@wildo-ai/platform-core-shared 1.0.1 → 1.1.1

package/dist/esm/wildo-applications-versions/wildo-applications-versions.custom.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-applications-versions.custom.shared.schemas.js","sourceRoot":"","sources":["../../../src/wildo-applications-versions/wildo-applications-versions.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EAAE,kBAAkB;IAC1F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC1E,CAAC,CAAC"}
+{"version":3,"file":"wildo-applications-versions.custom.shared.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-applications-versions/wildo-applications-versions.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACvG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,EAAE,kBAAkB;IAC1F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1F,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CAC1E,CAAC,CAAC","sourcesContent":["/**\n * Wildo Application Version Schema\n * \n * Represents a version/snapshot of a WildoApplication.\n * Each version is linked to a git commit and can be deployed to environments.\n * \n * ═══════════════════════════════════════════════════════════════════════════\n * RATIONALE: Why this type is defined in wildo-ai-application, not engine\n * ═══════════════════════════════════════════════════════════════════════════\n * \n * 1. Wildo_Application_Version_Schema\n *    - APP-FACTORY-SPECIFIC: Tracks versions of applications being built.\n *      Regular runtime apps don't version themselves in this way.\n *    - Fields like `gitBranch`, `gitCommitHash` link to the generated code\n *      repository - part of the code-generation pipeline.\n *    - The `wildoApplicationId` FK is specific to the app-factory paradigm.\n *    - Supports the publish/deploy workflow where users create versions\n *      of their application definitions.\n * \n * FRAMEWORK CANDIDATES: None. Version tracking of generated applications\n * is unique to the app-factory.\n * ═══════════════════════════════════════════════════════════════════════════\n */\n\nimport { z } from 'zod';\n\n// Initialize Zod decorators early (lazy init will also happen on first use)\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\ninitZodDecorators(z);\n\nexport const Wildo_Application_Version_Schema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  wildoApplicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  version: z.string().isDBIndexed().isSummaryField().excludeFromUpdate(), // Version lookups\n  gitBranch: z.string().isDBIndexed().isSummaryField(),\n  gitCommitHash: z.string().isDBIndexed().isSummaryField(),\n  createdAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type Wildo_Application_Version = z.infer<typeof Wildo_Application_Version_Schema>;\n"]}

package/dist/esm/workbench/workbench-resources-types.custom.shared.schemas.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The workbench's own resource vocabulary.
+ *
+ * A SEPARATE enum and factory map from `CustomShared_ResourceType`, deliberately. That map has six
+ * consumers, two of which must not receive these: `platform-apps-manager` (which would register
+ * resources it has no use for, and whose INIT lifecycle applies migrations) and the companion's i18n
+ * labelling planner, which enumerates `Object.keys(...)` and would generate labels for them.
+ *
+ * These resources are INTROSPECTION-backed: nothing is stored, nothing is migrated, and only the
+ * companion can serve them.
+ */
+export declare enum WorkbenchShared_ResourceType {
+    APPLICATION_MODULES = "workbenchApplicationModules",
+    /**
+     * Every relationship edge the application's resources declare — how its domain is wired.
+     *
+     * Projected from a DIFFERENT behavior (`resources-registry`) than the modules beside it, which is
+     * what makes it the surface that proves the adapter generalizes: one binding shape, two behaviors,
+     * two row shapes, no adapter change.
+     */
+    RESOURCE_RELATIONSHIPS = "workbenchResourceRelationships"
+}
+/**
+ * The field each resource is ADDRESSED BY — and it must be a field the rows actually carry.
+ *
+ * `workbenchApplicationModules` is identified by `moduleId`, not by a composed
+ * `workbenchApplicationModuleId`. The convention-shaped name was declared here first and no row ever
+ * carried it: the schema marks `moduleId` as the primary key, the behavior emits `moduleId`, and
+ * `identityFields: ['moduleId']` composes the id from it. Nothing anywhere produced the other name,
+ * so every consumer that addresses a row THROUGH this map looked for a field that did not exist.
+ *
+ * READ still worked, which is what kept it hidden: the adapter filters by `identityFields`, so
+ * `GET …/workbench-application-modules/engine` answered 200 while the frontend list refused every
+ * row click with "could not resolve resource id from list item" — the id it was told to read was
+ * absent from the item.
+ *
+ * Its sibling is the contrast that settles the rule rather than an inconsistency: an edge has no
+ * natural key, so `workbenchResourceRelationshipId` is SYNTHESIZED from three fields and is a real
+ * declared field of the schema, present on every row. Both entries now name something real; one
+ * happens to be the source's own key and the other is composed.
+ */
+export declare const WorkbenchShared_ResourceFieldIdentifier: {
+    [key in WorkbenchShared_ResourceType]: string;
+};
+/**
+ * The frontend-service name the application-creation workbench identifies itself by.
+ *
+ * Shared because BOTH sides must agree and neither owns it alone: the workbench sends it as
+ * `VITE_FRONTEND_SERVICE_NAME` on every `/application-config` and `/i18n/labels` request, and the
+ * companion seeds an entry under exactly this key so the engine's `ApplicationConfigController` can
+ * answer instead of refusing with `app_configuration_unknown_frontend_service`.
+ *
+ * Two string literals in two packages would compile perfectly and fail at runtime with an error that
+ * names neither of them.
+ */
+export declare const WORKBENCH_FRONTEND_SERVICE_NAME = "application-creation-workbench";
+//# sourceMappingURL=workbench-resources-types.custom.shared.schemas.d.ts.map

package/dist/esm/workbench/workbench-resources-types.custom.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbench-resources-types.custom.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/workbench/workbench-resources-types.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,oBAAY,4BAA4B;IACtC,mBAAmB,gCAAgC;IACnD;;;;;;OAMG;IACH,sBAAsB,mCAAmC;CAC1D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uCAAuC,EAAE;KAAG,GAAG,IAAI,4BAA4B,GAAG,MAAM;CAGpG,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,mCAAmC,CAAC"}

package/dist/esm/workbench/workbench-resources-types.custom.shared.schemas.js

@@ -0,0 +1,59 @@
+/**
+ * The workbench's own resource vocabulary.
+ *
+ * A SEPARATE enum and factory map from `CustomShared_ResourceType`, deliberately. That map has six
+ * consumers, two of which must not receive these: `platform-apps-manager` (which would register
+ * resources it has no use for, and whose INIT lifecycle applies migrations) and the companion's i18n
+ * labelling planner, which enumerates `Object.keys(...)` and would generate labels for them.
+ *
+ * These resources are INTROSPECTION-backed: nothing is stored, nothing is migrated, and only the
+ * companion can serve them.
+ */
+export var WorkbenchShared_ResourceType;
+(function (WorkbenchShared_ResourceType) {
+    WorkbenchShared_ResourceType["APPLICATION_MODULES"] = "workbenchApplicationModules";
+    /**
+     * Every relationship edge the application's resources declare — how its domain is wired.
+     *
+     * Projected from a DIFFERENT behavior (`resources-registry`) than the modules beside it, which is
+     * what makes it the surface that proves the adapter generalizes: one binding shape, two behaviors,
+     * two row shapes, no adapter change.
+     */
+    WorkbenchShared_ResourceType["RESOURCE_RELATIONSHIPS"] = "workbenchResourceRelationships";
+})(WorkbenchShared_ResourceType || (WorkbenchShared_ResourceType = {}));
+/**
+ * The field each resource is ADDRESSED BY — and it must be a field the rows actually carry.
+ *
+ * `workbenchApplicationModules` is identified by `moduleId`, not by a composed
+ * `workbenchApplicationModuleId`. The convention-shaped name was declared here first and no row ever
+ * carried it: the schema marks `moduleId` as the primary key, the behavior emits `moduleId`, and
+ * `identityFields: ['moduleId']` composes the id from it. Nothing anywhere produced the other name,
+ * so every consumer that addresses a row THROUGH this map looked for a field that did not exist.
+ *
+ * READ still worked, which is what kept it hidden: the adapter filters by `identityFields`, so
+ * `GET …/workbench-application-modules/engine` answered 200 while the frontend list refused every
+ * row click with "could not resolve resource id from list item" — the id it was told to read was
+ * absent from the item.
+ *
+ * Its sibling is the contrast that settles the rule rather than an inconsistency: an edge has no
+ * natural key, so `workbenchResourceRelationshipId` is SYNTHESIZED from three fields and is a real
+ * declared field of the schema, present on every row. Both entries now name something real; one
+ * happens to be the source's own key and the other is composed.
+ */
+export const WorkbenchShared_ResourceFieldIdentifier = {
+    [WorkbenchShared_ResourceType.APPLICATION_MODULES]: 'moduleId',
+    [WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS]: 'workbenchResourceRelationshipId',
+};
+/**
+ * The frontend-service name the application-creation workbench identifies itself by.
+ *
+ * Shared because BOTH sides must agree and neither owns it alone: the workbench sends it as
+ * `VITE_FRONTEND_SERVICE_NAME` on every `/application-config` and `/i18n/labels` request, and the
+ * companion seeds an entry under exactly this key so the engine's `ApplicationConfigController` can
+ * answer instead of refusing with `app_configuration_unknown_frontend_service`.
+ *
+ * Two string literals in two packages would compile perfectly and fail at runtime with an error that
+ * names neither of them.
+ */
+export const WORKBENCH_FRONTEND_SERVICE_NAME = 'application-creation-workbench';
+//# sourceMappingURL=workbench-resources-types.custom.shared.schemas.js.map

package/dist/esm/workbench/workbench-resources-types.custom.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbench-resources-types.custom.shared.schemas.js","sourceRoot":"","sources":["../../../../src/workbench/workbench-resources-types.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,4BAUX;AAVD,WAAY,4BAA4B;IACtC,mFAAmD,CAAA;IACnD;;;;;;OAMG;IACH,yFAAyD,CAAA;AAC3D,CAAC,EAVW,4BAA4B,KAA5B,4BAA4B,QAUvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAsD;IACxG,CAAC,4BAA4B,CAAC,mBAAmB,CAAC,EAAE,UAAU;IAC9D,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,EAAE,iCAAiC;CACzF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,gCAAgC,CAAC","sourcesContent":["/**\n * The workbench's own resource vocabulary.\n *\n * A SEPARATE enum and factory map from `CustomShared_ResourceType`, deliberately. That map has six\n * consumers, two of which must not receive these: `platform-apps-manager` (which would register\n * resources it has no use for, and whose INIT lifecycle applies migrations) and the companion's i18n\n * labelling planner, which enumerates `Object.keys(...)` and would generate labels for them.\n *\n * These resources are INTROSPECTION-backed: nothing is stored, nothing is migrated, and only the\n * companion can serve them.\n */\nexport enum WorkbenchShared_ResourceType {\n  APPLICATION_MODULES = 'workbenchApplicationModules',\n  /**\n   * Every relationship edge the application's resources declare — how its domain is wired.\n   *\n   * Projected from a DIFFERENT behavior (`resources-registry`) than the modules beside it, which is\n   * what makes it the surface that proves the adapter generalizes: one binding shape, two behaviors,\n   * two row shapes, no adapter change.\n   */\n  RESOURCE_RELATIONSHIPS = 'workbenchResourceRelationships',\n}\n\n/**\n * The field each resource is ADDRESSED BY — and it must be a field the rows actually carry.\n *\n * `workbenchApplicationModules` is identified by `moduleId`, not by a composed\n * `workbenchApplicationModuleId`. The convention-shaped name was declared here first and no row ever\n * carried it: the schema marks `moduleId` as the primary key, the behavior emits `moduleId`, and\n * `identityFields: ['moduleId']` composes the id from it. Nothing anywhere produced the other name,\n * so every consumer that addresses a row THROUGH this map looked for a field that did not exist.\n *\n * READ still worked, which is what kept it hidden: the adapter filters by `identityFields`, so\n * `GET …/workbench-application-modules/engine` answered 200 while the frontend list refused every\n * row click with \"could not resolve resource id from list item\" — the id it was told to read was\n * absent from the item.\n *\n * Its sibling is the contrast that settles the rule rather than an inconsistency: an edge has no\n * natural key, so `workbenchResourceRelationshipId` is SYNTHESIZED from three fields and is a real\n * declared field of the schema, present on every row. Both entries now name something real; one\n * happens to be the source's own key and the other is composed.\n */\nexport const WorkbenchShared_ResourceFieldIdentifier: { [key in WorkbenchShared_ResourceType]: string } = {\n  [WorkbenchShared_ResourceType.APPLICATION_MODULES]: 'moduleId',\n  [WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS]: 'workbenchResourceRelationshipId',\n};\n\n/**\n * The frontend-service name the application-creation workbench identifies itself by.\n *\n * Shared because BOTH sides must agree and neither owns it alone: the workbench sends it as\n * `VITE_FRONTEND_SERVICE_NAME` on every `/application-config` and `/i18n/labels` request, and the\n * companion seeds an entry under exactly this key so the engine's `ApplicationConfigController` can\n * answer instead of refusing with `app_configuration_unknown_frontend_service`.\n *\n * Two string literals in two packages would compile perfectly and fail at runtime with an error that\n * names neither of them.\n */\nexport const WORKBENCH_FRONTEND_SERVICE_NAME = 'application-creation-workbench';\n"]}

package/dist/esm/workbench/workbench-resources.custom.shared.resources-config.schemas.d.ts

@@ -0,0 +1,79 @@
+import { CoreResourceOperation, ResourceRelationship } from '@wildo-ai/saas-models';
+type WorkbenchApplicationModule_CoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST;
+/**
+ * The application's shared modules and the resources each owns.
+ *
+ * Rows are DERIVED per read from the companion's `resource-specifications` behavior; nothing is
+ * stored. `rowsPath` names where that behavior keeps them, because behaviors answer their own
+ * natural shape rather than a uniform envelope.
+ */
+export declare const workbenchApplicationModules_ResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("@wildo-ai/saas-models").ResourceConfiguration<any, WorkbenchApplicationModule_CoreOperations, import("zod").ZodObject<{
+    moduleId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    resourceTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodArray<import("zod").ZodString>>;
+    kind: import("zod").ZodNullable<import("zod").ZodString>;
+    contributions: import("zod").ZodArray<import("zod").ZodObject<{
+        contribution: import("zod").ZodString;
+        count: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>>;
+/**
+ * APPLICATION-scoped, anchored by a STANDALONE relationship.
+ *
+ * The form the resource factory's own migration note prescribes: STANDALONE "keeps the rel inert for
+ * URL routing while declaring the structural ownership anchor", so the resource is reachable at a
+ * flat path rather than nested under `/applications/:id/`.
+ *
+ * APPLICATION rather than ORGANIZATIONS on purpose: these rows describe the application's own
+ * structure, so the application IS their scope. There is no tenant dimension to anchor on — the
+ * binding's `APPLICATION_STRUCTURE` stance above says the same thing from the data's side.
+ *
+ * This originally read as a consequence of API-key scoping, because the workbench browser was
+ * expected to authenticate with an application-scope key. `APP_PUBLIC` removed that requirement
+ * entirely (see the role note above), so the scope now rests on its own merits rather than on a
+ * credential's constraint. The tenant-scoping trade remains recorded in issue #118.
+ */
+export declare const workbenchShared_ResourcesRelationships: ResourceRelationship[];
+type WorkbenchResourceRelationship_CoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST;
+export declare const workbenchResourceRelationships_ResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("@wildo-ai/saas-models").ResourceConfiguration<any, WorkbenchResourceRelationship_CoreOperations, import("zod").ZodObject<{
+    workbenchResourceRelationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    resourceType1: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+    resourceType2: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+    cardinality1: import("zod").ZodString;
+    cardinality2: import("zod").ZodString;
+    nature: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+    foreignKeyField: import("zod").ZodString;
+    accessScopeStrategy: import("zod").ZodString;
+    parentResourceRequirement: import("zod").ZodString;
+    isPrimaryScope: import("zod").ZodBoolean;
+    allowCycle: import("zod").ZodBoolean;
+    isDisabled: import("zod").ZodBoolean;
+    primaryScope: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>>;
+export declare const workbenchShared_ResourcesConfigurationsFactoryMap: {
+    workbenchApplicationModules: (resourcesRelationships: ResourceRelationship[]) => import("@wildo-ai/saas-models").ResourceConfiguration<any, WorkbenchApplicationModule_CoreOperations, import("zod").ZodObject<{
+        moduleId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+        resourceTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodArray<import("zod").ZodString>>;
+        kind: import("zod").ZodNullable<import("zod").ZodString>;
+        contributions: import("zod").ZodArray<import("zod").ZodObject<{
+            contribution: import("zod").ZodString;
+            count: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>>;
+    }, import("zod/v4/core").$strip>>;
+    workbenchResourceRelationships: (resourcesRelationships: ResourceRelationship[]) => import("@wildo-ai/saas-models").ResourceConfiguration<any, WorkbenchResourceRelationship_CoreOperations, import("zod").ZodObject<{
+        workbenchResourceRelationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+        resourceType1: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+        resourceType2: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+        cardinality1: import("zod").ZodString;
+        cardinality2: import("zod").ZodString;
+        nature: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
+        foreignKeyField: import("zod").ZodString;
+        accessScopeStrategy: import("zod").ZodString;
+        parentResourceRequirement: import("zod").ZodString;
+        isPrimaryScope: import("zod").ZodBoolean;
+        allowCycle: import("zod").ZodBoolean;
+        isDisabled: import("zod").ZodBoolean;
+        primaryScope: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+};
+export {};
+//# sourceMappingURL=workbench-resources.custom.shared.resources-config.schemas.d.ts.map

package/dist/esm/workbench/workbench-resources.custom.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbench-resources.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/workbench/workbench-resources.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qBAAqB,EAMrB,oBAAoB,EAMrB,MAAM,uBAAuB,CAAC;AAa/B,KAAK,yCAAyC,GAC1C,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,CAAC;AA6D/B;;;;;;GAMG;AACH,eAAO,MAAM,uEAAuE,GACjF,wBAAwB,oBAAoB,EAAE;;;;;;;;iCA6C7C,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sCAAsC,EAAE,oBAAoB,EA+BxE,CAAC;AAmBF,KAAK,4CAA4C,GAC7C,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,CAAC;AAE/B,eAAO,MAAM,0EAA0E,GACpF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;iCAmC7C,CAAC;AAEL,eAAO,MAAM,iDAAiD;0DA3JnC,oBAAoB,EAAE;;;;;;;;;6DAsHtB,oBAAoB,EAAE;;;;;;;;;;;;;;;CA0ChD,CAAC"}

package/dist/esm/workbench/workbench-resources.custom.shared.resources-config.schemas.js

@@ -0,0 +1,198 @@
+import { CORE_APP_ROLES, CoreResourceOperation, CoreResourceType, IntrospectionTenancyStance, PersistenceAdapter, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationshipAccessScopeStrategy, ResourceRelationshipCardinality, RelationshipNature, createResourceConfiguration_Initialization, createResourcesRelationship, } from '@wildo-ai/saas-models';
+import { WorkbenchShared_ResourceFieldIdentifier, WorkbenchShared_ResourceType, } from './workbench-resources-types.custom.shared.schemas.js';
+import { Workbench_ApplicationModule_Schema, Workbench_ResourceRelationship_Schema, } from './workbench-resources.custom.shared.schemas.js';
+const WorkbenchApplicationModule_Operations = undefined;
+/**
+ * Read-only over HTTP, and PUBLIC.
+ *
+ * `APP_PUBLIC` means what its enum comment says — accessible to everyone, no credential — and as of
+ * 2026-08-30 the runtime implements it: the authentication chain now admits an operation declaring
+ * this role instead of demanding a credential it never required. Before that it was declared,
+ * published as public by the OpenAPI generator, and refused at runtime.
+ *
+ * ## Why these rows are genuinely public
+ *
+ * They are a projection of the application's OWN SOURCE — module ids and the resource types each
+ * registers — carrying no tenant dimension, which is exactly what the binding's
+ * `APPLICATION_STRUCTURE` tenancy stance declares. There is no subject whose data could leak,
+ * because no subject's data is here.
+ *
+ * This is the same category as a public price list, a frontend application configuration or an i18n
+ * bundle: things every caller may read, which until now could only be served by escaping the
+ * resource system into a manual controller.
+ *
+ * ## What still confines them
+ *
+ * The companion asserts a loopback bind at startup and fails closed otherwise, so this surface is
+ * reachable only from the developer's own machine. `APP_PUBLIC` is the right declaration on its
+ * merits; the loopback bind is what makes the whole workbench local, and both remain true
+ * independently.
+ *
+ * If an introspected resource is ever added that projects something OTHER than the application's own
+ * structure, this role is wrong for it — the stance and the role must move together.
+ */
+function createReadOnlyApiVariant() {
+    return {
+        variantType: ResourceOperationVariantType.API_CALL,
+        isDefault: true,
+        /*
+         * BOTH roles, because `APP_PUBLIC` alone does not mean "everyone" at runtime.
+         *
+         * The authorizer admits a public operation only when the caller is ALSO a public execution —
+         * `executionContext.isPublicExecution() && operationDeclaresPublicAccess(operation)`, and its
+         * comment states the reasoning: a public context has no principal, so there are no roles to
+         * examine. An AUTHENTICATED caller therefore falls past that carve-out to the ordinary role
+         * gate, where `APP_PUBLIC` is not among anyone's granted roles, and is refused.
+         *
+         * Measured on this exact resource, 2026-08-31: with no credential `GET
+         * /api/v1/workbench-application-modules` answers 200 with the eight modules; with a valid
+         * administrator bearer it answers 403 `authorizations_access_denied`. The workbench's own
+         * sidebar could not read the rows it exists to show, because its operator had logged in.
+         *
+         * `APP_USER` is the role every authenticated user carries, so declaring it beside `APP_PUBLIC`
+         * says what these rows have always meant — readable by anyone — for both kinds of caller. It
+         * widens nothing beyond the public declaration already made.
+         *
+         * Whether presenting a credential SHOULD be able to reduce access below what presenting none
+         * grants is an engine question — issue #153 — and this declaration is correct either way.
+         */
+        roles: [CORE_APP_ROLES.APP_PUBLIC, CORE_APP_ROLES.APP_USER],
+        riskLevel: ResourceOperationRiskLevel.LOW,
+    };
+}
+/**
+ * The application's shared modules and the resources each owns.
+ *
+ * Rows are DERIVED per read from the companion's `resource-specifications` behavior; nothing is
+ * stored. `rowsPath` names where that behavior keeps them, because behaviors answer their own
+ * natural shape rather than a uniform envelope.
+ */
+export const workbenchApplicationModules_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: Workbench_ApplicationModule_Schema,
+    resourceIdentifier: WorkbenchShared_ResourceType.APPLICATION_MODULES,
+    resourceFieldIdentifier: WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.APPLICATION_MODULES],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: false,
+    persistenceAdapter: PersistenceAdapter.INTROSPECTION,
+    introspectionBinding: {
+        behavior: 'resource-specifications',
+        rowsPath: 'moduleOwnership',
+        /*
+         * A single-field key, and it is NOT redundant.
+         *
+         * The behavior's rows carry `moduleId`, but every lookup addresses a row by the resource's
+         * `resourceFieldIdentifier` — `workbenchApplicationModuleId` — so a row that never carries
+         * that field can be listed and never found. Measured: `GET …/workbench-application-modules`
+         * answered 200 with 8 rows while `…/engine` answered 404, because the filter looked for a
+         * field the row did not have.
+         *
+         * Composing from `moduleId` copies the behavior's own key onto the field the framework
+         * addresses by, which keeps ONE identity rather than two names for it.
+         */
+        identityFields: ['moduleId'],
+        /*
+         * A module id and the resource types it registers describe the APPLICATION'S OWN STRUCTURE.
+         * There is no tenant dimension for a scope predicate to filter on — every caller who may read
+         * this resource at all sees the same rows, because they are a projection of the application's
+         * source rather than of anyone's data.
+         *
+         * Declared rather than left implicit: an unstated stance is indistinguishable from an
+         * overlooked one, which is the whole reason the field is required.
+         */
+        tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,
+    },
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],
+    customOperation: WorkbenchApplicationModule_Operations,
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },
+        [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },
+    },
+});
+/**
+ * APPLICATION-scoped, anchored by a STANDALONE relationship.
+ *
+ * The form the resource factory's own migration note prescribes: STANDALONE "keeps the rel inert for
+ * URL routing while declaring the structural ownership anchor", so the resource is reachable at a
+ * flat path rather than nested under `/applications/:id/`.
+ *
+ * APPLICATION rather than ORGANIZATIONS on purpose: these rows describe the application's own
+ * structure, so the application IS their scope. There is no tenant dimension to anchor on — the
+ * binding's `APPLICATION_STRUCTURE` stance above says the same thing from the data's side.
+ *
+ * This originally read as a consequence of API-key scoping, because the workbench browser was
+ * expected to authenticate with an application-scope key. `APP_PUBLIC` removed that requirement
+ * entirely (see the role note above), so the scope now rests on its own merits rather than on a
+ * credential's constraint. The tenant-scoping trade remains recorded in issue #118.
+ */
+export const workbenchShared_ResourcesRelationships = [
+    createResourcesRelationship(CoreResourceType.APPLICATION, WorkbenchShared_ResourceType.APPLICATION_MODULES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        nature: RelationshipNature.COMPOSITION,
+        isPrimaryScope: true,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        contextPolicy: {},
+    }),
+    /*
+     * The same STANDALONE anchor for the relationships resource. Every INTROSPECTION resource needs
+     * one: `resourcePrimaryScope` is DERIVED from a relationship flagged `isPrimaryScope`, so a
+     * resource without one has no scope at all — and STANDALONE keeps it off the URL, which is what
+     * gives both resources a flat route instead of `/applications/:id/...`.
+     */
+    createResourcesRelationship(CoreResourceType.APPLICATION, WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+        nature: RelationshipNature.COMPOSITION,
+        isPrimaryScope: true,
+        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
+        contextPolicy: {},
+    }),
+];
+/**
+ * Every relationship edge the observed application declares.
+ *
+ * ## Why this resource exists as the SECOND surface
+ *
+ * It projects a DIFFERENT behavior (`resources-registry`) from the modules beside it
+ * (`resource-specifications`), with a different row shape and no natural primary key. That is the
+ * point: it proves the introspection adapter generalizes across the companion's 23 behaviors rather
+ * than fitting the one it was built against — and the missing key is what surfaced
+ * `identityFields` as a real seam instead of a guess.
+ *
+ * Same tenancy stance and same PUBLIC role as its sibling, for the same reason: an edge between two
+ * resource types is a fact about the application's SOURCE, with no tenant dimension and no subject
+ * whose data could leak.
+ */
+const WorkbenchResourceRelationship_Operations = undefined;
+export const workbenchResourceRelationships_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: Workbench_ResourceRelationship_Schema,
+    resourceIdentifier: WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS,
+    resourceFieldIdentifier: WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: false,
+    persistenceAdapter: PersistenceAdapter.INTROSPECTION,
+    introspectionBinding: {
+        behavior: 'resources-registry',
+        rowsPath: 'resourceRelationships',
+        tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,
+        /*
+         * The two endpoints plus the joining field.
+         *
+         * The pair ALONE is unique across all 16 edges in the dogfood application — measured, not
+         * assumed — and is still not safe: the framework permits several edges between the same two
+         * resources (a junction carrying two roles, a self-relationship). `foreignKeyField` is what
+         * distinguishes those, so it earns its place in the key rather than padding it.
+         *
+         * If these three ever collide the source REFUSES the whole derivation and names both rows,
+         * because the alternative is a row that LIST shows and READ can never reach.
+         */
+        identityFields: ['resourceType1', 'resourceType2', 'foreignKeyField'],
+    },
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],
+    customOperation: WorkbenchResourceRelationship_Operations,
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },
+        [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },
+    },
+});
+export const workbenchShared_ResourcesConfigurationsFactoryMap = {
+    [WorkbenchShared_ResourceType.APPLICATION_MODULES]: workbenchApplicationModules_ResourceConfiguration_InitializationFactory,
+    [WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS]: workbenchResourceRelationships_ResourceConfiguration_InitializationFactory,
+};
+//# sourceMappingURL=workbench-resources.custom.shared.resources-config.schemas.js.map

package/dist/esm/workbench/workbench-resources.custom.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbench-resources.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/workbench/workbench-resources.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAE5B,uCAAuC,EACvC,+BAA+B,EAC/B,kBAAkB,EAClB,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,kCAAkC,EAClC,qCAAqC,GACtC,MAAM,6CAA6C,CAAC;AAErD,MAAM,qCAAqC,GAAG,SAAS,CAAC;AAMxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,wBAAwB;IAC/B,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,QAAiB;QAC3D,SAAS,EAAE,IAAa;QACxB;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC;QAC3D,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uEAAuE,GAClF,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,kCAAkC;IAC9C,kBAAkB,EAAE,4BAA4B,CAAC,mBAAmB;IACpE,uBAAuB,EACrB,uCAAuC,CAAC,4BAA4B,CAAC,mBAAmB,CAAC;IAC3F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,kBAAkB,CAAC,aAAa;IACpD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,yBAAyB;QACnC,QAAQ,EAAE,iBAAiB;QAC3B;;;;;;;;;;;WAWG;QACH,cAAc,EAAE,CAAC,UAAU,CAAC;QAC5B;;;;;;;;WAQG;QACH,OAAO,EAAE,0BAA0B,CAAC,qBAAqB;KAC1D;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;IACxE,eAAe,EAAE,qCAAqC;IACtD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;KACzE;CACF,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAA2B;IAC5E,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAC5B,4BAA4B,CAAC,mBAAmB,EAChD,+BAA+B,CAAC,GAAG,EACnC,+BAA+B,CAAC,IAAI,EACpC;QACE,MAAM,EAAE,kBAAkB,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,aAAa,EAAE,EAAE;KAClB,CACF;IACD;;;;;OAKG;IACH,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAC5B,4BAA4B,CAAC,sBAAsB,EACnD,+BAA+B,CAAC,GAAG,EACnC,+BAA+B,CAAC,IAAI,EACpC;QACE,MAAM,EAAE,kBAAkB,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,aAAa,EAAE,EAAE;KAClB,CACF;CACF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,wCAAwC,GAAG,SAAS,CAAC;AAM3D,MAAM,CAAC,MAAM,0EAA0E,GACrF,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,qCAAqC;IACjD,kBAAkB,EAAE,4BAA4B,CAAC,sBAAsB;IACvE,uBAAuB,EACrB,uCAAuC,CAAC,4BAA4B,CAAC,sBAAsB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,kBAAkB,CAAC,aAAa;IACpD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,0BAA0B,CAAC,qBAAqB;QACzD;;;;;;;;;;WAUG;QACH,cAAc,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC;KACtE;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;IACxE,eAAe,EAAE,wCAAwC;IACzD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;KACzE;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iDAAiD,GAAG;IAC/D,CAAC,4BAA4B,CAAC,mBAAmB,CAAC,EAChD,uEAAuE;IACzE,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,EACnD,0EAA0E;CAC7E,CAAC","sourcesContent":["import {\n  CORE_APP_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  IntrospectionTenancyStance,\n  PersistenceAdapter,\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceRelationship,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  RelationshipNature,\n  createResourceConfiguration_Initialization,\n  createResourcesRelationship,\n} from '@wildo-ai/saas-models';\n\nimport {\n  WorkbenchShared_ResourceFieldIdentifier,\n  WorkbenchShared_ResourceType,\n} from './workbench-resources-types.custom.shared.schemas';\nimport {\n  Workbench_ApplicationModule_Schema,\n  Workbench_ResourceRelationship_Schema,\n} from './workbench-resources.custom.shared.schemas';\n\nconst WorkbenchApplicationModule_Operations = undefined;\n\ntype WorkbenchApplicationModule_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST;\n\n/**\n * Read-only over HTTP, and PUBLIC.\n *\n * `APP_PUBLIC` means what its enum comment says — accessible to everyone, no credential — and as of\n * 2026-08-30 the runtime implements it: the authentication chain now admits an operation declaring\n * this role instead of demanding a credential it never required. Before that it was declared,\n * published as public by the OpenAPI generator, and refused at runtime.\n *\n * ## Why these rows are genuinely public\n *\n * They are a projection of the application's OWN SOURCE — module ids and the resource types each\n * registers — carrying no tenant dimension, which is exactly what the binding's\n * `APPLICATION_STRUCTURE` tenancy stance declares. There is no subject whose data could leak,\n * because no subject's data is here.\n *\n * This is the same category as a public price list, a frontend application configuration or an i18n\n * bundle: things every caller may read, which until now could only be served by escaping the\n * resource system into a manual controller.\n *\n * ## What still confines them\n *\n * The companion asserts a loopback bind at startup and fails closed otherwise, so this surface is\n * reachable only from the developer's own machine. `APP_PUBLIC` is the right declaration on its\n * merits; the loopback bind is what makes the whole workbench local, and both remain true\n * independently.\n *\n * If an introspected resource is ever added that projects something OTHER than the application's own\n * structure, this role is wrong for it — the stance and the role must move together.\n */\nfunction createReadOnlyApiVariant() {\n  return {\n    variantType: ResourceOperationVariantType.API_CALL as const,\n    isDefault: true as const,\n    /*\n     * BOTH roles, because `APP_PUBLIC` alone does not mean \"everyone\" at runtime.\n     *\n     * The authorizer admits a public operation only when the caller is ALSO a public execution —\n     * `executionContext.isPublicExecution() && operationDeclaresPublicAccess(operation)`, and its\n     * comment states the reasoning: a public context has no principal, so there are no roles to\n     * examine. An AUTHENTICATED caller therefore falls past that carve-out to the ordinary role\n     * gate, where `APP_PUBLIC` is not among anyone's granted roles, and is refused.\n     *\n     * Measured on this exact resource, 2026-08-31: with no credential `GET\n     * /api/v1/workbench-application-modules` answers 200 with the eight modules; with a valid\n     * administrator bearer it answers 403 `authorizations_access_denied`. The workbench's own\n     * sidebar could not read the rows it exists to show, because its operator had logged in.\n     *\n     * `APP_USER` is the role every authenticated user carries, so declaring it beside `APP_PUBLIC`\n     * says what these rows have always meant — readable by anyone — for both kinds of caller. It\n     * widens nothing beyond the public declaration already made.\n     *\n     * Whether presenting a credential SHOULD be able to reduce access below what presenting none\n     * grants is an engine question — issue #153 — and this declaration is correct either way.\n     */\n    roles: [CORE_APP_ROLES.APP_PUBLIC, CORE_APP_ROLES.APP_USER],\n    riskLevel: ResourceOperationRiskLevel.LOW as const,\n  };\n}\n\n/**\n * The application's shared modules and the resources each owns.\n *\n * Rows are DERIVED per read from the companion's `resource-specifications` behavior; nothing is\n * stored. `rowsPath` names where that behavior keeps them, because behaviors answer their own\n * natural shape rather than a uniform envelope.\n */\nexport const workbenchApplicationModules_ResourceConfiguration_InitializationFactory =\n  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n    typeof WorkbenchApplicationModule_Operations,\n    WorkbenchApplicationModule_CoreOperations,\n    typeof Workbench_ApplicationModule_Schema\n  >({\n    mainSchema: Workbench_ApplicationModule_Schema,\n    resourceIdentifier: WorkbenchShared_ResourceType.APPLICATION_MODULES,\n    resourceFieldIdentifier:\n      WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.APPLICATION_MODULES],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: false,\n    persistenceAdapter: PersistenceAdapter.INTROSPECTION,\n    introspectionBinding: {\n      behavior: 'resource-specifications',\n      rowsPath: 'moduleOwnership',\n      /*\n       * A single-field key, and it is NOT redundant.\n       *\n       * The behavior's rows carry `moduleId`, but every lookup addresses a row by the resource's\n       * `resourceFieldIdentifier` — `workbenchApplicationModuleId` — so a row that never carries\n       * that field can be listed and never found. Measured: `GET …/workbench-application-modules`\n       * answered 200 with 8 rows while `…/engine` answered 404, because the filter looked for a\n       * field the row did not have.\n       *\n       * Composing from `moduleId` copies the behavior's own key onto the field the framework\n       * addresses by, which keeps ONE identity rather than two names for it.\n       */\n      identityFields: ['moduleId'],\n      /*\n       * A module id and the resource types it registers describe the APPLICATION'S OWN STRUCTURE.\n       * There is no tenant dimension for a scope predicate to filter on — every caller who may read\n       * this resource at all sees the same rows, because they are a projection of the application's\n       * source rather than of anyone's data.\n       *\n       * Declared rather than left implicit: an unstated stance is indistinguishable from an\n       * overlooked one, which is the whole reason the field is required.\n       */\n      tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],\n    customOperation: WorkbenchApplicationModule_Operations,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },\n      [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },\n    },\n  });\n\n/**\n * APPLICATION-scoped, anchored by a STANDALONE relationship.\n *\n * The form the resource factory's own migration note prescribes: STANDALONE \"keeps the rel inert for\n * URL routing while declaring the structural ownership anchor\", so the resource is reachable at a\n * flat path rather than nested under `/applications/:id/`.\n *\n * APPLICATION rather than ORGANIZATIONS on purpose: these rows describe the application's own\n * structure, so the application IS their scope. There is no tenant dimension to anchor on — the\n * binding's `APPLICATION_STRUCTURE` stance above says the same thing from the data's side.\n *\n * This originally read as a consequence of API-key scoping, because the workbench browser was\n * expected to authenticate with an application-scope key. `APP_PUBLIC` removed that requirement\n * entirely (see the role note above), so the scope now rests on its own merits rather than on a\n * credential's constraint. The tenant-scoping trade remains recorded in issue #118.\n */\nexport const workbenchShared_ResourcesRelationships: ResourceRelationship[] = [\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION,\n    WorkbenchShared_ResourceType.APPLICATION_MODULES,\n    ResourceRelationshipCardinality.ONE,\n    ResourceRelationshipCardinality.MANY,\n    {\n      nature: RelationshipNature.COMPOSITION,\n      isPrimaryScope: true,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      contextPolicy: {},\n    },\n  ),\n  /*\n   * The same STANDALONE anchor for the relationships resource. Every INTROSPECTION resource needs\n   * one: `resourcePrimaryScope` is DERIVED from a relationship flagged `isPrimaryScope`, so a\n   * resource without one has no scope at all — and STANDALONE keeps it off the URL, which is what\n   * gives both resources a flat route instead of `/applications/:id/...`.\n   */\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION,\n    WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS,\n    ResourceRelationshipCardinality.ONE,\n    ResourceRelationshipCardinality.MANY,\n    {\n      nature: RelationshipNature.COMPOSITION,\n      isPrimaryScope: true,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      contextPolicy: {},\n    },\n  ),\n];\n\n/**\n * Every relationship edge the observed application declares.\n *\n * ## Why this resource exists as the SECOND surface\n *\n * It projects a DIFFERENT behavior (`resources-registry`) from the modules beside it\n * (`resource-specifications`), with a different row shape and no natural primary key. That is the\n * point: it proves the introspection adapter generalizes across the companion's 23 behaviors rather\n * than fitting the one it was built against — and the missing key is what surfaced\n * `identityFields` as a real seam instead of a guess.\n *\n * Same tenancy stance and same PUBLIC role as its sibling, for the same reason: an edge between two\n * resource types is a fact about the application's SOURCE, with no tenant dimension and no subject\n * whose data could leak.\n */\nconst WorkbenchResourceRelationship_Operations = undefined;\n\ntype WorkbenchResourceRelationship_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST;\n\nexport const workbenchResourceRelationships_ResourceConfiguration_InitializationFactory =\n  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n    typeof WorkbenchResourceRelationship_Operations,\n    WorkbenchResourceRelationship_CoreOperations,\n    typeof Workbench_ResourceRelationship_Schema\n  >({\n    mainSchema: Workbench_ResourceRelationship_Schema,\n    resourceIdentifier: WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS,\n    resourceFieldIdentifier:\n      WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: false,\n    persistenceAdapter: PersistenceAdapter.INTROSPECTION,\n    introspectionBinding: {\n      behavior: 'resources-registry',\n      rowsPath: 'resourceRelationships',\n      tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,\n      /*\n       * The two endpoints plus the joining field.\n       *\n       * The pair ALONE is unique across all 16 edges in the dogfood application — measured, not\n       * assumed — and is still not safe: the framework permits several edges between the same two\n       * resources (a junction carrying two roles, a self-relationship). `foreignKeyField` is what\n       * distinguishes those, so it earns its place in the key rather than padding it.\n       *\n       * If these three ever collide the source REFUSES the whole derivation and names both rows,\n       * because the alternative is a row that LIST shows and READ can never reach.\n       */\n      identityFields: ['resourceType1', 'resourceType2', 'foreignKeyField'],\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],\n    customOperation: WorkbenchResourceRelationship_Operations,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },\n      [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },\n    },\n  });\n\nexport const workbenchShared_ResourcesConfigurationsFactoryMap = {\n  [WorkbenchShared_ResourceType.APPLICATION_MODULES]:\n    workbenchApplicationModules_ResourceConfiguration_InitializationFactory,\n  [WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS]:\n    workbenchResourceRelationships_ResourceConfiguration_InitializationFactory,\n};\n"]}

package/dist/esm/workbench/workbench-resources.custom.shared.schemas.d.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+/**
+ * An application's shared MODULE and the resources it owns — derived, never stored.
+ *
+ * The first resource backed by `PersistenceAdapter.INTROSPECTION`. Rows come from the companion's
+ * `resource-specifications` behavior, whose `moduleOwnership` is exactly this shape
+ * (`{ moduleId, resourceTypes }`), so nothing is reshaped on the way through: the binding names the
+ * behavior and the path, and the schema describes what that behavior already answers.
+ *
+ * ## Why `moduleId` is the primary key
+ *
+ * There is no store to mint a surrogate in. A derived row must be identified by something the SOURCE
+ * already guarantees unique, and a module id is that by construction — two modules with one id would
+ * be a defect in the application, not in this projection.
+ */
+export declare const Workbench_ApplicationModule_Schema: z.ZodObject<{
+    moduleId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    resourceTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodString>>;
+    kind: z.ZodNullable<z.ZodString>;
+    contributions: z.ZodArray<z.ZodObject<{
+        contribution: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Workbench_ApplicationModule = z.infer<typeof Workbench_ApplicationModule_Schema>;
+/**
+ * One relationship edge between two of the observed application's resources.
+ *
+ * ## Where the shape comes from
+ *
+ * MEASURED against a live `resources-registry` derivation rather than transcribed from the engine's
+ * `ResourceRelationship` type: 16 edges, 12 keys present on all of them and `primaryScope` on 8. The
+ * engine type carries more than the behavior emits, and a schema written from the type would refuse
+ * every row for fields the projection never sends.
+ *
+ * ## Why the vocabularies are plain strings here
+ *
+ * `nature`, `cardinality*` and `accessScopeStrategy` ARE closed engine enums, and this is one of the
+ * documented exceptions rather than an oversight: these rows cross a subprocess boundary as JSON
+ * from the OBSERVED application's registry, which may be built against a different engine revision
+ * than the workbench. Binding to the enum would make a row the observed app can legitimately produce
+ * unparseable here — the workbench would refuse to show exactly the drift it exists to reveal. This
+ * is a projection of someone else's runtime, not an authored value the framework controls.
+ *
+ * `resolvedSemantics` is deliberately ABSENT. It is a deep nested object (handling modes, foreign-key
+ * persistence) that no current view reads, and copying it into the schema would freeze a shape whose
+ * consumer does not exist yet.
+ */
+export declare const Workbench_ResourceRelationship_Schema: z.ZodObject<{
+    workbenchResourceRelationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    resourceType1: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    resourceType2: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    cardinality1: z.ZodString;
+    cardinality2: z.ZodString;
+    nature: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    foreignKeyField: z.ZodString;
+    accessScopeStrategy: z.ZodString;
+    parentResourceRequirement: z.ZodString;
+    isPrimaryScope: z.ZodBoolean;
+    allowCycle: z.ZodBoolean;
+    isDisabled: z.ZodBoolean;
+    primaryScope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type Workbench_ResourceRelationship = z.infer<typeof Workbench_ResourceRelationship_Schema>;
+//# sourceMappingURL=workbench-resources.custom.shared.schemas.d.ts.map

package/dist/esm/workbench/workbench-resources.custom.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbench-resources.custom.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/workbench/workbench-resources.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;iBAmC7C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE7F;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;iBA0ChD,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}