@wildo-ai/platform-core-shared 1.1.0 → 1.1.2

package/dist/esm/workbench/workbench-resources.custom.shared.resources-config.schemas.js

@@ -1,7 +1,36 @@
 import { CORE_APP_ROLES, CoreResourceOperation, CoreResourceType, IntrospectionTenancyStance, PersistenceAdapter, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationshipAccessScopeStrategy, ResourceRelationshipCardinality, RelationshipNature, createResourceConfiguration_Initialization, createResourcesRelationship, } from '@wildo-ai/saas-models';
+import { z } from 'zod';
 import { WorkbenchShared_ResourceFieldIdentifier, WorkbenchShared_ResourceType, } from './workbench-resources-types.custom.shared.schemas.js';
-import { Workbench_ApplicationModule_Schema, Workbench_ResourceRelationship_Schema, } from './workbench-resources.custom.shared.schemas.js';
-const WorkbenchApplicationModule_Operations = undefined;
+import { buildWorkbenchAspectRelationships, workbenchAspectResources_ConfigurationsFactoryMap, } from './workbench-aspect-resources.custom.shared.schemas.js';
+import { Workbench_DomainResource_Schema, Workbench_SpecificationArtifact_Schema, WorkbenchSpecificationArtifactConcern, WorkbenchSpecificationArtifactState, } from './workbench-resources.custom.shared.schemas.js';
+import { workbenchCreationPlane_ResourcesConfigurationsFactoryMap, workbenchCreationPlane_ResourcesRelationships, } from './workbench-creation-plane.custom.shared.resources-config.schemas.js';
+/**
+ * The page ceiling every workbench LIST declares — and it is a correctness fix, not a tuning knob.
+ *
+ * `IntrospectionResourceRepository.list()` answers `pagination.limit = rows.length` over the WHOLE
+ * derived set, deliberately: a behavior computes its entire answer in one subprocess run, there is no
+ * cursor to seek, and reporting a total the caller cannot page past would be a lie. The response DTO
+ * then bounds that `limit` by the operation's `maxPaginatedResultPerPageLimit`, whose default is
+ * **100**. So any introspected resource whose derivation exceeds 100 rows fails with `too_big` at
+ * `pagination.limit` — the request having been served correctly right up to the last hop.
+ *
+ * Measured 2026-08-31, and the measurement is why this ceiling is a CORRECTNESS FIX rather than
+ * headroom. The domain model projects every resource the observed application RUNS, which is its own
+ * plus the engine's whole merged vocabulary: `saas-models`' core map alone carries **82** resources
+ * and **105** relationships before `saas-backend-lib`'s map or the application's own eight are
+ * counted. So the domain-model LIST is already comfortably past the default 100 on the smallest
+ * application there is, and would have failed with `too_big` at `pagination.limit` — the request
+ * having been served correctly right up to the last hop, and the bound named in none of these
+ * declarations. The number also scales with the OBSERVED application, which is the one input this
+ * repository does not control.
+ *
+ * Declared on the shared variant so every workbench resource is bounded by the same number, rather
+ * than one being raised and its siblings left waiting to hit the same wall.
+ *
+ * Above the ceiling the request FAILS rather than truncating, which is the correct direction: a
+ * silently short domain model is indistinguishable from a complete one once it is drawn.
+ */
+export const WORKBENCH_INTROSPECTION_MAX_ROWS_PER_PAGE = 1000;
 /**
  * Read-only over HTTP, and PUBLIC.
  *
@@ -31,62 +60,49 @@ const WorkbenchApplicationModule_Operations = undefined;
  * If an introspected resource is ever added that projects something OTHER than the application's own
  * structure, this role is wrong for it — the stance and the role must move together.
  */
-function createReadOnlyApiVariant() {
+export function createReadOnlyApiVariant() {
     return {
         variantType: ResourceOperationVariantType.API_CALL,
         isDefault: true,
+        /*
+         * `APP_PUBLIC` ALONE, and that single entry is now load-bearing evidence rather than a shorthand.
+         *
+         * It briefly read `[APP_PUBLIC, APP_USER]`. That was a WORKAROUND for an engine defect (#153),
+         * not a statement about these rows: the authorizer admitted a public operation only when the
+         * caller was ALSO a public execution, so an AUTHENTICATED caller fell past that carve-out to the
+         * ordinary role gate — where `APP_PUBLIC` is in nobody's granted set — and was refused. Measured
+         * 2026-08-31 on the workbench's module projection (a resource retired the same day): with no
+         * credential the LIST answered 200 with the eight modules; with a valid administrator bearer it
+         * answered 403 `authorizations_access_denied`. The workbench's own sidebar could not read the
+         * rows it exists to show, because its operator had logged in.
+         *
+         * `requiredRolesDeclarePublicAccess` in `@wildo-ai/saas-models` is now the one named source for
+         * what `APP_PUBLIC` means, and every role gate in the engine consults it — so the sentinel
+         * genuinely admits every caller and the second role has nothing left to add. Declaring it anyway
+         * would say these rows need an authenticated reader, which is the opposite of what they are.
+         *
+         * Keeping the bare declaration is deliberate: it is the surface the fix is exercised on. If the
+         * defect ever returns, the workbench sidebar goes blank for a logged-in operator — a loud,
+         * immediate signal — instead of being silently masked by a role that was only ever there to hide
+         * it.
+         */
         roles: [CORE_APP_ROLES.APP_PUBLIC],
         riskLevel: ResourceOperationRiskLevel.LOW,
     };
 }
 /**
- * The application's shared modules and the resources each owns.
+ * The LIST variant — the read-only variant plus the page ceiling.
  *
- * Rows are DERIVED per read from the companion's `resource-specifications` behavior; nothing is
- * stored. `rowsPath` names where that behavior keeps them, because behaviors answer their own
- * natural shape rather than a uniform envelope.
+ * Separate from {@link createReadOnlyApiVariant} because `maxPaginatedResultPerPageLimit` is only
+ * read on a LIST-like operation (`isListLike` in the resource factory); putting it on READ too would
+ * declare a field that operation does not have, which reads as though it did something.
  */
-export const workbenchApplicationModules_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
-    mainSchema: Workbench_ApplicationModule_Schema,
-    resourceIdentifier: WorkbenchShared_ResourceType.APPLICATION_MODULES,
-    resourceFieldIdentifier: WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.APPLICATION_MODULES],
-    resourceRelationships: resourcesRelationships,
-    isSystemResource: false,
-    persistenceAdapter: PersistenceAdapter.INTROSPECTION,
-    introspectionBinding: {
-        behavior: 'resource-specifications',
-        rowsPath: 'moduleOwnership',
-        /*
-         * A single-field key, and it is NOT redundant.
-         *
-         * The behavior's rows carry `moduleId`, but every lookup addresses a row by the resource's
-         * `resourceFieldIdentifier` — `workbenchApplicationModuleId` — so a row that never carries
-         * that field can be listed and never found. Measured: `GET …/workbench-application-modules`
-         * answered 200 with 8 rows while `…/engine` answered 404, because the filter looked for a
-         * field the row did not have.
-         *
-         * Composing from `moduleId` copies the behavior's own key onto the field the framework
-         * addresses by, which keeps ONE identity rather than two names for it.
-         */
-        identityFields: ['moduleId'],
-        /*
-         * A module id and the resource types it registers describe the APPLICATION'S OWN STRUCTURE.
-         * There is no tenant dimension for a scope predicate to filter on — every caller who may read
-         * this resource at all sees the same rows, because they are a projection of the application's
-         * source rather than of anyone's data.
-         *
-         * Declared rather than left implicit: an unstated stance is indistinguishable from an
-         * overlooked one, which is the whole reason the field is required.
-         */
-        tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,
-    },
-    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],
-    customOperation: WorkbenchApplicationModule_Operations,
-    operationsConfiguration: {
-        [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },
-        [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },
-    },
-});
+export function createReadOnlyListApiVariant() {
+    return {
+        ...createReadOnlyApiVariant(),
+        maxPaginatedResultPerPageLimit: WORKBENCH_INTROSPECTION_MAX_ROWS_PER_PAGE,
+    };
+}
 /**
  * APPLICATION-scoped, anchored by a STANDALONE relationship.
  *
@@ -104,74 +120,164 @@ export const workbenchApplicationModules_ResourceConfiguration_InitializationFac
  * credential's constraint. The tenant-scoping trade remains recorded in issue #118.
  */
 export const workbenchShared_ResourcesRelationships = [
-    createResourcesRelationship(CoreResourceType.APPLICATION, WorkbenchShared_ResourceType.APPLICATION_MODULES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+    /*
+     * A STANDALONE anchor for the domain-model resource. Every INTROSPECTION resource needs one:
+     * `resourcePrimaryScope` is DERIVED from a relationship flagged `isPrimaryScope`, so a resource
+     * without one has no scope at all — and STANDALONE keeps it off the URL, which is what gives these
+     * resources a flat route instead of `/applications/:id/...`.
+     */
+    createResourcesRelationship(CoreResourceType.APPLICATION, WorkbenchShared_ResourceType.DOMAIN_RESOURCES, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         nature: RelationshipNature.COMPOSITION,
         isPrimaryScope: true,
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         contextPolicy: {},
     }),
-    /*
-     * The same STANDALONE anchor for the relationships resource. Every INTROSPECTION resource needs
-     * one: `resourcePrimaryScope` is DERIVED from a relationship flagged `isPrimaryScope`, so a
-     * resource without one has no scope at all — and STANDALONE keeps it off the URL, which is what
-     * gives both resources a flat route instead of `/applications/:id/...`.
-     */
-    createResourcesRelationship(CoreResourceType.APPLICATION, WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
+    /* And for the specification-artifacts resource. Same anchor, same reason. */
+    createResourcesRelationship(CoreResourceType.APPLICATION, WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS, ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY, {
         nature: RelationshipNature.COMPOSITION,
         isPrimaryScope: true,
         accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,
         contextPolicy: {},
     }),
+    /*
+     * Every family-aspect resource's relationships — the same STANDALONE anchor per aspect, plus
+     * one REFERENCE per declared edge whose `foreignKeyField` is what makes reference navigation
+     * resolve. Generated from the descriptor table beside the aspect configs.
+     */
+    ...buildWorkbenchAspectRelationships(),
+    /*
+     * The creation plane's four STANDALONE anchors — same form, declared beside its configs. Merged
+     * here so the one array every registrar consumes stays the single relationship authority.
+     */
+    ...workbenchCreationPlane_ResourcesRelationships,
 ];
 /**
- * Every relationship edge the observed application declares.
+ * The observed application's domain model — one row per resource, and the source the workbench's
+ * domain-model graph is drawn from.
  *
- * ## Why this resource exists as the SECOND surface
+ * ## Why a THIRD introspected resource beside modules and relationships
  *
- * It projects a DIFFERENT behavior (`resources-registry`) from the modules beside it
- * (`resource-specifications`), with a different row shape and no natural primary key. That is the
- * point: it proves the introspection adapter generalizes across the companion's 23 behaviors rather
- * than fitting the one it was built against — and the missing key is what surfaced
- * `identityFields` as a real seam instead of a guess.
+ * Its two siblings project two DIFFERENT behaviors on two different targets, so a graph assembled
+ * from both is assembled from two subprocess runs against a working tree an operator is editing —
+ * nodes from one state of the application, edges from the next, with nothing to detect the mismatch.
+ * `application-domain-model` answers ownership, edges, field names and specification prose from a
+ * SINGLE import, which is the only shape in which the three are internally consistent. Speed is the
+ * smaller half of the reason; consistency is the whole of it.
  *
- * Same tenancy stance and same PUBLIC role as its sibling, for the same reason: an edge between two
- * resource types is a fact about the application's SOURCE, with no tenant dimension and no subject
- * whose data could leak.
+ * Same tenancy stance and same PUBLIC role as its siblings, for the same reason: a resource, the
+ * module that registers it and the edges it declares are facts about the application's SOURCE, with
+ * no tenant dimension and no subject whose data could leak.
  */
-const WorkbenchResourceRelationship_Operations = undefined;
-export const workbenchResourceRelationships_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
-    mainSchema: Workbench_ResourceRelationship_Schema,
-    resourceIdentifier: WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS,
-    resourceFieldIdentifier: WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS],
+const WorkbenchDomainResource_Operations = undefined;
+export const workbenchDomainResources_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: Workbench_DomainResource_Schema,
+    resourceIdentifier: WorkbenchShared_ResourceType.DOMAIN_RESOURCES,
+    resourceFieldIdentifier: WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.DOMAIN_RESOURCES],
     resourceRelationships: resourcesRelationships,
     isSystemResource: false,
     persistenceAdapter: PersistenceAdapter.INTROSPECTION,
     introspectionBinding: {
-        behavior: 'resources-registry',
-        rowsPath: 'resourceRelationships',
+        behavior: 'application-domain-model',
+        rowsPath: 'domainResources',
         tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,
         /*
-         * The two endpoints plus the joining field.
+         * A resource type is unique in a registry by construction — a registry is keyed by it — so one
+         * field is the whole key here, and no discriminator can be needed.
          *
-         * The pair ALONE is unique across all 16 edges in the dogfood application — measured, not
-         * assumed — and is still not safe: the framework permits several edges between the same two
-         * resources (a junction carrying two roles, a self-relationship). `foreignKeyField` is what
-         * distinguishes those, so it earns its place in the key rather than padding it.
+         * Composed onto `workbenchDomainResourceId` rather than addressing the row by `resourceType`
+         * directly: `resourceFieldIdentifier` values are published into the GLOBAL field-identifier map
+         * that resolves a foreign-key field NAME to the resource it points at, and `resourceType` is a
+         * name any application could collide with on a map whose whole job is that names are
+         * unambiguous.
+         */
+        identityFields: ['resourceType'],
+    },
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],
+    customOperation: WorkbenchDomainResource_Operations,
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },
+        [CoreResourceOperation.LIST]: { variants: [createReadOnlyListApiVariant()] },
+    },
+});
+/**
+ * Every application-specification family the journey produces, projected for a human reviewer.
+ *
+ * ## What this is for
+ *
+ * Its three siblings project the application's STRUCTURE. This one projects the PRODUCT and its
+ * obligations — vision, market, requirements, roadmap, brand, business model, the assurance
+ * programme and the governed-document families — which until now were reachable only by opening a
+ * TypeScript file in an editor (issue #162).
+ *
+ * ## Why the same behavior does not serve it
+ *
+ * `application-domain-model` answers questions about the resource registry. A family's content is
+ * not in the registry at all: it is on the specifications package's companion exports, validated by
+ * the `_core` validator the semantic authority names for it. Different target, different question,
+ * different behavior — the split the two original workbench resources already demonstrate.
+ *
+ * ## Same posture as its siblings, for the same reason
+ *
+ * `APPLICATION_STRUCTURE` tenancy and `APP_PUBLIC`: a vision brief, a roadmap and a compliance
+ * programme are facts about what the application's own source SAYS about itself. There is no tenant
+ * dimension and no subject whose data could leak, and the companion's loopback bind is what keeps
+ * the whole workbench local.
+ *
+ * READ and LIST only, and structurally so — `PersistenceAdapter.INTROSPECTION` refuses every write
+ * verb, rows are derived per read and nothing is stored. Acceptance of a specification is a human
+ * git commit (`.claude/rules/one-source-of-truth.md` rule 2), so there is deliberately no place here
+ * for an acceptance state to accumulate, not even by accident.
+ */
+const WorkbenchSpecificationArtifact_Operations = undefined;
+export const workbenchSpecificationArtifacts_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: Workbench_SpecificationArtifact_Schema,
+    resourceIdentifier: WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS,
+    resourceFieldIdentifier: WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: false,
+    persistenceAdapter: PersistenceAdapter.INTROSPECTION,
+    introspectionBinding: {
+        behavior: 'specification-artifacts',
+        rowsPath: 'artifacts',
+        tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,
+        /*
+         * NO `identityFields`, and the omission is the point.
          *
-         * If these three ever collide the source REFUSES the whole derivation and names both rows,
-         * because the alternative is a row that LIST shows and READ can never reach.
+         * Every row already carries `family`, and `family` IS this resource's
+         * `resourceFieldIdentifier` — so there is nothing to compose. This is the `moduleId` case, not
+         * the relationships one: declaring an identity here would stamp a composed key over a real
+         * field, replacing the source's own id with a copy of itself.
          */
-        identityFields: ['resourceType1', 'resourceType2', 'foreignKeyField'],
     },
     coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],
-    customOperation: WorkbenchResourceRelationship_Operations,
+    customOperation: WorkbenchSpecificationArtifact_Operations,
     operationsConfiguration: {
         [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },
-        [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    ...createReadOnlyListApiVariant(),
+                    /*
+                     * The two review axes a reader slices fifteen rows by. Declaring them is an OBLIGATION,
+                     * not a hint: the introspection source honors exactly the scalar-equality/IN filters that
+                     * reach it and REFUSES shapes it cannot apply, because a declared filter that is silently
+                     * dropped returns the unfiltered set wearing a filtered label — the `--state ready` defect
+                     * class. The frontend's concern quick-filter tabs require `concern` to be here, or the
+                     * tab strip silently never renders.
+                     */
+                    filterFields: {
+                        concern: z.enum(WorkbenchSpecificationArtifactConcern),
+                        state: z.enum(WorkbenchSpecificationArtifactState),
+                    },
+                }],
+        },
     },
 });
 export const workbenchShared_ResourcesConfigurationsFactoryMap = {
-    [WorkbenchShared_ResourceType.APPLICATION_MODULES]: workbenchApplicationModules_ResourceConfiguration_InitializationFactory,
-    [WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS]: workbenchResourceRelationships_ResourceConfiguration_InitializationFactory,
+    [WorkbenchShared_ResourceType.DOMAIN_RESOURCES]: workbenchDomainResources_ResourceConfiguration_InitializationFactory,
+    [WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS]: workbenchSpecificationArtifacts_ResourceConfiguration_InitializationFactory,
+    // The 40 family-aspect resources — generated from the descriptor table, one mold for all.
+    ...workbenchAspectResources_ConfigurationsFactoryMap,
+    // The creation plane — companion-RUNTIME projections (authenticated, APPLICATION_RUNTIME tenancy).
+    ...workbenchCreationPlane_ResourcesConfigurationsFactoryMap,
 };
 //# sourceMappingURL=workbench-resources.custom.shared.resources-config.schemas.js.map

package/dist/esm/workbench/workbench-resources.custom.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"workbench-resources.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/workbench/workbench-resources.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAE5B,uCAAuC,EACvC,+BAA+B,EAC/B,kBAAkB,EAClB,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,kCAAkC,EAClC,qCAAqC,GACtC,MAAM,6CAA6C,CAAC;AAErD,MAAM,qCAAqC,GAAG,SAAS,CAAC;AAMxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,wBAAwB;IAC/B,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,QAAiB;QAC3D,SAAS,EAAE,IAAa;QACxB,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;QAClC,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uEAAuE,GAClF,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,kCAAkC;IAC9C,kBAAkB,EAAE,4BAA4B,CAAC,mBAAmB;IACpE,uBAAuB,EACrB,uCAAuC,CAAC,4BAA4B,CAAC,mBAAmB,CAAC;IAC3F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,kBAAkB,CAAC,aAAa;IACpD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,yBAAyB;QACnC,QAAQ,EAAE,iBAAiB;QAC3B;;;;;;;;;;;WAWG;QACH,cAAc,EAAE,CAAC,UAAU,CAAC;QAC5B;;;;;;;;WAQG;QACH,OAAO,EAAE,0BAA0B,CAAC,qBAAqB;KAC1D;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;IACxE,eAAe,EAAE,qCAAqC;IACtD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;KACzE;CACF,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAA2B;IAC5E,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAC5B,4BAA4B,CAAC,mBAAmB,EAChD,+BAA+B,CAAC,GAAG,EACnC,+BAA+B,CAAC,IAAI,EACpC;QACE,MAAM,EAAE,kBAAkB,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,aAAa,EAAE,EAAE;KAClB,CACF;IACD;;;;;OAKG;IACH,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAC5B,4BAA4B,CAAC,sBAAsB,EACnD,+BAA+B,CAAC,GAAG,EACnC,+BAA+B,CAAC,IAAI,EACpC;QACE,MAAM,EAAE,kBAAkB,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,aAAa,EAAE,EAAE;KAClB,CACF;CACF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,wCAAwC,GAAG,SAAS,CAAC;AAM3D,MAAM,CAAC,MAAM,0EAA0E,GACrF,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,qCAAqC;IACjD,kBAAkB,EAAE,4BAA4B,CAAC,sBAAsB;IACvE,uBAAuB,EACrB,uCAAuC,CAAC,4BAA4B,CAAC,sBAAsB,CAAC;IAC9F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,kBAAkB,CAAC,aAAa;IACpD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,0BAA0B,CAAC,qBAAqB;QACzD;;;;;;;;;;WAUG;QACH,cAAc,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC;KACtE;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;IACxE,eAAe,EAAE,wCAAwC;IACzD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;KACzE;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iDAAiD,GAAG;IAC/D,CAAC,4BAA4B,CAAC,mBAAmB,CAAC,EAChD,uEAAuE;IACzE,CAAC,4BAA4B,CAAC,sBAAsB,CAAC,EACnD,0EAA0E;CAC7E,CAAC","sourcesContent":["import {\n  CORE_APP_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  IntrospectionTenancyStance,\n  PersistenceAdapter,\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceRelationship,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  RelationshipNature,\n  createResourceConfiguration_Initialization,\n  createResourcesRelationship,\n} from '@wildo-ai/saas-models';\n\nimport {\n  WorkbenchShared_ResourceFieldIdentifier,\n  WorkbenchShared_ResourceType,\n} from './workbench-resources-types.custom.shared.schemas';\nimport {\n  Workbench_ApplicationModule_Schema,\n  Workbench_ResourceRelationship_Schema,\n} from './workbench-resources.custom.shared.schemas';\n\nconst WorkbenchApplicationModule_Operations = undefined;\n\ntype WorkbenchApplicationModule_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST;\n\n/**\n * Read-only over HTTP, and PUBLIC.\n *\n * `APP_PUBLIC` means what its enum comment says — accessible to everyone, no credential — and as of\n * 2026-08-30 the runtime implements it: the authentication chain now admits an operation declaring\n * this role instead of demanding a credential it never required. Before that it was declared,\n * published as public by the OpenAPI generator, and refused at runtime.\n *\n * ## Why these rows are genuinely public\n *\n * They are a projection of the application's OWN SOURCE — module ids and the resource types each\n * registers — carrying no tenant dimension, which is exactly what the binding's\n * `APPLICATION_STRUCTURE` tenancy stance declares. There is no subject whose data could leak,\n * because no subject's data is here.\n *\n * This is the same category as a public price list, a frontend application configuration or an i18n\n * bundle: things every caller may read, which until now could only be served by escaping the\n * resource system into a manual controller.\n *\n * ## What still confines them\n *\n * The companion asserts a loopback bind at startup and fails closed otherwise, so this surface is\n * reachable only from the developer's own machine. `APP_PUBLIC` is the right declaration on its\n * merits; the loopback bind is what makes the whole workbench local, and both remain true\n * independently.\n *\n * If an introspected resource is ever added that projects something OTHER than the application's own\n * structure, this role is wrong for it — the stance and the role must move together.\n */\nfunction createReadOnlyApiVariant() {\n  return {\n    variantType: ResourceOperationVariantType.API_CALL as const,\n    isDefault: true as const,\n    roles: [CORE_APP_ROLES.APP_PUBLIC],\n    riskLevel: ResourceOperationRiskLevel.LOW as const,\n  };\n}\n\n/**\n * The application's shared modules and the resources each owns.\n *\n * Rows are DERIVED per read from the companion's `resource-specifications` behavior; nothing is\n * stored. `rowsPath` names where that behavior keeps them, because behaviors answer their own\n * natural shape rather than a uniform envelope.\n */\nexport const workbenchApplicationModules_ResourceConfiguration_InitializationFactory =\n  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n    typeof WorkbenchApplicationModule_Operations,\n    WorkbenchApplicationModule_CoreOperations,\n    typeof Workbench_ApplicationModule_Schema\n  >({\n    mainSchema: Workbench_ApplicationModule_Schema,\n    resourceIdentifier: WorkbenchShared_ResourceType.APPLICATION_MODULES,\n    resourceFieldIdentifier:\n      WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.APPLICATION_MODULES],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: false,\n    persistenceAdapter: PersistenceAdapter.INTROSPECTION,\n    introspectionBinding: {\n      behavior: 'resource-specifications',\n      rowsPath: 'moduleOwnership',\n      /*\n       * A single-field key, and it is NOT redundant.\n       *\n       * The behavior's rows carry `moduleId`, but every lookup addresses a row by the resource's\n       * `resourceFieldIdentifier` — `workbenchApplicationModuleId` — so a row that never carries\n       * that field can be listed and never found. Measured: `GET …/workbench-application-modules`\n       * answered 200 with 8 rows while `…/engine` answered 404, because the filter looked for a\n       * field the row did not have.\n       *\n       * Composing from `moduleId` copies the behavior's own key onto the field the framework\n       * addresses by, which keeps ONE identity rather than two names for it.\n       */\n      identityFields: ['moduleId'],\n      /*\n       * A module id and the resource types it registers describe the APPLICATION'S OWN STRUCTURE.\n       * There is no tenant dimension for a scope predicate to filter on — every caller who may read\n       * this resource at all sees the same rows, because they are a projection of the application's\n       * source rather than of anyone's data.\n       *\n       * Declared rather than left implicit: an unstated stance is indistinguishable from an\n       * overlooked one, which is the whole reason the field is required.\n       */\n      tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],\n    customOperation: WorkbenchApplicationModule_Operations,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },\n      [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },\n    },\n  });\n\n/**\n * APPLICATION-scoped, anchored by a STANDALONE relationship.\n *\n * The form the resource factory's own migration note prescribes: STANDALONE \"keeps the rel inert for\n * URL routing while declaring the structural ownership anchor\", so the resource is reachable at a\n * flat path rather than nested under `/applications/:id/`.\n *\n * APPLICATION rather than ORGANIZATIONS on purpose: these rows describe the application's own\n * structure, so the application IS their scope. There is no tenant dimension to anchor on — the\n * binding's `APPLICATION_STRUCTURE` stance above says the same thing from the data's side.\n *\n * This originally read as a consequence of API-key scoping, because the workbench browser was\n * expected to authenticate with an application-scope key. `APP_PUBLIC` removed that requirement\n * entirely (see the role note above), so the scope now rests on its own merits rather than on a\n * credential's constraint. The tenant-scoping trade remains recorded in issue #118.\n */\nexport const workbenchShared_ResourcesRelationships: ResourceRelationship[] = [\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION,\n    WorkbenchShared_ResourceType.APPLICATION_MODULES,\n    ResourceRelationshipCardinality.ONE,\n    ResourceRelationshipCardinality.MANY,\n    {\n      nature: RelationshipNature.COMPOSITION,\n      isPrimaryScope: true,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      contextPolicy: {},\n    },\n  ),\n  /*\n   * The same STANDALONE anchor for the relationships resource. Every INTROSPECTION resource needs\n   * one: `resourcePrimaryScope` is DERIVED from a relationship flagged `isPrimaryScope`, so a\n   * resource without one has no scope at all — and STANDALONE keeps it off the URL, which is what\n   * gives both resources a flat route instead of `/applications/:id/...`.\n   */\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION,\n    WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS,\n    ResourceRelationshipCardinality.ONE,\n    ResourceRelationshipCardinality.MANY,\n    {\n      nature: RelationshipNature.COMPOSITION,\n      isPrimaryScope: true,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      contextPolicy: {},\n    },\n  ),\n];\n\n/**\n * Every relationship edge the observed application declares.\n *\n * ## Why this resource exists as the SECOND surface\n *\n * It projects a DIFFERENT behavior (`resources-registry`) from the modules beside it\n * (`resource-specifications`), with a different row shape and no natural primary key. That is the\n * point: it proves the introspection adapter generalizes across the companion's 23 behaviors rather\n * than fitting the one it was built against — and the missing key is what surfaced\n * `identityFields` as a real seam instead of a guess.\n *\n * Same tenancy stance and same PUBLIC role as its sibling, for the same reason: an edge between two\n * resource types is a fact about the application's SOURCE, with no tenant dimension and no subject\n * whose data could leak.\n */\nconst WorkbenchResourceRelationship_Operations = undefined;\n\ntype WorkbenchResourceRelationship_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST;\n\nexport const workbenchResourceRelationships_ResourceConfiguration_InitializationFactory =\n  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n    typeof WorkbenchResourceRelationship_Operations,\n    WorkbenchResourceRelationship_CoreOperations,\n    typeof Workbench_ResourceRelationship_Schema\n  >({\n    mainSchema: Workbench_ResourceRelationship_Schema,\n    resourceIdentifier: WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS,\n    resourceFieldIdentifier:\n      WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: false,\n    persistenceAdapter: PersistenceAdapter.INTROSPECTION,\n    introspectionBinding: {\n      behavior: 'resources-registry',\n      rowsPath: 'resourceRelationships',\n      tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,\n      /*\n       * The two endpoints plus the joining field.\n       *\n       * The pair ALONE is unique across all 16 edges in the dogfood application — measured, not\n       * assumed — and is still not safe: the framework permits several edges between the same two\n       * resources (a junction carrying two roles, a self-relationship). `foreignKeyField` is what\n       * distinguishes those, so it earns its place in the key rather than padding it.\n       *\n       * If these three ever collide the source REFUSES the whole derivation and names both rows,\n       * because the alternative is a row that LIST shows and READ can never reach.\n       */\n      identityFields: ['resourceType1', 'resourceType2', 'foreignKeyField'],\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],\n    customOperation: WorkbenchResourceRelationship_Operations,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },\n      [CoreResourceOperation.LIST]: { variants: [createReadOnlyApiVariant()] },\n    },\n  });\n\nexport const workbenchShared_ResourcesConfigurationsFactoryMap = {\n  [WorkbenchShared_ResourceType.APPLICATION_MODULES]:\n    workbenchApplicationModules_ResourceConfiguration_InitializationFactory,\n  [WorkbenchShared_ResourceType.RESOURCE_RELATIONSHIPS]:\n    workbenchResourceRelationships_ResourceConfiguration_InitializationFactory,\n};\n"]}
+{"version":3,"file":"workbench-resources.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/workbench/workbench-resources.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAE5B,uCAAuC,EACvC,+BAA+B,EAC/B,kBAAkB,EAClB,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,iCAAiC,EACjC,iDAAiD,GAClD,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EACL,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,mCAAmC,GACpC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,wDAAwD,EACxD,6CAA6C,GAC9C,MAAM,mEAAmE,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,IAAI,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,QAAiB;QAC3D,SAAS,EAAE,IAAa;QACxB;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;QAClC,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,GAAG,wBAAwB,EAAE;QAC7B,8BAA8B,EAAE,yCAAyC;KAC1E,CAAC;AACJ,CAAC;AAGD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAA2B;IAC5E;;;;;OAKG;IACH,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAC5B,4BAA4B,CAAC,gBAAgB,EAC7C,+BAA+B,CAAC,GAAG,EACnC,+BAA+B,CAAC,IAAI,EACpC;QACE,MAAM,EAAE,kBAAkB,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,aAAa,EAAE,EAAE;KAClB,CACF;IACD,6EAA6E;IAC7E,2BAA2B,CACzB,gBAAgB,CAAC,WAAW,EAC5B,4BAA4B,CAAC,uBAAuB,EACpD,+BAA+B,CAAC,GAAG,EACnC,+BAA+B,CAAC,IAAI,EACpC;QACE,MAAM,EAAE,kBAAkB,CAAC,WAAW;QACtC,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;QACvE,aAAa,EAAE,EAAE;KAClB,CACF;IACD;;;;OAIG;IACH,GAAG,iCAAiC,EAAE;IACtC;;;OAGG;IACH,GAAG,6CAA6C;CACjD,CAAC;AAGF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,kCAAkC,GAAG,SAAS,CAAC;AAMrD,MAAM,CAAC,MAAM,oEAAoE,GAC/E,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,+BAA+B;IAC3C,kBAAkB,EAAE,4BAA4B,CAAC,gBAAgB;IACjE,uBAAuB,EACrB,uCAAuC,CAAC,4BAA4B,CAAC,gBAAgB,CAAC;IACxF,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,kBAAkB,CAAC,aAAa;IACpD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,0BAA0B;QACpC,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,0BAA0B,CAAC,qBAAqB;QACzD;;;;;;;;;WASG;QACH,cAAc,EAAE,CAAC,cAAc,CAAC;KACjC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;IACxE,eAAe,EAAE,kCAAkC;IACnD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,4BAA4B,EAAE,CAAC,EAAE;KAC7E;CACF,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,yCAAyC,GAAG,SAAS,CAAC;AAM5D,MAAM,CAAC,MAAM,2EAA2E,GACtF,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,sCAAsC;IAClD,kBAAkB,EAAE,4BAA4B,CAAC,uBAAuB;IACxE,uBAAuB,EACrB,uCAAuC,CAAC,4BAA4B,CAAC,uBAAuB,CAAC;IAC/F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,kBAAkB,CAAC,aAAa;IACpD,oBAAoB,EAAE;QACpB,QAAQ,EAAE,yBAAyB;QACnC,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,0BAA0B,CAAC,qBAAqB;QACzD;;;;;;;WAOG;KACJ;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;IACxE,eAAe,EAAE,yCAAyC;IAC1D,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,GAAG,4BAA4B,EAAE;oBACjC;;;;;;;uBAOG;oBACH,YAAY,EAAE;wBACZ,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;wBACtD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC;qBACnD;iBACF,CAAC;SACH;KACF;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iDAAiD,GAAG;IAC/D,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,EAC7C,oEAAoE;IACtE,CAAC,4BAA4B,CAAC,uBAAuB,CAAC,EACpD,2EAA2E;IAC7E,0FAA0F;IAC1F,GAAG,iDAAiD;IACpD,mGAAmG;IACnG,GAAG,wDAAwD;CAC5D,CAAC","sourcesContent":["import {\n  CORE_APP_ROLES,\n  CoreResourceOperation,\n  CoreResourceType,\n  IntrospectionTenancyStance,\n  PersistenceAdapter,\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceRelationship,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  RelationshipNature,\n  createResourceConfiguration_Initialization,\n  createResourcesRelationship,\n} from '@wildo-ai/saas-models';\n\nimport { z } from 'zod';\n\nimport {\n  WorkbenchShared_ResourceFieldIdentifier,\n  WorkbenchShared_ResourceType,\n} from './workbench-resources-types.custom.shared.schemas';\nimport {\n  buildWorkbenchAspectRelationships,\n  workbenchAspectResources_ConfigurationsFactoryMap,\n} from './workbench-aspect-resources.custom.shared.schemas';\nimport {\n  Workbench_DomainResource_Schema,\n  Workbench_SpecificationArtifact_Schema,\n  WorkbenchSpecificationArtifactConcern,\n  WorkbenchSpecificationArtifactState,\n} from './workbench-resources.custom.shared.schemas';\nimport {\n  workbenchCreationPlane_ResourcesConfigurationsFactoryMap,\n  workbenchCreationPlane_ResourcesRelationships,\n} from './workbench-creation-plane.custom.shared.resources-config.schemas';\n\n/**\n * The page ceiling every workbench LIST declares — and it is a correctness fix, not a tuning knob.\n *\n * `IntrospectionResourceRepository.list()` answers `pagination.limit = rows.length` over the WHOLE\n * derived set, deliberately: a behavior computes its entire answer in one subprocess run, there is no\n * cursor to seek, and reporting a total the caller cannot page past would be a lie. The response DTO\n * then bounds that `limit` by the operation's `maxPaginatedResultPerPageLimit`, whose default is\n * **100**. So any introspected resource whose derivation exceeds 100 rows fails with `too_big` at\n * `pagination.limit` — the request having been served correctly right up to the last hop.\n *\n * Measured 2026-08-31, and the measurement is why this ceiling is a CORRECTNESS FIX rather than\n * headroom. The domain model projects every resource the observed application RUNS, which is its own\n * plus the engine's whole merged vocabulary: `saas-models`' core map alone carries **82** resources\n * and **105** relationships before `saas-backend-lib`'s map or the application's own eight are\n * counted. So the domain-model LIST is already comfortably past the default 100 on the smallest\n * application there is, and would have failed with `too_big` at `pagination.limit` — the request\n * having been served correctly right up to the last hop, and the bound named in none of these\n * declarations. The number also scales with the OBSERVED application, which is the one input this\n * repository does not control.\n *\n * Declared on the shared variant so every workbench resource is bounded by the same number, rather\n * than one being raised and its siblings left waiting to hit the same wall.\n *\n * Above the ceiling the request FAILS rather than truncating, which is the correct direction: a\n * silently short domain model is indistinguishable from a complete one once it is drawn.\n */\nexport const WORKBENCH_INTROSPECTION_MAX_ROWS_PER_PAGE = 1000;\n\n/**\n * Read-only over HTTP, and PUBLIC.\n *\n * `APP_PUBLIC` means what its enum comment says — accessible to everyone, no credential — and as of\n * 2026-08-30 the runtime implements it: the authentication chain now admits an operation declaring\n * this role instead of demanding a credential it never required. Before that it was declared,\n * published as public by the OpenAPI generator, and refused at runtime.\n *\n * ## Why these rows are genuinely public\n *\n * They are a projection of the application's OWN SOURCE — module ids and the resource types each\n * registers — carrying no tenant dimension, which is exactly what the binding's\n * `APPLICATION_STRUCTURE` tenancy stance declares. There is no subject whose data could leak,\n * because no subject's data is here.\n *\n * This is the same category as a public price list, a frontend application configuration or an i18n\n * bundle: things every caller may read, which until now could only be served by escaping the\n * resource system into a manual controller.\n *\n * ## What still confines them\n *\n * The companion asserts a loopback bind at startup and fails closed otherwise, so this surface is\n * reachable only from the developer's own machine. `APP_PUBLIC` is the right declaration on its\n * merits; the loopback bind is what makes the whole workbench local, and both remain true\n * independently.\n *\n * If an introspected resource is ever added that projects something OTHER than the application's own\n * structure, this role is wrong for it — the stance and the role must move together.\n */\nexport function createReadOnlyApiVariant() {\n  return {\n    variantType: ResourceOperationVariantType.API_CALL as const,\n    isDefault: true as const,\n    /*\n     * `APP_PUBLIC` ALONE, and that single entry is now load-bearing evidence rather than a shorthand.\n     *\n     * It briefly read `[APP_PUBLIC, APP_USER]`. That was a WORKAROUND for an engine defect (#153),\n     * not a statement about these rows: the authorizer admitted a public operation only when the\n     * caller was ALSO a public execution, so an AUTHENTICATED caller fell past that carve-out to the\n     * ordinary role gate — where `APP_PUBLIC` is in nobody's granted set — and was refused. Measured\n     * 2026-08-31 on the workbench's module projection (a resource retired the same day): with no\n     * credential the LIST answered 200 with the eight modules; with a valid administrator bearer it\n     * answered 403 `authorizations_access_denied`. The workbench's own sidebar could not read the\n     * rows it exists to show, because its operator had logged in.\n     *\n     * `requiredRolesDeclarePublicAccess` in `@wildo-ai/saas-models` is now the one named source for\n     * what `APP_PUBLIC` means, and every role gate in the engine consults it — so the sentinel\n     * genuinely admits every caller and the second role has nothing left to add. Declaring it anyway\n     * would say these rows need an authenticated reader, which is the opposite of what they are.\n     *\n     * Keeping the bare declaration is deliberate: it is the surface the fix is exercised on. If the\n     * defect ever returns, the workbench sidebar goes blank for a logged-in operator — a loud,\n     * immediate signal — instead of being silently masked by a role that was only ever there to hide\n     * it.\n     */\n    roles: [CORE_APP_ROLES.APP_PUBLIC],\n    riskLevel: ResourceOperationRiskLevel.LOW as const,\n  };\n}\n\n/**\n * The LIST variant — the read-only variant plus the page ceiling.\n *\n * Separate from {@link createReadOnlyApiVariant} because `maxPaginatedResultPerPageLimit` is only\n * read on a LIST-like operation (`isListLike` in the resource factory); putting it on READ too would\n * declare a field that operation does not have, which reads as though it did something.\n */\nexport function createReadOnlyListApiVariant() {\n  return {\n    ...createReadOnlyApiVariant(),\n    maxPaginatedResultPerPageLimit: WORKBENCH_INTROSPECTION_MAX_ROWS_PER_PAGE,\n  };\n}\n\n\n/**\n * APPLICATION-scoped, anchored by a STANDALONE relationship.\n *\n * The form the resource factory's own migration note prescribes: STANDALONE \"keeps the rel inert for\n * URL routing while declaring the structural ownership anchor\", so the resource is reachable at a\n * flat path rather than nested under `/applications/:id/`.\n *\n * APPLICATION rather than ORGANIZATIONS on purpose: these rows describe the application's own\n * structure, so the application IS their scope. There is no tenant dimension to anchor on — the\n * binding's `APPLICATION_STRUCTURE` stance above says the same thing from the data's side.\n *\n * This originally read as a consequence of API-key scoping, because the workbench browser was\n * expected to authenticate with an application-scope key. `APP_PUBLIC` removed that requirement\n * entirely (see the role note above), so the scope now rests on its own merits rather than on a\n * credential's constraint. The tenant-scoping trade remains recorded in issue #118.\n */\nexport const workbenchShared_ResourcesRelationships: ResourceRelationship[] = [\n  /*\n   * A STANDALONE anchor for the domain-model resource. Every INTROSPECTION resource needs one:\n   * `resourcePrimaryScope` is DERIVED from a relationship flagged `isPrimaryScope`, so a resource\n   * without one has no scope at all — and STANDALONE keeps it off the URL, which is what gives these\n   * resources a flat route instead of `/applications/:id/...`.\n   */\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION,\n    WorkbenchShared_ResourceType.DOMAIN_RESOURCES,\n    ResourceRelationshipCardinality.ONE,\n    ResourceRelationshipCardinality.MANY,\n    {\n      nature: RelationshipNature.COMPOSITION,\n      isPrimaryScope: true,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      contextPolicy: {},\n    },\n  ),\n  /* And for the specification-artifacts resource. Same anchor, same reason. */\n  createResourcesRelationship(\n    CoreResourceType.APPLICATION,\n    WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS,\n    ResourceRelationshipCardinality.ONE,\n    ResourceRelationshipCardinality.MANY,\n    {\n      nature: RelationshipNature.COMPOSITION,\n      isPrimaryScope: true,\n      accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n      contextPolicy: {},\n    },\n  ),\n  /*\n   * Every family-aspect resource's relationships — the same STANDALONE anchor per aspect, plus\n   * one REFERENCE per declared edge whose `foreignKeyField` is what makes reference navigation\n   * resolve. Generated from the descriptor table beside the aspect configs.\n   */\n  ...buildWorkbenchAspectRelationships(),\n  /*\n   * The creation plane's four STANDALONE anchors — same form, declared beside its configs. Merged\n   * here so the one array every registrar consumes stays the single relationship authority.\n   */\n  ...workbenchCreationPlane_ResourcesRelationships,\n];\n\n\n/**\n * The observed application's domain model — one row per resource, and the source the workbench's\n * domain-model graph is drawn from.\n *\n * ## Why a THIRD introspected resource beside modules and relationships\n *\n * Its two siblings project two DIFFERENT behaviors on two different targets, so a graph assembled\n * from both is assembled from two subprocess runs against a working tree an operator is editing —\n * nodes from one state of the application, edges from the next, with nothing to detect the mismatch.\n * `application-domain-model` answers ownership, edges, field names and specification prose from a\n * SINGLE import, which is the only shape in which the three are internally consistent. Speed is the\n * smaller half of the reason; consistency is the whole of it.\n *\n * Same tenancy stance and same PUBLIC role as its siblings, for the same reason: a resource, the\n * module that registers it and the edges it declares are facts about the application's SOURCE, with\n * no tenant dimension and no subject whose data could leak.\n */\nconst WorkbenchDomainResource_Operations = undefined;\n\ntype WorkbenchDomainResource_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST;\n\nexport const workbenchDomainResources_ResourceConfiguration_InitializationFactory =\n  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n    typeof WorkbenchDomainResource_Operations,\n    WorkbenchDomainResource_CoreOperations,\n    typeof Workbench_DomainResource_Schema\n  >({\n    mainSchema: Workbench_DomainResource_Schema,\n    resourceIdentifier: WorkbenchShared_ResourceType.DOMAIN_RESOURCES,\n    resourceFieldIdentifier:\n      WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.DOMAIN_RESOURCES],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: false,\n    persistenceAdapter: PersistenceAdapter.INTROSPECTION,\n    introspectionBinding: {\n      behavior: 'application-domain-model',\n      rowsPath: 'domainResources',\n      tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,\n      /*\n       * A resource type is unique in a registry by construction — a registry is keyed by it — so one\n       * field is the whole key here, and no discriminator can be needed.\n       *\n       * Composed onto `workbenchDomainResourceId` rather than addressing the row by `resourceType`\n       * directly: `resourceFieldIdentifier` values are published into the GLOBAL field-identifier map\n       * that resolves a foreign-key field NAME to the resource it points at, and `resourceType` is a\n       * name any application could collide with on a map whose whole job is that names are\n       * unambiguous.\n       */\n      identityFields: ['resourceType'],\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],\n    customOperation: WorkbenchDomainResource_Operations,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },\n      [CoreResourceOperation.LIST]: { variants: [createReadOnlyListApiVariant()] },\n    },\n  });\n\n/**\n * Every application-specification family the journey produces, projected for a human reviewer.\n *\n * ## What this is for\n *\n * Its three siblings project the application's STRUCTURE. This one projects the PRODUCT and its\n * obligations — vision, market, requirements, roadmap, brand, business model, the assurance\n * programme and the governed-document families — which until now were reachable only by opening a\n * TypeScript file in an editor (issue #162).\n *\n * ## Why the same behavior does not serve it\n *\n * `application-domain-model` answers questions about the resource registry. A family's content is\n * not in the registry at all: it is on the specifications package's companion exports, validated by\n * the `_core` validator the semantic authority names for it. Different target, different question,\n * different behavior — the split the two original workbench resources already demonstrate.\n *\n * ## Same posture as its siblings, for the same reason\n *\n * `APPLICATION_STRUCTURE` tenancy and `APP_PUBLIC`: a vision brief, a roadmap and a compliance\n * programme are facts about what the application's own source SAYS about itself. There is no tenant\n * dimension and no subject whose data could leak, and the companion's loopback bind is what keeps\n * the whole workbench local.\n *\n * READ and LIST only, and structurally so — `PersistenceAdapter.INTROSPECTION` refuses every write\n * verb, rows are derived per read and nothing is stored. Acceptance of a specification is a human\n * git commit (`.claude/rules/one-source-of-truth.md` rule 2), so there is deliberately no place here\n * for an acceptance state to accumulate, not even by accident.\n */\nconst WorkbenchSpecificationArtifact_Operations = undefined;\n\ntype WorkbenchSpecificationArtifact_CoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST;\n\nexport const workbenchSpecificationArtifacts_ResourceConfiguration_InitializationFactory =\n  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n    typeof WorkbenchSpecificationArtifact_Operations,\n    WorkbenchSpecificationArtifact_CoreOperations,\n    typeof Workbench_SpecificationArtifact_Schema\n  >({\n    mainSchema: Workbench_SpecificationArtifact_Schema,\n    resourceIdentifier: WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS,\n    resourceFieldIdentifier:\n      WorkbenchShared_ResourceFieldIdentifier[WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: false,\n    persistenceAdapter: PersistenceAdapter.INTROSPECTION,\n    introspectionBinding: {\n      behavior: 'specification-artifacts',\n      rowsPath: 'artifacts',\n      tenancy: IntrospectionTenancyStance.APPLICATION_STRUCTURE,\n      /*\n       * NO `identityFields`, and the omission is the point.\n       *\n       * Every row already carries `family`, and `family` IS this resource's\n       * `resourceFieldIdentifier` — so there is nothing to compose. This is the `moduleId` case, not\n       * the relationships one: declaring an identity here would stamp a composed key over a real\n       * field, replacing the source's own id with a copy of itself.\n       */\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST],\n    customOperation: WorkbenchSpecificationArtifact_Operations,\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: { variants: [createReadOnlyApiVariant()] },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          ...createReadOnlyListApiVariant(),\n          /*\n           * The two review axes a reader slices fifteen rows by. Declaring them is an OBLIGATION,\n           * not a hint: the introspection source honors exactly the scalar-equality/IN filters that\n           * reach it and REFUSES shapes it cannot apply, because a declared filter that is silently\n           * dropped returns the unfiltered set wearing a filtered label — the `--state ready` defect\n           * class. The frontend's concern quick-filter tabs require `concern` to be here, or the\n           * tab strip silently never renders.\n           */\n          filterFields: {\n            concern: z.enum(WorkbenchSpecificationArtifactConcern),\n            state: z.enum(WorkbenchSpecificationArtifactState),\n          },\n        }],\n      },\n    },\n  });\n\nexport const workbenchShared_ResourcesConfigurationsFactoryMap = {\n  [WorkbenchShared_ResourceType.DOMAIN_RESOURCES]:\n    workbenchDomainResources_ResourceConfiguration_InitializationFactory,\n  [WorkbenchShared_ResourceType.SPECIFICATION_ARTIFACTS]:\n    workbenchSpecificationArtifacts_ResourceConfiguration_InitializationFactory,\n  // The 40 family-aspect resources — generated from the descriptor table, one mold for all.\n  ...workbenchAspectResources_ConfigurationsFactoryMap,\n  // The creation plane — companion-RUNTIME projections (authenticated, APPLICATION_RUNTIME tenancy).\n  ...workbenchCreationPlane_ResourcesConfigurationsFactoryMap,\n};\n"]}