@wildo-ai/platform-core-shared 1.0.1 → 1.1.1

package/dist/esm/runtime/application-backend-env.contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCAOX;AAPD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD,wEAAmC,CAAA;AACrC,CAAC,EAPW,iCAAiC,KAAjC,iCAAiC,QAO5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,kGAA2D,CAAA;IAC3D,sHAA+E,CAAA;AACjF,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BAEX;AAFD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;AACjE,CAAC,EAFW,+BAA+B,KAA/B,+BAA+B,QAE1C;AAED,MAAM,CAAN,IAAY,4BA2BX;AA3BD,WAAY,4BAA4B;IACtC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC,yEAAyC,CAAA;IACzC,yEAAyC,CAAA;IACzC,iFAAiD,CAAA;IACjD,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B,yEAAyC,CAAA;IACzC,qEAAqC,CAAA;IACrC,mEAAmC,CAAA;IACnC,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EA3BW,4BAA4B,KAA5B,4BAA4B,QA2BvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,2BAA2B;IAC/D,mCAAmC,CAAC,qCAAqC;CACjE,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;CACrD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,gBAAgB;CAC9C,CAAC,CAAC"}
+{"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCASX;AATD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,oIAAoI;IACpI,0FAAqD,CAAA;IACrD,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD,wEAAmC,CAAA;AACrC,CAAC,EATW,iCAAiC,KAAjC,iCAAiC,QAS5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,sHAA+E,CAAA;IAC/E,oGAA6D,CAAA;AAC/D,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;IAC/D,8IAA8I;IAC9I,wGAAqE,CAAA;AACvE,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAED,MAAM,CAAN,IAAY,4BA6IX;AA7ID,WAAY,4BAA4B;IACtC;;;;;;;;;;;OAWG;IACH,qFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,yEAAyC,CAAA;IACzC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,mEAAmC,CAAA;IACnC,mEAAmC,CAAA;IACnC,2EAA2C,CAAA;IAC3C,2EAA2C,CAAA;IAC3C,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB;;;;OAIG;IACH,iEAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAqC,CAAA;IACrC,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IACjC,qEAAqC,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,+EAA+C,CAAA;IAC/C,8EAA8E;IAC9E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,sEAAsE;IACtE,iFAAiD,CAAA;IACjD,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EA7IW,4BAA4B,KAA5B,4BAA4B,QA6IvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,wBAAwB;IAC1D,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,qCAAqC;IACzE,mCAAmC,CAAC,4BAA4B;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;IAC7D,+BAA+B,CAAC,gCAAgC;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,wBAAwB;IACrD,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,qBAAqB;IAClD,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,kDAAkD;CACnD,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU;SACd,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,uCAAuC;SAC9E,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,qCAAqC;SACpE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,mBAAmB;SACvC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa;SACnC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,2BAA2B,GAAG,yBAAyB,CAAC,UAAU,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,mCAAmC;SAC1E,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,+CAA+C;SAC3E,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;IACtF,OAAO,UAAU,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC","sourcesContent":["/**\n * Shared environment contract for application backend processes.\n *\n * This is the canonical vocabulary for the app-backend `.env` surface emitted\n * by the CLI and parsed by backend runtimes. Keep the keys here purely\n * declarative: they describe names and ownership, not executor-specific\n * behavior.\n */\n\nexport enum ApplicationBackendBootstrapEnvKey {\n  APPLICATION_ID = 'APPLICATION_ID',\n  SERVICE_NAME = 'SERVICE_NAME',\n  PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n  /** Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. */\n  DEPLOYMENT_LOCATION_TYPE = 'DEPLOYMENT_LOCATION_TYPE',\n  PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n  PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n  APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationBackendPlatformUrlEnvKey {\n  PLATFORM_CRONTABS_BATCHES_MANAGER_URL = 'PLATFORM_CRONTABS_BATCHES_MANAGER_URL',\n  PLATFORM_MODULE_REGISTRY_URL = 'PLATFORM_MODULE_REGISTRY_URL',\n}\n\nexport enum ApplicationBackendRuntimeEnvKey {\n  APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n  /** Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. */\n  APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n}\n\nexport enum ApplicationBackendDataEnvKey {\n  /**\n   * Which persistence adapter the application's resources use.\n   *\n   * DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no\n   * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only\n   * by a test that reached into the config object directly, which is why no application had ever\n   * booted on it. Deriving it instead (\"PostgreSQL keys are present, so use PostgreSQL\") was\n   * rejected: which store an application persists to is a deployment decision that must be legible\n   * in one place, not an emergent property of which variables happen to be set.\n   *\n   * Absent means MONGODB, so every existing deployment is unaffected.\n   */\n  DATABASE_DEFAULT_ADAPTER = 'DATABASE_DEFAULT_ADAPTER',\n  /**\n   * The format NEW resource identifiers are minted in — `object-id` or `uuid`.\n   *\n   * DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to\n   * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's\n   * identity format a side effect of where its rows happen to live: moving a resource between\n   * adapters silently changed the shape of every id it minted AND made every id it had already\n   * minted fail `validateForResource`. Identity reaches URLs, exports, external references and\n   * integrations, so it is an application-level decision that must outlive a storage decision.\n   *\n   * It needed an env key for the same reason the adapter did. The loader hard-coded\n   * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an\n   * application could select PostgreSQL and still had no supported way to STATE its identity format,\n   * which left the engine's \"declared, never derived\" rule true in the schema and unreachable in\n   * practice.\n   *\n   * Absent means `OBJECT_ID` — what every existing application already mints — so no deployment\n   * changes behaviour by adding this key to the contract.\n   *\n   * One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold\n   * the declared format. DDL rendered from the schema plan types it `text`, which is correct for\n   * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects\n   * an `OBJECT_ID` outright.\n   */\n  RESOURCE_ID_FORMAT = 'RESOURCE_ID_FORMAT',\n  MONGODB_HOST = 'MONGODB_HOST',\n  MONGODB_DATABASE = 'MONGODB_DATABASE',\n  MONGODB_PROTOCOL = 'MONGODB_PROTOCOL',\n  MONGODB_DIRECT_CONNECTION = 'MONGODB_DIRECT_CONNECTION',\n  /**\n   * PostgreSQL TOPOLOGY only — host, port, database, ssl.\n   *\n   * CREDENTIALS are deliberately NOT here. They arrive through\n   * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,\n   * secrets carry who may open it. Putting a password in an env contract would make it readable\n   * from every process listing and every container inspect.\n   */\n  POSTGRESQL_HOST = 'POSTGRESQL_HOST',\n  POSTGRESQL_PORT = 'POSTGRESQL_PORT',\n  POSTGRESQL_DATABASE = 'POSTGRESQL_DATABASE',\n  POSTGRESQL_SSL_MODE = 'POSTGRESQL_SSL_MODE',\n  REDIS_HOST = 'REDIS_HOST',\n  REDIS_PORT = 'REDIS_PORT',\n  /**\n   * Optional Redis logical database index (0–15). Emitted only when the\n   * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.\n   * Consumers default to DB 0 when this var is missing.\n   */\n  REDIS_DATABASE = 'REDIS_DATABASE',\n  /**\n   * Canonical app-level Redis key namespace. Emitted only when the author\n   * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).\n   * `RedisService` uses this as the `appPrefix` for all keys it writes — every\n   * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or\n   * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix\n   * stays empty (multi-tenant isolation falls back to the\n   * `org:`/`global:` segment alone).\n   *\n   * REPLACE semantics: this supersedes the legacy\n   * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit\n   * decision — single source of truth = `wildo.saas.config.dataServices`).\n   */\n  REDIS_KEY_PREFIX = 'REDIS_KEY_PREFIX',\n  RABBITMQ_HOST = 'RABBITMQ_HOST',\n  RABBITMQ_PORT = 'RABBITMQ_PORT',\n  /**\n   * Optional RabbitMQ virtual host. Emitted only when the author sets\n   * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.\n   * Consumers default to `/` (the RabbitMQ root vhost) when missing.\n   *\n   * Note (Slice 3.6 audit): the symmetric saas-side field\n   * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an\n   * infra/topology concern with a single authoring seam (infra config).\n   */\n  RABBITMQ_VHOST = 'RABBITMQ_VHOST',\n  STORAGE_PROVIDER = 'STORAGE_PROVIDER',\n  /**\n   * S3-compatible endpoint **hostname** (NOT a URL). The variable name\n   * pre-dates the convention pin and is intentionally kept stable for\n   * backward compatibility with deployed manifests, but the value is\n   * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the\n   * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the\n   * full `https?://host:port` URL at the SDK initialization site.\n   *\n   * Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)\n   * silently breaks the `host:port` contract downstream because the SDK\n   * concatenates the parts naively. If a future migration wants to flip\n   * the contract to a URL, rename the env key (`STORAGE_URL`) rather\n   * than overloading this one — the rename surfaces the breaking change\n   * to operators.\n   */\n  STORAGE_ENDPOINT = 'STORAGE_ENDPOINT',\n  STORAGE_PORT = 'STORAGE_PORT',\n  STORAGE_USE_SSL = 'STORAGE_USE_SSL',\n  STORAGE_BUCKET = 'STORAGE_BUCKET',\n  /**\n   * Optional app-level object-key namespace prefix prepended to every\n   * application file path produced by `WildoManagedStorageProvider`\n   * (Slice 3.6). Final key shape becomes\n   * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`\n   * (extra segment above the existing `applicationId`-based namespace).\n   *\n   * Emitted only when the author sets `dataServices.s3.bucketPrefix` in\n   * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)\n   * remains infra-controlled and is unaffected by this prefix — N apps\n   * can share one bucket while keeping their object trees disjoint.\n   */\n  STORAGE_BUCKET_PREFIX = 'STORAGE_BUCKET_PREFIX',\n  // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from\n  // this contract, and must not be re-added.\n  //\n  // They carried the object store's ROOT credential — the same pair the MinIO\n  // container itself is created with — into every application, minion and worker\n  // environment. An application now obtains short-lived, prefix-confined session\n  // credentials from apps-manager instead (`createStsStorageCredentialResolver`),\n  // so there is no application-tier storage credential to name here.\n  //\n  // Re-adding them would not merely restore a variable: this enum is the DECLARED\n  // app-backend env surface, so a key here is an invitation for a builder to fill\n  // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.\n  // See `.claude/plans/object-storage-root-credential-distribution.md`.\n  STORAGE_LOCAL_BASE_DIR = 'STORAGE_LOCAL_BASE_DIR',\n  CLAMAV_HOST = 'CLAMAV_HOST',\n  CLAMAV_PORT = 'CLAMAV_PORT',\n  YARA_ENABLED = 'YARA_ENABLED',\n  YARA_HOST = 'YARA_HOST',\n  YARA_PORT = 'YARA_PORT',\n}\n\n/**\n * Keep the plural `*Keys` aliases so current consumers keep reading naturally,\n * while the actual source of truth is the scoped enum definition above.\n */\nexport const ApplicationBackendBootstrapEnvKeys = ApplicationBackendBootstrapEnvKey;\nexport const ApplicationBackendPlatformUrlEnvKeys = ApplicationBackendPlatformUrlEnvKey;\nexport const ApplicationBackendRuntimeEnvKeys = ApplicationBackendRuntimeEnvKey;\nexport const ApplicationBackendDataEnvKeys = ApplicationBackendDataEnvKey;\n\nexport const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [\n  ApplicationBackendBootstrapEnvKey.APPLICATION_ID,\n  ApplicationBackendBootstrapEnvKey.SERVICE_NAME,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n  ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n  ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [\n  ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n  ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,\n] as const;\n\nexport const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [\n  ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n  ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [\n  ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,\n  ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,\n  ApplicationBackendDataEnvKey.MONGODB_HOST,\n  ApplicationBackendDataEnvKey.MONGODB_DATABASE,\n  ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,\n  ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,\n  ApplicationBackendDataEnvKey.POSTGRESQL_HOST,\n  ApplicationBackendDataEnvKey.POSTGRESQL_PORT,\n  ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,\n  ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,\n  ApplicationBackendDataEnvKey.REDIS_HOST,\n  ApplicationBackendDataEnvKey.REDIS_PORT,\n  ApplicationBackendDataEnvKey.REDIS_DATABASE,\n  ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,\n  ApplicationBackendDataEnvKey.RABBITMQ_HOST,\n  ApplicationBackendDataEnvKey.RABBITMQ_PORT,\n  ApplicationBackendDataEnvKey.RABBITMQ_VHOST,\n  ApplicationBackendDataEnvKey.STORAGE_PROVIDER,\n  ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,\n  ApplicationBackendDataEnvKey.STORAGE_PORT,\n  ApplicationBackendDataEnvKey.STORAGE_USE_SSL,\n  ApplicationBackendDataEnvKey.STORAGE_BUCKET,\n  ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,\n  ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,\n  ApplicationBackendDataEnvKey.CLAMAV_HOST,\n  ApplicationBackendDataEnvKey.CLAMAV_PORT,\n  ApplicationBackendDataEnvKey.YARA_ENABLED,\n  ApplicationBackendDataEnvKey.YARA_HOST,\n  ApplicationBackendDataEnvKey.YARA_PORT,\n] as const;\n\nexport const APPLICATION_BACKEND_ENV_KEY_LIST = [\n  ...APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_DATA_ENV_KEY_LIST,\n] as const;\n\n/**\n * Keys that must always be treated as secrets when this app-backend env surface\n * is materialized into logs, CI artifacts, or deployment manifests.\n */\nexport const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set<string>([\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n  // The storage pair is gone rather than listed: an app-tier env no longer\n  // carries an object-storage credential at all, so there is nothing here to\n  // mark sensitive. See the note on the enum above.\n]);\n\nexport type ApplicationBackendEnvKey =\n  typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];\n\n/**\n * ────────────────────────────────────────────────────────────────────────\n * Backend → worker dispatch contract (G-8 / MW4)\n * ────────────────────────────────────────────────────────────────────────\n * A declared worker's HTTP base URL is injected into the app-backend env at\n * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC\n * (one per declared worker), so — unlike the static enums above — the key is a\n * HELPER, not a fixed member. Both the CLI EMIT side\n * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ\n * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL\n * through these single helpers so the two can never drift.\n */\nexport const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';\nexport const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';\n\n/**\n * Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —\n * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the\n * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both\n * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env\n * key is stable regardless of the authoring style.\n */\nexport function normalizeWorkerEnvSegment(workerName: string): string {\n  return workerName\n    .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore\n    .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore\n    .replace(/_+/g, '_') // collapse repeats\n    .replace(/^_|_$/g, '') // trim edges\n    .toUpperCase();\n}\n\n/**\n * The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single\n * source of truth for both emit (CLI) and read (backend factory).\n *\n * @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'\n */\nexport function wildoWorkerUrlEnvKey(workerName: string): string {\n  return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;\n}\n\n/**\n * Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket\n * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)\n * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no\n * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,\n * `myNodeWorker` → `my-node-worker`.\n *\n * This is the DNS-NAME axis of a background runtime — the segment embedded in the\n * k8s object/Service name, the built container image ref, the compose service name,\n * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw\n * bucket key), which apps-manager keys on (`appConfig.workers[key]` /\n * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`\n * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the\n * identity axis MUST stay raw and is NEVER passed through this helper. The\n * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,\n * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a\n * DNS label.\n *\n * This helper does NOT truncate — a name too long for a DNS label (63 chars) is\n * REJECTED at authoring, not silently shortened (truncation risks colliding with\n * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in\n * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with\n * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name\n * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach\n * the render.\n */\nexport function normalizeServiceKeyToDnsName(key: string): string {\n  return key\n    .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen\n    .replace(/^-+|-+$/g, ''); // trim leading/trailing hyphens\n}\n\n/**\n * The k8s Service (and same-network compose service) name for a per-app worker:\n * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction\n * with the CLI k8s render (`renderWorkerForTarget`), the compose render\n * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker\n * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives\n * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so\n * the backend calls the exact Service the render deploys and CI builds the exact\n * image ref the deploy pulls.\n *\n * `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —\n * passed raw; the normalization happens inside. The raw key remains the worker's\n * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that\n * is never derived from this function.\n */\nexport function buildWorkerServiceName(appSlug: string, workerName: string): string {\n  return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;\n}\n\n/**\n * The k8s Deployment (and same-network compose service) name for a per-app minion:\n * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with\n * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,\n * but the k8s render, the compose render, and the CI image build all need the\n * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is\n * the saas-config bucket key; the raw key stays the minion's IDENTITY (the\n * `wildo.ai/owned-service-name` pod label), never derived from here.\n */\nexport function buildMinionServiceName(appSlug: string, minionName: string): string {\n  return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;\n}\n\n/**\n * The in-cluster base URL the app-backend uses to reach a per-app worker\n * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers\n * deploy into the SAME namespace (per-app deploy), so the short Service name\n * resolves without a namespace qualifier. `port` is the worker's authored\n * `http.port` (schema default 8080).\n */\nexport function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string {\n  return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;\n}\n"]}

package/dist/esm/runtime/application-worker-env.contracts.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Shared environment contract for application worker processes.
+ *
+ * This surface is intentionally smaller than the backend contract:
+ * workers are language-agnostic subprocesses, so they receive only the
+ * bootstrap identity, worker identity, optional runtime topology hints,
+ * and provider/config secrets that are safe to deliver via env.
+ */
+/**
+ * Bootstrap-identity env contract for application worker processes.
+ *
+ * The worker IDENTITY is carried by the canonical background-runtime pair
+ * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` — the SAME vocabulary the
+ * `BackgroundRuntimeType` model (`@wildo-ai/saas-models`) declares apps-manager
+ * injects, that the k8s worker AND minion Deployment templates stamp, and that
+ * the reference Rust worker reads at boot. The worker forwards
+ * `APP_OWNED_SERVICE_NAME` as the `/apps-to-manager/workers/{name}/bootstrap`
+ * path segment, which apps-manager keys on `appConfig.workers[name]` — so
+ * `APP_OWNED_SERVICE_NAME` is exactly the `wildo.saas.config.ts > workers`
+ * bucket key. `APP_OWNED_SERVICE_KIND` is `BackgroundRuntimeType.WORKER` and
+ * disambiguates worker vs minion, so both background-runtime kinds share ONE
+ * identity contract across every deploy path (k8s manifest, docker-compose, and
+ * the generated `.env`).
+ *
+ * `SERVICE_NAME` is the SEPARATE process/observability identity
+ * (`wildo.worker.config.ts > name`, else the bucket key) — it also feeds
+ * `OTEL_SERVICE_NAME`. It is NOT the routing identity above; do not conflate
+ * the two.
+ */
+export declare enum ApplicationWorkerBootstrapEnvKey {
+    APPLICATION_ID = "APPLICATION_ID",
+    /** `BackgroundRuntimeType.WORKER` — pins this app-owned runtime kind (vs a minion). */
+    APP_OWNED_SERVICE_KIND = "APP_OWNED_SERVICE_KIND",
+    /**
+     * The `wildo.saas.config.ts > workers` bucket key — forwarded to apps-manager
+     * as the worker-bootstrap path segment (`appConfig.workers[name]` lookup).
+     */
+    APP_OWNED_SERVICE_NAME = "APP_OWNED_SERVICE_NAME",
+    /** Process/observability identity (`wildo.worker.config.ts > name`, else the bucket key); feeds `OTEL_SERVICE_NAME`. */
+    SERVICE_NAME = "SERVICE_NAME",
+    PLATFORM_ENVIRONMENT_ID = "PLATFORM_ENVIRONMENT_ID",
+    PLATFORM_APPLICATION_PRIMARY_SECRET = "PLATFORM_APPLICATION_PRIMARY_SECRET",
+    PLATFORM_APPS_MANAGER_URL = "PLATFORM_APPS_MANAGER_URL",
+    APPLICATION_ENV = "APPLICATION_ENV"
+}
+export declare enum ApplicationWorkerRuntimeEnvKey {
+    APPLICATION_RUNTIME_ENDPOINTS = "APPLICATION_RUNTIME_ENDPOINTS"
+}
+/**
+ * The worker's inbound HTTP-surface descriptor, projected from the authored
+ * `wildo.worker.config.ts > http` block (`WorkerHttpSchema` in
+ * `@wildo-ai/platform-config-lib`) into the worker process environment by
+ * `wildo config sync`.
+ *
+ * Unlike {@link ApplicationWorkerBootstrapEnvKey} (required identity — the
+ * worker fails closed when any key is missing), these keys are DEFAULTED: a
+ * worker booted without them falls back to its language-runtime's built-in
+ * defaults (`8080` / `/healthz` / `/readyz`), exactly as the Rust reference
+ * worker does with `std::env::var(...).unwrap_or_else(...)`. The generator
+ * always emits them from the authored config so the running port and probe
+ * paths track `wildo.worker.config.ts` rather than a per-language hardcoded
+ * default that only coincides with the authored value by luck.
+ *
+ * `WORKER_METRICS_PATH` mirrors the optional `WorkerHttpSchema.metricsPath` —
+ * emitted only when the author opts a worker into a Prometheus scrape surface.
+ */
+export declare enum ApplicationWorkerHttpSurfaceEnvKey {
+    WORKER_HTTP_PORT = "WORKER_HTTP_PORT",
+    WORKER_HEALTH_PATH = "WORKER_HEALTH_PATH",
+    WORKER_READY_PATH = "WORKER_READY_PATH",
+    WORKER_METRICS_PATH = "WORKER_METRICS_PATH"
+}
+export declare const ApplicationWorkerBootstrapEnvKeys: typeof ApplicationWorkerBootstrapEnvKey;
+export declare const ApplicationWorkerRuntimeEnvKeys: typeof ApplicationWorkerRuntimeEnvKey;
+export declare const ApplicationWorkerHttpSurfaceEnvKeys: typeof ApplicationWorkerHttpSurfaceEnvKey;
+export declare const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationWorkerBootstrapEnvKey.APPLICATION_ID, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV];
+export declare const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST: readonly [ApplicationWorkerRuntimeEnvKey];
+export declare const APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST: readonly [ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH];
+export declare const APPLICATION_WORKER_ENV_KEY_LIST: readonly [ApplicationWorkerBootstrapEnvKey.APPLICATION_ID, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV, ApplicationWorkerRuntimeEnvKey, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH];
+export declare const APPLICATION_WORKER_SENSITIVE_ENV_KEYS: Set<string>;
+export type ApplicationWorkerEnvKey = typeof APPLICATION_WORKER_ENV_KEY_LIST[number];
+//# sourceMappingURL=application-worker-env.contracts.d.ts.map

package/dist/esm/runtime/application-worker-env.contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-worker-env.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/application-worker-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,gCAAgC;IAC1C,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,sBAAsB,2BAA2B;IACjD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD,wHAAwH;IACxH,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,8BAA8B;IACxC,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,kCAAkC;IAC5C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;CAC5C;AAED,eAAO,MAAM,iCAAiC,yCAAmC,CAAC;AAClF,eAAO,MAAM,+BAA+B,uCAAiC,CAAC;AAC9E,eAAO,MAAM,mCAAmC,2CAAqC,CAAC;AAEtF,eAAO,MAAM,yCAAyC,2cAS5C,CAAC;AAEX,eAAO,MAAM,uCAAuC,2CAE1C,CAAC;AAEX,eAAO,MAAM,4CAA4C,qOAK/C,CAAC;AAEX,eAAO,MAAM,+BAA+B,qsBAIlC,CAAC;AAEX,eAAO,MAAM,qCAAqC,aAEhD,CAAC;AAEH,MAAM,MAAM,uBAAuB,GACjC,OAAO,+BAA+B,CAAC,MAAM,CAAC,CAAC"}

package/dist/esm/runtime/application-worker-env.contracts.js

@@ -0,0 +1,106 @@
+/**
+ * Shared environment contract for application worker processes.
+ *
+ * This surface is intentionally smaller than the backend contract:
+ * workers are language-agnostic subprocesses, so they receive only the
+ * bootstrap identity, worker identity, optional runtime topology hints,
+ * and provider/config secrets that are safe to deliver via env.
+ */
+/**
+ * Bootstrap-identity env contract for application worker processes.
+ *
+ * The worker IDENTITY is carried by the canonical background-runtime pair
+ * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` — the SAME vocabulary the
+ * `BackgroundRuntimeType` model (`@wildo-ai/saas-models`) declares apps-manager
+ * injects, that the k8s worker AND minion Deployment templates stamp, and that
+ * the reference Rust worker reads at boot. The worker forwards
+ * `APP_OWNED_SERVICE_NAME` as the `/apps-to-manager/workers/{name}/bootstrap`
+ * path segment, which apps-manager keys on `appConfig.workers[name]` — so
+ * `APP_OWNED_SERVICE_NAME` is exactly the `wildo.saas.config.ts > workers`
+ * bucket key. `APP_OWNED_SERVICE_KIND` is `BackgroundRuntimeType.WORKER` and
+ * disambiguates worker vs minion, so both background-runtime kinds share ONE
+ * identity contract across every deploy path (k8s manifest, docker-compose, and
+ * the generated `.env`).
+ *
+ * `SERVICE_NAME` is the SEPARATE process/observability identity
+ * (`wildo.worker.config.ts > name`, else the bucket key) — it also feeds
+ * `OTEL_SERVICE_NAME`. It is NOT the routing identity above; do not conflate
+ * the two.
+ */
+export var ApplicationWorkerBootstrapEnvKey;
+(function (ApplicationWorkerBootstrapEnvKey) {
+    ApplicationWorkerBootstrapEnvKey["APPLICATION_ID"] = "APPLICATION_ID";
+    /** `BackgroundRuntimeType.WORKER` — pins this app-owned runtime kind (vs a minion). */
+    ApplicationWorkerBootstrapEnvKey["APP_OWNED_SERVICE_KIND"] = "APP_OWNED_SERVICE_KIND";
+    /**
+     * The `wildo.saas.config.ts > workers` bucket key — forwarded to apps-manager
+     * as the worker-bootstrap path segment (`appConfig.workers[name]` lookup).
+     */
+    ApplicationWorkerBootstrapEnvKey["APP_OWNED_SERVICE_NAME"] = "APP_OWNED_SERVICE_NAME";
+    /** Process/observability identity (`wildo.worker.config.ts > name`, else the bucket key); feeds `OTEL_SERVICE_NAME`. */
+    ApplicationWorkerBootstrapEnvKey["SERVICE_NAME"] = "SERVICE_NAME";
+    ApplicationWorkerBootstrapEnvKey["PLATFORM_ENVIRONMENT_ID"] = "PLATFORM_ENVIRONMENT_ID";
+    ApplicationWorkerBootstrapEnvKey["PLATFORM_APPLICATION_PRIMARY_SECRET"] = "PLATFORM_APPLICATION_PRIMARY_SECRET";
+    ApplicationWorkerBootstrapEnvKey["PLATFORM_APPS_MANAGER_URL"] = "PLATFORM_APPS_MANAGER_URL";
+    ApplicationWorkerBootstrapEnvKey["APPLICATION_ENV"] = "APPLICATION_ENV";
+})(ApplicationWorkerBootstrapEnvKey || (ApplicationWorkerBootstrapEnvKey = {}));
+export var ApplicationWorkerRuntimeEnvKey;
+(function (ApplicationWorkerRuntimeEnvKey) {
+    ApplicationWorkerRuntimeEnvKey["APPLICATION_RUNTIME_ENDPOINTS"] = "APPLICATION_RUNTIME_ENDPOINTS";
+})(ApplicationWorkerRuntimeEnvKey || (ApplicationWorkerRuntimeEnvKey = {}));
+/**
+ * The worker's inbound HTTP-surface descriptor, projected from the authored
+ * `wildo.worker.config.ts > http` block (`WorkerHttpSchema` in
+ * `@wildo-ai/platform-config-lib`) into the worker process environment by
+ * `wildo config sync`.
+ *
+ * Unlike {@link ApplicationWorkerBootstrapEnvKey} (required identity — the
+ * worker fails closed when any key is missing), these keys are DEFAULTED: a
+ * worker booted without them falls back to its language-runtime's built-in
+ * defaults (`8080` / `/healthz` / `/readyz`), exactly as the Rust reference
+ * worker does with `std::env::var(...).unwrap_or_else(...)`. The generator
+ * always emits them from the authored config so the running port and probe
+ * paths track `wildo.worker.config.ts` rather than a per-language hardcoded
+ * default that only coincides with the authored value by luck.
+ *
+ * `WORKER_METRICS_PATH` mirrors the optional `WorkerHttpSchema.metricsPath` —
+ * emitted only when the author opts a worker into a Prometheus scrape surface.
+ */
+export var ApplicationWorkerHttpSurfaceEnvKey;
+(function (ApplicationWorkerHttpSurfaceEnvKey) {
+    ApplicationWorkerHttpSurfaceEnvKey["WORKER_HTTP_PORT"] = "WORKER_HTTP_PORT";
+    ApplicationWorkerHttpSurfaceEnvKey["WORKER_HEALTH_PATH"] = "WORKER_HEALTH_PATH";
+    ApplicationWorkerHttpSurfaceEnvKey["WORKER_READY_PATH"] = "WORKER_READY_PATH";
+    ApplicationWorkerHttpSurfaceEnvKey["WORKER_METRICS_PATH"] = "WORKER_METRICS_PATH";
+})(ApplicationWorkerHttpSurfaceEnvKey || (ApplicationWorkerHttpSurfaceEnvKey = {}));
+export const ApplicationWorkerBootstrapEnvKeys = ApplicationWorkerBootstrapEnvKey;
+export const ApplicationWorkerRuntimeEnvKeys = ApplicationWorkerRuntimeEnvKey;
+export const ApplicationWorkerHttpSurfaceEnvKeys = ApplicationWorkerHttpSurfaceEnvKey;
+export const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST = [
+    ApplicationWorkerBootstrapEnvKey.APPLICATION_ID,
+    ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND,
+    ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME,
+    ApplicationWorkerBootstrapEnvKey.SERVICE_NAME,
+    ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,
+    ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,
+    ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,
+    ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV,
+];
+export const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST = [
+    ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,
+];
+export const APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST = [
+    ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT,
+    ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH,
+    ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH,
+    ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH,
+];
+export const APPLICATION_WORKER_ENV_KEY_LIST = [
+    ...APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST,
+    ...APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST,
+    ...APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST,
+];
+export const APPLICATION_WORKER_SENSITIVE_ENV_KEYS = new Set([
+    ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,
+]);
+//# sourceMappingURL=application-worker-env.contracts.js.map

package/dist/esm/runtime/application-worker-env.contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-worker-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/application-worker-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,gCAeX;AAfD,WAAY,gCAAgC;IAC1C,qEAAiC,CAAA;IACjC,uFAAuF;IACvF,qFAAiD,CAAA;IACjD;;;OAGG;IACH,qFAAiD,CAAA;IACjD,wHAAwH;IACxH,iEAA6B,CAAA;IAC7B,uFAAmD,CAAA;IACnD,+GAA2E,CAAA;IAC3E,2FAAuD,CAAA;IACvD,uEAAmC,CAAA;AACrC,CAAC,EAfW,gCAAgC,KAAhC,gCAAgC,QAe3C;AAED,MAAM,CAAN,IAAY,8BAEX;AAFD,WAAY,8BAA8B;IACxC,iGAA+D,CAAA;AACjE,CAAC,EAFW,8BAA8B,KAA9B,8BAA8B,QAEzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,2EAAqC,CAAA;IACrC,+EAAyC,CAAA;IACzC,6EAAuC,CAAA;IACvC,iFAA2C,CAAA;AAC7C,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,gCAAgC,CAAC;AAClF,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAA8B,CAAC;AAC9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,kCAAkC,CAAC;AAEtF,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gCAAgC,CAAC,cAAc;IAC/C,gCAAgC,CAAC,sBAAsB;IACvD,gCAAgC,CAAC,sBAAsB;IACvD,gCAAgC,CAAC,YAAY;IAC7C,gCAAgC,CAAC,uBAAuB;IACxD,gCAAgC,CAAC,mCAAmC;IACpE,gCAAgC,CAAC,yBAAyB;IAC1D,gCAAgC,CAAC,eAAe;CACxC,CAAC;AAEX,MAAM,CAAC,MAAM,uCAAuC,GAAG;IACrD,8BAA8B,CAAC,6BAA6B;CACpD,CAAC;AAEX,MAAM,CAAC,MAAM,4CAA4C,GAAG;IAC1D,kCAAkC,CAAC,gBAAgB;IACnD,kCAAkC,CAAC,kBAAkB;IACrD,kCAAkC,CAAC,iBAAiB;IACpD,kCAAkC,CAAC,mBAAmB;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,GAAG,uCAAuC;IAC1C,GAAG,4CAA4C;CACvC,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,GAAG,CAAS;IACnE,gCAAgC,CAAC,mCAAmC;CACrE,CAAC,CAAC","sourcesContent":["/**\n * Shared environment contract for application worker processes.\n *\n * This surface is intentionally smaller than the backend contract:\n * workers are language-agnostic subprocesses, so they receive only the\n * bootstrap identity, worker identity, optional runtime topology hints,\n * and provider/config secrets that are safe to deliver via env.\n */\n\n/**\n * Bootstrap-identity env contract for application worker processes.\n *\n * The worker IDENTITY is carried by the canonical background-runtime pair\n * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` — the SAME vocabulary the\n * `BackgroundRuntimeType` model (`@wildo-ai/saas-models`) declares apps-manager\n * injects, that the k8s worker AND minion Deployment templates stamp, and that\n * the reference Rust worker reads at boot. The worker forwards\n * `APP_OWNED_SERVICE_NAME` as the `/apps-to-manager/workers/{name}/bootstrap`\n * path segment, which apps-manager keys on `appConfig.workers[name]` — so\n * `APP_OWNED_SERVICE_NAME` is exactly the `wildo.saas.config.ts > workers`\n * bucket key. `APP_OWNED_SERVICE_KIND` is `BackgroundRuntimeType.WORKER` and\n * disambiguates worker vs minion, so both background-runtime kinds share ONE\n * identity contract across every deploy path (k8s manifest, docker-compose, and\n * the generated `.env`).\n *\n * `SERVICE_NAME` is the SEPARATE process/observability identity\n * (`wildo.worker.config.ts > name`, else the bucket key) — it also feeds\n * `OTEL_SERVICE_NAME`. It is NOT the routing identity above; do not conflate\n * the two.\n */\nexport enum ApplicationWorkerBootstrapEnvKey {\n  APPLICATION_ID = 'APPLICATION_ID',\n  /** `BackgroundRuntimeType.WORKER` — pins this app-owned runtime kind (vs a minion). */\n  APP_OWNED_SERVICE_KIND = 'APP_OWNED_SERVICE_KIND',\n  /**\n   * The `wildo.saas.config.ts > workers` bucket key — forwarded to apps-manager\n   * as the worker-bootstrap path segment (`appConfig.workers[name]` lookup).\n   */\n  APP_OWNED_SERVICE_NAME = 'APP_OWNED_SERVICE_NAME',\n  /** Process/observability identity (`wildo.worker.config.ts > name`, else the bucket key); feeds `OTEL_SERVICE_NAME`. */\n  SERVICE_NAME = 'SERVICE_NAME',\n  PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n  PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n  PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n  APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationWorkerRuntimeEnvKey {\n  APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n}\n\n/**\n * The worker's inbound HTTP-surface descriptor, projected from the authored\n * `wildo.worker.config.ts > http` block (`WorkerHttpSchema` in\n * `@wildo-ai/platform-config-lib`) into the worker process environment by\n * `wildo config sync`.\n *\n * Unlike {@link ApplicationWorkerBootstrapEnvKey} (required identity — the\n * worker fails closed when any key is missing), these keys are DEFAULTED: a\n * worker booted without them falls back to its language-runtime's built-in\n * defaults (`8080` / `/healthz` / `/readyz`), exactly as the Rust reference\n * worker does with `std::env::var(...).unwrap_or_else(...)`. The generator\n * always emits them from the authored config so the running port and probe\n * paths track `wildo.worker.config.ts` rather than a per-language hardcoded\n * default that only coincides with the authored value by luck.\n *\n * `WORKER_METRICS_PATH` mirrors the optional `WorkerHttpSchema.metricsPath` —\n * emitted only when the author opts a worker into a Prometheus scrape surface.\n */\nexport enum ApplicationWorkerHttpSurfaceEnvKey {\n  WORKER_HTTP_PORT = 'WORKER_HTTP_PORT',\n  WORKER_HEALTH_PATH = 'WORKER_HEALTH_PATH',\n  WORKER_READY_PATH = 'WORKER_READY_PATH',\n  WORKER_METRICS_PATH = 'WORKER_METRICS_PATH',\n}\n\nexport const ApplicationWorkerBootstrapEnvKeys = ApplicationWorkerBootstrapEnvKey;\nexport const ApplicationWorkerRuntimeEnvKeys = ApplicationWorkerRuntimeEnvKey;\nexport const ApplicationWorkerHttpSurfaceEnvKeys = ApplicationWorkerHttpSurfaceEnvKey;\n\nexport const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST = [\n  ApplicationWorkerBootstrapEnvKey.APPLICATION_ID,\n  ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND,\n  ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME,\n  ApplicationWorkerBootstrapEnvKey.SERVICE_NAME,\n  ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n  ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n  ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n  ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST = [\n  ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n] as const;\n\nexport const APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST = [\n  ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT,\n  ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH,\n  ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH,\n  ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH,\n] as const;\n\nexport const APPLICATION_WORKER_ENV_KEY_LIST = [\n  ...APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST,\n  ...APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST,\n  ...APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST,\n] as const;\n\nexport const APPLICATION_WORKER_SENSITIVE_ENV_KEYS = new Set<string>([\n  ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n]);\n\nexport type ApplicationWorkerEnvKey =\n  typeof APPLICATION_WORKER_ENV_KEY_LIST[number];\n"]}

package/dist/esm/runtime/runtime-topology.contracts.d.ts

@@ -11,7 +11,7 @@ export interface RuntimeEndpointUrls {
 export declare enum PlatformApplicationType {
     PLATFORM_APPS_MANAGER = "platform_apps_manager",
     PLATFORM_CRONTABS_BATCHES_MANAGER = "platform_crontabs_batches_manager",
-    PLATFORM_FILE_GENERATOR = "platform_file_generator",
+    PLATFORM_MODULE_REGISTRY = "platform_module_registry",
     APP_LIFECYCLE_MANAGER = "app_lifecycle_manager",
     APP_CICD = "app_cicd",
     PLATFORM_CICD = "platform_cicd"
@@ -25,12 +25,19 @@ export declare enum PlatformApplicationType {
 export declare enum PlatformRuntimeEndpointKey {
     PLATFORM_APPS_MANAGER = "platform_apps_manager",
     PLATFORM_CRONTABS_BATCHES_MANAGER = "platform_crontabs_batches_manager",
-    PLATFORM_FILE_GENERATOR = "platform_file_generator"
+    PLATFORM_MODULE_REGISTRY = "platform_module_registry"
 }
 export interface PlatformRuntimeEndpointsInput {
     appsManager: RuntimeEndpointUrls;
     crontabsBatchesManager: RuntimeEndpointUrls;
-    fileGenerator: RuntimeEndpointUrls;
+    /**
+     * Module-registry endpoint (Phase 3 / KD-7). Optional during the
+     * Phase 3 rollout: existing platform deployments that haven't
+     * yet provisioned the registry pass `undefined` and the entry
+     * is omitted from the resulting record. New deployments + every
+     * Phase 4+ caller MUST set it.
+     */
+    moduleRegistry?: RuntimeEndpointUrls;
 }
 export declare function buildPlatformRuntimeEndpoints(input: PlatformRuntimeEndpointsInput): Record<string, RuntimeEndpointUrls>;
 export interface ApplicationRuntimeEndpointsInput {

package/dist/esm/runtime/runtime-topology.contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-topology.contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,qBAAqB,0BAA0B;IAC/C,iCAAiC,sCAAsC;IACvE,uBAAuB,4BAA4B;IACnD,qBAAqB,0BAA0B;IAC/C,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED;;;;;GAKG;AACH,oBAAY,0BAA0B;IACpC,qBAAqB,0BAAgD;IACrE,iCAAiC,sCAA4D;IAC7F,uBAAuB,4BAAkD;CAC1E;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,mBAAmB,CAAC;IACjC,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C,aAAa,EAAE,mBAAmB,CAAC;CACpC;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,6BAA6B,GACnC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAMrC;AAED,MAAM,WAAW,gCAAgC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACvE,OAAO,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1C,sBAAsB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACzD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1C;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,gCAAgC,GACtC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA2BrC;AAED,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,2BAA2B,CACzC,0BAA0B,EAAE,MAAM,GACjC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAsBrC"}
+{"version":3,"file":"runtime-topology.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,qBAAqB,0BAA0B;IAC/C,iCAAiC,sCAAsC;IACvE,wBAAwB,6BAA6B;IACrD,qBAAqB,0BAA0B;IAC/C,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED;;;;;GAKG;AACH,oBAAY,0BAA0B;IACpC,qBAAqB,0BAAgD;IACrE,iCAAiC,sCAA4D;IAC7F,wBAAwB,6BAAmD;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,mBAAmB,CAAC;IACjC,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,6BAA6B,GACnC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CASrC;AAED,MAAM,WAAW,gCAAgC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACvE,OAAO,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1C,sBAAsB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACzD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1C;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,gCAAgC,GACtC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA2BrC;AAED,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,2BAA2B,CACzC,0BAA0B,EAAE,MAAM,GACjC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAsBrC"}

package/dist/esm/runtime/runtime-topology.contracts.js

@@ -9,7 +9,7 @@ export var PlatformApplicationType;
 (function (PlatformApplicationType) {
     PlatformApplicationType["PLATFORM_APPS_MANAGER"] = "platform_apps_manager";
     PlatformApplicationType["PLATFORM_CRONTABS_BATCHES_MANAGER"] = "platform_crontabs_batches_manager";
-    PlatformApplicationType["PLATFORM_FILE_GENERATOR"] = "platform_file_generator";
+    PlatformApplicationType["PLATFORM_MODULE_REGISTRY"] = "platform_module_registry";
     PlatformApplicationType["APP_LIFECYCLE_MANAGER"] = "app_lifecycle_manager";
     PlatformApplicationType["APP_CICD"] = "app_cicd";
     PlatformApplicationType["PLATFORM_CICD"] = "platform_cicd";
@@ -24,14 +24,17 @@ export var PlatformRuntimeEndpointKey;
 (function (PlatformRuntimeEndpointKey) {
     PlatformRuntimeEndpointKey["PLATFORM_APPS_MANAGER"] = "platform_apps_manager";
     PlatformRuntimeEndpointKey["PLATFORM_CRONTABS_BATCHES_MANAGER"] = "platform_crontabs_batches_manager";
-    PlatformRuntimeEndpointKey["PLATFORM_FILE_GENERATOR"] = "platform_file_generator";
+    PlatformRuntimeEndpointKey["PLATFORM_MODULE_REGISTRY"] = "platform_module_registry";
 })(PlatformRuntimeEndpointKey || (PlatformRuntimeEndpointKey = {}));
 export function buildPlatformRuntimeEndpoints(input) {
-    return {
+    const out = {
         [PlatformRuntimeEndpointKey.PLATFORM_APPS_MANAGER]: input.appsManager,
         [PlatformRuntimeEndpointKey.PLATFORM_CRONTABS_BATCHES_MANAGER]: input.crontabsBatchesManager,
-        [PlatformRuntimeEndpointKey.PLATFORM_FILE_GENERATOR]: input.fileGenerator,
     };
+    if (input.moduleRegistry) {
+        out[PlatformRuntimeEndpointKey.PLATFORM_MODULE_REGISTRY] = input.moduleRegistry;
+    }
+    return out;
 }
 export function buildApplicationRuntimeEndpoints(input) {
     const endPoints = {
@@ -82,4 +85,4 @@ export function parseRuntimeEndpointsRecord(serializedRuntimeEndpoints) {
     }
     return record;
 }
-//# sourceMappingURL=runtime-topology.contracts.js.map
+//# sourceMappingURL=runtime-topology.contracts.js.map

package/dist/esm/runtime/runtime-topology.contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-topology.contracts.js","sourceRoot":"","sources":["../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAO/B;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,0EAA+C,CAAA;IAC/C,kGAAuE,CAAA;IACvE,8EAAmD,CAAA;IACnD,0EAA+C,CAAA;IAC/C,gDAAqB,CAAA;IACrB,0DAA+B,CAAA;AACjC,CAAC,EAPW,uBAAuB,KAAvB,uBAAuB,QAOlC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,6EAAqE,CAAA;IACrE,qGAA6F,CAAA;IAC7F,iFAAyE,CAAA;AAC3E,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAQD,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,OAAO;QACL,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,WAAW;QACrE,CAAC,0BAA0B,CAAC,iCAAiC,CAAC,EAAE,KAAK,CAAC,sBAAsB;QAC5F,CAAC,0BAA0B,CAAC,uBAAuB,CAAC,EAAE,KAAK,CAAC,aAAa;KAC1E,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,gCAAgC,CAC9C,KAAuC;IAEvC,MAAM,SAAS,GAAwC;QACrD,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC;KACtC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,sBAAsB,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACnD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,SAA8C;IAE9C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,0BAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAY,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAI,KAAiC,CAAC,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAI,KAAiC,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,4CAA4C,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"runtime-topology.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAO/B;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,0EAA+C,CAAA;IAC/C,kGAAuE,CAAA;IACvE,gFAAqD,CAAA;IACrD,0EAA+C,CAAA;IAC/C,gDAAqB,CAAA;IACrB,0DAA+B,CAAA;AACjC,CAAC,EAPW,uBAAuB,KAAvB,uBAAuB,QAOlC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,6EAAqE,CAAA;IACrE,qGAA6F,CAAA;IAC7F,mFAA2E,CAAA;AAC7E,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAeD,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,GAAG,GAAwC;QAC/C,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,WAAW;QACrE,CAAC,0BAA0B,CAAC,iCAAiC,CAAC,EAAE,KAAK,CAAC,sBAAsB;KAC7F,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,GAAG,CAAC,0BAA0B,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD,MAAM,UAAU,gCAAgC,CAC9C,KAAuC;IAEvC,MAAM,SAAS,GAAwC;QACrD,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC;KACtC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,sBAAsB,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACnD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,SAA8C;IAE9C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,0BAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAY,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAI,KAAiC,CAAC,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAI,KAAiC,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,4CAA4C,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  BackendApiType,\n  StaticFrontEndType,\n} from '@wildo-ai/saas-models';\n\nexport interface RuntimeEndpointUrls {\n  publicUrl: string;\n  internalUrl: string;\n}\n\n/**\n * Shared application/service identifiers for platform-owned runtimes.\n *\n * This enum must live in the shared contract layer because CLI/runtime topology\n * code needs these semantics without importing backend runtime packages.\n */\nexport enum PlatformApplicationType {\n  PLATFORM_APPS_MANAGER = 'platform_apps_manager',\n  PLATFORM_CRONTABS_BATCHES_MANAGER = 'platform_crontabs_batches_manager',\n  PLATFORM_MODULE_REGISTRY = 'platform_module_registry',\n  APP_LIFECYCLE_MANAGER = 'app_lifecycle_manager',\n  APP_CICD = 'app_cicd',\n  PLATFORM_CICD = 'platform_cicd',\n}\n\n/**\n * Shared runtime endpoint keys for platform services.\n *\n * These are the subset of `PlatformApplicationType` that expose runtime\n * endpoints directly.\n */\nexport enum PlatformRuntimeEndpointKey {\n  PLATFORM_APPS_MANAGER = PlatformApplicationType.PLATFORM_APPS_MANAGER,\n  PLATFORM_CRONTABS_BATCHES_MANAGER = PlatformApplicationType.PLATFORM_CRONTABS_BATCHES_MANAGER,\n  PLATFORM_MODULE_REGISTRY = PlatformApplicationType.PLATFORM_MODULE_REGISTRY,\n}\n\nexport interface PlatformRuntimeEndpointsInput {\n  appsManager: RuntimeEndpointUrls;\n  crontabsBatchesManager: RuntimeEndpointUrls;\n  /**\n   * Module-registry endpoint (Phase 3 / KD-7). Optional during the\n   * Phase 3 rollout: existing platform deployments that haven't\n   * yet provisioned the registry pass `undefined` and the entry\n   * is omitted from the resulting record. New deployments + every\n   * Phase 4+ caller MUST set it.\n   */\n  moduleRegistry?: RuntimeEndpointUrls;\n}\n\nexport function buildPlatformRuntimeEndpoints(\n  input: PlatformRuntimeEndpointsInput,\n): Record<string, RuntimeEndpointUrls> {\n  const out: Record<string, RuntimeEndpointUrls> = {\n    [PlatformRuntimeEndpointKey.PLATFORM_APPS_MANAGER]: input.appsManager,\n    [PlatformRuntimeEndpointKey.PLATFORM_CRONTABS_BATCHES_MANAGER]: input.crontabsBatchesManager,\n  };\n  if (input.moduleRegistry) {\n    out[PlatformRuntimeEndpointKey.PLATFORM_MODULE_REGISTRY] = input.moduleRegistry;\n  }\n  return out;\n}\n\nexport interface ApplicationRuntimeEndpointsInput {\n  frontendApplications?: Record<string, RuntimeEndpointUrls> | undefined;\n  website?: RuntimeEndpointUrls | undefined;\n  technicalDocumentation?: RuntimeEndpointUrls | undefined;\n  mainBackendApi?: RuntimeEndpointUrls | undefined;\n  healthCheckApi?: RuntimeEndpointUrls | undefined;\n  mainWebhookApi?: RuntimeEndpointUrls | undefined;\n  oauth2ProviderApi?: RuntimeEndpointUrls | undefined;\n  mcpApi?: RuntimeEndpointUrls | undefined;\n}\n\nexport function buildApplicationRuntimeEndpoints(\n  input: ApplicationRuntimeEndpointsInput,\n): Record<string, RuntimeEndpointUrls> {\n  const endPoints: Record<string, RuntimeEndpointUrls> = {\n    ...(input.frontendApplications ?? {}),\n  };\n  if (input.website) {\n    endPoints[StaticFrontEndType.WEBSITE] = input.website;\n  }\n  if (input.technicalDocumentation) {\n    endPoints[StaticFrontEndType.TECHNICAL_DOCUMENTATION] = input.technicalDocumentation;\n  }\n  if (input.mainBackendApi) {\n    endPoints[BackendApiType.MAIN_BACKEND_API] = input.mainBackendApi;\n  }\n  if (input.healthCheckApi) {\n    endPoints[BackendApiType.HEALTH_CHECK_API] = input.healthCheckApi;\n  }\n  if (input.mainWebhookApi) {\n    endPoints[BackendApiType.MAIN_WEBHOOK_API] = input.mainWebhookApi;\n  }\n  if (input.oauth2ProviderApi) {\n    endPoints[BackendApiType.OAUTH2_PROVIDER_API] = input.oauth2ProviderApi;\n  }\n  if (input.mcpApi) {\n    endPoints[BackendApiType.MCP_API] = input.mcpApi;\n  }\n\n  return endPoints;\n}\n\nexport function serializeRuntimeEndpointsRecord(\n  endPoints: Record<string, RuntimeEndpointUrls>,\n): string {\n  return JSON.stringify(endPoints);\n}\n\nexport function parseRuntimeEndpointsRecord(\n  serializedRuntimeEndpoints: string,\n): Record<string, RuntimeEndpointUrls> {\n  const parsed = JSON.parse(serializedRuntimeEndpoints) as unknown;\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('Runtime endpoints payload must be a JSON object');\n  }\n\n  const record: Record<string, RuntimeEndpointUrls> = {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!value || typeof value !== 'object' || Array.isArray(value)) {\n      throw new Error(`Runtime endpoint \"${key}\" must be an object`);\n    }\n\n    const publicUrl = (value as Record<string, unknown>).publicUrl;\n    const internalUrl = (value as Record<string, unknown>).internalUrl;\n    if (typeof publicUrl !== 'string' || typeof internalUrl !== 'string') {\n      throw new Error(`Runtime endpoint \"${key}\" must expose string publicUrl/internalUrl`);\n    }\n\n    record[key] = { publicUrl, internalUrl };\n  }\n\n  return record;\n}\n"]}

package/dist/esm/security/authorizations/roles.custom.shared.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.custom.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.custom.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAwB,MAAM,uBAAuB,CAAC;AAEjF,eAAO,MAAM,0BAA0B,EAAE,kBAExC,CAAC"}
+{"version":3,"file":"roles.custom.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.custom.shared.definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAwB,MAAM,uBAAuB,CAAC;AAEjF,eAAO,MAAM,0BAA0B,EAAE,kBAExC,CAAC"}

package/dist/esm/security/authorizations/roles.custom.shared.definitions.js

@@ -1,2 +1,2 @@
 export const CUSTOM_ROLES_CONFIGURATION = {};
-//# sourceMappingURL=roles.custom.shared.definitions.js.map
+//# sourceMappingURL=roles.custom.shared.definitions.js.map

package/dist/esm/security/authorizations/roles.custom.shared.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.custom.shared.definitions.js","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.custom.shared.definitions.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,0BAA0B,GAAuB,EAE7D,CAAC"}
+{"version":3,"file":"roles.custom.shared.definitions.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.custom.shared.definitions.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,0BAA0B,GAAuB,EAE7D,CAAC","sourcesContent":["import { RolesConfiguration, ResourcePrimaryScope } from \"@wildo-ai/saas-models\";\n\nexport const CUSTOM_ROLES_CONFIGURATION: RolesConfiguration = {\n  \n};\n\n"]}