@wildo-ai/platform-config-lib 1.0.1

package/src/project-config/define-minion-config.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import { WorkerRuntimeSchema, ResourceLimitsSchema, DataAccessSchema } from './shared/service-definitions.schemas';
+
+export const WildoMinionConfigSchema = z.object({
+  version: z.number().int().positive().default(1),
+  name: z.string().min(1),
+  displayName: z.string().min(1),
+  description: z.string().optional(),
+  runtime: WorkerRuntimeSchema,
+  /** Cron expression for scheduling (e.g. every 6 hours) */
+  schedule: z.string().min(1),
+  resources: ResourceLimitsSchema.optional(),
+  providers: z.record(z.string(), z.object({
+    required: z.boolean().default(true),
+  })).optional(),
+  dataAccess: DataAccessSchema.optional(),
+});
+export type WildoMinionConfig = z.infer<typeof WildoMinionConfigSchema>;
+export type WildoMinionConfigInput = z.input<typeof WildoMinionConfigSchema>;
+
+/**
+ * Define a minion (scheduled task / cron agent) configuration.
+ * Minions run on a schedule and can access data services and providers.
+ */
+export function defineMinionConfig(config: WildoMinionConfigInput): WildoMinionConfig {
+  return WildoMinionConfigSchema.parse(config);
+}

package/src/project-config/define-platform-config.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+import { BackingServicesDeclarationSchema } from './shared/backing-services.schemas';
+import { PlatformServicesDeclarationSchema } from './shared/platform-services.schemas';
+
+export const WildoAuthConfigSchema = z.object({
+  jwtAlgorithm: z.enum(['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512']).default('RS256'),
+  accessTokenExpirationMinutes: z.number().int().positive().default(60),
+  refreshTokenExpirationDays: z.number().int().positive().default(30),
+});
+export type WildoAuthConfig = z.infer<typeof WildoAuthConfigSchema>;
+export type WildoAuthConfigInput = z.input<typeof WildoAuthConfigSchema>;
+
+export const WildoPlatformConfigSchema = z.object({
+  version: z.number().int().positive().default(1),
+  platformServices: PlatformServicesDeclarationSchema,
+  backingServices: BackingServicesDeclarationSchema,
+  auth: WildoAuthConfigSchema,
+});
+export type WildoPlatformConfig = z.infer<typeof WildoPlatformConfigSchema>;
+export type WildoPlatformConfigInput = z.input<typeof WildoPlatformConfigSchema>;
+
+/**
+ * Define the base platform configuration (environment-independent).
+ * Declares which platform services and backing services are available.
+ */
+export function definePlatformConfig(config: WildoPlatformConfigInput): WildoPlatformConfig {
+  return WildoPlatformConfigSchema.parse(config);
+}

package/src/project-config/define-platform-env-config.ts

@@ -0,0 +1,59 @@
+import { RuntimeEnvironment } from '@wildo-ai/saas-models';
+import { z } from 'zod';
+import { BackingServicesEnvConfigSchema } from './shared/backing-services.schemas';
+import {
+  WildoDeploymentRuntime,
+  WildoEnvironment,
+  WildoEnvironmentIdSchema,
+  WildoKubernetesConfigSchema,
+  WildoLocationType,
+  WildoLoggingConfigSchema,
+  WildoRemoteProviderSchema,
+  isLocalEnvironmentId,
+} from './shared/environment.schemas';
+
+export const WildoPlatformEnvConfigSchema = z.object({
+  environment: WildoEnvironmentIdSchema,
+  locationType: z.enum(WildoLocationType).optional(),
+  runtimeEnvironment: z.nativeEnum(RuntimeEnvironment).optional(),
+  runtime: z.enum(WildoDeploymentRuntime),
+  kubernetes: WildoKubernetesConfigSchema.optional(),
+  remoteProvider: WildoRemoteProviderSchema.optional(),
+  backingServices: BackingServicesEnvConfigSchema,
+  logging: WildoLoggingConfigSchema.optional(),
+}).superRefine((config, ctx) => {
+  if (isLocalEnvironmentId(config.environment) && config.locationType === WildoLocationType.REMOTE) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['locationType'],
+      message: `"${WildoEnvironment.LOCAL}" environment cannot use remote locationType`,
+    });
+  }
+
+  if (!isLocalEnvironmentId(config.environment) && config.locationType === WildoLocationType.LOCAL) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['locationType'],
+      message: 'Only the "local" environment id can use local locationType',
+    });
+  }
+
+  if (!isLocalEnvironmentId(config.environment) && !config.runtimeEnvironment) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['runtimeEnvironment'],
+      message: 'runtimeEnvironment is required for remote environments',
+    });
+  }
+});
+export type WildoPlatformEnvConfig = z.infer<typeof WildoPlatformEnvConfigSchema>;
+export type WildoPlatformEnvConfigInput = z.input<typeof WildoPlatformEnvConfigSchema>;
+
+/**
+ * Define a per-environment platform configuration.
+ * Specifies the environment id, runtime semantics, backing service sources,
+ * and environment-specific overrides.
+ */
+export function definePlatformEnvConfig(config: WildoPlatformEnvConfigInput): WildoPlatformEnvConfig {
+  return WildoPlatformEnvConfigSchema.parse(config);
+}

package/src/project-config/define-project-config.ts

@@ -0,0 +1,63 @@
+import { isAbsolute, normalize } from 'path';
+import { z } from 'zod';
+
+const ProjectRelativePathSchema = z.string().min(1).superRefine((value, ctx) => {
+  const normalizedValue = normalize(value);
+  if (isAbsolute(value)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: 'platformPath must stay relative to the project root',
+    });
+    return;
+  }
+
+  if (normalizedValue === '.' || normalizedValue === '') {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: 'platformPath must point to a subdirectory such as ./wildo-platform or ../shared-platform',
+    });
+  }
+});
+
+const ProjectAppKeySchema = z
+  .string()
+  .min(1)
+  .regex(/^[a-z0-9-]+$/, 'app keys must be lowercase alphanumeric with hyphens');
+
+export const WildoProjectConfigSchema = z.object({
+  version: z.number().int().positive().default(1),
+  name: z.string().min(1),
+  projectSlug: z.string().min(1).regex(/^[a-z0-9-]+$/, 'projectSlug must be lowercase alphanumeric with hyphens'),
+  displayName: z.string().min(1),
+  platformPath: ProjectRelativePathSchema,
+  apps: z.record(ProjectAppKeySchema, z.object({
+    path: z.string().min(1),
+    type: z.enum(['saas']),
+  })),
+});
+export type WildoProjectConfig = z.infer<typeof WildoProjectConfigSchema>;
+export type WildoProjectConfigInput = z.input<typeof WildoProjectConfigSchema>;
+
+/**
+ * Define a Wildo project configuration.
+ * Provides full IDE autocompletion and runtime Zod validation.
+ *
+ * @example
+ * ```ts
+ * import { defineProjectConfig } from '@wildo-ai/platform-config-lib';
+ *
+ * export default defineProjectConfig({
+ *   version: 1,
+ *   name: 'wonder-todos-project',
+ *   projectSlug: 'wonder-todos',
+ *   displayName: 'Wonder Todos Project',
+ *   platformPath: './wildo-platform',
+ *   apps: {
+ *     'wonder-todos': { path: './wonder-todos', type: 'saas' },
+ *   },
+ * });
+ * ```
+ */
+export function defineProjectConfig(config: WildoProjectConfigInput): WildoProjectConfig {
+  return WildoProjectConfigSchema.parse(config);
+}

package/src/project-config/define-saas-config.ts

@@ -0,0 +1,171 @@
+import {
+  CLIRuntime_ConfigurationSchema,
+  ExternalProvider_ExchangeProtocol_Configuration_BaseSchema,
+  ExternalProvider_ExchangeProtocol_Kind,
+} from '@wildo-ai/external-connectors-models';
+import { z } from 'zod';
+import { EngineCapability } from '@wildo-ai/saas-models';
+import { AppDataServicesSchema } from './shared/data-services.schemas';
+import { ApplicationModulesSchema } from './shared/application-modules.schemas';
+import { AppServiceDefinitionSchema, AppRefSchema } from './shared/service-definitions.schemas';
+
+/**
+ * Capability binding in the app config.
+ * Declares whether a capability is enabled, its lifecycle scope,
+ * and which provider(s) back it.
+ *
+ * Provider refs are validated at CLI evaluation time against the
+ * external-connectors catalog to ensure the provider actually supports
+ * the declared capability.
+ *
+ * - `runtime` = app needs this at runtime (mandatory for production)
+ * - `tooling` = dev tooling needs this (companion, CLI, agents)
+ * - `servicesRestrictions` = per-service provider overrides
+ *   (omitted services get the default; empty array = unavailable for that service)
+ */
+export const CapabilityBindingSchema = z.object({
+  enabled: z.boolean(),
+  /** App needs this capability at runtime (mandatory for production) */
+  runtime: z.boolean().default(false),
+  /** Dev tooling needs this capability (companion, CLI, agents) */
+  tooling: z.boolean().default(false),
+  /** Single provider ref (for SINGLE mode capabilities) */
+  provider: z.string().min(1).optional(),
+  /** Multiple provider refs (for MULTIPLE mode capabilities like AI) */
+  providers: z.array(z.string().min(1)).optional(),
+  /** Whether this capability is required for the app to function */
+  required: z.boolean().optional(),
+  /**
+   * Per-service provider restrictions.
+   * Keys are service identifiers (e.g., 'minions.marketingScrapper').
+   * Values are arrays of allowed provider refs for that service.
+   * Omitted services inherit the default `provider`/`providers` list.
+   * Empty array = capability unavailable for that service.
+   */
+  servicesRestrictions: z.record(z.string(), z.array(z.string().min(1))).optional(),
+});
+export type CapabilityBinding = z.infer<typeof CapabilityBindingSchema>;
+export type CapabilityBindingInput = z.input<typeof CapabilityBindingSchema>;
+
+export const ExternalProvidersConfigurationsSchema = z.record(
+  z.string(),
+  z.partialRecord(
+    z.enum(ExternalProvider_ExchangeProtocol_Kind),
+    z.union([
+      CLIRuntime_ConfigurationSchema,
+      ExternalProvider_ExchangeProtocol_Configuration_BaseSchema,
+    ]),
+  ).optional(),
+).optional().default(() => ({}));
+export type ExternalProvidersConfigurations = z.infer<typeof ExternalProvidersConfigurationsSchema>;
+export type ExternalProvidersConfigurationsInput = z.input<typeof ExternalProvidersConfigurationsSchema>;
+
+const AppFeaturesSchema = z.object({
+  organizations: z.boolean().default(false),
+  billing: z.boolean().default(false),
+  multiLanguage: z.boolean().default(false),
+  compliance: z.object({
+    auditTrail: z.boolean().default(false),
+    gdpr: z.boolean().default(false),
+  }).optional(),
+});
+export type AppFeatures = z.infer<typeof AppFeaturesSchema>;
+
+const BootstrapFirstAdminSeedSchema = z.object({
+  userTypes: z.array(z.string().min(1)).min(1),
+});
+export type BootstrapFirstAdminSeed = z.infer<typeof BootstrapFirstAdminSeedSchema>;
+
+const AppBootstrapSchema = z.object({
+  firstAdmin: BootstrapFirstAdminSeedSchema.optional(),
+});
+export type AppBootstrap = z.infer<typeof AppBootstrapSchema>;
+
+export const WildoSaasConfigSchema = z.object({
+  version: z.number().int().positive().default(1),
+  name: z.string().min(1),
+  slug: z.string().min(1).regex(/^[a-z0-9-]+$/, 'slug must be lowercase alphanumeric with hyphens'),
+  displayName: z.string().min(1),
+  description: z.string().optional(),
+  type: z.literal('saas'),
+
+  services: z.record(z.string(), AppServiceDefinitionSchema),
+  modules: ApplicationModulesSchema,
+  minions: z.record(z.string(), AppRefSchema).optional(),
+  workers: z.record(z.string(), AppRefSchema).optional(),
+
+  /**
+   * Capabilities the app requires, keyed by EngineCapability enum.
+   * Each entry declares whether the capability is enabled and which provider(s) back it.
+   */
+  capabilities: z.partialRecord(
+    z.enum(EngineCapability),
+    CapabilityBindingSchema,
+  ).optional(),
+
+  /**
+   * App-authored, non-secret provider runtime policy.
+   * Secret values are never authored here and stay env/K8s-delivered.
+   */
+  externalProvidersConfigurations: ExternalProvidersConfigurationsSchema,
+
+  features: AppFeaturesSchema,
+  bootstrap: AppBootstrapSchema.optional(),
+  dataServices: AppDataServicesSchema,
+}).superRefine((config, ctx) => {
+  const availableServiceKeys = new Set(Object.keys(config.services));
+
+  for (const [moduleId, moduleBinding] of Object.entries(config.modules ?? {})) {
+    for (const serviceKey of moduleBinding.services) {
+      if (availableServiceKeys.has(serviceKey)) {
+        continue;
+      }
+
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['modules', moduleId, 'services'],
+        message: `Module "${moduleId}" references unknown service "${serviceKey}".`,
+      });
+    }
+  }
+});
+export type WildoSaasConfig = z.infer<typeof WildoSaasConfigSchema>;
+export type WildoSaasConfigInput = z.input<typeof WildoSaasConfigSchema>;
+
+/**
+ * Define a SaaS application configuration.
+ * Provides full IDE autocompletion for capabilities (via EngineCapability enum),
+ * features, services, and data services.
+ *
+ * @example
+ * ```ts
+ * import { defineSaasConfig } from '@wildo-ai/platform-config-lib';
+ * import { EngineCapability } from '@wildo-ai/saas-models';
+ *
+ * export default defineSaasConfig({
+ *   version: 1,
+ *   name: 'wonder-todos',
+ *   slug: 'wonder-todos',
+ *   displayName: 'Wonder Todos',
+ *   type: 'saas',
+ *   capabilities: {
+ *     [EngineCapability.EMAIL_TRANSACTIONAL]: {
+ *       enabled: true,
+ *       runtime: true,       // optional, defaults to false
+ *       provider: 'resend',
+ *     },
+ *     [EngineCapability.SMS]: { enabled: false },
+ *     [EngineCapability.AI_LLM]: {
+ *       enabled: true,
+ *       runtime: true,
+ *       tooling: true,       // optional, defaults to false
+ *       providers: ['openai', 'anthropic'],
+ *     },
+ *   },
+ *   // ...
+ * });
+ * ```
+ */
+export function defineSaasConfig(config: WildoSaasConfigInput): WildoSaasConfig {
+  return WildoSaasConfigSchema.parse(config);
+}

package/src/project-config/define-sharing-policy.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+
+const SharingScope = z.enum(['all-apps', 'named-apps', 'none']);
+
+const SecretSharingRuleSchema = z.object({
+  scope: SharingScope,
+  mode: z.string().optional(),
+  description: z.string().optional(),
+  defaults: z.array(z.string()).optional(),
+  perApp: z.record(z.string(), z.object({
+    include: z.array(z.string()).optional(),
+    exclude: z.array(z.string()).optional(),
+  })).optional(),
+});
+
+const ConfigSharingRuleSchema = z.object({
+  scope: SharingScope,
+  overridable: z.boolean().optional(),
+  description: z.string().optional(),
+});
+
+export const WildoSharingPolicySchema = z.object({
+  version: z.number().int().positive().default(1),
+  secrets: z.record(z.string(), SecretSharingRuleSchema),
+  config: z.record(z.string(), ConfigSharingRuleSchema),
+});
+export type WildoSharingPolicy = z.infer<typeof WildoSharingPolicySchema>;
+export type WildoSharingPolicyInput = z.input<typeof WildoSharingPolicySchema>;
+
+/**
+ * Define a per-environment sharing policy.
+ * Controls which secrets and config are shared across apps, and with what restrictions.
+ */
+export function defineSharingPolicy(config: WildoSharingPolicyInput): WildoSharingPolicy {
+  return WildoSharingPolicySchema.parse(config);
+}

package/src/project-config/define-worker-config.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import { WorkerRuntimeSchema, ResourceLimitsSchema, DataAccessSchema } from './shared/service-definitions.schemas';
+
+export const WildoWorkerConfigSchema = z.object({
+  version: z.number().int().positive().default(1),
+  name: z.string().min(1),
+  displayName: z.string().min(1),
+  description: z.string().optional(),
+  runtime: WorkerRuntimeSchema,
+  queue: z.object({
+    consumes: z.array(z.string().min(1)),
+    concurrency: z.number().int().positive().optional(),
+    prefetchCount: z.number().int().positive().optional(),
+  }),
+  resources: ResourceLimitsSchema.optional(),
+  dataAccess: DataAccessSchema.optional(),
+});
+export type WildoWorkerConfig = z.infer<typeof WildoWorkerConfigSchema>;
+export type WildoWorkerConfigInput = z.input<typeof WildoWorkerConfigSchema>;
+
+/**
+ * Define a worker service configuration.
+ * Workers are long-running queue consumers that process background tasks.
+ */
+export function defineWorkerConfig(config: WildoWorkerConfigInput): WildoWorkerConfig {
+  return WildoWorkerConfigSchema.parse(config);
+}

package/src/project-config/index.ts

@@ -0,0 +1,23 @@
+export * from './shared/backing-services.schemas';
+export * from './shared/platform-services.schemas';
+export * from './shared/data-services.schemas';
+export * from './shared/application-modules.schemas';
+export * from './shared/application-modules.utils';
+export * from './shared/service-definitions.schemas';
+export * from './shared/environment.schemas';
+export * from './shared/infrastructure-defaults.schemas';
+export * from './shared/k8s-utils';
+export * from './shared/env-example-defaults';
+
+export * from './loader';
+
+export * from './define-project-config';
+export * from './define-framework-config';
+export * from './define-platform-config';
+export * from './define-platform-env-config';
+export * from './define-sharing-policy';
+export * from './define-saas-config';
+export * from './define-infra-config';
+export * from './define-worker-config';
+export * from './define-minion-config';
+export * from './sharing-policy-validation';

package/src/project-config/loader.ts

@@ -0,0 +1,220 @@
+import { createHash } from 'crypto';
+import { existsSync, mkdirSync, readFileSync } from 'fs';
+import { dirname, join, resolve } from 'path';
+import { fileURLToPath } from 'url';
+import { createJiti } from 'jiti';
+import { WORKSPACE_CONFIG_NAMES } from '../workspace-scope/workspace-scope.schemas';
+import type { WildoFrameworkConfig } from './define-framework-config';
+import type { WildoSaasConfig } from './define-saas-config';
+import type { WildoSharingPolicy } from './define-sharing-policy';
+import {
+  ConfigArtifactsZone,
+  resolveConfigArtifactsBaseDir,
+  type ConfigArtifactsLocationOptions,
+} from '../workspace-scope/workspace-scope.schemas';
+
+export interface LoadConfigOptions {
+  /**
+   * Optional explicit owner zone for generated loader artifacts.
+   * Use this when the authored config file lives outside its semantic runtime
+   * owner, such as project-owned platform configs stored in a sibling
+   * `platformPath`.
+   */
+  artifactLocation?: ConfigArtifactsLocationOptions;
+}
+
+const PACKAGE_COMPANION_SUBPATH = './companion';
+
+/**
+ * Load and evaluate a TypeScript config file via jiti.
+ * The file must `export default defineXxxConfig({...})`.
+ * Zod validation runs inside the defineConfig helper at evaluation time,
+ * so the returned object is guaranteed valid.
+ *
+ * @param filePath - Absolute path to the `.ts` config file
+ * @returns The validated config object (the default export)
+ * @throws If the file doesn't exist, has syntax errors, or Zod validation fails
+ */
+export async function loadConfig<T>(filePath: string, options?: LoadConfigOptions): Promise<T> {
+  const absolutePath = resolve(filePath);
+  if (!existsSync(absolutePath)) {
+    throw new Error(`Config file not found: ${absolutePath}`);
+  }
+  const cacheBaseDir = options?.artifactLocation
+    ? resolveConfigArtifactsBaseDir(options.artifactLocation)
+    : resolveConfigArtifactsBaseDir(absolutePath);
+  const cacheDir = join(cacheBaseDir, createHash('sha1').update(absolutePath).digest('hex'));
+  mkdirSync(cacheDir, { recursive: true });
+
+  const currentModuleDirectory = dirname(fileURLToPath(import.meta.url));
+  const platformConfigLibEntry = resolvePlatformConfigLibEntry(currentModuleDirectory);
+  const workspaceRoot = resolveLoaderWorkspaceRoot(currentModuleDirectory);
+
+  const jiti = createJiti(import.meta.url, {
+    fsCache: cacheDir,
+    alias: {
+      '@wildo-ai/platform-config-lib': platformConfigLibEntry,
+      '~wildo-backend-lib': resolve(workspaceRoot, 'engine/saas-backend-lib/src'),
+      '~wildo-connectors': resolve(workspaceRoot, 'engine/external-connectors/src'),
+      '~wildo-connectors-models': resolve(workspaceRoot, 'engine/external-connectors-models/src'),
+      '~wildo-models': resolve(workspaceRoot, 'engine/saas-models/src'),
+      '~wildo-zod': resolve(workspaceRoot, 'engine/zod-decorators/src'),
+    },
+  });
+
+  const module = await jiti.import(absolutePath) as { default: T };
+  if (!module.default) {
+    throw new Error(`Config file must use \`export default\`: ${absolutePath}`);
+  }
+  return module.default;
+}
+
+export function resolvePackageCompanionEntryPath(
+  packageRoot: string,
+  subpath: string = PACKAGE_COMPANION_SUBPATH,
+): string {
+  const packageJsonPath = join(packageRoot, 'package.json');
+  if (!existsSync(packageJsonPath)) {
+    throw new Error(`Missing package.json for companion target at "${packageRoot}".`);
+  }
+
+  const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8')) as {
+    exports?: Record<string, string | { import?: string; default?: string }>;
+  };
+
+  const subpathExport = packageJson.exports?.[subpath];
+  if (typeof subpathExport === 'string') {
+    const exportPath = resolve(packageRoot, subpathExport);
+    if (existsSync(exportPath)) {
+      return exportPath;
+    }
+  }
+
+  if (subpathExport && typeof subpathExport === 'object') {
+    const declaredEntryPath = subpathExport.import ?? subpathExport.default;
+    if (typeof declaredEntryPath === 'string') {
+      const exportPath = resolve(packageRoot, declaredEntryPath);
+      if (existsSync(exportPath)) {
+        return exportPath;
+      }
+    }
+  }
+
+  if (subpath === PACKAGE_COMPANION_SUBPATH) {
+    const sourceCandidates = [
+      join(packageRoot, 'src', 'companion-exports.ts'),
+      join(packageRoot, 'src', 'companion-exports.tsx'),
+      join(packageRoot, 'src', 'companion-exports.js'),
+      join(packageRoot, 'src', 'companion-exports.mjs'),
+    ];
+
+    for (const candidate of sourceCandidates) {
+      if (existsSync(candidate)) {
+        return candidate;
+      }
+    }
+  }
+
+  throw new Error(
+    `Could not resolve companion entry for subpath "${subpath}" in package "${packageRoot}".`,
+  );
+}
+
+export async function loadPackageCompanionExport<T>(
+  packageRoot: string,
+  subpath: string = PACKAGE_COMPANION_SUBPATH,
+  options?: LoadConfigOptions,
+): Promise<T> {
+  const entryPath = resolvePackageCompanionEntryPath(packageRoot, subpath);
+  return loadConfig<T>(entryPath, options);
+}
+
+function resolvePlatformConfigLibEntry(startDirectory: string): string {
+  const packageRoot = resolveCurrentPackageRoot(startDirectory);
+  const sourceEntry = join(packageRoot, 'src', 'index.ts');
+  if (existsSync(sourceEntry)) {
+    return sourceEntry;
+  }
+
+  return join(packageRoot, 'dist', 'esm', 'index.js');
+}
+
+function resolveCurrentPackageRoot(startDirectory: string): string {
+  let currentDirectory = startDirectory;
+
+  while (true) {
+    if (existsSync(join(currentDirectory, 'package.json'))) {
+      return currentDirectory;
+    }
+
+    const parentDirectory = dirname(currentDirectory);
+    if (parentDirectory === currentDirectory) {
+      break;
+    }
+    currentDirectory = parentDirectory;
+  }
+
+  return startDirectory;
+}
+
+function resolveLoaderWorkspaceRoot(startDirectory: string): string {
+  let currentDirectory = startDirectory;
+
+  while (true) {
+    if (
+      existsSync(join(currentDirectory, 'wildo-framework.info.json'))
+      || existsSync(join(currentDirectory, 'pnpm-workspace.yaml'))
+    ) {
+      return currentDirectory;
+    }
+
+    const parentDirectory = dirname(currentDirectory);
+    if (parentDirectory === currentDirectory) {
+      break;
+    }
+    currentDirectory = parentDirectory;
+  }
+
+  return resolve(startDirectory, '../../../../..');
+}
+
+/**
+ * Load a `wildo.saas.config.ts` file.
+ * Returns `null` if the file doesn't exist (non-throwing variant for optional loading).
+ */
+export async function loadSaasConfig(filePath: string, options?: LoadConfigOptions): Promise<WildoSaasConfig | null> {
+  const absolutePath = resolve(filePath);
+  if (!existsSync(absolutePath)) return null;
+  return loadConfig<WildoSaasConfig>(absolutePath, options);
+}
+
+/**
+ * Load a `wildo.sharing-policy.{env}.ts` file.
+ * Returns `null` if the file doesn't exist (non-throwing variant for optional loading).
+ */
+export async function loadSharingPolicy(filePath: string, options?: LoadConfigOptions): Promise<WildoSharingPolicy | null> {
+  const absolutePath = resolve(filePath);
+  if (!existsSync(absolutePath)) return null;
+  return loadConfig<WildoSharingPolicy>(absolutePath, options);
+}
+
+/**
+ * Load the framework-scoped `wildo.framework.config.ts` file.
+ * Returns `null` if the file does not exist.
+ */
+export async function loadFrameworkConfig(
+  frameworkRoot: string,
+  options?: Omit<LoadConfigOptions, 'artifactLocation'>,
+): Promise<WildoFrameworkConfig | null> {
+  const filePath = join(frameworkRoot, WORKSPACE_CONFIG_NAMES.FRAMEWORK_DIR, 'wildo.framework.config.ts');
+  const absolutePath = resolve(filePath);
+  if (!existsSync(absolutePath)) return null;
+
+  return loadConfig<WildoFrameworkConfig>(absolutePath, {
+    ...options,
+    artifactLocation: {
+      zone: ConfigArtifactsZone.FRAMEWORK,
+      ownerRoot: frameworkRoot,
+    },
+  });
+}

package/src/project-config/shared/application-modules.schemas.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+
+export const ApplicationModuleBindingSchema = z.object({
+  services: z.array(z.string().min(1)).min(1),
+});
+export type ApplicationModuleBinding = z.infer<typeof ApplicationModuleBindingSchema>;
+
+export const ApplicationModulesSchema = z.record(
+  z.string().min(1),
+  ApplicationModuleBindingSchema,
+).optional();
+export type ApplicationModules = z.infer<typeof ApplicationModulesSchema>;