@wildo-ai/platform-core-shared 1.0.1 → 1.1.0

package/dist/esm/runtime/application-backend-env.contracts.d.ts

@@ -10,39 +10,144 @@ export declare enum ApplicationBackendBootstrapEnvKey {
     APPLICATION_ID = "APPLICATION_ID",
     SERVICE_NAME = "SERVICE_NAME",
     PLATFORM_ENVIRONMENT_ID = "PLATFORM_ENVIRONMENT_ID",
+    /** Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. */
+    DEPLOYMENT_LOCATION_TYPE = "DEPLOYMENT_LOCATION_TYPE",
     PLATFORM_APPLICATION_PRIMARY_SECRET = "PLATFORM_APPLICATION_PRIMARY_SECRET",
     PLATFORM_APPS_MANAGER_URL = "PLATFORM_APPS_MANAGER_URL",
     APPLICATION_ENV = "APPLICATION_ENV"
 }
 export declare enum ApplicationBackendPlatformUrlEnvKey {
-    PLATFORM_FILE_GENERATOR_URL = "PLATFORM_FILE_GENERATOR_URL",
-    PLATFORM_CRONTABS_BATCHES_MANAGER_URL = "PLATFORM_CRONTABS_BATCHES_MANAGER_URL"
+    PLATFORM_CRONTABS_BATCHES_MANAGER_URL = "PLATFORM_CRONTABS_BATCHES_MANAGER_URL",
+    PLATFORM_MODULE_REGISTRY_URL = "PLATFORM_MODULE_REGISTRY_URL"
 }
 export declare enum ApplicationBackendRuntimeEnvKey {
-    APPLICATION_RUNTIME_ENDPOINTS = "APPLICATION_RUNTIME_ENDPOINTS"
+    APPLICATION_RUNTIME_ENDPOINTS = "APPLICATION_RUNTIME_ENDPOINTS",
+    /** Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. */
+    APPLICATION_RUNTIME_SIGNALS_HOME = "APPLICATION_RUNTIME_SIGNALS_HOME"
 }
 export declare enum ApplicationBackendDataEnvKey {
+    /**
+     * Which persistence adapter the application's resources use.
+     *
+     * DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no
+     * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only
+     * by a test that reached into the config object directly, which is why no application had ever
+     * booted on it. Deriving it instead ("PostgreSQL keys are present, so use PostgreSQL") was
+     * rejected: which store an application persists to is a deployment decision that must be legible
+     * in one place, not an emergent property of which variables happen to be set.
+     *
+     * Absent means MONGODB, so every existing deployment is unaffected.
+     */
+    DATABASE_DEFAULT_ADAPTER = "DATABASE_DEFAULT_ADAPTER",
+    /**
+     * The format NEW resource identifiers are minted in — `object-id` or `uuid`.
+     *
+     * DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to
+     * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's
+     * identity format a side effect of where its rows happen to live: moving a resource between
+     * adapters silently changed the shape of every id it minted AND made every id it had already
+     * minted fail `validateForResource`. Identity reaches URLs, exports, external references and
+     * integrations, so it is an application-level decision that must outlive a storage decision.
+     *
+     * It needed an env key for the same reason the adapter did. The loader hard-coded
+     * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an
+     * application could select PostgreSQL and still had no supported way to STATE its identity format,
+     * which left the engine's "declared, never derived" rule true in the schema and unreachable in
+     * practice.
+     *
+     * Absent means `OBJECT_ID` — what every existing application already mints — so no deployment
+     * changes behaviour by adding this key to the contract.
+     *
+     * One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold
+     * the declared format. DDL rendered from the schema plan types it `text`, which is correct for
+     * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects
+     * an `OBJECT_ID` outright.
+     */
+    RESOURCE_ID_FORMAT = "RESOURCE_ID_FORMAT",
     MONGODB_HOST = "MONGODB_HOST",
     MONGODB_DATABASE = "MONGODB_DATABASE",
     MONGODB_PROTOCOL = "MONGODB_PROTOCOL",
     MONGODB_DIRECT_CONNECTION = "MONGODB_DIRECT_CONNECTION",
+    /**
+     * PostgreSQL TOPOLOGY only — host, port, database, ssl.
+     *
+     * CREDENTIALS are deliberately NOT here. They arrive through
+     * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,
+     * secrets carry who may open it. Putting a password in an env contract would make it readable
+     * from every process listing and every container inspect.
+     */
+    POSTGRESQL_HOST = "POSTGRESQL_HOST",
+    POSTGRESQL_PORT = "POSTGRESQL_PORT",
+    POSTGRESQL_DATABASE = "POSTGRESQL_DATABASE",
+    POSTGRESQL_SSL_MODE = "POSTGRESQL_SSL_MODE",
     REDIS_HOST = "REDIS_HOST",
     REDIS_PORT = "REDIS_PORT",
+    /**
+     * Optional Redis logical database index (0–15). Emitted only when the
+     * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.
+     * Consumers default to DB 0 when this var is missing.
+     */
+    REDIS_DATABASE = "REDIS_DATABASE",
+    /**
+     * Canonical app-level Redis key namespace. Emitted only when the author
+     * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).
+     * `RedisService` uses this as the `appPrefix` for all keys it writes — every
+     * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or
+     * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix
+     * stays empty (multi-tenant isolation falls back to the
+     * `org:`/`global:` segment alone).
+     *
+     * REPLACE semantics: this supersedes the legacy
+     * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit
+     * decision — single source of truth = `wildo.saas.config.dataServices`).
+     */
+    REDIS_KEY_PREFIX = "REDIS_KEY_PREFIX",
     RABBITMQ_HOST = "RABBITMQ_HOST",
     RABBITMQ_PORT = "RABBITMQ_PORT",
+    /**
+     * Optional RabbitMQ virtual host. Emitted only when the author sets
+     * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.
+     * Consumers default to `/` (the RabbitMQ root vhost) when missing.
+     *
+     * Note (Slice 3.6 audit): the symmetric saas-side field
+     * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an
+     * infra/topology concern with a single authoring seam (infra config).
+     */
+    RABBITMQ_VHOST = "RABBITMQ_VHOST",
     STORAGE_PROVIDER = "STORAGE_PROVIDER",
+    /**
+     * S3-compatible endpoint **hostname** (NOT a URL). The variable name
+     * pre-dates the convention pin and is intentionally kept stable for
+     * backward compatibility with deployed manifests, but the value is
+     * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the
+     * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the
+     * full `https?://host:port` URL at the SDK initialization site.
+     *
+     * Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)
+     * silently breaks the `host:port` contract downstream because the SDK
+     * concatenates the parts naively. If a future migration wants to flip
+     * the contract to a URL, rename the env key (`STORAGE_URL`) rather
+     * than overloading this one — the rename surfaces the breaking change
+     * to operators.
+     */
     STORAGE_ENDPOINT = "STORAGE_ENDPOINT",
     STORAGE_PORT = "STORAGE_PORT",
     STORAGE_USE_SSL = "STORAGE_USE_SSL",
     STORAGE_BUCKET = "STORAGE_BUCKET",
-    STORAGE_ACCESS_KEY = "STORAGE_ACCESS_KEY",
-    STORAGE_SECRET_KEY = "STORAGE_SECRET_KEY",
+    /**
+     * Optional app-level object-key namespace prefix prepended to every
+     * application file path produced by `WildoManagedStorageProvider`
+     * (Slice 3.6). Final key shape becomes
+     * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`
+     * (extra segment above the existing `applicationId`-based namespace).
+     *
+     * Emitted only when the author sets `dataServices.s3.bucketPrefix` in
+     * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)
+     * remains infra-controlled and is unaffected by this prefix — N apps
+     * can share one bucket while keeping their object trees disjoint.
+     */
+    STORAGE_BUCKET_PREFIX = "STORAGE_BUCKET_PREFIX",
     STORAGE_LOCAL_BASE_DIR = "STORAGE_LOCAL_BASE_DIR",
-    WEAVIATE_HOST = "WEAVIATE_HOST",
-    WEAVIATE_PORT = "WEAVIATE_PORT",
-    WEAVIATE_GRPC_PORT = "WEAVIATE_GRPC_PORT",
-    WEAVIATE_API_KEY = "WEAVIATE_API_KEY",
-    WEAVIATE_SCHEME = "WEAVIATE_SCHEME",
     CLAMAV_HOST = "CLAMAV_HOST",
     CLAMAV_PORT = "CLAMAV_PORT",
     YARA_ENABLED = "YARA_ENABLED",
@@ -57,15 +162,107 @@ export declare const ApplicationBackendBootstrapEnvKeys: typeof ApplicationBacke
 export declare const ApplicationBackendPlatformUrlEnvKeys: typeof ApplicationBackendPlatformUrlEnvKey;
 export declare const ApplicationBackendRuntimeEnvKeys: typeof ApplicationBackendRuntimeEnvKey;
 export declare const ApplicationBackendDataEnvKeys: typeof ApplicationBackendDataEnvKey;
-export declare const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV];
-export declare const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST: readonly [ApplicationBackendPlatformUrlEnvKey.PLATFORM_FILE_GENERATOR_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL];
-export declare const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST: readonly [ApplicationBackendRuntimeEnvKey];
-export declare const APPLICATION_BACKEND_DATA_ENV_KEY_LIST: readonly [ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_ACCESS_KEY, ApplicationBackendDataEnvKey.STORAGE_SECRET_KEY, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.WEAVIATE_HOST, ApplicationBackendDataEnvKey.WEAVIATE_PORT, ApplicationBackendDataEnvKey.WEAVIATE_GRPC_PORT, ApplicationBackendDataEnvKey.WEAVIATE_API_KEY, ApplicationBackendDataEnvKey.WEAVIATE_SCHEME, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
-export declare const APPLICATION_BACKEND_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV, ApplicationBackendPlatformUrlEnvKey.PLATFORM_FILE_GENERATOR_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendRuntimeEnvKey, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_ACCESS_KEY, ApplicationBackendDataEnvKey.STORAGE_SECRET_KEY, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.WEAVIATE_HOST, ApplicationBackendDataEnvKey.WEAVIATE_PORT, ApplicationBackendDataEnvKey.WEAVIATE_GRPC_PORT, ApplicationBackendDataEnvKey.WEAVIATE_API_KEY, ApplicationBackendDataEnvKey.WEAVIATE_SCHEME, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
+export declare const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV];
+export declare const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST: readonly [ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL];
+export declare const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST: readonly [ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME];
+export declare const APPLICATION_BACKEND_DATA_ENV_KEY_LIST: readonly [ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
+export declare const APPLICATION_BACKEND_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV, ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME, ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
 /**
  * Keys that must always be treated as secrets when this app-backend env surface
  * is materialized into logs, CI artifacts, or deployment manifests.
  */
 export declare const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS: Set<string>;
 export type ApplicationBackendEnvKey = typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];
+/**
+ * ────────────────────────────────────────────────────────────────────────
+ * Backend → worker dispatch contract (G-8 / MW4)
+ * ────────────────────────────────────────────────────────────────────────
+ * A declared worker's HTTP base URL is injected into the app-backend env at
+ * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC
+ * (one per declared worker), so — unlike the static enums above — the key is a
+ * HELPER, not a fixed member. Both the CLI EMIT side
+ * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ
+ * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL
+ * through these single helpers so the two can never drift.
+ */
+export declare const WILDO_WORKER_URL_ENV_PREFIX = "WILDO_WORKER_";
+export declare const WILDO_WORKER_URL_ENV_SUFFIX = "_URL";
+/**
+ * Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —
+ * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the
+ * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both
+ * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env
+ * key is stable regardless of the authoring style.
+ */
+export declare function normalizeWorkerEnvSegment(workerName: string): string;
+/**
+ * The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single
+ * source of truth for both emit (CLI) and read (backend factory).
+ *
+ * @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'
+ */
+export declare function wildoWorkerUrlEnvKey(workerName: string): string;
+/**
+ * Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket
+ * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)
+ * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no
+ * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,
+ * `myNodeWorker` → `my-node-worker`.
+ *
+ * This is the DNS-NAME axis of a background runtime — the segment embedded in the
+ * k8s object/Service name, the built container image ref, the compose service name,
+ * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw
+ * bucket key), which apps-manager keys on (`appConfig.workers[key]` /
+ * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`
+ * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the
+ * identity axis MUST stay raw and is NEVER passed through this helper. The
+ * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,
+ * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a
+ * DNS label.
+ *
+ * This helper does NOT truncate — a name too long for a DNS label (63 chars) is
+ * REJECTED at authoring, not silently shortened (truncation risks colliding with
+ * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in
+ * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with
+ * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name
+ * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach
+ * the render.
+ */
+export declare function normalizeServiceKeyToDnsName(key: string): string;
+/**
+ * The k8s Service (and same-network compose service) name for a per-app worker:
+ * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an
+ * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction
+ * with the CLI k8s render (`renderWorkerForTarget`), the compose render
+ * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker
+ * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives
+ * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so
+ * the backend calls the exact Service the render deploys and CI builds the exact
+ * image ref the deploy pulls.
+ *
+ * `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —
+ * passed raw; the normalization happens inside. The raw key remains the worker's
+ * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that
+ * is never derived from this function.
+ */
+export declare function buildWorkerServiceName(appSlug: string, workerName: string): string;
+/**
+ * The k8s Deployment (and same-network compose service) name for a per-app minion:
+ * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an
+ * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with
+ * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,
+ * but the k8s render, the compose render, and the CI image build all need the
+ * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is
+ * the saas-config bucket key; the raw key stays the minion's IDENTITY (the
+ * `wildo.ai/owned-service-name` pod label), never derived from here.
+ */
+export declare function buildMinionServiceName(appSlug: string, minionName: string): string;
+/**
+ * The in-cluster base URL the app-backend uses to reach a per-app worker
+ * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers
+ * deploy into the SAME namespace (per-app deploy), so the short Service name
+ * resolves without a namespace qualifier. `port` is the worker's authored
+ * `http.port` (schema default 8080).
+ */
+export declare function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string;
 //# sourceMappingURL=application-backend-env.contracts.d.ts.map

package/dist/esm/runtime/application-backend-env.contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,2BAA2B,gCAAgC;IAC3D,qCAAqC,0CAA0C;CAChF;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;CAChE;AAED,oBAAY,4BAA4B;IACtC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,sBAAsB,2BAA2B;IACjD,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,+VAO7C,CAAC;AAEX,eAAO,MAAM,6CAA6C,uJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4CAE3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,sqCA2BxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,uqDAKnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,aAKjD,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,oIAAoI;IACpI,wBAAwB,6BAA6B;IACrD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,qCAAqC,0CAA0C;IAC/E,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;IAC/D,8IAA8I;IAC9I,gCAAgC,qCAAqC;CACtE;AAED,oBAAY,4BAA4B;IACtC;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,eAAe,oBAAoB;IACnC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB;;;;OAIG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;;;OAYG;IACH,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,qBAAqB,0BAA0B;IAc/C,sBAAsB,2BAA2B;IACjD,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,2ZAQ7C,CAAC;AAEX,eAAO,MAAM,6CAA6C,wJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4IAG3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,m0CA8BxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,i+DAKnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,aAKjD,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhG"}

package/dist/esm/runtime/application-backend-env.contracts.js

@@ -11,42 +11,160 @@ export var ApplicationBackendBootstrapEnvKey;
     ApplicationBackendBootstrapEnvKey["APPLICATION_ID"] = "APPLICATION_ID";
     ApplicationBackendBootstrapEnvKey["SERVICE_NAME"] = "SERVICE_NAME";
     ApplicationBackendBootstrapEnvKey["PLATFORM_ENVIRONMENT_ID"] = "PLATFORM_ENVIRONMENT_ID";
+    /** Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. */
+    ApplicationBackendBootstrapEnvKey["DEPLOYMENT_LOCATION_TYPE"] = "DEPLOYMENT_LOCATION_TYPE";
     ApplicationBackendBootstrapEnvKey["PLATFORM_APPLICATION_PRIMARY_SECRET"] = "PLATFORM_APPLICATION_PRIMARY_SECRET";
     ApplicationBackendBootstrapEnvKey["PLATFORM_APPS_MANAGER_URL"] = "PLATFORM_APPS_MANAGER_URL";
     ApplicationBackendBootstrapEnvKey["APPLICATION_ENV"] = "APPLICATION_ENV";
 })(ApplicationBackendBootstrapEnvKey || (ApplicationBackendBootstrapEnvKey = {}));
 export var ApplicationBackendPlatformUrlEnvKey;
 (function (ApplicationBackendPlatformUrlEnvKey) {
-    ApplicationBackendPlatformUrlEnvKey["PLATFORM_FILE_GENERATOR_URL"] = "PLATFORM_FILE_GENERATOR_URL";
     ApplicationBackendPlatformUrlEnvKey["PLATFORM_CRONTABS_BATCHES_MANAGER_URL"] = "PLATFORM_CRONTABS_BATCHES_MANAGER_URL";
+    ApplicationBackendPlatformUrlEnvKey["PLATFORM_MODULE_REGISTRY_URL"] = "PLATFORM_MODULE_REGISTRY_URL";
 })(ApplicationBackendPlatformUrlEnvKey || (ApplicationBackendPlatformUrlEnvKey = {}));
 export var ApplicationBackendRuntimeEnvKey;
 (function (ApplicationBackendRuntimeEnvKey) {
     ApplicationBackendRuntimeEnvKey["APPLICATION_RUNTIME_ENDPOINTS"] = "APPLICATION_RUNTIME_ENDPOINTS";
+    /** Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. */
+    ApplicationBackendRuntimeEnvKey["APPLICATION_RUNTIME_SIGNALS_HOME"] = "APPLICATION_RUNTIME_SIGNALS_HOME";
 })(ApplicationBackendRuntimeEnvKey || (ApplicationBackendRuntimeEnvKey = {}));
 export var ApplicationBackendDataEnvKey;
 (function (ApplicationBackendDataEnvKey) {
+    /**
+     * Which persistence adapter the application's resources use.
+     *
+     * DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no
+     * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only
+     * by a test that reached into the config object directly, which is why no application had ever
+     * booted on it. Deriving it instead ("PostgreSQL keys are present, so use PostgreSQL") was
+     * rejected: which store an application persists to is a deployment decision that must be legible
+     * in one place, not an emergent property of which variables happen to be set.
+     *
+     * Absent means MONGODB, so every existing deployment is unaffected.
+     */
+    ApplicationBackendDataEnvKey["DATABASE_DEFAULT_ADAPTER"] = "DATABASE_DEFAULT_ADAPTER";
+    /**
+     * The format NEW resource identifiers are minted in — `object-id` or `uuid`.
+     *
+     * DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to
+     * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's
+     * identity format a side effect of where its rows happen to live: moving a resource between
+     * adapters silently changed the shape of every id it minted AND made every id it had already
+     * minted fail `validateForResource`. Identity reaches URLs, exports, external references and
+     * integrations, so it is an application-level decision that must outlive a storage decision.
+     *
+     * It needed an env key for the same reason the adapter did. The loader hard-coded
+     * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an
+     * application could select PostgreSQL and still had no supported way to STATE its identity format,
+     * which left the engine's "declared, never derived" rule true in the schema and unreachable in
+     * practice.
+     *
+     * Absent means `OBJECT_ID` — what every existing application already mints — so no deployment
+     * changes behaviour by adding this key to the contract.
+     *
+     * One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold
+     * the declared format. DDL rendered from the schema plan types it `text`, which is correct for
+     * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects
+     * an `OBJECT_ID` outright.
+     */
+    ApplicationBackendDataEnvKey["RESOURCE_ID_FORMAT"] = "RESOURCE_ID_FORMAT";
     ApplicationBackendDataEnvKey["MONGODB_HOST"] = "MONGODB_HOST";
     ApplicationBackendDataEnvKey["MONGODB_DATABASE"] = "MONGODB_DATABASE";
     ApplicationBackendDataEnvKey["MONGODB_PROTOCOL"] = "MONGODB_PROTOCOL";
     ApplicationBackendDataEnvKey["MONGODB_DIRECT_CONNECTION"] = "MONGODB_DIRECT_CONNECTION";
+    /**
+     * PostgreSQL TOPOLOGY only — host, port, database, ssl.
+     *
+     * CREDENTIALS are deliberately NOT here. They arrive through
+     * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,
+     * secrets carry who may open it. Putting a password in an env contract would make it readable
+     * from every process listing and every container inspect.
+     */
+    ApplicationBackendDataEnvKey["POSTGRESQL_HOST"] = "POSTGRESQL_HOST";
+    ApplicationBackendDataEnvKey["POSTGRESQL_PORT"] = "POSTGRESQL_PORT";
+    ApplicationBackendDataEnvKey["POSTGRESQL_DATABASE"] = "POSTGRESQL_DATABASE";
+    ApplicationBackendDataEnvKey["POSTGRESQL_SSL_MODE"] = "POSTGRESQL_SSL_MODE";
     ApplicationBackendDataEnvKey["REDIS_HOST"] = "REDIS_HOST";
     ApplicationBackendDataEnvKey["REDIS_PORT"] = "REDIS_PORT";
+    /**
+     * Optional Redis logical database index (0–15). Emitted only when the
+     * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.
+     * Consumers default to DB 0 when this var is missing.
+     */
+    ApplicationBackendDataEnvKey["REDIS_DATABASE"] = "REDIS_DATABASE";
+    /**
+     * Canonical app-level Redis key namespace. Emitted only when the author
+     * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).
+     * `RedisService` uses this as the `appPrefix` for all keys it writes — every
+     * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or
+     * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix
+     * stays empty (multi-tenant isolation falls back to the
+     * `org:`/`global:` segment alone).
+     *
+     * REPLACE semantics: this supersedes the legacy
+     * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit
+     * decision — single source of truth = `wildo.saas.config.dataServices`).
+     */
+    ApplicationBackendDataEnvKey["REDIS_KEY_PREFIX"] = "REDIS_KEY_PREFIX";
     ApplicationBackendDataEnvKey["RABBITMQ_HOST"] = "RABBITMQ_HOST";
     ApplicationBackendDataEnvKey["RABBITMQ_PORT"] = "RABBITMQ_PORT";
+    /**
+     * Optional RabbitMQ virtual host. Emitted only when the author sets
+     * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.
+     * Consumers default to `/` (the RabbitMQ root vhost) when missing.
+     *
+     * Note (Slice 3.6 audit): the symmetric saas-side field
+     * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an
+     * infra/topology concern with a single authoring seam (infra config).
+     */
+    ApplicationBackendDataEnvKey["RABBITMQ_VHOST"] = "RABBITMQ_VHOST";
     ApplicationBackendDataEnvKey["STORAGE_PROVIDER"] = "STORAGE_PROVIDER";
+    /**
+     * S3-compatible endpoint **hostname** (NOT a URL). The variable name
+     * pre-dates the convention pin and is intentionally kept stable for
+     * backward compatibility with deployed manifests, but the value is
+     * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the
+     * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the
+     * full `https?://host:port` URL at the SDK initialization site.
+     *
+     * Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)
+     * silently breaks the `host:port` contract downstream because the SDK
+     * concatenates the parts naively. If a future migration wants to flip
+     * the contract to a URL, rename the env key (`STORAGE_URL`) rather
+     * than overloading this one — the rename surfaces the breaking change
+     * to operators.
+     */
     ApplicationBackendDataEnvKey["STORAGE_ENDPOINT"] = "STORAGE_ENDPOINT";
     ApplicationBackendDataEnvKey["STORAGE_PORT"] = "STORAGE_PORT";
     ApplicationBackendDataEnvKey["STORAGE_USE_SSL"] = "STORAGE_USE_SSL";
     ApplicationBackendDataEnvKey["STORAGE_BUCKET"] = "STORAGE_BUCKET";
-    ApplicationBackendDataEnvKey["STORAGE_ACCESS_KEY"] = "STORAGE_ACCESS_KEY";
-    ApplicationBackendDataEnvKey["STORAGE_SECRET_KEY"] = "STORAGE_SECRET_KEY";
+    /**
+     * Optional app-level object-key namespace prefix prepended to every
+     * application file path produced by `WildoManagedStorageProvider`
+     * (Slice 3.6). Final key shape becomes
+     * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`
+     * (extra segment above the existing `applicationId`-based namespace).
+     *
+     * Emitted only when the author sets `dataServices.s3.bucketPrefix` in
+     * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)
+     * remains infra-controlled and is unaffected by this prefix — N apps
+     * can share one bucket while keeping their object trees disjoint.
+     */
+    ApplicationBackendDataEnvKey["STORAGE_BUCKET_PREFIX"] = "STORAGE_BUCKET_PREFIX";
+    // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from
+    // this contract, and must not be re-added.
+    //
+    // They carried the object store's ROOT credential — the same pair the MinIO
+    // container itself is created with — into every application, minion and worker
+    // environment. An application now obtains short-lived, prefix-confined session
+    // credentials from apps-manager instead (`createStsStorageCredentialResolver`),
+    // so there is no application-tier storage credential to name here.
+    //
+    // Re-adding them would not merely restore a variable: this enum is the DECLARED
+    // app-backend env surface, so a key here is an invitation for a builder to fill
+    // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.
+    // See `.claude/plans/object-storage-root-credential-distribution.md`.
     ApplicationBackendDataEnvKey["STORAGE_LOCAL_BASE_DIR"] = "STORAGE_LOCAL_BASE_DIR";
-    ApplicationBackendDataEnvKey["WEAVIATE_HOST"] = "WEAVIATE_HOST";
-    ApplicationBackendDataEnvKey["WEAVIATE_PORT"] = "WEAVIATE_PORT";
-    ApplicationBackendDataEnvKey["WEAVIATE_GRPC_PORT"] = "WEAVIATE_GRPC_PORT";
-    ApplicationBackendDataEnvKey["WEAVIATE_API_KEY"] = "WEAVIATE_API_KEY";
-    ApplicationBackendDataEnvKey["WEAVIATE_SCHEME"] = "WEAVIATE_SCHEME";
     ApplicationBackendDataEnvKey["CLAMAV_HOST"] = "CLAMAV_HOST";
     ApplicationBackendDataEnvKey["CLAMAV_PORT"] = "CLAMAV_PORT";
     ApplicationBackendDataEnvKey["YARA_ENABLED"] = "YARA_ENABLED";
@@ -65,39 +183,44 @@ export const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [
     ApplicationBackendBootstrapEnvKey.APPLICATION_ID,
     ApplicationBackendBootstrapEnvKey.SERVICE_NAME,
     ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,
+    ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,
     ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,
     ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,
     ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,
 ];
 export const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [
-    ApplicationBackendPlatformUrlEnvKey.PLATFORM_FILE_GENERATOR_URL,
     ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,
+    ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,
 ];
 export const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [
     ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,
+    ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,
 ];
 export const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [
+    ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,
+    ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,
     ApplicationBackendDataEnvKey.MONGODB_HOST,
     ApplicationBackendDataEnvKey.MONGODB_DATABASE,
     ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,
     ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,
+    ApplicationBackendDataEnvKey.POSTGRESQL_HOST,
+    ApplicationBackendDataEnvKey.POSTGRESQL_PORT,
+    ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,
+    ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,
     ApplicationBackendDataEnvKey.REDIS_HOST,
     ApplicationBackendDataEnvKey.REDIS_PORT,
+    ApplicationBackendDataEnvKey.REDIS_DATABASE,
+    ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,
     ApplicationBackendDataEnvKey.RABBITMQ_HOST,
     ApplicationBackendDataEnvKey.RABBITMQ_PORT,
+    ApplicationBackendDataEnvKey.RABBITMQ_VHOST,
     ApplicationBackendDataEnvKey.STORAGE_PROVIDER,
     ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,
     ApplicationBackendDataEnvKey.STORAGE_PORT,
     ApplicationBackendDataEnvKey.STORAGE_USE_SSL,
     ApplicationBackendDataEnvKey.STORAGE_BUCKET,
-    ApplicationBackendDataEnvKey.STORAGE_ACCESS_KEY,
-    ApplicationBackendDataEnvKey.STORAGE_SECRET_KEY,
+    ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,
     ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,
-    ApplicationBackendDataEnvKey.WEAVIATE_HOST,
-    ApplicationBackendDataEnvKey.WEAVIATE_PORT,
-    ApplicationBackendDataEnvKey.WEAVIATE_GRPC_PORT,
-    ApplicationBackendDataEnvKey.WEAVIATE_API_KEY,
-    ApplicationBackendDataEnvKey.WEAVIATE_SCHEME,
     ApplicationBackendDataEnvKey.CLAMAV_HOST,
     ApplicationBackendDataEnvKey.CLAMAV_PORT,
     ApplicationBackendDataEnvKey.YARA_ENABLED,
@@ -116,8 +239,121 @@ export const APPLICATION_BACKEND_ENV_KEY_LIST = [
  */
 export const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set([
     ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,
-    ApplicationBackendDataEnvKey.STORAGE_ACCESS_KEY,
-    ApplicationBackendDataEnvKey.STORAGE_SECRET_KEY,
-    ApplicationBackendDataEnvKey.WEAVIATE_API_KEY,
+    // The storage pair is gone rather than listed: an app-tier env no longer
+    // carries an object-storage credential at all, so there is nothing here to
+    // mark sensitive. See the note on the enum above.
 ]);
-//# sourceMappingURL=application-backend-env.contracts.js.map
+/**
+ * ────────────────────────────────────────────────────────────────────────
+ * Backend → worker dispatch contract (G-8 / MW4)
+ * ────────────────────────────────────────────────────────────────────────
+ * A declared worker's HTTP base URL is injected into the app-backend env at
+ * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC
+ * (one per declared worker), so — unlike the static enums above — the key is a
+ * HELPER, not a fixed member. Both the CLI EMIT side
+ * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ
+ * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL
+ * through these single helpers so the two can never drift.
+ */
+export const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';
+export const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';
+/**
+ * Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —
+ * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the
+ * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both
+ * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env
+ * key is stable regardless of the authoring style.
+ */
+export function normalizeWorkerEnvSegment(workerName) {
+    return workerName
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore
+        .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore
+        .replace(/_+/g, '_') // collapse repeats
+        .replace(/^_|_$/g, '') // trim edges
+        .toUpperCase();
+}
+/**
+ * The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single
+ * source of truth for both emit (CLI) and read (backend factory).
+ *
+ * @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'
+ */
+export function wildoWorkerUrlEnvKey(workerName) {
+    return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;
+}
+/**
+ * Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket
+ * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)
+ * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no
+ * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,
+ * `myNodeWorker` → `my-node-worker`.
+ *
+ * This is the DNS-NAME axis of a background runtime — the segment embedded in the
+ * k8s object/Service name, the built container image ref, the compose service name,
+ * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw
+ * bucket key), which apps-manager keys on (`appConfig.workers[key]` /
+ * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`
+ * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the
+ * identity axis MUST stay raw and is NEVER passed through this helper. The
+ * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,
+ * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a
+ * DNS label.
+ *
+ * This helper does NOT truncate — a name too long for a DNS label (63 chars) is
+ * REJECTED at authoring, not silently shortened (truncation risks colliding with
+ * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in
+ * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with
+ * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name
+ * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach
+ * the render.
+ */
+export function normalizeServiceKeyToDnsName(key) {
+    return key
+        .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen
+        .replace(/^-+|-+$/g, ''); // trim leading/trailing hyphens
+}
+/**
+ * The k8s Service (and same-network compose service) name for a per-app worker:
+ * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an
+ * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction
+ * with the CLI k8s render (`renderWorkerForTarget`), the compose render
+ * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker
+ * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives
+ * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so
+ * the backend calls the exact Service the render deploys and CI builds the exact
+ * image ref the deploy pulls.
+ *
+ * `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —
+ * passed raw; the normalization happens inside. The raw key remains the worker's
+ * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that
+ * is never derived from this function.
+ */
+export function buildWorkerServiceName(appSlug, workerName) {
+    return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;
+}
+/**
+ * The k8s Deployment (and same-network compose service) name for a per-app minion:
+ * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an
+ * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with
+ * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,
+ * but the k8s render, the compose render, and the CI image build all need the
+ * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is
+ * the saas-config bucket key; the raw key stays the minion's IDENTITY (the
+ * `wildo.ai/owned-service-name` pod label), never derived from here.
+ */
+export function buildMinionServiceName(appSlug, minionName) {
+    return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;
+}
+/**
+ * The in-cluster base URL the app-backend uses to reach a per-app worker
+ * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers
+ * deploy into the SAME namespace (per-app deploy), so the short Service name
+ * resolves without a namespace qualifier. `port` is the worker's authored
+ * `http.port` (schema default 8080).
+ */
+export function buildWorkerInternalUrl(appSlug, workerName, port) {
+    return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;
+}
+//# sourceMappingURL=application-backend-env.contracts.js.map