npm - @wildo-ai/platform-core-shared - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/platform-core-shared 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (61) hide show

package/dist/esm/index.d.ts CHANGED Viewed

@@ -2,6 +2,11 @@ export * from './core/resources/resources-types.custom.shared.schemas';
 export * from './workbench/workbench-resources-types.custom.shared.schemas';
 export * from './workbench/workbench-resources.custom.shared.schemas';
 export * from './workbench/workbench-resources.custom.shared.resources-config.schemas';
+export * from './workbench/workbench-creation-plane.custom.shared.schemas';
+export * from './workbench/workbench-creation-plane.custom.shared.resources-config.schemas';
+export * from './workbench/workbench-aspect-resources.custom.shared.schemas';
+export * from './workbench/workbench-creation-board.custom.shared.schemas';
+export * from './workbench/workbench-domain-model.custom.shared.schemas';
 export * from './core/resources/resources-relationships.custom.shared.definitions';
 export * from './core/resources/resources-operations.custom.shared.definitions';
 export * from './security/authorizations/roles.custom.shared.definitions';
@@ -14,4 +19,6 @@ export * from './wildo-applications/wildo-applications.custom.shared.schemas';
 export * from './wildo-applications-versions/wildo-applications-versions.custom.shared.schemas';
 export * from './wildo-application-executions/wildo-application-executions.custom.shared.schemas';
 export * from './wildo-application-tasks/wildo-application-tasks.custom.shared.schemas';
+export * from './wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas';
+export * from './wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,wDAAwD,CAAC;AAWvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAGhF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,sCAAsC,CAAC;AAGrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,eAAO,MAAM,sBAAsB,EAAE,iBAAiB,EAAO,CAAC;AAK9D,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,wDAAwD,CAAC;AAWvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAGhF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,sCAAsC,CAAC;AAGrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,eAAO,MAAM,sBAAsB,EAAE,iBAAiB,EAAO,CAAC;AAK9D,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC;AACxF,cAAc,oGAAoG,CAAC;AACnH,cAAc,0FAA0F,CAAC"}

package/dist/esm/index.js CHANGED Viewed

@@ -15,6 +15,11 @@ export * from './core/resources/resources-types.custom.shared.schemas.js';
 export * from './workbench/workbench-resources-types.custom.shared.schemas.js';
 export * from './workbench/workbench-resources.custom.shared.schemas.js';
 export * from './workbench/workbench-resources.custom.shared.resources-config.schemas.js';
+export * from './workbench/workbench-creation-plane.custom.shared.schemas.js';
+export * from './workbench/workbench-creation-plane.custom.shared.resources-config.schemas.js';
+export * from './workbench/workbench-aspect-resources.custom.shared.schemas.js';
+export * from './workbench/workbench-creation-board.custom.shared.schemas.js';
+export * from './workbench/workbench-domain-model.custom.shared.schemas.js';
 export * from './core/resources/resources-relationships.custom.shared.definitions.js';
 export * from './core/resources/resources-operations.custom.shared.definitions.js';
 // Custom security
@@ -29,4 +34,6 @@ export * from './wildo-applications-versions/wildo-applications-versions.custom.
 // ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_end ] [ END ]  ##########################################################
 export * from './wildo-application-executions/wildo-application-executions.custom.shared.schemas.js';
 export * from './wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.js';
+export * from './wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.js';
+export * from './wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,iBAAiB,EAAE,CAAC;AAEpB,mBAAmB;AACnB,cAAc,wDAAwD,CAAC;AAEvE;;;;;;;;GAQG;AACH,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAEhF,kBAAkB;AAClB,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,sCAAsC,CAAC;AAIrD,MAAM,CAAC,MAAM,sBAAsB,GAAwB,EAAE,CAAC;AAG9D,0NAA0N;AAE1N,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAEhG,uIAAuI;AAEvI,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC","sourcesContent":["// Initialize Zod decorators early (lazy init will also happen on first use)\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\ninitZodDecorators();\n\n// Custom resources\nexport * from './core/resources/resources-types.custom.shared.schemas';\n\n/\n The workbench's own vocabulary, kept SEPARATE from `customShared_` on purpose.\n \n * These resources are INTROSPECTION-backed — derived per read by the dev companion, never stored.\n * Adding them to `customShared_ResourcesConfigurationsFactoryMap` would hand them to that map's six\n * consumers, two of which must not have them: `platform-apps-manager` (whose INIT lifecycle applies\n * migrations, and there is nothing here to migrate) and the companion's i18n labelling planner,\n * which enumerates that map's keys and would generate labels for them.\n /\nexport from './workbench/workbench-resources-types.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.resources-config.schemas';\nexport * from './core/resources/resources-relationships.custom.shared.definitions';\nexport * from './core/resources/resources-operations.custom.shared.definitions';\n\n// Custom security\nexport * from './security/authorizations/roles.custom.shared.definitions';\nexport * from './runtime/application-backend-env.contracts';\nexport * from './runtime/application-worker-env.contracts';\nexport * from './runtime/runtime-topology.contracts';\n\n// Custom billing — product catalog (placeholder until product definitions are configured)\nimport type { ProductDefinition } from '@wildo-ai/saas-models';\nexport const CUSTOM_PRODUCT_CATALOG: ProductDefinition[] = [];\n\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_begin ] [ BEGIN ] - Do not edit this code block. It is used by the platform to manage the code - ##########################################################\n\nexport * from './wildo-applications/wildo-applications.custom.shared.schemas';\nexport * from './wildo-applications-versions/wildo-applications-versions.custom.shared.schemas';\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_end ] [ END ] ##########################################################\n\nexport * from './wildo-application-executions/wildo-application-executions.custom.shared.schemas';\nexport * from './wildo-application-tasks/wildo-application-tasks.custom.shared.schemas';\n\n\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,iBAAiB,EAAE,CAAC;AAEpB,mBAAmB;AACnB,cAAc,wDAAwD,CAAC;AAEvE;;;;;;;;GAQG;AACH,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAEhF,kBAAkB;AAClB,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,sCAAsC,CAAC;AAIrD,MAAM,CAAC,MAAM,sBAAsB,GAAwB,EAAE,CAAC;AAG9D,0NAA0N;AAE1N,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAEhG,uIAAuI;AAEvI,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC;AACxF,cAAc,oGAAoG,CAAC;AACnH,cAAc,0FAA0F,CAAC","sourcesContent":["// Initialize Zod decorators early (lazy init will also happen on first use)\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\ninitZodDecorators();\n\n// Custom resources\nexport * from './core/resources/resources-types.custom.shared.schemas';\n\n/\n The workbench's own vocabulary, kept SEPARATE from `customShared_` on purpose.\n \n * These resources are INTROSPECTION-backed — derived per read by the dev companion, never stored.\n * Adding them to `customShared_ResourcesConfigurationsFactoryMap` would hand them to that map's six\n * consumers, two of which must not have them: `platform-apps-manager` (whose INIT lifecycle applies\n * migrations, and there is nothing here to migrate) and the companion's i18n labelling planner,\n * which enumerates that map's keys and would generate labels for them.\n /\nexport from './workbench/workbench-resources-types.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.resources-config.schemas';\nexport * from './workbench/workbench-creation-plane.custom.shared.schemas';\nexport * from './workbench/workbench-creation-plane.custom.shared.resources-config.schemas';\nexport * from './workbench/workbench-aspect-resources.custom.shared.schemas';\nexport * from './workbench/workbench-creation-board.custom.shared.schemas';\nexport * from './workbench/workbench-domain-model.custom.shared.schemas';\nexport * from './core/resources/resources-relationships.custom.shared.definitions';\nexport * from './core/resources/resources-operations.custom.shared.definitions';\n\n// Custom security\nexport * from './security/authorizations/roles.custom.shared.definitions';\nexport * from './runtime/application-backend-env.contracts';\nexport * from './runtime/application-worker-env.contracts';\nexport * from './runtime/runtime-topology.contracts';\n\n// Custom billing — product catalog (placeholder until product definitions are configured)\nimport type { ProductDefinition } from '@wildo-ai/saas-models';\nexport const CUSTOM_PRODUCT_CATALOG: ProductDefinition[] = [];\n\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_begin ] [ BEGIN ] - Do not edit this code block. It is used by the platform to manage the code - ##########################################################\n\nexport * from './wildo-applications/wildo-applications.custom.shared.schemas';\nexport * from './wildo-applications-versions/wildo-applications-versions.custom.shared.schemas';\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_end ] [ END ] ##########################################################\n\nexport * from './wildo-application-executions/wildo-application-executions.custom.shared.schemas';\nexport * from './wildo-application-tasks/wildo-application-tasks.custom.shared.schemas';\nexport * from './wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas';\nexport * from './wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas';\n\n\n"]}

package/dist/esm/runtime/application-backend-env.contracts.d.ts CHANGED Viewed

@@ -265,4 +265,24 @@ export declare function buildMinionServiceName(appSlug: string, minionName: stri
  * `http.port` (schema default 8080).
  */
 export declare function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string;
+/**
+ * The base URL the app-backend uses to reach a per-app worker in LOCAL development.
+ *
+ * There is no k8s Service locally, so there is no name to resolve — the worker is a supervised
+ * process listening on its authored `http.port` on the loopback interface, which is the same
+ * convention every other local runtime address in this repository uses.
+ *
+ * ## Why this exists at all (#426)
+ *
+ * `buildApplicationWorkerDispatchUrls` used to return `undefined` for anything but REMOTE, on the
+ * reasoning that "local dev has no k8s Services, and worker dispatch is a k8s-deploy concern". The
+ * first half is still true and the second no longer is: local dev now STARTS the worker, so the
+ * only thing missing was an address. Without one, `WorkerRemoteClientFactory.client()` fails closed
+ * on the absent `WILDO_WORKER_<NAME>_URL` — which is why the whole backend-to-worker chain had
+ * never been exercised by anyone, in a test or in the dev stack.
+ *
+ * Declared here, beside its in-cluster sibling and the env-key helper both sides derive, so the
+ * emit side and the read side cannot drift apart for either deployment shape.
+ */
+export declare function buildWorkerLocalUrl(port: number): string;
 //# sourceMappingURL=application-backend-env.contracts.d.ts.map

package/dist/esm/runtime/application-backend-env.contracts.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,oIAAoI;IACpI,wBAAwB,6BAA6B;IACrD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,qCAAqC,0CAA0C;IAC/E,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;IAC/D,8IAA8I;IAC9I,gCAAgC,qCAAqC;CACtE;AAED,oBAAY,4BAA4B;IACtC;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,eAAe,oBAAoB;IACnC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB;;;;OAIG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;;;OAYG;IACH,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,qBAAqB,0BAA0B;IAc/C,sBAAsB,2BAA2B;IACjD,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,2ZAQ7C,CAAC;AAEX,eAAO,MAAM,6CAA6C,wJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4IAG3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,m0CA8BxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,i+DAKnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,aAKjD,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhG"}
1	+ {"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,oIAAoI;IACpI,wBAAwB,6BAA6B;IACrD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,qCAAqC,0CAA0C;IAC/E,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;IAC/D,8IAA8I;IAC9I,gCAAgC,qCAAqC;CACtE;AAED,oBAAY,4BAA4B;IACtC;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,eAAe,oBAAoB;IACnC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB;;;;OAIG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;;;OAYG;IACH,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,qBAAqB,0BAA0B;IAc/C,sBAAsB,2BAA2B;IACjD,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,2ZAQ7C,CAAC;AAEX,eAAO,MAAM,6CAA6C,wJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4IAG3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,m0CA8BxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,i+DAKnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,aAKjD,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/dist/esm/runtime/application-backend-env.contracts.js CHANGED Viewed

@@ -356,4 +356,26 @@ export function buildMinionServiceName(appSlug, minionName) {
 export function buildWorkerInternalUrl(appSlug, workerName, port) {
     return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;
 }
+/**
+ * The base URL the app-backend uses to reach a per-app worker in LOCAL development.
+ *
+ * There is no k8s Service locally, so there is no name to resolve — the worker is a supervised
+ * process listening on its authored `http.port` on the loopback interface, which is the same
+ * convention every other local runtime address in this repository uses.
+ *
+ * ## Why this exists at all (#426)
+ *
+ * `buildApplicationWorkerDispatchUrls` used to return `undefined` for anything but REMOTE, on the
+ * reasoning that "local dev has no k8s Services, and worker dispatch is a k8s-deploy concern". The
+ * first half is still true and the second no longer is: local dev now STARTS the worker, so the
+ * only thing missing was an address. Without one, `WorkerRemoteClientFactory.client()` fails closed
+ * on the absent `WILDO_WORKER_<NAME>_URL` — which is why the whole backend-to-worker chain had
+ * never been exercised by anyone, in a test or in the dev stack.
+ *
+ * Declared here, beside its in-cluster sibling and the env-key helper both sides derive, so the
+ * emit side and the read side cannot drift apart for either deployment shape.
+ */
+export function buildWorkerLocalUrl(port) {
+    return `http://localhost:${port}`;
+}
 //# sourceMappingURL=application-backend-env.contracts.js.map

package/dist/esm/runtime/application-backend-env.contracts.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCASX;AATD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,oIAAoI;IACpI,0FAAqD,CAAA;IACrD,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD,wEAAmC,CAAA;AACrC,CAAC,EATW,iCAAiC,KAAjC,iCAAiC,QAS5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,sHAA+E,CAAA;IAC/E,oGAA6D,CAAA;AAC/D,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;IAC/D,8IAA8I;IAC9I,wGAAqE,CAAA;AACvE,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAED,MAAM,CAAN,IAAY,4BA6IX;AA7ID,WAAY,4BAA4B;IACtC;;;;;;;;;;;OAWG;IACH,qFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,yEAAyC,CAAA;IACzC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,mEAAmC,CAAA;IACnC,mEAAmC,CAAA;IACnC,2EAA2C,CAAA;IAC3C,2EAA2C,CAAA;IAC3C,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB;;;;OAIG;IACH,iEAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAqC,CAAA;IACrC,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IACjC,qEAAqC,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,+EAA+C,CAAA;IAC/C,8EAA8E;IAC9E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,sEAAsE;IACtE,iFAAiD,CAAA;IACjD,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EA7IW,4BAA4B,KAA5B,4BAA4B,QA6IvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,wBAAwB;IAC1D,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,qCAAqC;IACzE,mCAAmC,CAAC,4BAA4B;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;IAC7D,+BAA+B,CAAC,gCAAgC;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,wBAAwB;IACrD,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,qBAAqB;IAClD,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,kDAAkD;CACnD,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU;SACd,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,uCAAuC;SAC9E,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,qCAAqC;SACpE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,mBAAmB;SACvC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa;SACnC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,2BAA2B,GAAG,yBAAyB,CAAC,UAAU,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,mCAAmC;SAC1E,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,+CAA+C;SAC3E,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;IACtF,OAAO,UAAU,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC","sourcesContent":["/*\n Shared environment contract for application backend processes.\n \n This is the canonical vocabulary for the app-backend `.env` surface emitted\n * by the CLI and parsed by backend runtimes. Keep the keys here purely\n * declarative: they describe names and ownership, not executor-specific\n * behavior.\n /\n\nexport enum ApplicationBackendBootstrapEnvKey {\n APPLICATION_ID = 'APPLICATION_ID',\n SERVICE_NAME = 'SERVICE_NAME',\n PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n /* Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. /\n DEPLOYMENT_LOCATION_TYPE = 'DEPLOYMENT_LOCATION_TYPE',\n PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationBackendPlatformUrlEnvKey {\n PLATFORM_CRONTABS_BATCHES_MANAGER_URL = 'PLATFORM_CRONTABS_BATCHES_MANAGER_URL',\n PLATFORM_MODULE_REGISTRY_URL = 'PLATFORM_MODULE_REGISTRY_URL',\n}\n\nexport enum ApplicationBackendRuntimeEnvKey {\n APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n /* Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. /\n APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n}\n\nexport enum ApplicationBackendDataEnvKey {\n /\n Which persistence adapter the application's resources use.\n \n DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no\n * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only\n * by a test that reached into the config object directly, which is why no application had ever\n * booted on it. Deriving it instead (\"PostgreSQL keys are present, so use PostgreSQL\") was\n * rejected: which store an application persists to is a deployment decision that must be legible\n * in one place, not an emergent property of which variables happen to be set.\n \n Absent means MONGODB, so every existing deployment is unaffected.\n /\n DATABASE_DEFAULT_ADAPTER = 'DATABASE_DEFAULT_ADAPTER',\n /\n The format NEW resource identifiers are minted in — `object-id` or `uuid`.\n \n DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to\n * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's\n * identity format a side effect of where its rows happen to live: moving a resource between\n * adapters silently changed the shape of every id it minted AND made every id it had already\n * minted fail `validateForResource`. Identity reaches URLs, exports, external references and\n * integrations, so it is an application-level decision that must outlive a storage decision.\n \n It needed an env key for the same reason the adapter did. The loader hard-coded\n * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an\n * application could select PostgreSQL and still had no supported way to STATE its identity format,\n * which left the engine's \"declared, never derived\" rule true in the schema and unreachable in\n * practice.\n \n Absent means `OBJECT_ID` — what every existing application already mints — so no deployment\n * changes behaviour by adding this key to the contract.\n \n One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold\n * the declared format. DDL rendered from the schema plan types it `text`, which is correct for\n * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects\n * an `OBJECT_ID` outright.\n /\n RESOURCE_ID_FORMAT = 'RESOURCE_ID_FORMAT',\n MONGODB_HOST = 'MONGODB_HOST',\n MONGODB_DATABASE = 'MONGODB_DATABASE',\n MONGODB_PROTOCOL = 'MONGODB_PROTOCOL',\n MONGODB_DIRECT_CONNECTION = 'MONGODB_DIRECT_CONNECTION',\n /\n PostgreSQL TOPOLOGY only — host, port, database, ssl.\n \n CREDENTIALS are deliberately NOT here. They arrive through\n * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,\n * secrets carry who may open it. Putting a password in an env contract would make it readable\n * from every process listing and every container inspect.\n /\n POSTGRESQL_HOST = 'POSTGRESQL_HOST',\n POSTGRESQL_PORT = 'POSTGRESQL_PORT',\n POSTGRESQL_DATABASE = 'POSTGRESQL_DATABASE',\n POSTGRESQL_SSL_MODE = 'POSTGRESQL_SSL_MODE',\n REDIS_HOST = 'REDIS_HOST',\n REDIS_PORT = 'REDIS_PORT',\n /\n Optional Redis logical database index (0–15). Emitted only when the\n * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.\n * Consumers default to DB 0 when this var is missing.\n /\n REDIS_DATABASE = 'REDIS_DATABASE',\n /\n Canonical app-level Redis key namespace. Emitted only when the author\n * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).\n * `RedisService` uses this as the `appPrefix` for all keys it writes — every\n * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or\n * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix\n * stays empty (multi-tenant isolation falls back to the\n * `org:`/`global:` segment alone).\n \n REPLACE semantics: this supersedes the legacy\n * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit\n * decision — single source of truth = `wildo.saas.config.dataServices`).\n /\n REDIS_KEY_PREFIX = 'REDIS_KEY_PREFIX',\n RABBITMQ_HOST = 'RABBITMQ_HOST',\n RABBITMQ_PORT = 'RABBITMQ_PORT',\n /\n Optional RabbitMQ virtual host. Emitted only when the author sets\n * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.\n * Consumers default to `/` (the RabbitMQ root vhost) when missing.\n \n Note (Slice 3.6 audit): the symmetric saas-side field\n * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an\n * infra/topology concern with a single authoring seam (infra config).\n /\n RABBITMQ_VHOST = 'RABBITMQ_VHOST',\n STORAGE_PROVIDER = 'STORAGE_PROVIDER',\n /\n S3-compatible endpoint hostname (NOT a URL). The variable name\n * pre-dates the convention pin and is intentionally kept stable for\n * backward compatibility with deployed manifests, but the value is\n * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the\n * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the\n * full `https?://host:port` URL at the SDK initialization site.\n \n Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)\n * silently breaks the `host:port` contract downstream because the SDK\n * concatenates the parts naively. If a future migration wants to flip\n * the contract to a URL, rename the env key (`STORAGE_URL`) rather\n * than overloading this one — the rename surfaces the breaking change\n * to operators.\n /\n STORAGE_ENDPOINT = 'STORAGE_ENDPOINT',\n STORAGE_PORT = 'STORAGE_PORT',\n STORAGE_USE_SSL = 'STORAGE_USE_SSL',\n STORAGE_BUCKET = 'STORAGE_BUCKET',\n /\n Optional app-level object-key namespace prefix prepended to every\n * application file path produced by `WildoManagedStorageProvider`\n * (Slice 3.6). Final key shape becomes\n * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`\n * (extra segment above the existing `applicationId`-based namespace).\n \n Emitted only when the author sets `dataServices.s3.bucketPrefix` in\n * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)\n * remains infra-controlled and is unaffected by this prefix — N apps\n * can share one bucket while keeping their object trees disjoint.\n /\n STORAGE_BUCKET_PREFIX = 'STORAGE_BUCKET_PREFIX',\n // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from\n // this contract, and must not be re-added.\n //\n // They carried the object store's ROOT credential — the same pair the MinIO\n // container itself is created with — into every application, minion and worker\n // environment. An application now obtains short-lived, prefix-confined session\n // credentials from apps-manager instead (`createStsStorageCredentialResolver`),\n // so there is no application-tier storage credential to name here.\n //\n // Re-adding them would not merely restore a variable: this enum is the DECLARED\n // app-backend env surface, so a key here is an invitation for a builder to fill\n // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.\n // See `.claude/plans/object-storage-root-credential-distribution.md`.\n STORAGE_LOCAL_BASE_DIR = 'STORAGE_LOCAL_BASE_DIR',\n CLAMAV_HOST = 'CLAMAV_HOST',\n CLAMAV_PORT = 'CLAMAV_PORT',\n YARA_ENABLED = 'YARA_ENABLED',\n YARA_HOST = 'YARA_HOST',\n YARA_PORT = 'YARA_PORT',\n}\n\n/\n Keep the plural `Keys` aliases so current consumers keep reading naturally,\n while the actual source of truth is the scoped enum definition above.\n /\nexport const ApplicationBackendBootstrapEnvKeys = ApplicationBackendBootstrapEnvKey;\nexport const ApplicationBackendPlatformUrlEnvKeys = ApplicationBackendPlatformUrlEnvKey;\nexport const ApplicationBackendRuntimeEnvKeys = ApplicationBackendRuntimeEnvKey;\nexport const ApplicationBackendDataEnvKeys = ApplicationBackendDataEnvKey;\n\nexport const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [\n ApplicationBackendBootstrapEnvKey.APPLICATION_ID,\n ApplicationBackendBootstrapEnvKey.SERVICE_NAME,\n ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,\n] as const;\n\nexport const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [\n ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,\n ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,\n ApplicationBackendDataEnvKey.MONGODB_HOST,\n ApplicationBackendDataEnvKey.MONGODB_DATABASE,\n ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,\n ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,\n ApplicationBackendDataEnvKey.POSTGRESQL_HOST,\n ApplicationBackendDataEnvKey.POSTGRESQL_PORT,\n ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,\n ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,\n ApplicationBackendDataEnvKey.REDIS_HOST,\n ApplicationBackendDataEnvKey.REDIS_PORT,\n ApplicationBackendDataEnvKey.REDIS_DATABASE,\n ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,\n ApplicationBackendDataEnvKey.RABBITMQ_HOST,\n ApplicationBackendDataEnvKey.RABBITMQ_PORT,\n ApplicationBackendDataEnvKey.RABBITMQ_VHOST,\n ApplicationBackendDataEnvKey.STORAGE_PROVIDER,\n ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,\n ApplicationBackendDataEnvKey.STORAGE_PORT,\n ApplicationBackendDataEnvKey.STORAGE_USE_SSL,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,\n ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,\n ApplicationBackendDataEnvKey.CLAMAV_HOST,\n ApplicationBackendDataEnvKey.CLAMAV_PORT,\n ApplicationBackendDataEnvKey.YARA_ENABLED,\n ApplicationBackendDataEnvKey.YARA_HOST,\n ApplicationBackendDataEnvKey.YARA_PORT,\n] as const;\n\nexport const APPLICATION_BACKEND_ENV_KEY_LIST = [\n ...APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_DATA_ENV_KEY_LIST,\n] as const;\n\n/\n Keys that must always be treated as secrets when this app-backend env surface\n * is materialized into logs, CI artifacts, or deployment manifests.\n /\nexport const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set<string>([\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n // The storage pair is gone rather than listed: an app-tier env no longer\n // carries an object-storage credential at all, so there is nothing here to\n // mark sensitive. See the note on the enum above.\n]);\n\nexport type ApplicationBackendEnvKey =\n typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];\n\n/\n ────────────────────────────────────────────────────────────────────────\n * Backend → worker dispatch contract (G-8 / MW4)\n * ────────────────────────────────────────────────────────────────────────\n * A declared worker's HTTP base URL is injected into the app-backend env at\n * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC\n * (one per declared worker), so — unlike the static enums above — the key is a\n * HELPER, not a fixed member. Both the CLI EMIT side\n * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ\n * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL\n * through these single helpers so the two can never drift.\n /\nexport const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';\nexport const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';\n\n/\n Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —\n * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the\n * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both\n * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env\n * key is stable regardless of the authoring style.\n /\nexport function normalizeWorkerEnvSegment(workerName: string): string {\n return workerName\n .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore\n .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore\n .replace(/_+/g, '_') // collapse repeats\n .replace(/^_\|_$/g, '') // trim edges\n .toUpperCase();\n}\n\n/\n The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single\n * source of truth for both emit (CLI) and read (backend factory).\n \n @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'\n /\nexport function wildoWorkerUrlEnvKey(workerName: string): string {\n return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;\n}\n\n/\n Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket\n * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)\n * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no\n * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,\n * `myNodeWorker` → `my-node-worker`.\n \n This is the DNS-NAME axis of a background runtime — the segment embedded in the\n * k8s object/Service name, the built container image ref, the compose service name,\n * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw\n * bucket key), which apps-manager keys on (`appConfig.workers[key]` /\n * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`\n * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the\n * identity axis MUST stay raw and is NEVER passed through this helper. The\n * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,\n * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a\n * DNS label.\n \n This helper does NOT truncate — a name too long for a DNS label (63 chars) is\n * REJECTED at authoring, not silently shortened (truncation risks colliding with\n * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in\n * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with\n * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name\n * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach\n * the render.\n /\nexport function normalizeServiceKeyToDnsName(key: string): string {\n return key\n .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen\n .toLowerCase()\n .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen\n .replace(/^-+\|-+$/g, ''); // trim leading/trailing hyphens\n}\n\n/\n The k8s Service (and same-network compose service) name for a per-app worker:\n * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction\n * with the CLI k8s render (`renderWorkerForTarget`), the compose render\n * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker\n * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives\n * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so\n * the backend calls the exact Service the render deploys and CI builds the exact\n * image ref the deploy pulls.\n \n `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —\n * passed raw; the normalization happens inside. The raw key remains the worker's\n * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that\n * is never derived from this function.\n /\nexport function buildWorkerServiceName(appSlug: string, workerName: string): string {\n return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;\n}\n\n/\n The k8s Deployment (and same-network compose service) name for a per-app minion:\n * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with\n * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,\n * but the k8s render, the compose render, and the CI image build all need the\n * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is\n * the saas-config bucket key; the raw key stays the minion's IDENTITY (the\n * `wildo.ai/owned-service-name` pod label), never derived from here.\n /\nexport function buildMinionServiceName(appSlug: string, minionName: string): string {\n return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;\n}\n\n/\n The in-cluster base URL the app-backend uses to reach a per-app worker\n * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers\n * deploy into the SAME namespace (per-app deploy), so the short Service name\n * resolves without a namespace qualifier. `port` is the worker's authored\n * `http.port` (schema default 8080).\n */\nexport function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string {\n return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;\n}\n"]}
1	+ {"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCASX;AATD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,oIAAoI;IACpI,0FAAqD,CAAA;IACrD,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD,wEAAmC,CAAA;AACrC,CAAC,EATW,iCAAiC,KAAjC,iCAAiC,QAS5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,sHAA+E,CAAA;IAC/E,oGAA6D,CAAA;AAC/D,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;IAC/D,8IAA8I;IAC9I,wGAAqE,CAAA;AACvE,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAED,MAAM,CAAN,IAAY,4BA6IX;AA7ID,WAAY,4BAA4B;IACtC;;;;;;;;;;;OAWG;IACH,qFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,yEAAyC,CAAA;IACzC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,mEAAmC,CAAA;IACnC,mEAAmC,CAAA;IACnC,2EAA2C,CAAA;IAC3C,2EAA2C,CAAA;IAC3C,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB;;;;OAIG;IACH,iEAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAqC,CAAA;IACrC,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IACjC,qEAAqC,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,+EAA+C,CAAA;IAC/C,8EAA8E;IAC9E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,sEAAsE;IACtE,iFAAiD,CAAA;IACjD,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EA7IW,4BAA4B,KAA5B,4BAA4B,QA6IvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,wBAAwB;IAC1D,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,qCAAqC;IACzE,mCAAmC,CAAC,4BAA4B;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;IAC7D,+BAA+B,CAAC,gCAAgC;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,wBAAwB;IACrD,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,qBAAqB;IAClD,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,kDAAkD;CACnD,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU;SACd,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,uCAAuC;SAC9E,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,qCAAqC;SACpE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,mBAAmB;SACvC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa;SACnC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,2BAA2B,GAAG,yBAAyB,CAAC,UAAU,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,mCAAmC;SAC1E,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,+CAA+C;SAC3E,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;IACtF,OAAO,UAAU,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/*\n Shared environment contract for application backend processes.\n \n This is the canonical vocabulary for the app-backend `.env` surface emitted\n * by the CLI and parsed by backend runtimes. Keep the keys here purely\n * declarative: they describe names and ownership, not executor-specific\n * behavior.\n /\n\nexport enum ApplicationBackendBootstrapEnvKey {\n APPLICATION_ID = 'APPLICATION_ID',\n SERVICE_NAME = 'SERVICE_NAME',\n PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n /* Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. /\n DEPLOYMENT_LOCATION_TYPE = 'DEPLOYMENT_LOCATION_TYPE',\n PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationBackendPlatformUrlEnvKey {\n PLATFORM_CRONTABS_BATCHES_MANAGER_URL = 'PLATFORM_CRONTABS_BATCHES_MANAGER_URL',\n PLATFORM_MODULE_REGISTRY_URL = 'PLATFORM_MODULE_REGISTRY_URL',\n}\n\nexport enum ApplicationBackendRuntimeEnvKey {\n APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n /* Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. /\n APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n}\n\nexport enum ApplicationBackendDataEnvKey {\n /\n Which persistence adapter the application's resources use.\n \n DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no\n * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only\n * by a test that reached into the config object directly, which is why no application had ever\n * booted on it. Deriving it instead (\"PostgreSQL keys are present, so use PostgreSQL\") was\n * rejected: which store an application persists to is a deployment decision that must be legible\n * in one place, not an emergent property of which variables happen to be set.\n \n Absent means MONGODB, so every existing deployment is unaffected.\n /\n DATABASE_DEFAULT_ADAPTER = 'DATABASE_DEFAULT_ADAPTER',\n /\n The format NEW resource identifiers are minted in — `object-id` or `uuid`.\n \n DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to\n * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's\n * identity format a side effect of where its rows happen to live: moving a resource between\n * adapters silently changed the shape of every id it minted AND made every id it had already\n * minted fail `validateForResource`. Identity reaches URLs, exports, external references and\n * integrations, so it is an application-level decision that must outlive a storage decision.\n \n It needed an env key for the same reason the adapter did. The loader hard-coded\n * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an\n * application could select PostgreSQL and still had no supported way to STATE its identity format,\n * which left the engine's \"declared, never derived\" rule true in the schema and unreachable in\n * practice.\n \n Absent means `OBJECT_ID` — what every existing application already mints — so no deployment\n * changes behaviour by adding this key to the contract.\n \n One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold\n * the declared format. DDL rendered from the schema plan types it `text`, which is correct for\n * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects\n * an `OBJECT_ID` outright.\n /\n RESOURCE_ID_FORMAT = 'RESOURCE_ID_FORMAT',\n MONGODB_HOST = 'MONGODB_HOST',\n MONGODB_DATABASE = 'MONGODB_DATABASE',\n MONGODB_PROTOCOL = 'MONGODB_PROTOCOL',\n MONGODB_DIRECT_CONNECTION = 'MONGODB_DIRECT_CONNECTION',\n /\n PostgreSQL TOPOLOGY only — host, port, database, ssl.\n \n CREDENTIALS are deliberately NOT here. They arrive through\n * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,\n * secrets carry who may open it. Putting a password in an env contract would make it readable\n * from every process listing and every container inspect.\n /\n POSTGRESQL_HOST = 'POSTGRESQL_HOST',\n POSTGRESQL_PORT = 'POSTGRESQL_PORT',\n POSTGRESQL_DATABASE = 'POSTGRESQL_DATABASE',\n POSTGRESQL_SSL_MODE = 'POSTGRESQL_SSL_MODE',\n REDIS_HOST = 'REDIS_HOST',\n REDIS_PORT = 'REDIS_PORT',\n /\n Optional Redis logical database index (0–15). Emitted only when the\n * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.\n * Consumers default to DB 0 when this var is missing.\n /\n REDIS_DATABASE = 'REDIS_DATABASE',\n /\n Canonical app-level Redis key namespace. Emitted only when the author\n * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).\n * `RedisService` uses this as the `appPrefix` for all keys it writes — every\n * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or\n * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix\n * stays empty (multi-tenant isolation falls back to the\n * `org:`/`global:` segment alone).\n \n REPLACE semantics: this supersedes the legacy\n * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit\n * decision — single source of truth = `wildo.saas.config.dataServices`).\n /\n REDIS_KEY_PREFIX = 'REDIS_KEY_PREFIX',\n RABBITMQ_HOST = 'RABBITMQ_HOST',\n RABBITMQ_PORT = 'RABBITMQ_PORT',\n /\n Optional RabbitMQ virtual host. Emitted only when the author sets\n * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.\n * Consumers default to `/` (the RabbitMQ root vhost) when missing.\n \n Note (Slice 3.6 audit): the symmetric saas-side field\n * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an\n * infra/topology concern with a single authoring seam (infra config).\n /\n RABBITMQ_VHOST = 'RABBITMQ_VHOST',\n STORAGE_PROVIDER = 'STORAGE_PROVIDER',\n /\n S3-compatible endpoint hostname (NOT a URL). The variable name\n * pre-dates the convention pin and is intentionally kept stable for\n * backward compatibility with deployed manifests, but the value is\n * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the\n * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the\n * full `https?://host:port` URL at the SDK initialization site.\n \n Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)\n * silently breaks the `host:port` contract downstream because the SDK\n * concatenates the parts naively. If a future migration wants to flip\n * the contract to a URL, rename the env key (`STORAGE_URL`) rather\n * than overloading this one — the rename surfaces the breaking change\n * to operators.\n /\n STORAGE_ENDPOINT = 'STORAGE_ENDPOINT',\n STORAGE_PORT = 'STORAGE_PORT',\n STORAGE_USE_SSL = 'STORAGE_USE_SSL',\n STORAGE_BUCKET = 'STORAGE_BUCKET',\n /\n Optional app-level object-key namespace prefix prepended to every\n * application file path produced by `WildoManagedStorageProvider`\n * (Slice 3.6). Final key shape becomes\n * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`\n * (extra segment above the existing `applicationId`-based namespace).\n \n Emitted only when the author sets `dataServices.s3.bucketPrefix` in\n * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)\n * remains infra-controlled and is unaffected by this prefix — N apps\n * can share one bucket while keeping their object trees disjoint.\n /\n STORAGE_BUCKET_PREFIX = 'STORAGE_BUCKET_PREFIX',\n // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from\n // this contract, and must not be re-added.\n //\n // They carried the object store's ROOT credential — the same pair the MinIO\n // container itself is created with — into every application, minion and worker\n // environment. An application now obtains short-lived, prefix-confined session\n // credentials from apps-manager instead (`createStsStorageCredentialResolver`),\n // so there is no application-tier storage credential to name here.\n //\n // Re-adding them would not merely restore a variable: this enum is the DECLARED\n // app-backend env surface, so a key here is an invitation for a builder to fill\n // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.\n // See `.claude/plans/object-storage-root-credential-distribution.md`.\n STORAGE_LOCAL_BASE_DIR = 'STORAGE_LOCAL_BASE_DIR',\n CLAMAV_HOST = 'CLAMAV_HOST',\n CLAMAV_PORT = 'CLAMAV_PORT',\n YARA_ENABLED = 'YARA_ENABLED',\n YARA_HOST = 'YARA_HOST',\n YARA_PORT = 'YARA_PORT',\n}\n\n/\n Keep the plural `Keys` aliases so current consumers keep reading naturally,\n while the actual source of truth is the scoped enum definition above.\n /\nexport const ApplicationBackendBootstrapEnvKeys = ApplicationBackendBootstrapEnvKey;\nexport const ApplicationBackendPlatformUrlEnvKeys = ApplicationBackendPlatformUrlEnvKey;\nexport const ApplicationBackendRuntimeEnvKeys = ApplicationBackendRuntimeEnvKey;\nexport const ApplicationBackendDataEnvKeys = ApplicationBackendDataEnvKey;\n\nexport const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [\n ApplicationBackendBootstrapEnvKey.APPLICATION_ID,\n ApplicationBackendBootstrapEnvKey.SERVICE_NAME,\n ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,\n] as const;\n\nexport const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [\n ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,\n ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,\n ApplicationBackendDataEnvKey.MONGODB_HOST,\n ApplicationBackendDataEnvKey.MONGODB_DATABASE,\n ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,\n ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,\n ApplicationBackendDataEnvKey.POSTGRESQL_HOST,\n ApplicationBackendDataEnvKey.POSTGRESQL_PORT,\n ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,\n ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,\n ApplicationBackendDataEnvKey.REDIS_HOST,\n ApplicationBackendDataEnvKey.REDIS_PORT,\n ApplicationBackendDataEnvKey.REDIS_DATABASE,\n ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,\n ApplicationBackendDataEnvKey.RABBITMQ_HOST,\n ApplicationBackendDataEnvKey.RABBITMQ_PORT,\n ApplicationBackendDataEnvKey.RABBITMQ_VHOST,\n ApplicationBackendDataEnvKey.STORAGE_PROVIDER,\n ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,\n ApplicationBackendDataEnvKey.STORAGE_PORT,\n ApplicationBackendDataEnvKey.STORAGE_USE_SSL,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,\n ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,\n ApplicationBackendDataEnvKey.CLAMAV_HOST,\n ApplicationBackendDataEnvKey.CLAMAV_PORT,\n ApplicationBackendDataEnvKey.YARA_ENABLED,\n ApplicationBackendDataEnvKey.YARA_HOST,\n ApplicationBackendDataEnvKey.YARA_PORT,\n] as const;\n\nexport const APPLICATION_BACKEND_ENV_KEY_LIST = [\n ...APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_DATA_ENV_KEY_LIST,\n] as const;\n\n/\n Keys that must always be treated as secrets when this app-backend env surface\n * is materialized into logs, CI artifacts, or deployment manifests.\n /\nexport const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set<string>([\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n // The storage pair is gone rather than listed: an app-tier env no longer\n // carries an object-storage credential at all, so there is nothing here to\n // mark sensitive. See the note on the enum above.\n]);\n\nexport type ApplicationBackendEnvKey =\n typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];\n\n/\n ────────────────────────────────────────────────────────────────────────\n * Backend → worker dispatch contract (G-8 / MW4)\n * ────────────────────────────────────────────────────────────────────────\n * A declared worker's HTTP base URL is injected into the app-backend env at\n * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC\n * (one per declared worker), so — unlike the static enums above — the key is a\n * HELPER, not a fixed member. Both the CLI EMIT side\n * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ\n * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL\n * through these single helpers so the two can never drift.\n /\nexport const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';\nexport const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';\n\n/\n Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —\n * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the\n * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both\n * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env\n * key is stable regardless of the authoring style.\n /\nexport function normalizeWorkerEnvSegment(workerName: string): string {\n return workerName\n .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore\n .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore\n .replace(/_+/g, '_') // collapse repeats\n .replace(/^_\|_$/g, '') // trim edges\n .toUpperCase();\n}\n\n/\n The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single\n * source of truth for both emit (CLI) and read (backend factory).\n \n @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'\n /\nexport function wildoWorkerUrlEnvKey(workerName: string): string {\n return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;\n}\n\n/\n Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket\n * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)\n * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no\n * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,\n * `myNodeWorker` → `my-node-worker`.\n \n This is the DNS-NAME axis of a background runtime — the segment embedded in the\n * k8s object/Service name, the built container image ref, the compose service name,\n * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw\n * bucket key), which apps-manager keys on (`appConfig.workers[key]` /\n * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`\n * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the\n * identity axis MUST stay raw and is NEVER passed through this helper. The\n * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,\n * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a\n * DNS label.\n \n This helper does NOT truncate — a name too long for a DNS label (63 chars) is\n * REJECTED at authoring, not silently shortened (truncation risks colliding with\n * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in\n * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with\n * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name\n * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach\n * the render.\n /\nexport function normalizeServiceKeyToDnsName(key: string): string {\n return key\n .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen\n .toLowerCase()\n .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen\n .replace(/^-+\|-+$/g, ''); // trim leading/trailing hyphens\n}\n\n/\n The k8s Service (and same-network compose service) name for a per-app worker:\n * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction\n * with the CLI k8s render (`renderWorkerForTarget`), the compose render\n * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker\n * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives\n * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so\n * the backend calls the exact Service the render deploys and CI builds the exact\n * image ref the deploy pulls.\n \n `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —\n * passed raw; the normalization happens inside. The raw key remains the worker's\n * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that\n * is never derived from this function.\n /\nexport function buildWorkerServiceName(appSlug: string, workerName: string): string {\n return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;\n}\n\n/\n The k8s Deployment (and same-network compose service) name for a per-app minion:\n * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with\n * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,\n * but the k8s render, the compose render, and the CI image build all need the\n * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is\n * the saas-config bucket key; the raw key stays the minion's IDENTITY (the\n * `wildo.ai/owned-service-name` pod label), never derived from here.\n /\nexport function buildMinionServiceName(appSlug: string, minionName: string): string {\n return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;\n}\n\n/\n The in-cluster base URL the app-backend uses to reach a per-app worker\n * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers\n * deploy into the SAME namespace (per-app deploy), so the short Service name\n * resolves without a namespace qualifier. `port` is the worker's authored\n * `http.port` (schema default 8080).\n /\nexport function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string {\n return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;\n}\n\n/\n The base URL the app-backend uses to reach a per-app worker in LOCAL development.\n \n There is no k8s Service locally, so there is no name to resolve — the worker is a supervised\n * process listening on its authored `http.port` on the loopback interface, which is the same\n * convention every other local runtime address in this repository uses.\n \n ## Why this exists at all (#426)\n \n `buildApplicationWorkerDispatchUrls` used to return `undefined` for anything but REMOTE, on the\n * reasoning that \"local dev has no k8s Services, and worker dispatch is a k8s-deploy concern\". The\n * first half is still true and the second no longer is: local dev now STARTS the worker, so the\n * only thing missing was an address. Without one, `WorkerRemoteClientFactory.client()` fails closed\n * on the absent `WILDO_WORKER_<NAME>_URL` — which is why the whole backend-to-worker chain had\n * never been exercised by anyone, in a test or in the dev stack.\n \n Declared here, beside its in-cluster sibling and the env-key helper both sides derive, so the\n * emit side and the read side cannot drift apart for either deployment shape.\n */\nexport function buildWorkerLocalUrl(port: number): string {\n return `http://localhost:${port}`;\n}\n"]}

package/dist/esm/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -1,9 +1,9 @@
 import { CoreResourceOperation, ResourceRelationship } from '@wildo-ai/saas-models';
 type WildoApplicationExecution_CoreOperations = CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE;
 /**
- * These records are internal control-plane persistence for the local companion.
- * They intentionally register repository-first CRUD operations without opening a
- * generated public API surface through the standard resource controllers.
+ * These records are control-plane persistence written ONLY by the local companion. Writes stay
+ * repository-first with no generated API; the READ HALF is an ORG_MEMBER-gated API surface since
+ * 2026-09-01 — see `createOrgMemberReadApiVariant` above for the decision.
  */
 export declare const wildoApplicationActorSystemExecutions_ResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("@wildo-ai/saas-models").ResourceConfiguration<any, WildoApplicationExecution_CoreOperations, import("zod").ZodObject<{
     initiator: import("zod").ZodOptional<import("zod").ZodObject<{

package/dist/esm/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-application-executions.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,~~EAEL~~,qBAAqB,EAGrB,oBAAoB,EAErB,MAAM,uBAAuB,CAAC;AAY/B,KAAK,wCAAwC,GACzC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,CAAC;~~AAWjC~~;;;;GAIG;AACH,eAAO,MAAM,iFAAiF,GAC3F,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwB7C,CAAC;AAEL,eAAO,MAAM,gFAAgF,GAC1F,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwB7C,CAAC"}
1	+ {"version":3,"file":"wildo-application-executions.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,qBAAqB,EAGrB,oBAAoB,EAErB,MAAM,uBAAuB,CAAC;AAY/B,KAAK,wCAAwC,GACzC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,CAAC;AA2CjC;;;;GAIG;AACH,eAAO,MAAM,iFAAiF,GAC3F,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwB7C,CAAC;AAEL,eAAO,MAAM,gFAAgF,GAC1F,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwB7C,CAAC"}

package/dist/esm/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { CORE_APP_ROLES, CoreResourceOperation, ResourceOperationRiskLevel, ResourceOperationVariantType, createResourceConfiguration_Initialization, } from '@wildo-ai/saas-models';
+import { CORE_APP_ROLES, CORE_ORG_ROLES, CoreResourceOperation, ResourceOperationRiskLevel, ResourceOperationVariantType, createResourceConfiguration_Initialization, } from '@wildo-ai/saas-models';
 import { CustomShared_ResourceFieldIdentifier, CustomShared_ResourceType, } from '../core/resources/resources-types.custom.shared.schemas.js';
 import { Wildo_Application_ActorSystem_Execution_Schema, Wildo_Application_FlowSystem_Execution_Schema, } from './wildo-application-executions.custom.shared.schemas.js';
 const WildoApplicationExecution_Operations = undefined;
@@ -11,9 +11,40 @@ function createRepositoryOnlyDefaultVariant() {
     };
 }
 /**
- * These records are internal control-plane persistence for the local companion.
- * They intentionally register repository-first CRUD operations without opening a
- * generated public API surface through the standard resource controllers.
+ * READ/LIST are API-callable since 2026-09-01; CREATE/UPDATE stay repository-only.
+ *
+ * The original decision ("no public resource-controller surface") was made when the ONLY consumer
+ * was the companion's own repository-direct persistence. The application-creation workbench now
+ * consumes these rows AS RESOURCES (plan `workbench-creation-board-resources.md`, Phase 1): the
+ * creation board renders them through the engine's embedded resource surfaces instead of bespoke
+ * companion routes. That requires exactly the read half of an API surface, so exactly the read half
+ * is opened:
+ *
+ * - READ/LIST: `API_CALL`, gated `ORG_MEMBER` — the SAME read-posture as the parent
+ *   `wildoApplications` rows one resource over, resolved through organization membership. The first
+ *   draft reused the repository-only variants' `APP_ADMIN_SUPER_ADMIN`, and the measurement retired
+ *   it: a companion operator's app-tier roles are plain `APP_USER` (the seeded developer holds
+ *   `ORG_ADMIN` via MEMBERSHIP, not app-tier super-admin), so the admin gate 403'd the exact
+ *   operator this surface serves. Consistent with the audit-retention decision (2026-07-29): rows
+ *   kept as the organization's own audit material are rows its members may read.
+ * - CREATE/UPDATE: unchanged `REPOSITORY_ONLY`. The companion remains the only writer, and the
+ *   generated write API the original decision refused stays refused.
+ *
+ * This config is shared with the platform tier (apps-manager registers the same map), so the read
+ * routes appear there too, behind the same ORG_MEMBER gate — a deliberate consequence, not a leak.
+ */
+function createOrgMemberReadApiVariant() {
+    return {
+        variantType: ResourceOperationVariantType.API_CALL,
+        isDefault: true,
+        roles: [CORE_ORG_ROLES.ORG_MEMBER],
+        riskLevel: ResourceOperationRiskLevel.LOW,
+    };
+}
+/**
+ * These records are control-plane persistence written ONLY by the local companion. Writes stay
+ * repository-first with no generated API; the READ HALF is an ORG_MEMBER-gated API surface since
+ * 2026-09-01 — see `createOrgMemberReadApiVariant` above for the decision.
  */
 export const wildoApplicationActorSystemExecutions_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: Wildo_Application_ActorSystem_Execution_Schema,
@@ -30,8 +61,8 @@ export const wildoApplicationActorSystemExecutions_ResourceConfiguration_Initial
     customOperation: WildoApplicationExecution_Operations,
     operationsConfiguration: {
         [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },
-        [CoreResourceOperation.READ]: { variants: [createRepositoryOnlyDefaultVariant()] },
-        [CoreResourceOperation.LIST]: { variants: [createRepositoryOnlyDefaultVariant()] },
+        [CoreResourceOperation.READ]: { variants: [createOrgMemberReadApiVariant()] },
+        [CoreResourceOperation.LIST]: { variants: [createOrgMemberReadApiVariant()] },
         [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },
     },
 });
@@ -50,8 +81,8 @@ export const wildoApplicationFlowSystemExecutions_ResourceConfiguration_Initiali
     customOperation: WildoApplicationExecution_Operations,
     operationsConfiguration: {
         [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },
-        [CoreResourceOperation.READ]: { variants: [createRepositoryOnlyDefaultVariant()] },
-        [CoreResourceOperation.LIST]: { variants: [createRepositoryOnlyDefaultVariant()] },
+        [CoreResourceOperation.READ]: { variants: [createOrgMemberReadApiVariant()] },
+        [CoreResourceOperation.LIST]: { variants: [createOrgMemberReadApiVariant()] },
         [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },
     },
 });

package/dist/esm/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-application-executions.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAE5B,0CAA0C,GAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oCAAoC,EACpC,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,8CAA8C,EAC9C,6CAA6C,GAC9C,MAAM,sDAAsD,CAAC;AAE9D,MAAM,oCAAoC,GAAG,SAAS,CAAC;AAQvD,SAAS,kCAAkC;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,eAAwB;QAClE,SAAS,EAAE,IAAa;QACxB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;QAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iFAAiF,GAC5F,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,8CAA8C;IAC1D,kBAAkB,EAAE,yBAAyB,CAAC,yCAAyC;IACvF,uBAAuB,EACrB,oCAAoC,CAAC,yBAAyB,CAAC,yCAAyC,CAAC;IAC3G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,eAAe,EAAE,oCAAoC;IACrD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;QACpF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,~~kCAAkC~~,EAAE,CAAC,EAAE;~~QAClF~~,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,~~kCAAkC~~,EAAE,CAAC,EAAE;~~QAClF~~,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;KACrF;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gFAAgF,GAC3F,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,6CAA6C;IACzD,kBAAkB,EAAE,yBAAyB,CAAC,wCAAwC;IACtF,uBAAuB,EACrB,oCAAoC,CAAC,yBAAyB,CAAC,wCAAwC,CAAC;IAC1G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,eAAe,EAAE,oCAAoC;IACrD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;QACpF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,~~kCAAkC~~,EAAE,CAAC,EAAE;~~QAClF~~,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,~~kCAAkC~~,EAAE,CAAC,EAAE;~~QAClF~~,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;KACrF;CACF,CAAC,CAAC","sourcesContent":["import {\n CORE_APP_ROLES,\n CoreResourceOperation,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceRelationship,\n createResourceConfiguration_Initialization,\n} from '@wildo-ai/saas-models';\nimport {\n CustomShared_ResourceFieldIdentifier,\n CustomShared_ResourceType,\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport {\n Wildo_Application_ActorSystem_Execution_Schema,\n Wildo_Application_FlowSystem_Execution_Schema,\n} from './wildo-application-executions.custom.shared.schemas';\n\nconst WildoApplicationExecution_Operations = undefined;\n\ntype WildoApplicationExecution_CoreOperations =\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.UPDATE;\n\nfunction createRepositoryOnlyDefaultVariant() {\n return {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY as const,\n isDefault: true as const,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW as const,\n };\n}\n\n/*\n ~~These~~ ~~records~~ are ~~internal~~ ~~control~~-~~plane~~ persistence ~~for~~ the ~~local~~ companion.\n * ~~They~~ ~~intentionally~~ ~~register~~ ~~repository~~-first ~~CRUD~~ ~~operations~~ ~~without~~ ~~opening~~ a\n * generated ~~public~~ API ~~surface~~ ~~through~~ the ~~standard~~ ~~resource~~ ~~controllers~~.\n */\nexport const wildoApplicationActorSystemExecutions_ResourceConfiguration_InitializationFactory =\n (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof WildoApplicationExecution_Operations,\n WildoApplicationExecution_CoreOperations,\n typeof Wildo_Application_ActorSystem_Execution_Schema\n >({\n mainSchema: Wildo_Application_ActorSystem_Execution_Schema,\n resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_SYSTEM_EXECUTIONS,\n resourceFieldIdentifier:\n CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_SYSTEM_EXECUTIONS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: false,\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE,\n ],\n customOperation: WildoApplicationExecution_Operations,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n [CoreResourceOperation.READ]: { variants: [~~createRepositoryOnlyDefaultVariant~~()] },\n [CoreResourceOperation.LIST]: { variants: [~~createRepositoryOnlyDefaultVariant~~()] },\n [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n },\n });\n\nexport const wildoApplicationFlowSystemExecutions_ResourceConfiguration_InitializationFactory =\n (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof WildoApplicationExecution_Operations,\n WildoApplicationExecution_CoreOperations,\n typeof Wildo_Application_FlowSystem_Execution_Schema\n >({\n mainSchema: Wildo_Application_FlowSystem_Execution_Schema,\n resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_FLOW_SYSTEM_EXECUTIONS,\n resourceFieldIdentifier:\n CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_FLOW_SYSTEM_EXECUTIONS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: false,\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE,\n ],\n customOperation: WildoApplicationExecution_Operations,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n [CoreResourceOperation.READ]: { variants: [~~createRepositoryOnlyDefaultVariant~~()] },\n [CoreResourceOperation.LIST]: { variants: [~~createRepositoryOnlyDefaultVariant~~()] },\n [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n },\n });\n"]}
1	+ {"version":3,"file":"wildo-application-executions.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAE5B,0CAA0C,GAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oCAAoC,EACpC,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,8CAA8C,EAC9C,6CAA6C,GAC9C,MAAM,sDAAsD,CAAC;AAE9D,MAAM,oCAAoC,GAAG,SAAS,CAAC;AAQvD,SAAS,kCAAkC;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,eAAwB;QAClE,SAAS,EAAE,IAAa;QACxB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;QAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,6BAA6B;IACpC,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,QAAiB;QAC3D,SAAS,EAAE,IAAa;QACxB,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;QAClC,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iFAAiF,GAC5F,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,8CAA8C;IAC1D,kBAAkB,EAAE,yBAAyB,CAAC,yCAAyC;IACvF,uBAAuB,EACrB,oCAAoC,CAAC,yBAAyB,CAAC,yCAAyC,CAAC;IAC3G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,eAAe,EAAE,oCAAoC;IACrD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;QACpF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,CAAC,EAAE;QAC7E,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,CAAC,EAAE;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;KACrF;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gFAAgF,GAC3F,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,6CAA6C;IACzD,kBAAkB,EAAE,yBAAyB,CAAC,wCAAwC;IACtF,uBAAuB,EACrB,oCAAoC,CAAC,yBAAyB,CAAC,wCAAwC,CAAC;IAC1G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,eAAe,EAAE,oCAAoC;IACrD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;QACpF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,CAAC,EAAE;QAC7E,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,CAAC,EAAE;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;KACrF;CACF,CAAC,CAAC","sourcesContent":["import {\n CORE_APP_ROLES,\n CORE_ORG_ROLES,\n CoreResourceOperation,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceRelationship,\n createResourceConfiguration_Initialization,\n} from '@wildo-ai/saas-models';\nimport {\n CustomShared_ResourceFieldIdentifier,\n CustomShared_ResourceType,\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport {\n Wildo_Application_ActorSystem_Execution_Schema,\n Wildo_Application_FlowSystem_Execution_Schema,\n} from './wildo-application-executions.custom.shared.schemas';\n\nconst WildoApplicationExecution_Operations = undefined;\n\ntype WildoApplicationExecution_CoreOperations =\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.UPDATE;\n\nfunction createRepositoryOnlyDefaultVariant() {\n return {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY as const,\n isDefault: true as const,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW as const,\n };\n}\n\n/*\n READ/LIST are API-callable since 2026-09-01; CREATE/UPDATE stay repository-only.\n \n The original decision (\"no public resource-controller surface\") was made when the ONLY consumer\n * was the companion's own repository-direct persistence. The application-creation workbench now\n * consumes these rows AS RESOURCES (plan `workbench-creation-board-resources.md`, Phase 1): the\n * creation board renders them through the engine's embedded resource surfaces instead of bespoke\n * companion routes. That requires exactly the read half of an API surface, so exactly the read half\n * is opened:\n \n - READ/LIST: `API_CALL`, gated `ORG_MEMBER` — the SAME read-posture as the parent\n * `wildoApplications` rows one resource over, resolved through organization membership. The first\n * draft reused the repository-only variants' `APP_ADMIN_SUPER_ADMIN`, and the measurement retired\n * it: a companion operator's app-tier roles are plain `APP_USER` (the seeded developer holds\n * `ORG_ADMIN` via MEMBERSHIP, not app-tier super-admin), so the admin gate 403'd the exact\n * operator this surface serves. Consistent with the audit-retention decision (2026-07-29): rows\n * kept as the organization's own audit material are rows its members may read.\n * - CREATE/UPDATE: unchanged `REPOSITORY_ONLY`. The companion remains the only writer, and the\n * generated write API the original decision refused stays refused.\n \n This config is shared with the platform tier (apps-manager registers the same map), so the read\n * routes appear there too, behind the same ORG_MEMBER gate — a deliberate consequence, not a leak.\n /\nfunction createOrgMemberReadApiVariant() {\n return {\n variantType: ResourceOperationVariantType.API_CALL as const,\n isDefault: true as const,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW as const,\n };\n}\n\n/\n These records are control-plane persistence written ONLY by the local companion. Writes stay\n * repository-first with no generated API; the READ HALF is an ORG_MEMBER-gated API surface since\n * 2026-09-01 — see `createOrgMemberReadApiVariant` above for the decision.\n */\nexport const wildoApplicationActorSystemExecutions_ResourceConfiguration_InitializationFactory =\n (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof WildoApplicationExecution_Operations,\n WildoApplicationExecution_CoreOperations,\n typeof Wildo_Application_ActorSystem_Execution_Schema\n >({\n mainSchema: Wildo_Application_ActorSystem_Execution_Schema,\n resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_SYSTEM_EXECUTIONS,\n resourceFieldIdentifier:\n CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_SYSTEM_EXECUTIONS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: false,\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE,\n ],\n customOperation: WildoApplicationExecution_Operations,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n [CoreResourceOperation.READ]: { variants: [createOrgMemberReadApiVariant()] },\n [CoreResourceOperation.LIST]: { variants: [createOrgMemberReadApiVariant()] },\n [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n },\n });\n\nexport const wildoApplicationFlowSystemExecutions_ResourceConfiguration_InitializationFactory =\n (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof WildoApplicationExecution_Operations,\n WildoApplicationExecution_CoreOperations,\n typeof Wildo_Application_FlowSystem_Execution_Schema\n >({\n mainSchema: Wildo_Application_FlowSystem_Execution_Schema,\n resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_FLOW_SYSTEM_EXECUTIONS,\n resourceFieldIdentifier:\n CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_FLOW_SYSTEM_EXECUTIONS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: false,\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE,\n ],\n customOperation: WildoApplicationExecution_Operations,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n [CoreResourceOperation.READ]: { variants: [createOrgMemberReadApiVariant()] },\n [CoreResourceOperation.LIST]: { variants: [createOrgMemberReadApiVariant()] },\n [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n },\n });\n"]}

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -1,9 +1,9 @@
 import { CoreResourceOperation, ResourceRelationship } from '@wildo-ai/saas-models';
 type WildoApplicationActorTasks_CoreOperations = CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.UPDATE;
 /**
- * Actor tasks are mutable control-plane records managed by the local companion,
- * not public resource-controller surfaces. Repository-only CRUD keeps the
- * framework persistence contract truthful without widening generated APIs.
+ * Actor tasks are mutable control-plane records written ONLY by the local companion. Writes stay
+ * repository-only, keeping the persistence contract truthful; the READ HALF is an ORG_MEMBER-gated API
+ * surface since 2026-09-01 — see `createOrgMemberReadApiVariant` above for the decision.
  */
 export declare const wildoApplicationActorTasks_ResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("@wildo-ai/saas-models").ResourceConfiguration<any, WildoApplicationActorTasks_CoreOperations, import("zod").ZodObject<{
     description: import("zod").ZodString;
@@ -334,6 +334,7 @@ export declare const wildoApplicationActorTasks_ResourceConfiguration_Initializa
     wildoApplicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>>;
     wildoApplicationActorSystemExecutionId: import("zod").ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>;
     continuityAttemptKey: import("zod").ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>;
+    workbenchBuildPlanTaskId: import("zod").ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>;
     title: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("@wildo-ai/saas-models").FlowsActors_Status>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-application-tasks.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,~~EAEL~~,qBAAqB,EAGrB,oBAAoB,EAErB,MAAM,uBAAuB,CAAC;AAS/B,KAAK,yCAAyC,GAC1C,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,CAAC;~~AAWjC~~;;;;GAIG;AACH,eAAO,MAAM,sEAAsE,GAChF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwB7C,CAAC"}
1	+ {"version":3,"file":"wildo-application-tasks.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,qBAAqB,EAGrB,oBAAoB,EAErB,MAAM,uBAAuB,CAAC;AAS/B,KAAK,yCAAyC,GAC1C,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,CAAC;AA2CjC;;;;GAIG;AACH,eAAO,MAAM,sEAAsE,GAChF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwB7C,CAAC"}

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { CORE_APP_ROLES, CoreResourceOperation, ResourceOperationRiskLevel, ResourceOperationVariantType, createResourceConfiguration_Initialization, } from '@wildo-ai/saas-models';
+import { CORE_APP_ROLES, CORE_ORG_ROLES, CoreResourceOperation, ResourceOperationRiskLevel, ResourceOperationVariantType, createResourceConfiguration_Initialization, } from '@wildo-ai/saas-models';
 import { CustomShared_ResourceFieldIdentifier, CustomShared_ResourceType, } from '../core/resources/resources-types.custom.shared.schemas.js';
 import { Wildo_Application_Actor_Task_Schema } from './wildo-application-tasks.custom.shared.schemas.js';
 const WildoApplicationActorTasks_Operations = undefined;
@@ -11,9 +11,40 @@ function createRepositoryOnlyDefaultVariant() {
     };
 }
 /**
- * Actor tasks are mutable control-plane records managed by the local companion,
- * not public resource-controller surfaces. Repository-only CRUD keeps the
- * framework persistence contract truthful without widening generated APIs.
+ * READ/LIST are API-callable since 2026-09-01; CREATE/UPDATE stay repository-only.
+ *
+ * The original decision ("no public resource-controller surface") was made when the ONLY consumer
+ * was the companion's own repository-direct persistence. The application-creation workbench now
+ * consumes these rows AS RESOURCES (plan `workbench-creation-board-resources.md`, Phase 1): the
+ * creation board renders them through the engine's embedded resource surfaces instead of bespoke
+ * companion routes. That requires exactly the read half of an API surface, so exactly the read half
+ * is opened:
+ *
+ * - READ/LIST: `API_CALL`, gated `ORG_MEMBER` — the SAME read-posture as the parent
+ *   `wildoApplications` rows one resource over, resolved through organization membership. The first
+ *   draft reused the repository-only variants' `APP_ADMIN_SUPER_ADMIN`, and the measurement retired
+ *   it: a companion operator's app-tier roles are plain `APP_USER` (the seeded developer holds
+ *   `ORG_ADMIN` via MEMBERSHIP, not app-tier super-admin), so the admin gate 403'd the exact
+ *   operator this surface serves. Consistent with the audit-retention decision (2026-07-29): rows
+ *   kept as the organization's own audit material are rows its members may read.
+ * - CREATE/UPDATE: unchanged `REPOSITORY_ONLY`. The companion remains the only writer, and the
+ *   generated write API the original decision refused stays refused.
+ *
+ * This config is shared with the platform tier (apps-manager registers the same map), so the read
+ * routes appear there too, behind the same ORG_MEMBER gate — a deliberate consequence, not a leak.
+ */
+function createOrgMemberReadApiVariant() {
+    return {
+        variantType: ResourceOperationVariantType.API_CALL,
+        isDefault: true,
+        roles: [CORE_ORG_ROLES.ORG_MEMBER],
+        riskLevel: ResourceOperationRiskLevel.LOW,
+    };
+}
+/**
+ * Actor tasks are mutable control-plane records written ONLY by the local companion. Writes stay
+ * repository-only, keeping the persistence contract truthful; the READ HALF is an ORG_MEMBER-gated API
+ * surface since 2026-09-01 — see `createOrgMemberReadApiVariant` above for the decision.
  */
 export const wildoApplicationActorTasks_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: Wildo_Application_Actor_Task_Schema,
@@ -30,8 +61,8 @@ export const wildoApplicationActorTasks_ResourceConfiguration_InitializationFact
     customOperation: WildoApplicationActorTasks_Operations,
     operationsConfiguration: {
         [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },
-        [CoreResourceOperation.READ]: { variants: [createRepositoryOnlyDefaultVariant()] },
-        [CoreResourceOperation.LIST]: { variants: [createRepositoryOnlyDefaultVariant()] },
+        [CoreResourceOperation.READ]: { variants: [createOrgMemberReadApiVariant()] },
+        [CoreResourceOperation.LIST]: { variants: [createOrgMemberReadApiVariant()] },
         [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },
     },
 });

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-application-tasks.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAE5B,0CAA0C,GAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oCAAoC,EACpC,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAEtG,MAAM,qCAAqC,GAAG,SAAS,CAAC;AAQxD,SAAS,kCAAkC;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,eAAwB;QAClE,SAAS,EAAE,IAAa;QACxB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;QAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sEAAsE,GACjF,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAAE,yBAAyB,CAAC,6BAA6B;IAC3E,uBAAuB,EACrB,oCAAoC,CAAC,yBAAyB,CAAC,6BAA6B,CAAC;IAC/F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,eAAe,EAAE,qCAAqC;IACtD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;QACpF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,~~kCAAkC~~,EAAE,CAAC,EAAE;~~QAClF~~,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,~~kCAAkC~~,EAAE,CAAC,EAAE;~~QAClF~~,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;KACrF;CACF,CAAC,CAAC","sourcesContent":["import {\n CORE_APP_ROLES,\n CoreResourceOperation,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceRelationship,\n createResourceConfiguration_Initialization,\n} from '@wildo-ai/saas-models';\nimport {\n CustomShared_ResourceFieldIdentifier,\n CustomShared_ResourceType,\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport { Wildo_Application_Actor_Task_Schema } from './wildo-application-tasks.custom.shared.schemas';\n\nconst WildoApplicationActorTasks_Operations = undefined;\n\ntype WildoApplicationActorTasks_CoreOperations =\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.UPDATE;\n\nfunction createRepositoryOnlyDefaultVariant() {\n return {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY as const,\n isDefault: true as const,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW as const,\n };\n}\n\n/*\n ~~Actor~~ ~~tasks~~ are ~~mutable control~~-~~plane~~ ~~records~~ ~~managed~~ by ~~the~~ ~~local~~ ~~companion,\~~n * ~~not~~ public resource-controller surfaces. ~~Repository~~-only ~~CRUD~~ ~~keeps~~ the\n * ~~framework~~ persistence contract truthful ~~without~~ ~~widening~~ ~~generated~~ ~~APIs~~.\n */\nexport const wildoApplicationActorTasks_ResourceConfiguration_InitializationFactory =\n (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof WildoApplicationActorTasks_Operations,\n WildoApplicationActorTasks_CoreOperations,\n typeof Wildo_Application_Actor_Task_Schema\n >({\n mainSchema: Wildo_Application_Actor_Task_Schema,\n resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_TASKS,\n resourceFieldIdentifier:\n CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_TASKS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: false,\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE,\n ],\n customOperation: WildoApplicationActorTasks_Operations,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n [CoreResourceOperation.READ]: { variants: [~~createRepositoryOnlyDefaultVariant~~()] },\n [CoreResourceOperation.LIST]: { variants: [~~createRepositoryOnlyDefaultVariant~~()] },\n [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n },\n });\n"]}
1	+ {"version":3,"file":"wildo-application-tasks.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAE5B,0CAA0C,GAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oCAAoC,EACpC,yBAAyB,GAC1B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAEtG,MAAM,qCAAqC,GAAG,SAAS,CAAC;AAQxD,SAAS,kCAAkC;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,eAAwB;QAClE,SAAS,EAAE,IAAa;QACxB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;QAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,6BAA6B;IACpC,OAAO;QACL,WAAW,EAAE,4BAA4B,CAAC,QAAiB;QAC3D,SAAS,EAAE,IAAa;QACxB,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;QAClC,SAAS,EAAE,0BAA0B,CAAC,GAAY;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sEAAsE,GACjF,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI5F;IACA,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAAE,yBAAyB,CAAC,6BAA6B;IAC3E,uBAAuB,EACrB,oCAAoC,CAAC,yBAAyB,CAAC,6BAA6B,CAAC;IAC/F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,eAAe,EAAE,qCAAqC;IACtD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;QACpF,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,CAAC,EAAE;QAC7E,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,CAAC,EAAE;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,kCAAkC,EAAE,CAAC,EAAE;KACrF;CACF,CAAC,CAAC","sourcesContent":["import {\n CORE_APP_ROLES,\n CORE_ORG_ROLES,\n CoreResourceOperation,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceRelationship,\n createResourceConfiguration_Initialization,\n} from '@wildo-ai/saas-models';\nimport {\n CustomShared_ResourceFieldIdentifier,\n CustomShared_ResourceType,\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport { Wildo_Application_Actor_Task_Schema } from './wildo-application-tasks.custom.shared.schemas';\n\nconst WildoApplicationActorTasks_Operations = undefined;\n\ntype WildoApplicationActorTasks_CoreOperations =\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.UPDATE;\n\nfunction createRepositoryOnlyDefaultVariant() {\n return {\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY as const,\n isDefault: true as const,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW as const,\n };\n}\n\n/*\n READ/LIST are API-callable since 2026-09-01; CREATE/UPDATE stay repository-only.\n \n The original decision (\"no public resource-controller surface\") was made when the ONLY consumer\n * was the companion's own repository-direct persistence. The application-creation workbench now\n * consumes these rows AS RESOURCES (plan `workbench-creation-board-resources.md`, Phase 1): the\n * creation board renders them through the engine's embedded resource surfaces instead of bespoke\n * companion routes. That requires exactly the read half of an API surface, so exactly the read half\n * is opened:\n \n - READ/LIST: `API_CALL`, gated `ORG_MEMBER` — the SAME read-posture as the parent\n * `wildoApplications` rows one resource over, resolved through organization membership. The first\n * draft reused the repository-only variants' `APP_ADMIN_SUPER_ADMIN`, and the measurement retired\n * it: a companion operator's app-tier roles are plain `APP_USER` (the seeded developer holds\n * `ORG_ADMIN` via MEMBERSHIP, not app-tier super-admin), so the admin gate 403'd the exact\n * operator this surface serves. Consistent with the audit-retention decision (2026-07-29): rows\n * kept as the organization's own audit material are rows its members may read.\n * - CREATE/UPDATE: unchanged `REPOSITORY_ONLY`. The companion remains the only writer, and the\n * generated write API the original decision refused stays refused.\n \n This config is shared with the platform tier (apps-manager registers the same map), so the read\n * routes appear there too, behind the same ORG_MEMBER gate — a deliberate consequence, not a leak.\n /\nfunction createOrgMemberReadApiVariant() {\n return {\n variantType: ResourceOperationVariantType.API_CALL as const,\n isDefault: true as const,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW as const,\n };\n}\n\n/\n Actor tasks are mutable control-plane records written ONLY by the local companion. Writes stay\n * repository-only, keeping the persistence contract truthful; the READ HALF is an ORG_MEMBER-gated API\n * surface since 2026-09-01 — see `createOrgMemberReadApiVariant` above for the decision.\n */\nexport const wildoApplicationActorTasks_ResourceConfiguration_InitializationFactory =\n (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof WildoApplicationActorTasks_Operations,\n WildoApplicationActorTasks_CoreOperations,\n typeof Wildo_Application_Actor_Task_Schema\n >({\n mainSchema: Wildo_Application_Actor_Task_Schema,\n resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_TASKS,\n resourceFieldIdentifier:\n CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_ACTOR_TASKS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: false,\n coreOperations: [\n CoreResourceOperation.CREATE,\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.UPDATE,\n ],\n customOperation: WildoApplicationActorTasks_Operations,\n operationsConfiguration: {\n [CoreResourceOperation.CREATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n [CoreResourceOperation.READ]: { variants: [createOrgMemberReadApiVariant()] },\n [CoreResourceOperation.LIST]: { variants: [createOrgMemberReadApiVariant()] },\n [CoreResourceOperation.UPDATE]: { variants: [createRepositoryOnlyDefaultVariant()] },\n },\n });\n"]}

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.d.ts CHANGED Viewed

@@ -335,6 +335,7 @@ export declare const Wildo_Application_Actor_Task_Schema: z.ZodObject<{
     wildoApplicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     wildoApplicationActorSystemExecutionId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     continuityAttemptKey: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    workbenchBuildPlanTaskId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     title: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof FlowsActors_Status>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-application-tasks.custom.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAK/B;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0B9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}
1	+ {"version":3,"file":"wildo-application-tasks.custom.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAK/B;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuC9C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.js CHANGED Viewed

@@ -31,6 +31,19 @@ export const Wildo_Application_Actor_Task_Schema = Actors_Task_Schema.extend({
     })
         .excludeFromUpdate()
         .optional(),
+    /**
+     * The CROSS-PLANE join (creation board, Phase 4 R5): the workbench build-plan DISPATCH row this
+     * task executes, as its SANITIZED identity (`sanitizeWorkbenchCreationPlaneIdentity(taskRef)` —
+     * task refs are URL-safe by their own regex, so this is currently the ref verbatim).
+     *
+     * OPTIONAL twice over: only coding/generation dispatches carry a build-plan task (flow-driven
+     * actor tasks have none), and rows written before 2026-09-01 predate the field — the workbench
+     * declares the REFERENCE edge dangling-tolerant for exactly that population. The edge itself is
+     * declared WORKBENCH-SIDE only: this config is also registered by `platform-apps-manager`, where
+     * no `workbenchBuildPlanTasks` resource exists, and there the field is inert data rather than a
+     * dangling relationship.
+     */
+    workbenchBuildPlanTaskId: z.string().min(1).isForeignKey().isSummaryField().optional(),
     title: z.string().min(1).isSummaryField(),
     status: z.enum(FlowsActors_Status).isDBIndexed().isSummaryField(),
     updatedAt: z.string().refine((val) => !isNaN(Date.parse(val)), { error: 'Invalid datetime string' }).isDBIndexed(),

package/dist/esm/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-application-tasks.custom.shared.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAC3E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAChG,sCAAsC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE;IAC1F;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC;QACR,YAAY,EAAE,oBAAoB;QAClC,MAAM,EAAE,IAAI;KACb,CAAC;SACD,iBAAiB,EAAE;SACnB,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE;CACnH,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport {\n Actors_Task_Schema,\n FlowsActors_Status,\n} from '@wildo-ai/saas-models';\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\n\ninitZodDecorators(z);\n\n/*\n Actor-flow tasks are persisted as first-class platform records because task\n * content evolves independently of one execution snapshot. The execution link is\n * optional/updateable so tasks can outlive a specific run while still being\n * queryable from the current actor-system follow-up record.\n /\nexport const Wildo_Application_Actor_Task_Schema = Actors_Task_Schema.extend({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n organizationId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n wildoApplicationId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n wildoApplicationActorSystemExecutionId: z.string().isDBIndexed().isForeignKey().optional(),\n /\n Server-managed physical-attempt identity for continuity-bound Tasks.\n \n `compoundWith` produces the required sparse unique\n * `(wildoApplicationId, continuityAttemptKey)` index: legacy/unbound Tasks\n * remain outside the index, while concurrent creation of one exact\n * Execution-Binding attempt has a database backstop. Retry receives a new\n * key and Task; this field is never rewritten in place.\n */\n continuityAttemptKey: z\n .string()\n .min(1)\n .isUnique({\n compoundWith: 'wildoApplicationId',\n sparse: true,\n })\n .excludeFromUpdate()\n .optional(),\n title: z.string().min(1).isSummaryField(),\n status: z.enum(FlowsActors_Status).isDBIndexed().isSummaryField(),\n updatedAt: z.string().refine((val) => !isNaN(Date.parse(val)), { error: 'Invalid datetime string' }).isDBIndexed(),\n});\nexport type Wildo_Application_Actor_Task = z.infer<typeof Wildo_Application_Actor_Task_Schema>;\n"]}
1	+ {"version":3,"file":"wildo-application-tasks.custom.shared.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-application-tasks/wildo-application-tasks.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAErB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAC3E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC5F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAChG,sCAAsC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE;IAC1F;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC;QACR,YAAY,EAAE,oBAAoB;QAClC,MAAM,EAAE,IAAI;KACb,CAAC;SACD,iBAAiB,EAAE;SACnB,QAAQ,EAAE;IACb;;;;;;;;;;;OAWG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;IACtF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC,WAAW,EAAE;CACnH,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport {\n Actors_Task_Schema,\n FlowsActors_Status,\n} from '@wildo-ai/saas-models';\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\n\ninitZodDecorators(z);\n\n/*\n Actor-flow tasks are persisted as first-class platform records because task\n * content evolves independently of one execution snapshot. The execution link is\n * optional/updateable so tasks can outlive a specific run while still being\n * queryable from the current actor-system follow-up record.\n /\nexport const Wildo_Application_Actor_Task_Schema = Actors_Task_Schema.extend({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n organizationId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n wildoApplicationId: z.string().isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n wildoApplicationActorSystemExecutionId: z.string().isDBIndexed().isForeignKey().optional(),\n /\n Server-managed physical-attempt identity for continuity-bound Tasks.\n \n `compoundWith` produces the required sparse unique\n * `(wildoApplicationId, continuityAttemptKey)` index: legacy/unbound Tasks\n * remain outside the index, while concurrent creation of one exact\n * Execution-Binding attempt has a database backstop. Retry receives a new\n * key and Task; this field is never rewritten in place.\n /\n continuityAttemptKey: z\n .string()\n .min(1)\n .isUnique({\n compoundWith: 'wildoApplicationId',\n sparse: true,\n })\n .excludeFromUpdate()\n .optional(),\n /\n The CROSS-PLANE join (creation board, Phase 4 R5): the workbench build-plan DISPATCH row this\n * task executes, as its SANITIZED identity (`sanitizeWorkbenchCreationPlaneIdentity(taskRef)` —\n * task refs are URL-safe by their own regex, so this is currently the ref verbatim).\n \n OPTIONAL twice over: only coding/generation dispatches carry a build-plan task (flow-driven\n * actor tasks have none), and rows written before 2026-09-01 predate the field — the workbench\n * declares the REFERENCE edge dangling-tolerant for exactly that population. The edge itself is\n * declared WORKBENCH-SIDE only: this config is also registered by `platform-apps-manager`, where\n * no `workbenchBuildPlanTasks` resource exists, and there the field is inert data rather than a\n * dangling relationship.\n */\n workbenchBuildPlanTaskId: z.string().min(1).isForeignKey().isSummaryField().optional(),\n title: z.string().min(1).isSummaryField(),\n status: z.enum(FlowsActors_Status).isDBIndexed().isSummaryField(),\n updatedAt: z.string().refine((val) => !isNaN(Date.parse(val)), { error: 'Invalid datetime string' }).isDBIndexed(),\n});\nexport type Wildo_Application_Actor_Task = z.infer<typeof Wildo_Application_Actor_Task_Schema>;\n"]}

package/dist/esm/wildo-applications/wildo-applications.custom.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-applications.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-applications/wildo-applications.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6BH,eAAO,MAAM,6DAA6D,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,~~GAuI9F~~,CAAC"}
1	+ {"version":3,"file":"wildo-applications.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-applications/wildo-applications.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6BH,eAAO,MAAM,6DAA6D,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAkJ9F,CAAC"}