningController.java"
@@ -3843,10 +4052,18 @@
           "path": "/{id}/bootstrap-defaults",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
         },
+        {
+          "path": "/{id}/bootstrap-admin-user",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
+        },
         {
           "path": "/application-catalog/{key}",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
         },
+        {
+          "path": "/{id}/applications/{applicationKey}/assign",
+          "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
+        },
         {
           "path": "/{id}/sandbox",
           "file": "backend\\platform-runtime\\engine-api\\src\\main\\java\\com\\erp\\platform\\engine\\api\\tenancy\\TenantController.java"
@@ -4215,6 +4432,31 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V65__gateway_public_read_path.sql",
+          "version": 65,
+          "tables": [
+            "gateway_public_read_path"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V8__translation_key_value.sql",
           "version": 8,
@@ -4438,6 +4680,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V163__user_organization_scope.sql",
+          "version": 163,
+          "tables": [
+            "user_organization_scope"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V16__block_definition.sql",
           "version": 16,
@@ -4491,6 +4741,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V26__actor_role_assignment.sql",
+          "version": 26,
+          "tables": [
+            "actor_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V27__validation_library.sql",
           "version": 27,
@@ -4566,6 +4824,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V40__role_catalog.sql",
+          "version": 40,
+          "tables": [
+            "role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V41__permission_catalog.sql",
           "version": 41,
@@ -5196,6 +5462,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -8550,6 +8824,15 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V8__translation_key_value.sql",
           "version": 8,
@@ -9320,6 +9603,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -10581,6 +10872,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V8__translation_key_value.sql",
           "version": 8,
@@ -13263,6 +13562,23 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V8__translation_key_value.sql",
           "version": 8,
@@ -14358,6 +14674,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V8__translation_key_value.sql",
           "version": 8,
@@ -15766,6 +16090,23 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -16939,6 +17280,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -18131,6 +18480,23 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V101__erp_orchestration_phases_2_to_6.sql",
           "version": 101,
@@ -18198,6 +18564,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V163__user_organization_scope.sql",
+          "version": 163,
+          "tables": [
+            "user_organization_scope"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V1__init_tenant_baseline.sql",
           "version": 1,
@@ -18534,7 +18908,7 @@
     },
     "engine-plugin": {
       "module": "engine-plugin",
-      "classCount": 53,
+      "classCount": 54,
       "classes": [
         {
           "name": "ApplicationRegistryInstaller",
@@ -18741,6 +19115,11 @@
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-plugin\\src\\main\\java\\com\\erp\\platform\\engine\\plugin\\PluginMetadataArtifactInstaller.java"
         },
+        {
+          "name": "PluginPublicApiInstaller",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-plugin\\src\\main\\java\\com\\erp\\platform\\engine\\plugin\\PluginPublicApiInstaller.java"
+        },
         {
           "name": "PluginRoleInstaller",
           "kind": "class",
@@ -19100,6 +19479,31 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V65__gateway_public_read_path.sql",
+          "version": 65,
+          "tables": [
+            "gateway_public_read_path"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V105__password_policy_overrides.sql",
           "version": 105,
@@ -19571,7 +19975,7 @@
     },
     "engine-plugin-api": {
       "module": "engine-plugin-api",
-      "classCount": 46,
+      "classCount": 48,
       "classes": [
         {
           "name": "AiActionContribution",
@@ -19723,6 +20127,11 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-plugin-api\\src\\main\\java\\com\\erp\\platform\\engine\\plugin\\api\\PluginManifest.java"
         },
+        {
+          "name": "PluginPublicApiDeclaration",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-plugin-api\\src\\main\\java\\com\\erp\\platform\\engine\\plugin\\api\\PluginPublicApiDeclaration.java"
+        },
         {
           "name": "PluginRoleDeclaration",
           "kind": "record",
@@ -19783,6 +20192,11 @@
           "kind": "interface",
           "file": "backend\\platform-runtime\\engine-plugin-api\\src\\main\\java\\com\\erp\\platform\\engine\\plugin\\api\\ServiceContribution.java"
         },
+        {
+          "name": "ShellContribution",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-plugin-api\\src\\main\\java\\com\\erp\\platform\\engine\\plugin\\api\\PluginManifest.java"
+        },
         {
           "name": "StorageProviderContribution",
           "kind": "interface",
@@ -19906,6 +20320,23 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V65__gateway_public_read_path.sql",
+          "version": 65,
+          "tables": [
+            "gateway_public_read_path"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V108__communication_channel_provider.sql",
           "version": 108,
@@ -20397,6 +20828,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V65__gateway_public_read_path.sql",
+          "version": 65,
+          "tables": [
+            "gateway_public_read_path"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V152__workflow_parallel_gateway.sql",
           "version": 152,
@@ -20775,6 +21214,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -21169,6 +21616,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V105__password_policy_overrides.sql",
           "version": 105,
@@ -23003,6 +23458,31 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V65__gateway_public_read_path.sql",
+          "version": 65,
+          "tables": [
+            "gateway_public_read_path"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -23348,6 +23828,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V9__translation_panel_cutover.sql",
           "version": 9,
@@ -24035,7 +24523,7 @@
     },
     "engine-security": {
       "module": "engine-security",
-      "classCount": 193,
+      "classCount": 202,
       "classes": [
         {
           "name": "ActiveSession",
@@ -24092,6 +24580,21 @@
           "kind": "interface",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\notify\\AuthNotificationPort.java"
         },
+        {
+          "name": "BulkActionItemResult",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserController.java"
+        },
+        {
+          "name": "BulkActionRequest",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserController.java"
+        },
+        {
+          "name": "BulkActionResult",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserController.java"
+        },
         {
           "name": "BulkImportResult",
           "kind": "record",
@@ -24667,6 +25170,11 @@
           "kind": "class",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\ScimUserController.java"
         },
+        {
+          "name": "ScopeRequest",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserOrganizationScopeController.java"
+        },
         {
           "name": "ScopeType",
           "kind": "enum",
@@ -24767,6 +25275,16 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\auth\\TenantAuthenticationConfigController.java"
         },
+        {
+          "name": "ShellContributionRow",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\ShellContributionsController.java"
+        },
+        {
+          "name": "ShellContributionsController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\ShellContributionsController.java"
+        },
         {
           "name": "SsoIdentityRepository",
           "kind": "class",
@@ -24942,6 +25460,21 @@
           "kind": "record",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserLoginAttempted.java"
         },
+        {
+          "name": "UserOrganizationScopeController",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserOrganizationScopeController.java"
+        },
+        {
+          "name": "UserOrganizationScopeRepository",
+          "kind": "class",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserOrganizationScopeRepository.java"
+        },
+        {
+          "name": "UserOrganizationScopeRow",
+          "kind": "record",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserOrganizationScopeRow.java"
+        },
         {
           "name": "UserPreferenceRepository",
           "kind": "class",
@@ -25014,6 +25547,7 @@
         "/api/v1/delegations",
         "/api/v1/password",
         "/api/v1/password-policy",
+        "/api/v1/plugins/shell-contributions",
         "/api/v1/portal-access",
         "/api/v1/preferences",
         "/api/v1/preferences/page-style",
@@ -25028,6 +25562,7 @@
         "/api/v1/users",
         "/api/v1/users/{id}/mfa",
         "/approve",
+        "/bulk-action",
         "/bulk-import",
         "/by-domain/{domain}",
         "/code",
@@ -25093,6 +25628,7 @@
         "/{id}/role-mappings",
         "/{id}/roles",
         "/{id}/roles/{role}",
+        "/{id}/scope",
         "/{id}/suspend",
         "/{id}/test-connection",
         "/{id}/unlock",
@@ -25496,6 +26032,10 @@
           "path": "/api/v1/session-policy",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\SessionPolicyController.java"
         },
+        {
+          "path": "/api/v1/plugins/shell-contributions",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\ShellContributionsController.java"
+        },
         {
           "path": "/api/v1/auth/sso",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\SsoLoginController.java"
@@ -25612,6 +26152,10 @@
           "path": "/{id}",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserController.java"
         },
+        {
+          "path": "/bulk-action",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserController.java"
+        },
         {
           "path": "/{id}/roles",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserController.java"
@@ -25623,6 +26167,18 @@
         {
           "path": "/{id}/roles/{role}",
           "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserController.java"
+        },
+        {
+          "path": "/api/v1/users",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserOrganizationScopeController.java"
+        },
+        {
+          "path": "/{id}/scope",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserOrganizationScopeController.java"
+        },
+        {
+          "path": "/{id}/scope",
+          "file": "backend\\platform-runtime\\engine-security\\src\\main\\java\\com\\erp\\platform\\engine\\security\\UserOrganizationScopeController.java"
         }
       ],
       "ownedMigrations": [],
@@ -25840,6 +26396,31 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V65__gateway_public_read_path.sql",
+          "version": 65,
+          "tables": [
+            "gateway_public_read_path"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V72__platform_admin_role.sql",
+          "version": 72,
+          "tables": [
+            "platform_admin_role",
+            "platform_admin_user_role"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V8__translation_key_value.sql",
           "version": 8,
@@ -26002,6 +26583,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V163__user_organization_scope.sql",
+          "version": 163,
+          "tables": [
+            "user_organization_scope"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V17__session_token.sql",
           "version": 17,
@@ -26010,6 +26599,18 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V1__init_tenant_baseline.sql",
+          "version": 1,
+          "tables": [
+            "action_definition",
+            "rule_definition",
+            "rule_action",
+            "expression_definition",
+            "execution_log"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\tenant\\V26__actor_role_assignment.sql",
           "version": 26,
@@ -27411,6 +28012,14 @@
           ],
           "note": "keyword-matched to this module's class names, not a confirmed repository binding"
         },
+        {
+          "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V80__tenant_password_policy.sql",
+          "version": 80,
+          "tables": [
+            "tenant_password_policy"
+          ],
+          "note": "keyword-matched to this module's class names, not a confirmed repository binding"
+        },
         {
           "file": "backend\\platform-runtime\\metadata\\src\\main\\resources\\db\\migration\\platform-registry\\V8__translation_key_value.sql",
           "version": 8,